mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 22:13:18 +09:00
Alexey Artamonov
9f857f64e1
users[].password is gone from the chart, its schema and the API type. Every password, root included, is generated into <release>-credentials and kept across reconciles by lookup, and a password left in values is ignored. An upgrade that finds no credentials Secret fails instead of minting new passwords, because mariadb-operator applies root only at datadir bootstrap and would advertise a root it never set. The Secret carries k8s.mariadb.com/watch so the operator applies a changed password without waiting for its requeue interval. A username or database name becomes a Secret key and a resource name, so render-time guards reject a name outside the DNS-1123 rule or past its limit: 80 for a username, as the User CRD allows, and 64 for a database, as the server allows. Names that differ only in "_" and "-" collide on one resource; that is rejected on install only, since an existing release already applied the overwrite. A user in both admin and readonly of a database keeps a single ALL grant under the unchanged Grant name, because renaming a Grant makes the operator revoke the live privilege. A role member past 128 characters, the server's account-name limit, and a database name of 65-80 characters, which the Database CRD accepts but the server does not, are rejected on install and on upgrade only when their Grant or Database does not exist yet, so a release that already applied one keeps upgrading. User CR names and keys are quoted so a username that reads as a YAML scalar stays a string. Signed-off-by: Alexey Artamonov <aleksei.artamonov@aenix.io>
267 lines
8.3 KiB
JSON
267 lines
8.3 KiB
JSON
{
|
|
"title": "Chart Values",
|
|
"type": "object",
|
|
"properties": {
|
|
"replicas": {
|
|
"description": "Number of MariaDB replicas.",
|
|
"type": "integer",
|
|
"default": 2
|
|
},
|
|
"resources": {
|
|
"description": "Explicit CPU and memory configuration for each MariaDB replica. When omitted, the preset defined in `resourcesPreset` is applied.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"cpu": {
|
|
"description": "CPU available to each replica.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
},
|
|
"memory": {
|
|
"description": "Memory (RAM) available to each replica.",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
}
|
|
}
|
|
},
|
|
"resourcesPreset": {
|
|
"description": "Default sizing preset used when `resources` is omitted.",
|
|
"type": "string",
|
|
"default": "t1.nano",
|
|
"enum": [
|
|
"t1.nano",
|
|
"t1.micro",
|
|
"t1.small",
|
|
"t1.medium",
|
|
"t1.large",
|
|
"t1.xlarge",
|
|
"t1.2xlarge",
|
|
"t1.4xlarge",
|
|
"c1.nano",
|
|
"c1.micro",
|
|
"c1.small",
|
|
"c1.medium",
|
|
"c1.large",
|
|
"c1.xlarge",
|
|
"c1.2xlarge",
|
|
"c1.4xlarge",
|
|
"s1.nano",
|
|
"s1.micro",
|
|
"s1.small",
|
|
"s1.medium",
|
|
"s1.large",
|
|
"s1.xlarge",
|
|
"s1.2xlarge",
|
|
"s1.4xlarge",
|
|
"u1.nano",
|
|
"u1.micro",
|
|
"u1.small",
|
|
"u1.medium",
|
|
"u1.large",
|
|
"u1.xlarge",
|
|
"u1.2xlarge",
|
|
"u1.4xlarge",
|
|
"m1.nano",
|
|
"m1.micro",
|
|
"m1.small",
|
|
"m1.medium",
|
|
"m1.large",
|
|
"m1.xlarge",
|
|
"m1.2xlarge",
|
|
"m1.4xlarge",
|
|
"nano",
|
|
"micro",
|
|
"small",
|
|
"medium",
|
|
"large",
|
|
"xlarge",
|
|
"2xlarge"
|
|
]
|
|
},
|
|
"size": {
|
|
"description": "Persistent Volume Claim size available for application data.",
|
|
"default": "10Gi",
|
|
"pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"x-kubernetes-int-or-string": true
|
|
},
|
|
"storageClass": {
|
|
"description": "StorageClass used to store the data.",
|
|
"type": "string",
|
|
"default": "",
|
|
"x-kubernetes-validations": [
|
|
{
|
|
"rule": "self == oldSelf",
|
|
"message": "storageClass is immutable"
|
|
}
|
|
],
|
|
"x-cozystack-options": {
|
|
"source": "storageclass"
|
|
}
|
|
},
|
|
"external": {
|
|
"description": "Enable external access from outside the cluster.",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"tls": {
|
|
"description": "TLS configuration. Selects who issues the certificates and whether plaintext is refused; TLS itself is always served.",
|
|
"type": "object",
|
|
"default": {},
|
|
"properties": {
|
|
"issuer": {
|
|
