diff --git a/.changes/unreleased/charts-redpanda-Added-20260512-host-tuners.yaml b/.changes/unreleased/charts-redpanda-Added-20260512-host-tuners.yaml new file mode 100644 index 000000000..77bbfdd4c --- /dev/null +++ b/.changes/unreleased/charts-redpanda-Added-20260512-host-tuners.yaml @@ -0,0 +1,15 @@ +project: charts/redpanda +kind: Added +body: |- + `tuning.apply_host_tuners` (default `false`) gates a chroot-based tuning + init container that gives `rpk redpanda tune all` real access to the + host's `/sys`, `/proc`, NICs and block devices. When enabled, tuners + that previously failed inside the pod sandbox — `disk_irq`, + `disk_scheduler`, `disk_nomerges`, `net`, `fstrim`, and (on GCP) + `disk_write_cache` — are default-enabled and actually apply, along + with `cpu` (a no-op on VMs without cpufreq, real work on metal). + + Opt-in only; the default tuning container is unchanged. Enabling + `apply_host_tuners` requires the same security posture as + `tune_aio_events` (privileged container, hostPath volumes). +time: 2026-05-12T20:00:00.000000-07:00 diff --git a/charts/redpanda/chart/templates/_statefulset.go.tpl b/charts/redpanda/chart/templates/_statefulset.go.tpl index a56350576..c153facbb 100644 --- a/charts/redpanda/chart/templates/_statefulset.go.tpl +++ b/charts/redpanda/chart/templates/_statefulset.go.tpl @@ -86,12 +86,32 @@ {{- $volumes = (concat (default (list) $volumes) (list $v_2)) -}} {{- end -}} {{- $volumes = (concat (default (list) $volumes) (list (get (fromJson (include "redpanda.kubeTokenAPIVolume" (dict "a" (list "kube-api-access")))) "r"))) -}} +{{- if (and $state.Values.tuning.tune_aio_events $state.Values.tuning.apply_host_tuners) -}} +{{- $volumes = (concat (default (list) $volumes) (default (list) (get (fromJson (include "redpanda.hostTunerVolumes" (dict "a" (list)))) "r"))) -}} +{{- end -}} {{- $_is_returning = true -}} {{- (dict "r" $volumes) | toJson -}} {{- break -}} {{- end -}} {{- end -}} +{{- define "redpanda.hostTunerVolumes" -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $vols := (list) -}} +{{- range $_, $dir := (get (fromJson (include "redpanda.hostTunerDirs" (dict "a" (list)))) "r") -}} +{{- $vols = (concat (default (list) $vols) (list (mustMergeOverwrite (dict "name" "") (mustMergeOverwrite (dict) (dict "hostPath" (mustMergeOverwrite (dict "path" "") (dict "path" (printf "/%s" $dir) "type" "DirectoryOrCreate")))) (dict "name" (printf "host-%s" $dir))))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $vols = (concat (default (list) $vols) (list (mustMergeOverwrite (dict "name" "") (mustMergeOverwrite (dict) (dict "hostPath" (mustMergeOverwrite (dict "path" "") (dict "path" "/var/run/redpanda_node_tuner_state.yaml" "type" "FileOrCreate")))) (dict "name" "host-tuner-state")))) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $vols) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + {{- define "redpanda.kubeTokenAPIVolume" -}} {{- $name := (index .a 0) -}} {{- range $_ := (list 1) -}} @@ -190,6 +210,15 @@ {{- end -}} {{- end -}} +{{- define "redpanda.hostTunerDirs" -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list "bin" "sbin" "sys" "proc" "etc" "usr" "lib" "lib64" "dev" "var" "run")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + {{- define "redpanda.statefulSetInitContainerTuning" -}} {{- $state := (index .a 0) -}} {{- range $_ := (list 1) -}} @@ -199,12 +228,61 @@ {{- (dict "r" (coalesce nil)) | toJson -}} {{- break -}} {{- end -}} +{{- if $state.Values.tuning.apply_host_tuners -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.statefulSetInitContainerTuningOnHost" (dict "a" (list $state)))) "r")) | toJson -}} +{{- break -}} +{{- end -}} {{- $_is_returning = true -}} {{- (dict "r" (mustMergeOverwrite (dict "name" "" "resources" (dict)) (dict "name" "tuning" "image" (printf "%s:%s" $state.Values.image.repository (get (fromJson (include "redpanda.Tag" (dict "a" (list $state)))) "r")) "command" (list `/bin/bash` `-c` `rpk redpanda tune all`) "securityContext" (mustMergeOverwrite (dict) (dict "capabilities" (mustMergeOverwrite (dict) (dict "add" (list `SYS_RESOURCE`))) "privileged" true "runAsNonRoot" false "runAsUser" ((0 | int64) | int64) "runAsGroup" ((0 | int64) | int64))) "volumeMounts" (concat (default (list) (get (fromJson (include "redpanda.CommonMounts" (dict "a" (list $state)))) "r")) (list (mustMergeOverwrite (dict "name" "" "mountPath" "") (dict "name" "base-config" "mountPath" "/etc/redpanda")) (mustMergeOverwrite (dict "name" "" "mountPath" "") (dict "name" `datadir` "mountPath" `/var/lib/redpanda/data`))))))) | toJson -}} {{- break -}} {{- end -}} {{- end -}} +{{- define "redpanda.statefulSetInitContainerTuningOnHost" -}} +{{- $state := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $mounts := (list) -}} +{{- range $_, $dir := (get (fromJson (include "redpanda.hostTunerDirs" (dict "a" (list)))) "r") -}} +{{- $mounts = (concat (default (list) $mounts) (list (mustMergeOverwrite (dict "name" "" "mountPath" "") (dict "name" (printf "host-%s" $dir) "mountPath" (printf "/host/%s" $dir) "mountPropagation" "HostToContainer")))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $mounts = (concat (default (list) $mounts) (list (mustMergeOverwrite (dict "name" "" "mountPath" "") (dict "name" "host-tuner-state" "mountPath" "/host/tuner_state.yaml")) (mustMergeOverwrite (dict "name" "" "mountPath" "") (dict "name" "base-config" "mountPath" "/host/redpanda_etc")) (mustMergeOverwrite (dict "name" "" "mountPath" "") (dict "name" "datadir" "mountPath" "/host/var/lib/redpanda/data")))) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "name" "" "resources" (dict)) (dict "name" "tuning" "image" (printf "%s:%s" $state.Values.image.repository (get (fromJson (include "redpanda.Tag" (dict "a" (list $state)))) "r")) "command" (list `/bin/bash` `-c` (get (fromJson (include "redpanda.hostTunerScript" (dict "a" (list)))) "r")) "securityContext" (mustMergeOverwrite (dict) (dict "capabilities" (mustMergeOverwrite (dict) (dict "add" (list `SYS_RESOURCE` `SYS_ADMIN`))) "privileged" true "runAsNonRoot" false "runAsUser" ((0 | int64) | int64) "runAsGroup" ((0 | int64) | int64))) "volumeMounts" $mounts))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.hostTunerScript" -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" `set -x +mkdir -p /host/opt/redpanda +mount --bind /opt/redpanda /host/opt/redpanda +cp /host/redpanda_etc/redpanda.yaml /host/var/tmp/redpanda-tune.yaml +sed -i 's|^redpanda:|redpanda:\n data_directory: /var/lib/redpanda/data|' /host/var/tmp/redpanda-tune.yaml +printf '#!/bin/sh\ncommand -v "$@"\n' > /opt/redpanda/bin/which && chmod +x /opt/redpanda/bin/which || true +chroot /host /bin/bash -c ' + export PATH="/opt/redpanda/bin:$PATH" + nsenter -t 1 -n /opt/redpanda/bin/rpk redpanda tune all \ + --config /var/tmp/redpanda-tune.yaml \ + --node-tuner-state-path /tuner_state.yaml \ + -v + /usr/bin/busctl call org.freedesktop.systemd1 /org/freedesktop/systemd1 \ + org.freedesktop.systemd1.Manager RestartUnit ss "irqbalance.service" "replace" \ + || pkill -f irqbalance || true +' || true +exit 0 +`) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + {{- define "redpanda.statefulSetInitContainerSetDataDirOwnership" -}} {{- $state := (index .a 0) -}} {{- $pool := (index .a 1) -}} @@ -215,9 +293,9 @@ {{- (dict "r" (coalesce nil)) | toJson -}} {{- break -}} {{- end -}} -{{- $_402_uid_gid := (get (fromJson (include "redpanda.securityContextUidGid" (dict "a" (list $state $pool "set-datadir-ownership")))) "r") -}} -{{- $uid := ((index $_402_uid_gid 0) | int64) -}} -{{- $gid := ((index $_402_uid_gid 1) | int64) -}} +{{- $_587_uid_gid := (get (fromJson (include "redpanda.securityContextUidGid" (dict "a" (list $state $pool "set-datadir-ownership")))) "r") -}} +{{- $uid := ((index $_587_uid_gid 0) | int64) -}} +{{- $gid := ((index $_587_uid_gid 1) | int64) -}} {{- $_is_returning = true -}} {{- (dict "r" (mustMergeOverwrite (dict "name" "" "resources" (dict)) (dict "name" "set-datadir-ownership" "image" (printf "%s:%s" $pool.Statefulset.initContainerImage.repository $pool.Statefulset.initContainerImage.tag) "command" (list `/bin/sh` `-c` (printf `chown %d:%d -R /var/lib/redpanda/data` $uid $gid)) "securityContext" (mustMergeOverwrite (dict) (dict "runAsUser" (0 | int64) "runAsGroup" (0 | int64))) "volumeMounts" (concat (default (list) (get (fromJson (include "redpanda.CommonMounts" (dict "a" (list $state)))) "r")) (list (mustMergeOverwrite (dict "name" "" "mountPath" "") (dict "name" `datadir` "mountPath" `/var/lib/redpanda/data`))))))) | toJson -}} {{- break -}} @@ -230,12 +308,12 @@ {{- $containerName := (index .a 2) -}} {{- range $_ := (list 1) -}} {{- $_is_returning := false -}} -{{- $_428_gid_uid := (get (fromJson (include "redpanda.giduidFromPodTemplate" (dict "a" (list $state.Values.podTemplate "redpanda")))) "r") -}} -{{- $gid := (index $_428_gid_uid 0) -}} -{{- $uid := (index $_428_gid_uid 1) -}} -{{- $_429_sgid_suid := (get (fromJson (include "redpanda.giduidFromPodTemplate" (dict "a" (list $pool.Statefulset.podTemplate "redpanda")))) "r") -}} -{{- $sgid := (index $_429_sgid_suid 0) -}} -{{- $suid := (index $_429_sgid_suid 1) -}} +{{- $_613_gid_uid := (get (fromJson (include "redpanda.giduidFromPodTemplate" (dict "a" (list $state.Values.podTemplate "redpanda")))) "r") -}} +{{- $gid := (index $_613_gid_uid 0) -}} +{{- $uid := (index $_613_gid_uid 1) -}} +{{- $_614_sgid_suid := (get (fromJson (include "redpanda.giduidFromPodTemplate" (dict "a" (list $pool.Statefulset.podTemplate "redpanda")))) "r") -}} +{{- $sgid := (index $_614_sgid_suid 0) -}} +{{- $suid := (index $_614_sgid_suid 1) -}} {{- if (ne (toJson $sgid) "null") -}} {{- $gid = $sgid -}} {{- end -}} @@ -312,9 +390,9 @@ {{- (dict "r" (coalesce nil)) | toJson -}} {{- break -}} {{- end -}} -{{- $_508_uid_gid := (get (fromJson (include "redpanda.securityContextUidGid" (dict "a" (list $state $pool "set-tiered-storage-cache-dir-ownership")))) "r") -}} -{{- $uid := ((index $_508_uid_gid 0) | int64) -}} -{{- $gid := ((index $_508_uid_gid 1) | int64) -}} +{{- $_693_uid_gid := (get (fromJson (include "redpanda.securityContextUidGid" (dict "a" (list $state $pool "set-tiered-storage-cache-dir-ownership")))) "r") -}} +{{- $uid := ((index $_693_uid_gid 0) | int64) -}} +{{- $gid := ((index $_693_uid_gid 1) | int64) -}} {{- $cacheDir := (get (fromJson (include "redpanda.Storage.TieredCacheDirectory" (dict "a" (list $state.Values.storage $state)))) "r") -}} {{- $mounts := (get (fromJson (include "redpanda.CommonMounts" (dict "a" (list $state)))) "r") -}} {{- $mounts = (concat (default (list) $mounts) (list (mustMergeOverwrite (dict "name" "" "mountPath" "") (dict "name" "datadir" "mountPath" "/var/lib/redpanda/data")))) -}} @@ -475,9 +553,9 @@ {{- end -}} {{- $args = (concat (default (list) $args) (default (list) $pool.Statefulset.sideCars.args)) -}} {{- $volumeMounts := (concat (default (list) (get (fromJson (include "redpanda.CommonMounts" (dict "a" (list $state)))) "r")) (list (mustMergeOverwrite (dict "name" "" "mountPath" "") (dict "name" "config" "mountPath" "/etc/redpanda")) (mustMergeOverwrite (dict "name" "" "mountPath" "") (dict "name" "base-config" "mountPath" "/tmp/base-config" "readOnly" true)) (mustMergeOverwrite (dict "name" "" "mountPath" "") (dict "name" "kube-api-access" "mountPath" "/var/run/secrets/kubernetes.io/serviceaccount" "readOnly" true)))) -}} -{{- $_925_uid_gid := (get (fromJson (include "redpanda.securityContextUidGid" (dict "a" (list $state $pool "sidecar")))) "r") -}} -{{- $uid := ((index $_925_uid_gid 0) | int64) -}} -{{- $gid := ((index $_925_uid_gid 1) | int64) -}} +{{- $_1110_uid_gid := (get (fromJson (include "redpanda.securityContextUidGid" (dict "a" (list $state $pool "sidecar")))) "r") -}} +{{- $uid := ((index $_1110_uid_gid 0) | int64) -}} +{{- $gid := ((index $_1110_uid_gid 1) | int64) -}} {{- $_is_returning = true -}} {{- (dict "r" (mustMergeOverwrite (dict "name" "" "resources" (dict)) (dict "name" "sidecar" "image" (printf `%s:%s` $pool.Statefulset.sideCars.image.repository $pool.Statefulset.sideCars.image.tag) "command" (list `/redpanda-operator`) "args" (concat (default (list) (list `supervisor` `--`)) (default (list) $args)) "env" (concat (default (list) (get (fromJson (include "redpanda.rpkEnvVars" (dict "a" (list $state (coalesce nil))))) "r")) (default (list) (get (fromJson (include "redpanda.statefulSetRedpandaEnv" (dict "a" (list)))) "r"))) "volumeMounts" $volumeMounts "securityContext" (mustMergeOverwrite (dict) (dict "runAsUser" $uid "runAsGroup" $gid "runAsNonRoot" true "allowPrivilegeEscalation" false)) "readinessProbe" (mustMergeOverwrite (dict) (mustMergeOverwrite (dict) (dict "httpGet" (mustMergeOverwrite (dict "port" 0) (dict "path" "/healthz" "port" (8093 | int))))) (dict "failureThreshold" (3 | int) "initialDelaySeconds" (1 | int) "periodSeconds" (10 | int) "successThreshold" (1 | int) "timeoutSeconds" (0 | int)))))) | toJson -}} {{- break -}} diff --git a/charts/redpanda/chart/templates/_values.go.tpl b/charts/redpanda/chart/templates/_values.go.tpl index e7f575921..f298a7e3b 100644 --- a/charts/redpanda/chart/templates/_values.go.tpl +++ b/charts/redpanda/chart/templates/_values.go.tpl @@ -522,9 +522,9 @@ {{- $result := (dict) -}} {{- $s := (toJson $t) -}} {{- $tune := (fromJson $s) -}} -{{- $_920_m_ok := (get (fromJson (include "_shims.typetest" (dict "a" (list (printf "map[%s]%s" "string" "interface {}") $tune (coalesce nil))))) "r") -}} -{{- $m := (index $_920_m_ok 0) -}} -{{- $ok := (index $_920_m_ok 1) -}} +{{- $_966_m_ok := (get (fromJson (include "_shims.typetest" (dict "a" (list (printf "map[%s]%s" "string" "interface {}") $tune (coalesce nil))))) "r") -}} +{{- $m := (index $_966_m_ok 0) -}} +{{- $ok := (index $_966_m_ok 1) -}} {{- if (not $ok) -}} {{- $_is_returning = true -}} {{- (dict "r" (dict)) | toJson -}} @@ -536,6 +536,14 @@ {{- if $_is_returning -}} {{- break -}} {{- end -}} +{{- if $t.apply_host_tuners -}} +{{- range $_, $k := (list "tune_disk_irq" "tune_disk_scheduler" "tune_disk_nomerges" "tune_network" "tune_fstrim" "tune_disk_write_cache" "tune_cpu") -}} +{{- $_ := (set $result $k true) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- end -}} {{- $_is_returning = true -}} {{- (dict "r" $result) | toJson -}} {{- break -}} @@ -671,9 +679,9 @@ {{- $seen := (dict) -}} {{- $deduped := (coalesce nil) -}} {{- range $_, $item := $items -}} -{{- $_1114___ok_11 := (get (fromJson (include "_shims.dicttest" (dict "a" (list $seen $item.key false)))) "r") -}} -{{- $_ := (index $_1114___ok_11 0) -}} -{{- $ok_11 := (index $_1114___ok_11 1) -}} +{{- $_1185___ok_11 := (get (fromJson (include "_shims.dicttest" (dict "a" (list $seen $item.key false)))) "r") -}} +{{- $_ := (index $_1185___ok_11 0) -}} +{{- $ok_11 := (index $_1185___ok_11 1) -}} {{- if $ok_11 -}} {{- continue -}} {{- end -}} @@ -896,9 +904,9 @@ {{- $name := (index .a 1) -}} {{- range $_ := (list 1) -}} {{- $_is_returning := false -}} -{{- $_1402_cert_ok := (get (fromJson (include "_shims.dicttest" (dict "a" (list $m $name (dict "enabled" (coalesce nil) "caEnabled" false "applyInternalDNSNames" (coalesce nil) "duration" "" "issuerRef" (coalesce nil) "secretRef" (coalesce nil) "clientSecretRef" (coalesce nil)))))) "r") -}} -{{- $cert := (index $_1402_cert_ok 0) -}} -{{- $ok := (index $_1402_cert_ok 1) -}} +{{- $_1473_cert_ok := (get (fromJson (include "_shims.dicttest" (dict "a" (list $m $name (dict "enabled" (coalesce nil) "caEnabled" false "applyInternalDNSNames" (coalesce nil) "duration" "" "issuerRef" (coalesce nil) "secretRef" (coalesce nil) "clientSecretRef" (coalesce nil)))))) "r") -}} +{{- $cert := (index $_1473_cert_ok 0) -}} +{{- $ok := (index $_1473_cert_ok 1) -}} {{- if (not $ok) -}} {{- $_ := (fail (printf "Certificate %q referenced, but not found in the tls.certs map" $name)) -}} {{- end -}} @@ -1390,9 +1398,9 @@ {{- $result := (dict) -}} {{- range $k, $v := $c -}} {{- if (not (empty $v)) -}} -{{- $_1973___ok_15 := (get (fromJson (include "_shims.asnumeric" (dict "a" (list $v)))) "r") -}} -{{- $_ := ((index $_1973___ok_15 0) | float64) -}} -{{- $ok_15 := (index $_1973___ok_15 1) -}} +{{- $_2044___ok_15 := (get (fromJson (include "_shims.asnumeric" (dict "a" (list $v)))) "r") -}} +{{- $_ := ((index $_2044___ok_15 0) | float64) -}} +{{- $ok_15 := (index $_2044___ok_15 1) -}} {{- if $ok_15 -}} {{- $_ := (set $result $k $v) -}} {{- else -}}{{- if (kindIs "bool" $v) -}} @@ -1418,9 +1426,9 @@ {{- $_is_returning := false -}} {{- $result := (dict) -}} {{- range $k, $v := $c -}} -{{- $_1993_b_16_ok_17 := (get (fromJson (include "_shims.typetest" (dict "a" (list "bool" $v false)))) "r") -}} -{{- $b_16 := (index $_1993_b_16_ok_17 0) -}} -{{- $ok_17 := (index $_1993_b_16_ok_17 1) -}} +{{- $_2064_b_16_ok_17 := (get (fromJson (include "_shims.typetest" (dict "a" (list "bool" $v false)))) "r") -}} +{{- $b_16 := (index $_2064_b_16_ok_17 0) -}} +{{- $ok_17 := (index $_2064_b_16_ok_17 1) -}} {{- if $ok_17 -}} {{- $_ := (set $result $k $b_16) -}} {{- continue -}} @@ -1463,15 +1471,15 @@ {{- $config := (index .a 1) -}} {{- range $_ := (list 1) -}} {{- $_is_returning := false -}} -{{- $_2038___hasAccessKey := (get (fromJson (include "_shims.dicttest" (dict "a" (list $config "cloud_storage_access_key" (coalesce nil))))) "r") -}} -{{- $_ := (index $_2038___hasAccessKey 0) -}} -{{- $hasAccessKey := (index $_2038___hasAccessKey 1) -}} -{{- $_2039___hasSecretKey := (get (fromJson (include "_shims.dicttest" (dict "a" (list $config "cloud_storage_secret_key" (coalesce nil))))) "r") -}} -{{- $_ := (index $_2039___hasSecretKey 0) -}} -{{- $hasSecretKey := (index $_2039___hasSecretKey 1) -}} -{{- $_2040___hasSharedKey := (get (fromJson (include "_shims.dicttest" (dict "a" (list $config "cloud_storage_azure_shared_key" (coalesce nil))))) "r") -}} -{{- $_ := (index $_2040___hasSharedKey 0) -}} -{{- $hasSharedKey := (index $_2040___hasSharedKey 1) -}} +{{- $_2109___hasAccessKey := (get (fromJson (include "_shims.dicttest" (dict "a" (list $config "cloud_storage_access_key" (coalesce nil))))) "r") -}} +{{- $_ := (index $_2109___hasAccessKey 0) -}} +{{- $hasAccessKey := (index $_2109___hasAccessKey 1) -}} +{{- $_2110___hasSecretKey := (get (fromJson (include "_shims.dicttest" (dict "a" (list $config "cloud_storage_secret_key" (coalesce nil))))) "r") -}} +{{- $_ := (index $_2110___hasSecretKey 0) -}} +{{- $hasSecretKey := (index $_2110___hasSecretKey 1) -}} +{{- $_2111___hasSharedKey := (get (fromJson (include "_shims.dicttest" (dict "a" (list $config "cloud_storage_azure_shared_key" (coalesce nil))))) "r") -}} +{{- $_ := (index $_2111___hasSharedKey 0) -}} +{{- $hasSharedKey := (index $_2111___hasSharedKey 1) -}} {{- $envvars := (coalesce nil) -}} {{- if (and (not $hasAccessKey) (get (fromJson (include "redpanda.SecretRef.IsValid" (dict "a" (list $tsc.accessKey)))) "r")) -}} {{- $envvars = (concat (default (list) $envvars) (list (mustMergeOverwrite (dict "name" "") (dict "name" "REDPANDA_CLOUD_STORAGE_ACCESS_KEY" "valueFrom" (get (fromJson (include "redpanda.SecretRef.AsSource" (dict "a" (list $tsc.accessKey)))) "r"))))) -}} @@ -1494,12 +1502,12 @@ {{- $c := (index .a 0) -}} {{- range $_ := (list 1) -}} {{- $_is_returning := false -}} -{{- $_2076___containerExists := (get (fromJson (include "_shims.dicttest" (dict "a" (list $c "cloud_storage_azure_container" (coalesce nil))))) "r") -}} -{{- $_ := (index $_2076___containerExists 0) -}} -{{- $containerExists := (index $_2076___containerExists 1) -}} -{{- $_2077___accountExists := (get (fromJson (include "_shims.dicttest" (dict "a" (list $c "cloud_storage_azure_storage_account" (coalesce nil))))) "r") -}} -{{- $_ := (index $_2077___accountExists 0) -}} -{{- $accountExists := (index $_2077___accountExists 1) -}} +{{- $_2147___containerExists := (get (fromJson (include "_shims.dicttest" (dict "a" (list $c "cloud_storage_azure_container" (coalesce nil))))) "r") -}} +{{- $_ := (index $_2147___containerExists 0) -}} +{{- $containerExists := (index $_2147___containerExists 1) -}} +{{- $_2148___accountExists := (get (fromJson (include "_shims.dicttest" (dict "a" (list $c "cloud_storage_azure_storage_account" (coalesce nil))))) "r") -}} +{{- $_ := (index $_2148___accountExists 0) -}} +{{- $accountExists := (index $_2148___accountExists 1) -}} {{- $_is_returning = true -}} {{- (dict "r" (and $containerExists $accountExists)) | toJson -}} {{- break -}} @@ -1510,9 +1518,9 @@ {{- $c := (index .a 0) -}} {{- range $_ := (list 1) -}} {{- $_is_returning := false -}} -{{- $_2082_value_ok := (get (fromJson (include "_shims.dicttest" (dict "a" (list $c `cloud_storage_cache_size` (coalesce nil))))) "r") -}} -{{- $value := (index $_2082_value_ok 0) -}} -{{- $ok := (index $_2082_value_ok 1) -}} +{{- $_2153_value_ok := (get (fromJson (include "_shims.dicttest" (dict "a" (list $c `cloud_storage_cache_size` (coalesce nil))))) "r") -}} +{{- $value := (index $_2153_value_ok 0) -}} +{{- $ok := (index $_2153_value_ok 1) -}} {{- if (not $ok) -}} {{- $_is_returning = true -}} {{- (dict "r" (coalesce nil)) | toJson -}} diff --git a/charts/redpanda/chart/values.schema.json b/charts/redpanda/chart/values.schema.json index d65c835f1..9deecf6c7 100644 --- a/charts/redpanda/chart/values.schema.json +++ b/charts/redpanda/chart/values.schema.json @@ -22452,6 +22452,9 @@ "tuning": { "additionalProperties": false, "properties": { + "apply_host_tuners": { + "type": "boolean" + }, "ballast_file_path": { "type": "string" }, diff --git a/charts/redpanda/statefulset.go b/charts/redpanda/statefulset.go index c26b19c91..c33e4a91a 100644 --- a/charts/redpanda/statefulset.go +++ b/charts/redpanda/statefulset.go @@ -205,9 +205,45 @@ func StatefulSetVolumes(state *RenderState, pool Pool) []corev1.Volume { volumes = append(volumes, kubeTokenAPIVolume(ServiceAccountVolumeName)) + if state.Values.Tuning.TuneAIOEvents && state.Values.Tuning.ApplyHostTuners { + volumes = append(volumes, hostTunerVolumes()...) + } + return volumes } +// hostTunerVolumes returns the hostPath volumes used by the host-mode +// tuning init container. Bound only when Tuning.ApplyHostTuners is true. +// +// Operators using OpenShift SCCs need to allow `hostPath` in the SCC's +// volumes list and add these paths to `allowedHostPaths` (or use the +// built-in `privileged` SCC). On PSA clusters, the namespace must be +// labeled `privileged`. +func hostTunerVolumes() []corev1.Volume { + vols := []corev1.Volume{} + for _, dir := range hostTunerDirs() { + vols = append(vols, corev1.Volume{ + Name: fmt.Sprintf("host-%s", dir), + VolumeSource: corev1.VolumeSource{ + HostPath: &corev1.HostPathVolumeSource{ + Path: fmt.Sprintf("/%s", dir), + Type: ptr.To(corev1.HostPathDirectoryOrCreate), + }, + }, + }) + } + vols = append(vols, corev1.Volume{ + Name: "host-tuner-state", + VolumeSource: corev1.VolumeSource{ + HostPath: &corev1.HostPathVolumeSource{ + Path: hostTunerStateFilePath, + Type: ptr.To(corev1.HostPathFileOrCreate), + }, + }, + }) + return vols +} + // kubeTokenAPIVolume is a slightly changed variant of // https://github.com/kubernetes/kubernetes/blob/c6669ea7d61af98da3a2aa8c1d2cdc9c2c57080a/plugin/pkg/admission/serviceaccount/admission.go#L484-L524 // Upstream creates Projected Volume Source, but this function returns Volume with provided name. @@ -354,11 +390,35 @@ func StatefulSetInitContainers(state *RenderState, pool Pool) []corev1.Container return containers } +// hostTunerDirs returns the host filesystem directories bind-mounted +// into the tuning container so that `rpk redpanda tune all` can chroot +// in and see the host's /sys, /proc, NIC devices, block devices, and +// rpk binary. Kept as a list (not whole-/) on purpose: bind-mounting / +// into /host creates mount-loops with /opt/redpanda. See +// https://redpandadata.atlassian.net/browse/CORE-13685 +// bin and sbin matter for non-usr-merged hosts (GKE's COS): there +// /bin is a real directory — bash lives at /bin/bash, NOT +// /usr/bin/bash — so without these mounts the chroot has no shell at +// all and tuning silently no-ops. On usr-merged hosts (Ubuntu, +// AL2023) /bin and /sbin are symlinks into /usr, and the bind mount +// just resolves to the same content. +func hostTunerDirs() []string { + return []string{"bin", "sbin", "sys", "proc", "etc", "usr", "lib", "lib64", "dev", "var", "run"} +} + +// hostTunerStateFilePath is where rpk persists its tuner state on the +// host so subsequent pod restarts skip already-applied tuners. +const hostTunerStateFilePath = "/var/run/redpanda_node_tuner_state.yaml" + func statefulSetInitContainerTuning(state *RenderState) *corev1.Container { if !state.Values.Tuning.TuneAIOEvents { return nil } + if state.Values.Tuning.ApplyHostTuners { + return statefulSetInitContainerTuningOnHost(state) + } + return &corev1.Container{ Name: RedpandaTuningContainerName, Image: fmt.Sprintf("%s:%s", state.Values.Image.Repository, Tag(state)), @@ -390,6 +450,131 @@ func statefulSetInitContainerTuning(state *RenderState) *corev1.Container { } } +// statefulSetInitContainerTuningOnHost returns the tuning init container +// that runs `rpk redpanda tune all` in a chroot to the host filesystem. +// +// Why a chroot: the default tuning container runs rpk inside the pod's +// own filesystem and namespaces, so the disk_irq / disk_scheduler / +// disk_nomerges / net tuners can't find host block devices in /sys/block +// or write host sysctls in /proc/sys/net. By chrooting into /host (which +// has the host's /sys, /proc, /usr, ... bind-mounted) and using +// `nsenter -t 1 -n` to enter the host network namespace, rpk sees the +// real host and the tuners apply for real. +// +// Three workarounds layered in by this function: +// - cp+sed the rendered redpanda.yaml into /var/tmp and inject +// `redpanda.data_directory` so the disk tuners have a path to +// resolve. The base chart deliberately omits data_directory (the +// broker doesn't need it) but rpk's tuner refuses to combine +// `--dirs` with `--config`, so the value must live in the file. +// - busctl call into the host's systemd to restart irqbalance after +// rpk rewrites IRQ affinity (systemctl can't traverse a chroot). +// Falls back to `pkill irqbalance` if systemd isn't present. +// - `|| true ; exit 0` so a single failing tuner (e.g. AWS lacks +// disk_write_cache) doesn't crashloop the init container. +// - a `which` shim written into /opt/redpanda/bin (bind-mounted into +// the chroot, first on PATH): rpk's fstrim tuner shells out to +// `which`, and some minimal node images (AKS Ubuntu) ship a broken +// or missing /usr/bin/which. +// +// Pre-conditions for this to work: +// - one Redpanda pod per node (anti-affinity); concurrent tuners race +// on the same kernel parameters. +// - the pod's ServiceAccount is bound to an SCC / PSA level that +// allows hostPath volumes and privileged: true. +func statefulSetInitContainerTuningOnHost(state *RenderState) *corev1.Container { + // HostToContainer, NOT Bidirectional: the chroot'd rpk runs in this + // container's mount namespace, so it already sees every mount made + // here (the /opt/redpanda bind, the datadir PVC) without any + // propagation. Bidirectional would additionally propagate the + // datadir PVC mount (which lives under the host-var subtree at + // /host/var/lib/redpanda/data) back onto the host's real + // /var/lib/redpanda/data — and that host-side mount outlives the + // pod, stacking one leaked mount per pod incarnation. + mounts := []corev1.VolumeMount{} + for _, dir := range hostTunerDirs() { + mounts = append(mounts, corev1.VolumeMount{ + Name: fmt.Sprintf("host-%s", dir), + MountPath: fmt.Sprintf("/host/%s", dir), + MountPropagation: ptr.To(corev1.MountPropagationHostToContainer), + }) + } + mounts = append(mounts, + corev1.VolumeMount{ + Name: "host-tuner-state", + MountPath: "/host/tuner_state.yaml", + }, + corev1.VolumeMount{ + Name: "base-config", + MountPath: "/host/redpanda_etc", + }, + corev1.VolumeMount{ + Name: "datadir", + MountPath: "/host/var/lib/redpanda/data", + }, + ) + + return &corev1.Container{ + Name: RedpandaTuningContainerName, + Image: fmt.Sprintf("%s:%s", state.Values.Image.Repository, Tag(state)), + Command: []string{`/bin/bash`, `-c`, hostTunerScript()}, + SecurityContext: &corev1.SecurityContext{ + Capabilities: &corev1.Capabilities{ + Add: []corev1.Capability{`SYS_RESOURCE`, `SYS_ADMIN`}, + }, + Privileged: ptr.To(true), + RunAsNonRoot: ptr.To(false), + RunAsUser: ptr.To(int64(0)), + RunAsGroup: ptr.To(int64(0)), + }, + VolumeMounts: mounts, + } +} + +// hostTunerScript returns the bash script run by the host-mode tuning +// init container. It builds a chroot to the host filesystem and invokes +// `rpk redpanda tune all` inside the host's network namespace so the +// tuners that need /sys, /proc, host NICs and host block devices can +// actually apply. +// +// Three workarounds layered in: +// - The chart-rendered redpanda.yaml omits `redpanda.data_directory` +// (the broker doesn't need it). rpk's disk tuners do need it, and +// rpk refuses to combine `--dirs` with `--config`. So we cp+sed a +// working copy into /var/tmp (because /tmp is not bind-mounted from +// the host). +// - busctl call into systemd to restart irqbalance after rpk rewrites +// IRQ affinity. systemctl can't traverse a chroot. Falls back to +// `pkill irqbalance` for non-systemd hosts. +// - `|| true ; exit 0` so a single unsupported tuner (e.g. AWS does +// not support disk_write_cache) does not crashloop the init. +// - a `which` shim in /opt/redpanda/bin for rpk's fstrim tuner, which +// shells out to `which` (missing/broken on minimal node images). +// +// The chroot shell is /bin/bash (not /usr/bin/bash): COS is not +// usr-merged and only has /bin/bash; usr-merged hosts resolve +// /bin/bash to the same binary via the /bin symlink. +func hostTunerScript() string { + return `set -x +mkdir -p /host/opt/redpanda +mount --bind /opt/redpanda /host/opt/redpanda +cp /host/redpanda_etc/redpanda.yaml /host/var/tmp/redpanda-tune.yaml +sed -i 's|^redpanda:|redpanda:\n data_directory: /var/lib/redpanda/data|' /host/var/tmp/redpanda-tune.yaml +printf '#!