Yan Bondarenko
fe59a6bf91
The hourly defrag CronJob runs etcd-defrag with its defaults, which compact to the latest revision before defragmenting. Every cluster already compacts itself with a periodic five-minute retention, so the second compaction either fails with "required revision has been compacted" when nothing was written since, or drops the history that retention keeps for watchers to resume from. The same defaults evaluate dbQuotaUsage in the defrag rule against 2 GiB rather than the quotaBackendBytes the cluster runs with, so the 80 percent threshold fires at a different database size than intended. Assisted-by: LLM Signed-off-by: Yan Bondarenko <202671653+yankawai@users.noreply.github.com>
Etcd-cluster
This chart renders an EtcdCluster (etcd-operator.cozystack.io/v1alpha2)
managed by the cozystack etcd-operator, plus the cert-manager CA chain and a
Kamaji DataStore. TLS uses secretRef mode: this chart's own cert-manager
Certificate resources issue the server, operator-client and peer certs from
the etcd-issuer / etcd-peer-issuer CA Issuers, and the EtcdCluster only
references the resulting Secrets via serverSecretRef /
operatorClientSecretRef / peer.secretRef (the operator itself mints
nothing). This is deliberate: spec.tls is immutable in v1alpha2 and
etcd-migrate adopts legacy clusters into exactly this secretRef shape, so the
chart must match it or every post-adoption reconcile is rejected. etcd runs
cert-only (--client-cert-auth, no password auth); consumers authenticate by
presenting a commonName=root client cert (etcd-client-tls) signed by the
same CA.
Backups
Backups are driven by the Cozystack BackupClass flow: a BackupJob /
RestoreJob against the Etcd strategy (strategy.backups.cozystack.io/v1alpha1).
See examples/backups/etcd/ for the end-to-end demo and
internal/backupcontroller/etcdstrategy_controller.go for the driver. The
driver materialises one EtcdSnapshot (etcd-operator.cozystack.io/v1alpha2)
per BackupJob; restore is in-place (the driver suspends this chart's
HelmRelease, deletes the live EtcdCluster, and re-creates it with
spec.bootstrap.restore.source.s3 populated from the Backup artefact's
coordinates).
The legacy
backup.*values block and theEtcdBackupScheduleCRD no longer exist under the v1alpha2 operator — scheduled backups are expressed as aBackupClass/Planinstead.
Parameters
Common parameters
| Name | Description | Type | Value |
|---|---|---|---|
version |
etcd version (X.Y.Z) to run, set on the EtcdCluster's spec.version; the operator pulls etcd from its own configured image. | string |
3.6.11 |
size |
Persistent Volume size. | quantity |
4Gi |
storageClass |
StorageClass used to store the data. | string |
"" |
replicas |
Number of etcd replicas. | int |
3 |
resources |
Resource configuration for etcd. | object |
{} |
resources.cpu |
Number of CPU cores allocated. | quantity |
1000m |
resources.memory |
Amount of memory allocated. | quantity |
512Mi |
affinity |
Affinity rules set verbatim on the EtcdCluster's spec.affinity, replacing the chart default. When left empty the chart applies a soft (preferred) podAntiAffinity that spreads members across nodes by kubernetes.io/hostname on a best-effort basis, so a single node failure is less likely to take out more than one member. The default is intentionally soft: a hard rule would leave a member Pending when there are fewer schedulable nodes than replicas, or when node-local storage pins a member to a node. Set a hard requiredDuringSchedulingIgnoredDuringExecution rule here to forbid co-location outright (only on clusters with enough nodes and non-node-pinned storage). Note that the operator applies affinity only when it creates or replaces a member Pod and does not reschedule running members, so on a cluster that already has co-located members the rule takes effect only as each member is replaced, not retroactively. | object |
{} |