"description": "Who issues the server certificate: `operator` uses the CA mariadb-operator manages itself, `cert-manager` gives the instance its own CA and is what covers the external hostname. Named for the issuer because TLS is served under both, unlike the similarly-spelled `tls.enabled` in some other charts, which does switch TLS on and off.",
|
|
"type": "string",
|
|
"default": "operator",
|
|
"enum": [
|
|
"operator",
|
|
"cert-manager"
|
|
]
|
|
},
|
|
"required": {
|
|
"description": "Refuse plaintext connections (sets MariaDB require_secure_transport=ON). Applies under either issuer. Opt-in: turn it on once every client connects over TLS, since it disconnects those that do not.",
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
},
|
|
"version": {
|
|
"description": "MariaDB major.minor version to deploy",
|
|
"type": "string",
|
|
"default": "v11.8",
|
|
"enum": [
|
|
"v11.8",
|
|
"v11.4",
|
|
"v10.11",
|
|
"v10.6"
|
|
]
|
|
},
|
|
"users": {
|
|
"description": "Users configuration map. Passwords (including the `root` account) are always auto-generated and stored in the `\u003crelease\u003e-credentials` Secret; they cannot be set from values — read a user's password from that Secret. A `password` left over in values from before the field was removed is ignored by the render and draws an admission warning, but it is not inert on an upgraded release: the chart preserves whatever password is already in the Secret, which on the first upgrade is the value that was set before removal, so that value stays the live credential until it is rotated (dedicated rotation is tracked in cozystack/community#72). The live password lives only in the Secret.",
|
|
"type": "object",
|
|
"default": {},
|
|
"additionalProperties": {
|
|
"type": "object",
|
|
"required": [
|
|
"maxUserConnections"
|
|
],
|
|
"properties": {
|
|
"maxUserConnections": {
|
|
"description": "Maximum number of connections.",
|
|
"type": "integer"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"databases": {
|
|
"description": "Databases configuration map.",
|
|
"type": "object",
|
|
"default": {},
|
|
"additionalProperties": {
|
|
"type": "object",
|
|
"properties": {
|
|
"roles": {
|
|
"description": "Roles assigned to users.",
|
|
"type": "object",
|
|
"properties": {
|
|
"admin": {
|
|
"description": "List of users with admin privileges.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"readonly": {
|
|
"description": "List of users with read-only privileges.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"backup": {
|
|
"description": "DEPRECATED: Backup configuration. Prefer the BackupClass / Plan flow under examples/backups/mariadb/.",
|
|
"type": "object",
|
|
"default": {},
|
|
"required": [
|
|
"cleanupStrategy",
|
|
"enabled",
|
|
"resticPassword",
|
|
"s3AccessKey",
|
|
"s3Bucket",
|
|
"s3Region",
|
|
"s3SecretKey",
|
|
"schedule"
|
|
],
|
|
"properties": {
|
|
"cleanupStrategy": {
|
|
"description": "DEPRECATED: Retention strategy for cleaning up old backups.",
|
|
"type": "string",
|
|
"default": "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
|
|
},
|
|
"enabled": {
|
|
"description": "DEPRECATED: Enable regular backups (default: false).",
|
|
"type": "boolean",
|
|
"default": false
|
|
},
|
|
"resticPassword": {
|
|
"description": "DEPRECATED: Password for Restic backup encryption.",
|
|
"type": "string",
|
|
"default": "\u003cpassword\u003e"
|
|
},
|
|
"s3AccessKey": {
|
|
"description": "DEPRECATED: Access key for S3 authentication.",
|
|
"type": "string",
|
|
"default": "\u003cyour-access-key\u003e"
|
|
},
|
|
"s3Bucket": {
|
|
"description": "DEPRECATED: S3 bucket used for storing backups.",
|
|
"type": "string",
|
|
"default": "s3.example.org/mariadb-backups"
|
|
},
|
|
"s3Region": {
|
|
"description": "DEPRECATED: AWS S3 region where backups are stored.",
|
|
"type": "string",
|
|
"default": "us-east-1"
|
|
},
|
|
"s3SecretKey": {
|
|
"description": "DEPRECATED: Secret key for S3 authentication.",
|
|
"type": "string",
|
|
"default": "\u003cyour-secret-key\u003e"
|
|
},
|
|
"schedule": {
|
|
"description": "DEPRECATED: Cron schedule for automated backups.",
|
|
"type": "string",
|
|
"default": "0 2 * * *"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|