/bin/sh\ncommand -v "$@"\n' > /opt/redpanda/bin/which && chmod +x /opt/redpanda/bin/which || true +chroot /host /bin/bash -c ' + export PATH="/opt/redpanda/bin:$PATH" + nsenter -t 1 -n /opt/redpanda/bin/rpk redpanda tune all \ + --config /var/tmp/redpanda-tune.yaml \ + --node-tuner-state-path /tuner_state.yaml \ + -v + /usr/bin/busctl call org.freedesktop.systemd1 /org/freedesktop/systemd1 \ + org.freedesktop.systemd1.Manager RestartUnit ss "irqbalance.service" "replace" \ + || pkill -f irqbalance || true +' || true +exit 0 +` +} + func statefulSetInitContainerSetDataDirOwnership(state *RenderState, pool Pool) *corev1.Container { if !pool.Statefulset.InitContainers.SetDataDirOwnership.Enabled { return nil diff --git a/charts/redpanda/testdata/template-cases.golden.txtar b/charts/redpanda/testdata/template-cases.golden.txtar index 9c6c1d96e..cc0d75283 100644 --- a/charts/redpanda/testdata/template-cases.golden.txtar +++ b/charts/redpanda/testdata/template-cases.golden.txtar @@ -141542,3 +141542,1568 @@ spec: name: base-config - emptyDir: {} name: config +-- testdata/TestTemplate/tuning-host-mode.yaml.golden -- +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda + namespace: default +spec: + maxUnavailable: 1 + selector: + matchLabels: + app.kubernetes.io/instance: redpanda + app.kubernetes.io/name: redpanda + redpanda.com/poddisruptionbudget: redpanda +--- +# Source: redpanda/charts/console/templates/entry-point.yaml +apiVersion: v1 +automountServiceAccountToken: false +kind: ServiceAccount +metadata: + annotations: {} + labels: + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v3.7.0 + helm.sh/chart: console-3.7.0 + name: redpanda-console + namespace: default +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: v1 +automountServiceAccountToken: false +kind: ServiceAccount +metadata: + annotations: {} + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda + namespace: default +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: v1 +kind: Secret +metadata: + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda-sts-lifecycle + namespace: default +stringData: + common.sh: |- + #!/usr/bin/env bash + + # the SERVICE_NAME comes from the metadata.name of the pod, essentially the POD_NAME + CURL_URL="https://${SERVICE_NAME}.redpanda.default.svc.cluster.local:9644" + + # commands used throughout + CURL_NODE_ID_CMD="curl --silent --fail --cacert /etc/tls/certs/default/ca.crt ${CURL_URL}/v1/node_config" + + CURL_MAINTENANCE_DELETE_CMD_PREFIX='curl -X DELETE --silent -o /dev/null -w "%{http_code}"' + CURL_MAINTENANCE_PUT_CMD_PREFIX='curl -X PUT --silent -o /dev/null -w "%{http_code}"' + CURL_MAINTENANCE_GET_CMD="curl -X GET --silent --cacert /etc/tls/certs/default/ca.crt ${CURL_URL}/v1/maintenance" + postStart.sh: |- + #!/usr/bin/env bash + # This code should be similar if not exactly the same as that found in the panda-operator, see + # https://github.com/redpanda-data/redpanda/blob/e51d5b7f2ef76d5160ca01b8c7a8cf07593d29b6/src/go/k8s/pkg/resources/secret.go + + # path below should match the path defined on the statefulset + source /var/lifecycle/common.sh + + postStartHook () { + set -x + + touch /tmp/postStartHookStarted + + until NODE_ID=$(${CURL_NODE_ID_CMD} | grep -o '\"node_id\":[^,}]*' | grep -o '[^: ]*$'); do + sleep 0.5 + done + + echo "Clearing maintenance mode on node ${NODE_ID}" + CURL_MAINTENANCE_DELETE_CMD="${CURL_MAINTENANCE_DELETE_CMD_PREFIX} --cacert /etc/tls/certs/default/ca.crt ${CURL_URL}/v1/brokers/${NODE_ID}/maintenance" + # a 400 here would mean not in maintenance mode + until [ "${status:-}" = '"200"' ] || [ "${status:-}" = '"400"' ]; do + status=$(${CURL_MAINTENANCE_DELETE_CMD}) + sleep 0.5 + done + + touch /tmp/postStartHookFinished + } + + postStartHook + true + preStop.sh: |- + #!/usr/bin/env bash + # This code should be similar if not exactly the same as that found in the panda-operator, see + # https://github.com/redpanda-data/redpanda/blob/e51d5b7f2ef76d5160ca01b8c7a8cf07593d29b6/src/go/k8s/pkg/resources/secret.go + + touch /tmp/preStopHookStarted + + # path below should match the path defined on the statefulset + source /var/lifecycle/common.sh + + set -x + + preStopHook () { + until NODE_ID=$(${CURL_NODE_ID_CMD} | grep -o '\"node_id\":[^,}]*' | grep -o '[^: ]*$'); do + sleep 0.5 + done + + echo "Setting maintenance mode on node ${NODE_ID}" + CURL_MAINTENANCE_PUT_CMD="${CURL_MAINTENANCE_PUT_CMD_PREFIX} --cacert /etc/tls/certs/default/ca.crt ${CURL_URL}/v1/brokers/${NODE_ID}/maintenance" + until [ "${status:-}" = '"200"' ]; do + status=$(${CURL_MAINTENANCE_PUT_CMD}) + sleep 0.5 + done + + until [ "${finished:-}" = "true" ] || [ "${draining:-}" = "false" ]; do + res=$(${CURL_MAINTENANCE_GET_CMD}) + finished=$(echo $res | grep -o '\"finished\":[^,}]*' | grep -o '[^: ]*$') + draining=$(echo $res | grep -o '\"draining\":[^,}]*' | grep -o '[^: ]*$') + sleep 0.5 + done + + touch /tmp/preStopHookFinished + } + preStopHook + true +type: Opaque +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: v1 +kind: Secret +metadata: + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda-configurator + namespace: default +stringData: + configurator.sh: |- + set -xe + SERVICE_NAME=$1 + KUBERNETES_NODE_NAME=$2 + POD_ORDINAL=${SERVICE_NAME##*-} + BROKER_INDEX=`expr $POD_ORDINAL + 1` + + CONFIG=/etc/redpanda/redpanda.yaml + + # Setup config files + cp /tmp/base-config/redpanda.yaml "${CONFIG}" + + LISTENER="{\"address\":\"${SERVICE_NAME}.redpanda.default.svc.cluster.local.\",\"name\":\"internal\",\"port\":9093}" + rpk redpanda config --config "$CONFIG" set redpanda.advertised_kafka_api[0] "$LISTENER" + + ADVERTISED_KAFKA_ADDRESSES=() + + PREFIX_TEMPLATE="" + ADVERTISED_KAFKA_ADDRESSES+=("{\"address\":\"${SERVICE_NAME}\",\"name\":\"default\",\"port\":31092}") + + PREFIX_TEMPLATE="" + ADVERTISED_KAFKA_ADDRESSES+=("{\"address\":\"${SERVICE_NAME}\",\"name\":\"default\",\"port\":31092}") + + PREFIX_TEMPLATE="" + ADVERTISED_KAFKA_ADDRESSES+=("{\"address\":\"${SERVICE_NAME}\",\"name\":\"default\",\"port\":31092}") + + rpk redpanda config --config "$CONFIG" set redpanda.advertised_kafka_api[1] "${ADVERTISED_KAFKA_ADDRESSES[$POD_ORDINAL]}" + + LISTENER="{\"address\":\"${SERVICE_NAME}.redpanda.default.svc.cluster.local.\",\"name\":\"internal\",\"port\":8082}" + rpk redpanda config --config "$CONFIG" set pandaproxy.advertised_pandaproxy_api[0] "$LISTENER" + + ADVERTISED_HTTP_ADDRESSES=() + + PREFIX_TEMPLATE="" + ADVERTISED_HTTP_ADDRESSES+=("{\"address\":\"${SERVICE_NAME}\",\"name\":\"default\",\"port\":30082}") + + PREFIX_TEMPLATE="" + ADVERTISED_HTTP_ADDRESSES+=("{\"address\":\"${SERVICE_NAME}\",\"name\":\"default\",\"port\":30082}") + + PREFIX_TEMPLATE="" + ADVERTISED_HTTP_ADDRESSES+=("{\"address\":\"${SERVICE_NAME}\",\"name\":\"default\",\"port\":30082}") + + rpk redpanda config --config "$CONFIG" set pandaproxy.advertised_pandaproxy_api[1] "${ADVERTISED_HTTP_ADDRESSES[$POD_ORDINAL]}" +type: Opaque +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: v1 +data: + .bootstrap.json.in: '{"audit_enabled":"false","cloud_storage_cache_size":"5368709120","cloud_storage_enable_remote_read":"true","cloud_storage_enable_remote_write":"true","cloud_storage_enabled":"false","compacted_log_segment_size":"67108864","default_topic_replications":"3","enable_rack_awareness":"false","enable_sasl":"false","kafka_connection_rate_limit":"1000","kafka_enable_authorization":"false","log_segment_size_max":"268435456","log_segment_size_min":"16777216","max_compacted_log_segment_size":"536870912","storage_min_free_bytes":"1073741824"}' + bootstrap.yaml.fixups: '[]' + redpanda.yaml: |- + config_file: /etc/redpanda/redpanda.yaml + pandaproxy: + pandaproxy_api: + - address: 0.0.0.0 + name: internal + port: 8082 + - address: 0.0.0.0 + name: default + port: 8083 + pandaproxy_api_tls: + - cert_file: /etc/tls/certs/default/tls.crt + enabled: true + key_file: /etc/tls/certs/default/tls.key + name: internal + require_client_auth: false + truststore_file: /etc/tls/certs/default/ca.crt + - cert_file: /etc/tls/certs/external/tls.crt + enabled: true + key_file: /etc/tls/certs/external/tls.key + name: default + require_client_auth: false + truststore_file: /etc/tls/certs/external/ca.crt + pandaproxy_client: + broker_tls: + enabled: true + require_client_auth: false + truststore_file: /etc/tls/certs/default/ca.crt + brokers: + - address: redpanda-0.redpanda.default.svc.cluster.local. + port: 9093 + - address: redpanda-1.redpanda.default.svc.cluster.local. + port: 9093 + - address: redpanda-2.redpanda.default.svc.cluster.local. + port: 9093 + redpanda: + admin: + - address: 0.0.0.0 + name: internal + port: 9644 + - address: 0.0.0.0 + name: default + port: 9645 + admin_api_tls: + - cert_file: /etc/tls/certs/default/tls.crt + enabled: true + key_file: /etc/tls/certs/default/tls.key + name: internal + require_client_auth: false + truststore_file: /etc/tls/certs/default/ca.crt + - cert_file: /etc/tls/certs/external/tls.crt + enabled: true + key_file: /etc/tls/certs/external/tls.key + name: default + require_client_auth: false + truststore_file: /etc/tls/certs/external/ca.crt + crash_loop_limit: 5 + empty_seed_starts_cluster: false + kafka_api: + - address: 0.0.0.0 + name: internal + port: 9093 + - address: 0.0.0.0 + name: default + port: 9094 + kafka_api_tls: + - cert_file: /etc/tls/certs/default/tls.crt + enabled: true + key_file: /etc/tls/certs/default/tls.key + name: internal + require_client_auth: false + truststore_file: /etc/tls/certs/default/ca.crt + - cert_file: /etc/tls/certs/external/tls.crt + enabled: true + key_file: /etc/tls/certs/external/tls.key + name: default + require_client_auth: false + truststore_file: /etc/tls/certs/external/ca.crt + rpc_server: + address: 0.0.0.0 + port: 33145 + rpc_server_tls: + cert_file: /etc/tls/certs/default/tls.crt + enabled: true + key_file: /etc/tls/certs/default/tls.key + require_client_auth: false + truststore_file: /etc/tls/certs/default/ca.crt + seed_servers: + - host: + address: redpanda-0.redpanda.default.svc.cluster.local. + port: 33145 + - host: + address: redpanda-1.redpanda.default.svc.cluster.local. + port: 33145 + - host: + address: redpanda-2.redpanda.default.svc.cluster.local. + port: 33145 + rpk: + additional_start_flags: + - --default-log-level=info + - --memory=2048M + - --reserve-memory=205M + - --smp=1 + admin_api: + addresses: + - redpanda-0.redpanda.default.svc.cluster.local.:9644 + - redpanda-1.redpanda.default.svc.cluster.local.:9644 + - redpanda-2.redpanda.default.svc.cluster.local.:9644 + tls: + ca_file: /etc/tls/certs/default/ca.crt + apply_host_tuners: true + enable_memory_locking: false + kafka_api: + brokers: + - redpanda-0.redpanda.default.svc.cluster.local.:9093 + - redpanda-1.redpanda.default.svc.cluster.local.:9093 + - redpanda-2.redpanda.default.svc.cluster.local.:9093 + tls: + ca_file: /etc/tls/certs/default/ca.crt + overprovisioned: false + schema_registry: + addresses: + - redpanda-0.redpanda.default.svc.cluster.local.:8081 + - redpanda-1.redpanda.default.svc.cluster.local.:8081 + - redpanda-2.redpanda.default.svc.cluster.local.:8081 + tls: + ca_file: /etc/tls/certs/default/ca.crt + tune_aio_events: true + tune_cpu: true + tune_disk_irq: true + tune_disk_nomerges: true + tune_disk_scheduler: true + tune_disk_write_cache: true + tune_fstrim: true + tune_network: true + schema_registry: + schema_registry_api: + - address: 0.0.0.0 + name: internal + port: 8081 + - address: 0.0.0.0 + name: default + port: 8084 + schema_registry_api_tls: + - cert_file: /etc/tls/certs/default/tls.crt + enabled: true + key_file: /etc/tls/certs/default/tls.key + name: internal + require_client_auth: false + truststore_file: /etc/tls/certs/default/ca.crt + - cert_file: /etc/tls/certs/external/tls.crt + enabled: true + key_file: /etc/tls/certs/external/tls.key + name: default + require_client_auth: false + truststore_file: /etc/tls/certs/external/ca.crt + schema_registry_client: + broker_tls: + enabled: true + require_client_auth: false + truststore_file: /etc/tls/certs/default/ca.crt + brokers: + - address: redpanda-0.redpanda.default.svc.cluster.local. + port: 9093 + - address: redpanda-1.redpanda.default.svc.cluster.local. + port: 9093 + - address: redpanda-2.redpanda.default.svc.cluster.local. + port: 9093 +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda + namespace: default +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: v1 +data: + profile: |- + admin_api: + addresses: + - redpanda-0:31644 + - redpanda-1:31644 + - redpanda-2:31644 + tls: + ca_file: ca.crt + kafka_api: + brokers: + - redpanda-0:31092 + - redpanda-1:31092 + - redpanda-2:31092 + tls: + ca_file: ca.crt + name: default + schema_registry: + addresses: + - redpanda-0:30081 + - redpanda-1:30081 + - redpanda-2:30081 + tls: + ca_file: ca.crt +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda-rpk + namespace: default +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.config + kafka: + brokers: + - redpanda-0.redpanda.default.svc.cluster.local.:9093 + - redpanda-1.redpanda.default.svc.cluster.local.:9093 + - redpanda-2.redpanda.default.svc.cluster.local.:9093 + tls: + caFilepath: /etc/tls/certs/secrets/redpanda-default-cert/ca.crt + enabled: true + redpanda: + adminApi: + enabled: true + tls: + caFilepath: /etc/tls/certs/secrets/redpanda-default-cert/ca.crt + enabled: true + urls: + - https://redpanda.default.svc.cluster.local.:9644 + schemaRegistry: + enabled: true + tls: + caFilepath: /etc/tls/certs/secrets/redpanda-default-cert/ca.crt + enabled: true + urls: + - https://redpanda-0.redpanda.default.svc.cluster.local.:8081 + - https://redpanda-1.redpanda.default.svc.cluster.local.:8081 + - https://redpanda-2.redpanda.default.svc.cluster.local.:8081 +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v3.7.0 + helm.sh/chart: console-3.7.0 + name: redpanda-console + namespace: default +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + annotations: {} + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda-rpk-debug-bundle + namespace: default +rules: +- apiGroups: + - "" + resources: + - configmaps + - endpoints + - events + - limitranges + - persistentvolumeclaims + - pods + - pods/log + - replicationcontrollers + - resourcequotas + - serviceaccounts + - services + verbs: + - get + - list +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + annotations: {} + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda-sidecar + namespace: default +rules: +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + annotations: {} + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda-rpk-debug-bundle + namespace: default +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: redpanda-rpk-debug-bundle +subjects: +- kind: ServiceAccount + name: redpanda + namespace: default +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + annotations: {} + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda-sidecar + namespace: default +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: redpanda-sidecar +subjects: +- kind: ServiceAccount + name: redpanda + namespace: default +--- +# Source: redpanda/charts/console/templates/entry-point.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + labels: + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v3.7.0 + helm.sh/chart: console-3.7.0 + name: redpanda-console + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: redpanda + app.kubernetes.io/name: console + type: ClusterIP +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda-external + namespace: default +spec: + externalTrafficPolicy: Local + ports: + - name: admin-default + nodePort: 31644 + port: 9645 + protocol: TCP + targetPort: 0 + - name: kafka-default + nodePort: 31092 + port: 9094 + protocol: TCP + targetPort: 0 + - name: http-default + nodePort: 30082 + port: 8083 + protocol: TCP + targetPort: 0 + - name: schema-default + nodePort: 30081 + port: 8084 + protocol: TCP + targetPort: 0 + publishNotReadyAddresses: true + selector: + app.kubernetes.io/instance: redpanda + app.kubernetes.io/name: redpanda + sessionAffinity: None + type: NodePort +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + monitoring.redpanda.com/enabled: "false" + name: redpanda + namespace: default +spec: + clusterIP: None + ports: + - appProtocol: null + name: admin + port: 9644 + protocol: TCP + targetPort: 9644 + - name: http + port: 8082 + protocol: TCP + targetPort: 8082 + - name: kafka + port: 9093 + protocol: TCP + targetPort: 9093 + - name: rpc + port: 33145 + protocol: TCP + targetPort: 33145 + - name: schemaregistry + port: 8081 + protocol: TCP + targetPort: 8081 + publishNotReadyAddresses: true + selector: + app.kubernetes.io/instance: redpanda + app.kubernetes.io/name: redpanda + type: ClusterIP +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + labels: + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v3.7.0 + helm.sh/chart: console-3.7.0 + name: redpanda-console + namespace: default +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/instance: redpanda + app.kubernetes.io/name: console + strategy: {} + template: + metadata: + annotations: + checksum/config: 44e632405e10e419e4cb3a5f69d2911edabaa8fd561fc25ec1017dc35a99fc96 + labels: + app.kubernetes.io/instance: redpanda + app.kubernetes.io/name: console + spec: + affinity: {} + automountServiceAccountToken: false + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: REDPANDA_METRICS_K8S_DEPLOYMENT_TYPE + value: helm + - name: REDPANDA_METRICS_K8S_CHART_VERSION + value: 3.7.0 + - name: REDPANDA_METRICS_K8S_CONSOLE_IMAGE_VERSION + value: redpandadata/console:v3.7.0 + - name: REDPANDA_METRICS_K8S_VERSION + value: v1.99.0-gke + - name: REDPANDA_METRICS_K8S_ENVIRONMENT + value: GCP + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v3.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/tls/certs + name: redpanda-certificates + imagePullSecrets: [] + initContainers: null + nodeSelector: {} + priorityClassName: "" + securityContext: + fsGroup: 99 + fsGroupChangePolicy: Always + runAsUser: 99 + serviceAccountName: redpanda-console + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: redpanda-console + name: configs + - name: redpanda-certificates + projected: + sources: + - secret: + items: + - key: ca.crt + path: secrets/redpanda-default-cert/ca.crt + name: redpanda-default-cert +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: apps/v1 +kind: StatefulSet +metadata: + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda + namespace: default +spec: + persistentVolumeClaimRetentionPolicy: + whenDeleted: Retain + whenScaled: Retain + podManagementPolicy: Parallel + replicas: 3 + selector: + matchLabels: + app.kubernetes.io/component: redpanda-statefulset + app.kubernetes.io/instance: redpanda + app.kubernetes.io/name: redpanda + serviceName: redpanda + template: + metadata: + annotations: + config.redpanda.com/checksum: a90b21628d89546d234075143f437a7118e87dca2eb009f7ffb653e7b8f09eca + labels: + app.kubernetes.io/component: redpanda-statefulset + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + cluster.redpanda.com/broker: "true" + helm.sh/chart: redpanda-26.1.1 + redpanda.com/poddisruptionbudget: redpanda + spec: + affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + app.kubernetes.io/component: redpanda-statefulset + app.kubernetes.io/instance: redpanda + app.kubernetes.io/name: redpanda + topologyKey: kubernetes.io/hostname + automountServiceAccountToken: false + containers: + - command: + - rpk + - redpanda + - start + - --advertise-rpc-addr=$(SERVICE_NAME).redpanda.default.svc.cluster.local.:33145 + env: + - name: SERVICE_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: REDPANDA_METRICS_K8S_VERSION + value: v1.99.0-gke + - name: REDPANDA_METRICS_K8S_DEPLOYMENT_TYPE + value: helm + - name: REDPANDA_METRICS_K8S_CHART_VERSION + value: 26.1.1 + - name: REDPANDA_METRICS_K8S_OPERATOR_IMAGE_VERSION + value: docker.redpanda.com/redpandadata/redpanda-operator:v26.2.1-beta.2 + - name: REDPANDA_METRICS_K8S_ENVIRONMENT + value: GCP + image: docker.redpanda.com/redpandadata/redpanda:v26.1.1 + lifecycle: + postStart: + exec: + command: + - bash + - -c + - |- + timeout -v 45 bash -x /var/lifecycle/postStart.sh 2>&1 | sed "s/^/lifecycle-hook post-start $(date): /" | tee /proc/1/fd/1 + ec=${PIPESTATUS[0]} + if [ "$ec" = "124" ] || [ "$ec" = "137" ]; then + echo "lifecycle-hook post-start $(date): TIMEOUT after 45s — hook killed before completion; the broker will receive SIGTERM with work in-flight (exit $ec)" | tee /proc/1/fd/1 + fi + true + preStop: + exec: + command: + - bash + - -c + - |- + timeout -v 45 bash -x /var/lifecycle/preStop.sh 2>&1 | sed "s/^/lifecycle-hook pre-stop $(date): /" | tee /proc/1/fd/1 + ec=${PIPESTATUS[0]} + if [ "$ec" = "124" ] || [ "$ec" = "137" ]; then + echo "lifecycle-hook pre-stop $(date): TIMEOUT after 45s — hook killed before completion; the broker will receive SIGTERM with work in-flight (exit $ec)" | tee /proc/1/fd/1 + fi + true + livenessProbe: + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + tcpSocket: + port: 9644 + name: redpanda + ports: + - containerPort: 9644 + name: admin + - containerPort: 9645 + name: admin-default + - containerPort: 8082 + name: http + - containerPort: 8083 + name: http-default + - containerPort: 9093 + name: kafka + - containerPort: 9094 + name: kafka-default + - containerPort: 33145 + name: rpc + - containerPort: 8081 + name: schemaregistry + - containerPort: 8084 + name: schema-default + resources: + limits: + cpu: 1 + memory: 2.5Gi + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + startupProbe: + exec: + command: + - /bin/sh + - -c + - | + set -e + RESULT=$(curl --silent --fail -k -m 5 --cacert /etc/tls/certs/default/ca.crt "https://${SERVICE_NAME}.redpanda.default.svc.cluster.local.:9644/v1/status/ready") + echo $RESULT + echo $RESULT | grep ready + failureThreshold: 120 + initialDelaySeconds: 1 + periodSeconds: 10 + volumeMounts: + - mountPath: /etc/tls/certs/default + name: redpanda-default-cert + - mountPath: /etc/tls/certs/external + name: redpanda-external-cert + - mountPath: /etc/redpanda + name: config + - mountPath: /tmp/base-config + name: base-config + - mountPath: /var/lifecycle + name: lifecycle-scripts + - mountPath: /var/lib/redpanda/data + name: datadir + - mountPath: /var/run/secrets/kubernetes.io/serviceaccount + name: kube-api-access + readOnly: true + - args: + - supervisor + - -- + - /redpanda-operator + - sidecar + - --redpanda-yaml + - /etc/redpanda/redpanda.yaml + - --redpanda-cluster-namespace + - default + - --redpanda-cluster-name + - redpanda + - --selector=helm.sh/chart=redpanda-26.1.1,app.kubernetes.io/name=redpanda,app.kubernetes.io/instance=redpanda + - --run-broker-probe + - --broker-probe-broker-url + - $(SERVICE_NAME).redpanda.default.svc.cluster.local.:9644 + - --watch-rpk-profile + - --rpk-profile-source=/tmp/base-config/redpanda.yaml + command: + - /redpanda-operator + env: + - name: SERVICE_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + image: docker.redpanda.com/redpandadata/redpanda-operator:v26.2.1-beta.2 + name: sidecar + readinessProbe: + failureThreshold: 3 + httpGet: + path: /healthz + port: 8093 + initialDelaySeconds: 1 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 0 + resources: {} + securityContext: + allowPrivilegeEscalation: false + runAsGroup: 101 + runAsNonRoot: true + runAsUser: 101 + volumeMounts: + - mountPath: /etc/tls/certs/default + name: redpanda-default-cert + - mountPath: /etc/tls/certs/external + name: redpanda-external-cert + - mountPath: /etc/redpanda + name: config + - mountPath: /tmp/base-config + name: base-config + readOnly: true + - mountPath: /var/run/secrets/kubernetes.io/serviceaccount + name: kube-api-access + readOnly: true + imagePullSecrets: [] + initContainers: + - command: + - /bin/bash + - -c + - | + set -x + mkdir -p /host/opt/redpanda + mount --bind /opt/redpanda /host/opt/redpanda + cp /host/redpanda_etc/redpanda.yaml /host/var/tmp/redpanda-tune.yaml + sed -i 's|^redpanda:|redpanda:\n data_directory: /var/lib/redpanda/data|' /host/var/tmp/redpanda-tune.yaml + printf '#!/bin/sh\ncommand -v "$@"\n' > /opt/redpanda/bin/which && chmod +x /opt/redpanda/bin/which || true + chroot /host /bin/bash -c ' + export PATH="/opt/redpanda/bin:$PATH" + nsenter -t 1 -n /opt/redpanda/bin/rpk redpanda tune all \ + --config /var/tmp/redpanda-tune.yaml \ + --node-tuner-state-path /tuner_state.yaml \ + -v + /usr/bin/busctl call org.freedesktop.systemd1 /org/freedesktop/systemd1 \ + org.freedesktop.systemd1.Manager RestartUnit ss "irqbalance.service" "replace" \ + || pkill -f irqbalance || true + ' || true + exit 0 + env: null + image: docker.redpanda.com/redpandadata/redpanda:v26.1.1 + name: tuning + resources: {} + securityContext: + capabilities: + add: + - SYS_RESOURCE + - SYS_ADMIN + privileged: true + runAsGroup: 0 + runAsNonRoot: false + runAsUser: 0 + volumeMounts: + - mountPath: /host/bin + mountPropagation: HostToContainer + name: host-bin + - mountPath: /host/sbin + mountPropagation: HostToContainer + name: host-sbin + - mountPath: /host/sys + mountPropagation: HostToContainer + name: host-sys + - mountPath: /host/proc + mountPropagation: HostToContainer + name: host-proc + - mountPath: /host/etc + mountPropagation: HostToContainer + name: host-etc + - mountPath: /host/usr + mountPropagation: HostToContainer + name: host-usr + - mountPath: /host/lib + mountPropagation: HostToContainer + name: host-lib + - mountPath: /host/lib64 + mountPropagation: HostToContainer + name: host-lib64 + - mountPath: /host/dev + mountPropagation: HostToContainer + name: host-dev + - mountPath: /host/var + mountPropagation: HostToContainer + name: host-var + - mountPath: /host/run + mountPropagation: HostToContainer + name: host-run + - mountPath: /host/tuner_state.yaml + name: host-tuner-state + - mountPath: /host/redpanda_etc + name: base-config + - mountPath: /host/var/lib/redpanda/data + name: datadir + - command: + - /bin/bash + - -c + - trap "exit 0" TERM; exec $CONFIGURATOR_SCRIPT "${SERVICE_NAME}" "${KUBERNETES_NODE_NAME}" + & wait $! + env: + - name: CONFIGURATOR_SCRIPT + value: /etc/secrets/configurator/scripts/configurator.sh + - name: SERVICE_NAME + valueFrom: + configMapKeyRef: null + fieldRef: + fieldPath: metadata.name + resourceFieldRef: null + secretKeyRef: null + - name: KUBERNETES_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: HOST_IP_ADDRESS + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: status.hostIP + image: docker.redpanda.com/redpandadata/redpanda:v26.1.1 + name: redpanda-configurator + resources: {} + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/tls/certs/default + name: redpanda-default-cert + - mountPath: /etc/tls/certs/external + name: redpanda-external-cert + - mountPath: /etc/redpanda + name: config + - mountPath: /tmp/base-config + name: base-config + - mountPath: /etc/secrets/configurator/scripts/ + name: redpanda-configurator + - command: + - /redpanda-operator + - bootstrap + - --in-dir + - /tmp/base-config + - --out-dir + - /tmp/config + env: null + image: docker.redpanda.com/redpandadata/redpanda-operator:v26.2.1-beta.2 + name: bootstrap-yaml-envsubst + resources: + limits: + cpu: 100m + memory: 125Mi + requests: + cpu: 100m + memory: 125Mi + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + volumeMounts: + - mountPath: /tmp/config/ + name: config + - mountPath: /tmp/base-config/ + name: base-config + nodeSelector: {} + priorityClassName: "" + securityContext: + fsGroup: 101 + fsGroupChangePolicy: OnRootMismatch + runAsUser: 101 + serviceAccountName: redpanda + terminationGracePeriodSeconds: 90 + tolerations: [] + topologySpreadConstraints: + - labelSelector: + matchLabels: + app.kubernetes.io/component: redpanda-statefulset + app.kubernetes.io/instance: redpanda + app.kubernetes.io/name: redpanda + maxSkew: 1 + topologyKey: topology.kubernetes.io/zone + whenUnsatisfiable: ScheduleAnyway + volumes: + - name: redpanda-default-cert + secret: + defaultMode: 288 + secretName: redpanda-default-cert + - name: redpanda-external-cert + secret: + defaultMode: 288 + secretName: redpanda-external-cert + - name: lifecycle-scripts + secret: + defaultMode: 509 + secretName: redpanda-sts-lifecycle + - configMap: + name: redpanda + name: base-config + - emptyDir: {} + name: config + - name: redpanda-configurator + secret: + defaultMode: 509 + secretName: redpanda-configurator + - name: datadir + persistentVolumeClaim: + claimName: datadir + - name: kube-api-access + projected: + defaultMode: 420 + sources: + - serviceAccountToken: + expirationSeconds: 3607 + path: token + - configMap: + items: + - key: ca.crt + path: ca.crt + name: kube-root-ca.crt + - downwardAPI: + items: + - fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + path: namespace + - hostPath: + path: /bin + type: DirectoryOrCreate + name: host-bin + - hostPath: + path: /sbin + type: DirectoryOrCreate + name: host-sbin + - hostPath: + path: /sys + type: DirectoryOrCreate + name: host-sys + - hostPath: + path: /proc + type: DirectoryOrCreate + name: host-proc + - hostPath: + path: /etc + type: DirectoryOrCreate + name: host-etc + - hostPath: + path: /usr + type: DirectoryOrCreate + name: host-usr + - hostPath: + path: /lib + type: DirectoryOrCreate + name: host-lib + - hostPath: + path: /lib64 + type: DirectoryOrCreate + name: host-lib64 + - hostPath: + path: /dev + type: DirectoryOrCreate + name: host-dev + - hostPath: + path: /var + type: DirectoryOrCreate + name: host-var + - hostPath: + path: /run + type: DirectoryOrCreate + name: host-run + - hostPath: + path: /var/run/redpanda_node_tuner_state.yaml + type: FileOrCreate + name: host-tuner-state + updateStrategy: + type: RollingUpdate + volumeClaimTemplates: + - metadata: + annotations: null + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/name: redpanda + name: datadir + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 20Gi + status: {} +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda-default-root-certificate + namespace: default +spec: + commonName: redpanda-default-root-certificate + duration: 43800h0m0s + isCA: true + issuerRef: + group: cert-manager.io + kind: Issuer + name: redpanda-default-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 + secretName: redpanda-default-root-certificate +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda-external-root-certificate + namespace: default +spec: + commonName: redpanda-external-root-certificate + duration: 43800h0m0s + isCA: true + issuerRef: + group: cert-manager.io + kind: Issuer + name: redpanda-external-selfsigned-issuer + privateKey: + algorithm: ECDSA + size: 256 + secretName: redpanda-external-root-certificate +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda-default-cert + namespace: default +spec: + dnsNames: + - redpanda-cluster.redpanda.default.svc.cluster.local + - redpanda-cluster.redpanda.default.svc + - redpanda-cluster.redpanda.default + - '*.redpanda-cluster.redpanda.default.svc.cluster.local' + - '*.redpanda-cluster.redpanda.default.svc' + - '*.redpanda-cluster.redpanda.default' + - redpanda.default.svc.cluster.local + - redpanda.default.svc + - redpanda.default + - '*.redpanda.default.svc.cluster.local' + - '*.redpanda.default.svc' + - '*.redpanda.default' + duration: 43800h0m0s + isCA: false + issuerRef: + group: cert-manager.io + kind: Issuer + name: redpanda-default-root-issuer + privateKey: + algorithm: ECDSA + size: 256 + secretName: redpanda-default-cert +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda-external-cert + namespace: default +spec: + dnsNames: + - redpanda-cluster.redpanda.default.svc.cluster.local + - redpanda-cluster.redpanda.default.svc + - redpanda-cluster.redpanda.default + - '*.redpanda-cluster.redpanda.default.svc.cluster.local' + - '*.redpanda-cluster.redpanda.default.svc' + - '*.redpanda-cluster.redpanda.default' + - redpanda.default.svc.cluster.local + - redpanda.default.svc + - redpanda.default + - '*.redpanda.default.svc.cluster.local' + - '*.redpanda.default.svc' + - '*.redpanda.default' + duration: 43800h0m0s + isCA: false + issuerRef: + group: cert-manager.io + kind: Issuer + name: redpanda-external-root-issuer + privateKey: + algorithm: ECDSA + size: 256 + secretName: redpanda-external-cert +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda-default-selfsigned-issuer + namespace: default +spec: + selfSigned: {} +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda-default-root-issuer + namespace: default +spec: + ca: + secretName: redpanda-default-root-certificate +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda-external-selfsigned-issuer + namespace: default +spec: + selfSigned: {} +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda-external-root-issuer + namespace: default +spec: + ca: + secretName: redpanda-external-root-certificate +--- +# Source: redpanda/templates/entry-point.yaml +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + helm.sh/hook: post-install,post-upgrade + helm.sh/hook-delete-policy: before-hook-creation + helm.sh/hook-weight: "-5" + labels: + app.kubernetes.io/component: redpanda + app.kubernetes.io/instance: redpanda + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: redpanda + helm.sh/chart: redpanda-26.1.1 + name: redpanda-configuration + namespace: default +spec: + template: + metadata: + annotations: {} + generateName: redpanda-post- + labels: + app.kubernetes.io/component: redpanda-post-install + app.kubernetes.io/instance: redpanda + app.kubernetes.io/name: redpanda-configuration + spec: + automountServiceAccountToken: false + containers: + - command: + - /redpanda-operator + - sync-cluster-config + - --users-directory + - /etc/secrets/users + - --redpanda-yaml + - /tmp/base-config/redpanda.yaml + - --bootstrap-yaml + - /tmp/config/.bootstrap.yaml + env: null + image: docker.redpanda.com/redpandadata/redpanda-operator:v26.2.1-beta.2 + name: post-install + resources: {} + securityContext: {} + volumeMounts: + - mountPath: /etc/tls/certs/default + name: redpanda-default-cert + - mountPath: /etc/tls/certs/external + name: redpanda-external-cert + - mountPath: /tmp/config + name: config + - mountPath: /tmp/base-config + name: base-config + imagePullSecrets: [] + initContainers: + - command: + - /redpanda-operator + - bootstrap + - --in-dir + - /tmp/base-config + - --out-dir + - /tmp/config + env: null + image: docker.redpanda.com/redpandadata/redpanda-operator:v26.2.1-beta.2 + name: bootstrap-yaml-envsubst + resources: + limits: + cpu: 100m + memory: 125Mi + requests: + cpu: 100m + memory: 125Mi + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + volumeMounts: + - mountPath: /tmp/config/ + name: config + - mountPath: /tmp/base-config/ + name: base-config + nodeSelector: {} + restartPolicy: Never + securityContext: + fsGroup: 101 + fsGroupChangePolicy: OnRootMismatch + runAsUser: 101 + serviceAccountName: redpanda + tolerations: [] + volumes: + - name: redpanda-default-cert + secret: + defaultMode: 288 + secretName: redpanda-default-cert + - name: redpanda-external-cert + secret: + defaultMode: 288 + secretName: redpanda-external-cert + - configMap: + name: redpanda + name: base-config + - emptyDir: {} + name: config diff --git a/charts/redpanda/testdata/template-cases.txtar b/charts/redpanda/testdata/template-cases.txtar index 957eb26bf..4d4867d26 100644 --- a/charts/redpanda/testdata/template-cases.txtar +++ b/charts/redpanda/testdata/template-cases.txtar @@ -1387,4 +1387,13 @@ listeners: # ASSERT-VALID-RPK-CONFIGURATION config: cluster: - cloud_storage_enable_remote_read: false \ No newline at end of file + cloud_storage_enable_remote_read: false + +-- tuning-host-mode -- +# ASSERT-NO-ERROR +# ASSERT-GOLDEN +# Verifies that tuning.apply_host_tuners=true produces the chroot-based +# tuning init container with host bind mounts. See K8S-101 / CORE-13685. +tuning: + tune_aio_events: true + apply_host_tuners: true diff --git a/charts/redpanda/values.go b/charts/redpanda/values.go index 9648d847b..4346f225d 100644 --- a/charts/redpanda/values.go +++ b/charts/redpanda/values.go @@ -908,6 +908,52 @@ type Tuning struct { BallastFilePath string `json:"ballast_file_path,omitempty"` BallastFileSize string `json:"ballast_file_size,omitempty"` WellKnownIO string `json:"well_known_io,omitempty"` + // ApplyHostTuners enables the chroot-based tuning path. When true, the + // tuning init container builds a chroot to the host filesystem and runs + // `rpk redpanda tune all` in the host's network namespace, so tuners + // that need /sys, /proc, host NICs, or host block devices can actually + // apply (disk_irq, disk_scheduler, disk_nomerges, net, ...). When false + // (the default), only the small set of tuners that can run inside a + // container are applied (aio_events, swappiness, THP, etc.). + // + // To save users from a two-step config (set ApplyHostTuners AND remember + // to flip each of the host-mode tune flags via config.rpk.tune_*), + // turning this on default-enables the tuners the chroot path exists + // to fix: + // - tune_disk_irq + // - tune_disk_scheduler + // - tune_disk_nomerges + // - tune_network + // - tune_fstrim: rpk starts (or installs) a weekly fstrim systemd + // timer via the host's systemd. In-pod this fails ("dial unix + // /run/systemd/private"); in the chroot the host's /run and /etc + // are bind-mounted, so the D-Bus call reaches the host's PID 1 and + // unit files land in the host's real /etc/systemd/system. + // - tune_disk_write_cache: GCP-only (write-through cache on + // /sys/class/block). In-pod /sys is read-only; the chroot makes it + // writable. rpk explicitly exempts this tuner from its + // enabled-but-unsupported exit(1) on non-GCP clouds, so leaving it + // on everywhere is safe (it reports SUPPORTED=false and is skipped). + // - tune_cpu: sets cpufreq governor to performance. A no-op reported + // as applied on VMs without cpufreq sysfs (most cloud instance + // types); does real work on metal instance types. + // The set is unconditional — the chart's RPK config merge is first-arg- + // wins, so a user setting `config.rpk.tune_disk_irq: false` alongside + // `apply_host_tuners: true` will see the chart's `true` win. Users who + // want apply_host_tuners off for any of those tuners should leave + // ApplyHostTuners false and wire host tuning via their own DaemonSet. + // + // Enabling this requires the same security posture as TuneAIOEvents + // (privileged container, hostPath volumes). On OpenShift, the pod's + // ServiceAccount must be bound to a SCC that allows `hostPath` volumes + // and `privileged: true` (the built-in `privileged` SCC works). On + // Pod Security Admission clusters, the namespace must be labeled + // `privileged`. + // + // This setting must NOT be combined with running multiple Redpanda + // pods per node — concurrent tuners will race on the same kernel + // parameters. Use a pod anti-affinity rule that disallows co-location. + ApplyHostTuners bool `json:"apply_host_tuners,omitempty"` } func (t *Tuning) Translate() map[string]any { @@ -924,6 +970,31 @@ func (t *Tuning) Translate() map[string]any { result[k] = v } + // Whole point of ApplyHostTuners is to make the rpk tuners that need + // host /sys, /proc, NICs and block devices actually fire. Those tuners + // are gated by per-tuner flags in the rpk section of redpanda.yaml, not + // by ApplyHostTuners itself — so flipping just ApplyHostTuners renders + // the chroot init container but `rpk redpanda tune all` runs it against + // a config where only tune_aio_events is true (the only host-mode- + // relevant flag exposed at the top level). Default-enable the tuners + // that motivate this feature. See the ApplyHostTuners doc comment for + // per-tuner rationale; the invariant for membership in this list is + // "only works (or only does real work) via the chroot path, and cannot + // crashloop the init container on hosts that lack the feature". + if t.ApplyHostTuners { + for _, k := range []string{ + "tune_disk_irq", + "tune_disk_scheduler", + "tune_disk_nomerges", + "tune_network", + "tune_fstrim", + "tune_disk_write_cache", + "tune_cpu", + } { + result[k] = true + } + } + return result } diff --git a/charts/redpanda/values_partial.gen.go b/charts/redpanda/values_partial.gen.go index 4dd6b36ea..523f6bee7 100644 --- a/charts/redpanda/values_partial.gen.go +++ b/charts/redpanda/values_partial.gen.go @@ -226,6 +226,7 @@ type PartialTuning struct { BallastFilePath *string "json:\"ballast_file_path,omitempty\"" BallastFileSize *string "json:\"ballast_file_size,omitempty\"" WellKnownIO *string "json:\"well_known_io,omitempty\"" + ApplyHostTuners *bool "json:\"apply_host_tuners,omitempty\"" } type PartialListeners struct { diff --git a/operator/api/applyconfiguration/redpanda/v1alpha2/stretchtuning.go b/operator/api/applyconfiguration/redpanda/v1alpha2/stretchtuning.go index 1c05290fb..28d1b6381 100644 --- a/operator/api/applyconfiguration/redpanda/v1alpha2/stretchtuning.go +++ b/operator/api/applyconfiguration/redpanda/v1alpha2/stretchtuning.go @@ -20,6 +20,7 @@ type StretchTuningApplyConfiguration struct { TuneBallastFile *bool `json:"tune_ballast_file,omitempty"` TuneClockSource *bool `json:"tune_clocksource,omitempty"` WellKnownIo *string `json:"well_known_io,omitempty"` + ApplyHostTuners *bool `json:"apply_host_tuners,omitempty"` } // StretchTuningApplyConfiguration constructs a declarative configuration of the StretchTuning type for use with @@ -75,3 +76,11 @@ func (b *StretchTuningApplyConfiguration) WithWellKnownIo(value string) *Stretch b.WellKnownIo = &value return b } + +// WithApplyHostTuners sets the ApplyHostTuners field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the ApplyHostTuners field is set to the value of the last call. +func (b *StretchTuningApplyConfiguration) WithApplyHostTuners(value bool) *StretchTuningApplyConfiguration { + b.ApplyHostTuners = &value + return b +} diff --git a/operator/api/applyconfiguration/redpanda/v1alpha2/tuning.go b/operator/api/applyconfiguration/redpanda/v1alpha2/tuning.go index 7de6dbe18..5ca3f09cd 100644 --- a/operator/api/applyconfiguration/redpanda/v1alpha2/tuning.go +++ b/operator/api/applyconfiguration/redpanda/v1alpha2/tuning.go @@ -26,6 +26,7 @@ type TuningApplyConfiguration struct { TuneBallastFile *bool `json:"tune_ballast_file,omitempty"` TuneClockSource *bool `json:"tune_clocksource,omitempty"` WellKnownIo *string `json:"well_known_io,omitempty"` + ApplyHostTuners *bool `json:"apply_host_tuners,omitempty"` } // TuningApplyConfiguration constructs a declarative configuration of the Tuning type for use with @@ -97,3 +98,11 @@ func (b *TuningApplyConfiguration) WithWellKnownIo(value string) *TuningApplyCon b.WellKnownIo = &value return b } + +// WithApplyHostTuners sets the ApplyHostTuners field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the ApplyHostTuners field is set to the value of the last call. +func (b *TuningApplyConfiguration) WithApplyHostTuners(value bool) *TuningApplyConfiguration { + b.ApplyHostTuners = &value + return b +} diff --git a/operator/api/redpanda/v1alpha2/redpanda_clusterspec_types.go b/operator/api/redpanda/v1alpha2/redpanda_clusterspec_types.go index 7bad7524b..163b1b0aa 100644 --- a/operator/api/redpanda/v1alpha2/redpanda_clusterspec_types.go +++ b/operator/api/redpanda/v1alpha2/redpanda_clusterspec_types.go @@ -953,6 +953,14 @@ type Tuning struct { TuneClockSource *bool `json:"tune_clocksource,omitempty"` // Specifies the vendor, VM type, and storage device type that Redpanda runs on, in the format ::. This hints to Redpanda which configuration values it should use for the Redpanda IO scheduler. WellKnownIo *string `json:"well_known_io,omitempty"` + // ApplyHostTuners enables a chroot-based tuning init container that + // gives `rpk redpanda tune all` access to the host's /sys, /proc, + // NICs and block devices so tuners like disk_irq, disk_scheduler, + // disk_nomerges and net actually apply. Requires `tune_aio_events`. + // Opt-in: defaults to false. Enabling requires a privileged SCC/PSA + // on the namespace and MUST be combined with one-pod-per-node + // anti-affinity to avoid kernel-parameter races. + ApplyHostTuners *bool `json:"apply_host_tuners,omitempty"` } func (t *Tuning) GetResources() *corev1.ResourceRequirements { diff --git a/operator/api/redpanda/v1alpha2/stretch_cluster_types.go b/operator/api/redpanda/v1alpha2/stretch_cluster_types.go index e7ab97203..098c5e93b 100644 --- a/operator/api/redpanda/v1alpha2/stretch_cluster_types.go +++ b/operator/api/redpanda/v1alpha2/stretch_cluster_types.go @@ -169,6 +169,10 @@ type StretchTuning struct { TuneClockSource *bool `json:"tune_clocksource,omitempty"` // Specifies the vendor, VM type, and storage device type that Redpanda runs on, in the format ::. WellKnownIo *string `json:"well_known_io,omitempty"` + // ApplyHostTuners enables a chroot-based tuning init container that + // gives `rpk redpanda tune all` access to the host's /sys, /proc, + // NICs and block devices. See `Tuning.ApplyHostTuners`. + ApplyHostTuners *bool `json:"apply_host_tuners,omitempty"` } // StretchStorage configures storage for stretch clusters. diff --git a/operator/api/redpanda/v1alpha2/testdata/crd-docs.adoc b/operator/api/redpanda/v1alpha2/testdata/crd-docs.adoc index e5a0fedf2..4876016cc 100644 --- a/operator/api/redpanda/v1alpha2/testdata/crd-docs.adoc +++ b/operator/api/redpanda/v1alpha2/testdata/crd-docs.adoc @@ -5319,6 +5319,13 @@ Tuning configures settings for the autotuner tool in Redpanda. The autotuner ide | *`tune_ballast_file`* __boolean__ | Specifies whether to create the ballast file. + | | | *`tune_clocksource`* __boolean__ | Specifies whether to synchronize NTP. + | | | *`well_known_io`* __string__ | Specifies the vendor, VM type, and storage device type that Redpanda runs on, in the format ::. This hints to Redpanda which configuration values it should use for the Redpanda IO scheduler. + | | +| *`apply_host_tuners`* __boolean__ | ApplyHostTuners enables a chroot-based tuning init container that + +gives `rpk redpanda tune all` access to the host's /sys, /proc, + +NICs and block devices so tuners like disk_irq, disk_scheduler, + +disk_nomerges and net actually apply. Requires `tune_aio_events`. + +Opt-in: defaults to false. Enabling requires a privileged SCC/PSA + +on the namespace and MUST be combined with one-pod-per-node + +anti-affinity to avoid kernel-parameter races. + | | |=== diff --git a/operator/api/redpanda/v1alpha2/zz_generated.deepcopy.go b/operator/api/redpanda/v1alpha2/zz_generated.deepcopy.go index faf036da9..55bd266b8 100644 --- a/operator/api/redpanda/v1alpha2/zz_generated.deepcopy.go +++ b/operator/api/redpanda/v1alpha2/zz_generated.deepcopy.go @@ -7074,6 +7074,11 @@ func (in *StretchTuning) DeepCopyInto(out *StretchTuning) { *out = new(string) **out = **in } + if in.ApplyHostTuners != nil { + in, out := &in.ApplyHostTuners, &out.ApplyHostTuners + *out = new(bool) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StretchTuning. @@ -7604,6 +7609,11 @@ func (in *Tuning) DeepCopyInto(out *Tuning) { *out = new(string) **out = **in } + if in.ApplyHostTuners != nil { + in, out := &in.ApplyHostTuners, &out.ApplyHostTuners + *out = new(bool) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Tuning. diff --git a/operator/config/crd/bases/cluster.redpanda.com_redpandas.yaml b/operator/config/crd/bases/cluster.redpanda.com_redpandas.yaml index afe89356b..b369662d2 100644 --- a/operator/config/crd/bases/cluster.redpanda.com_redpandas.yaml +++ b/operator/config/crd/bases/cluster.redpanda.com_redpandas.yaml @@ -22946,6 +22946,16 @@ spec: in the container and optimizes the Linux kernel to give you the best performance. properties: + apply_host_tuners: + description: |- + ApplyHostTuners enables a chroot-based tuning init container that + gives `rpk redpanda tune all` access to the host's /sys, /proc, + NICs and block devices so tuners like disk_irq, disk_scheduler, + disk_nomerges and net actually apply. Requires `tune_aio_events`. + Opt-in: defaults to false. Enabling requires a privileged SCC/PSA + on the namespace and MUST be combined with one-pod-per-node + anti-affinity to avoid kernel-parameter races. + type: boolean ballast_file_path: description: Specifies the file path for ballast file. A ballast file is an empty file that takes up disk @@ -33587,6 +33597,16 @@ spec: The autotuner identifies the hardware configuration in the container and optimizes the Linux kernel to give you the best performance. properties: + apply_host_tuners: + description: |- + ApplyHostTuners enables a chroot-based tuning init container that + gives `rpk redpanda tune all` access to the host's /sys, /proc, + NICs and block devices so tuners like disk_irq, disk_scheduler, + disk_nomerges and net actually apply. Requires `tune_aio_events`. + Opt-in: defaults to false. Enabling requires a privileged SCC/PSA + on the namespace and MUST be combined with one-pod-per-node + anti-affinity to avoid kernel-parameter races. + type: boolean ballast_file_path: description: Specifies the file path for ballast file. A ballast file is an empty file that takes up disk space. If Redpanda @@ -56897,6 +56917,16 @@ spec: in the container and optimizes the Linux kernel to give you the best performance. properties: + apply_host_tuners: + description: |- + ApplyHostTuners enables a chroot-based tuning init container that + gives `rpk redpanda tune all` access to the host's /sys, /proc, + NICs and block devices so tuners like disk_irq, disk_scheduler, + disk_nomerges and net actually apply. Requires `tune_aio_events`. + Opt-in: defaults to false. Enabling requires a privileged SCC/PSA + on the namespace and MUST be combined with one-pod-per-node + anti-affinity to avoid kernel-parameter races. + type: boolean ballast_file_path: description: Specifies the file path for ballast file. A ballast file is an empty file that takes up disk @@ -67538,6 +67568,16 @@ spec: The autotuner identifies the hardware configuration in the container and optimizes the Linux kernel to give you the best performance. properties: + apply_host_tuners: + description: |- + ApplyHostTuners enables a chroot-based tuning init container that + gives `rpk redpanda tune all` access to the host's /sys, /proc, + NICs and block devices so tuners like disk_irq, disk_scheduler, + disk_nomerges and net actually apply. Requires `tune_aio_events`. + Opt-in: defaults to false. Enabling requires a privileged SCC/PSA + on the namespace and MUST be combined with one-pod-per-node + anti-affinity to avoid kernel-parameter races. + type: boolean ballast_file_path: description: Specifies the file path for ballast file. A ballast file is an empty file that takes up disk space. If Redpanda diff --git a/operator/config/crd/bases/cluster.redpanda.com_stretchclusters.yaml b/operator/config/crd/bases/cluster.redpanda.com_stretchclusters.yaml index 5512f5e98..a2be6c52c 100644 --- a/operator/config/crd/bases/cluster.redpanda.com_stretchclusters.yaml +++ b/operator/config/crd/bases/cluster.redpanda.com_stretchclusters.yaml @@ -704,6 +704,12 @@ spec: tuning: description: Defines settings for the autotuner tool in Redpanda. properties: + apply_host_tuners: + description: |- + ApplyHostTuners enables a chroot-based tuning init container that + gives `rpk redpanda tune all` access to the host's /sys, /proc, + NICs and block devices. See `Tuning.ApplyHostTuners`. + type: boolean ballast_file_path: description: Specifies the file path for ballast file. type: string