{{- if eq .Values.architecture "replicaset" }} {{- $replicaCount := int .Values.replicaCount }} {{- $loadBalancerIPListLength := len .Values.externalAccess.service.loadBalancerIPs }} {{- if not (and .Values.externalAccess.enabled (not .Values.externalAccess.autoDiscovery.enabled) (not (eq $replicaCount $loadBalancerIPListLength )) (eq .Values.externalAccess.service.type "LoadBalancer")) }} apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} kind: StatefulSet metadata: name: {{ include "mongodb.fullname" . }} namespace: {{ include "mongodb.namespace" . }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: mongodb {{- if .Values.labels }} {{- include "common.tplvalues.render" (dict "value" .Values.labels "context" $) | nindent 4 }} {{- end }} {{- if .Values.annotations }} annotations: {{- include "common.tplvalues.render" (dict "value" .Values.annotations "context" $) | nindent 4 }} {{- end }} spec: serviceName: {{ include "mongodb.fullname" . }}-headless podManagementPolicy: {{ .Values.podManagementPolicy }} replicas: {{ .Values.replicaCount }} updateStrategy: type: {{ .Values.strategyType }} {{- if (eq "OnDelete" .Values.strategyType) }} rollingUpdate: null {{- end }} selector: matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} app.kubernetes.io/component: mongodb template: metadata: labels: {{- include "common.labels.standard" . | nindent 8 }} app.kubernetes.io/component: mongodb {{- if .Values.podLabels }} {{- include "common.tplvalues.render" (dict "value" .Values.podLabels "context" $) | nindent 8 }} {{- end }} {{- if or (include "mongodb.createConfigmap" .) .Values.podAnnotations }} annotations: {{- if (include "mongodb.createConfigmap" .) }} checksum/configuration: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} {{- end }} {{- if .Values.podAnnotations }} {{- include "common.tplvalues.render" (dict "value" .Values.podAnnotations "context" $) | nindent 8 }} {{- end }} {{- end }} spec: {{- include "mongodb.imagePullSecrets" . | nindent 6 }} {{- if .Values.schedulerName }} schedulerName: "{{ .Values.schedulerName }}" {{- end }} serviceAccountName: {{ template "mongodb.serviceAccountName" . }} {{- if .Values.affinity }} affinity: {{- include "common.tplvalues.render" (dict "value" .Values.affinity "context" $) | nindent 8 }} {{- else }} affinity: podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset "component" "mongodb" "context" $) | nindent 10 }} podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset "component" "mongodb" "context" $) | nindent 10 }} nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values) | nindent 10 }} {{- end }} {{- if .Values.nodeSelector }} nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.nodeSelector "context" $) | nindent 8 }} {{- end }} {{- if .Values.tolerations }} tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" $) | nindent 8 }} {{- end }} {{- if .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }} {{- end }} {{- if .Values.podSecurityContext.enabled }} securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} {{- end }} {{- if or .Values.initContainers (and .Values.volumePermissions.enabled .Values.persistence.enabled) (and .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled) .Values.tls.enabled }} initContainers: {{- if .Values.initContainers }} {{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | nindent 8 }} {{- end }} {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} - name: volume-permissions image: {{ include "mongodb.volumePermissions.image" . }} imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} command: - /bin/bash - -ec args: - | mkdir -p {{ .Values.persistence.mountPath }} {{- if and .Values.podSecurityContext.enabled .Values.containerSecurityContext.enabled }} chown -R "{{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }}" "{{ .Values.persistence.mountPath }}" {{- end }} {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} securityContext: {{- omit .Values.volumePermissions.securityContext "runAsUser" | toYaml | nindent 12 }} {{- else }} securityContext: {{- .Values.volumePermissions.securityContext | toYaml | nindent 12 }} {{- end }} {{- if .Values.volumePermissions.resources }} resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} {{- end }} volumeMounts: - name: datadir mountPath: {{ .Values.persistence.mountPath }} {{- end }} {{- if .Values.tls.enabled }} - name: generate-tls-certs image: {{ include "mongodb.tls.image" . }} imagePullPolicy: {{ .Values.tls.image.pullPolicy | quote }} env: - name: MY_POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace volumeMounts: - name: certs-volume mountPath: /certs/CAs - name: certs mountPath: /certs command: - sh - "-c" - | /bin/bash <<'EOF' my_hostname=$(hostname) svc=$(echo -n "$my_hostname" | sed s/-[0-9]*$//)-headless cp /certs/CAs/* /certs/ cat >/certs/openssl.cnf < /certs/mongodb.pem cd /certs/ shopt -s extglob rm -rf !(mongodb-ca-cert|mongodb.pem|CAs|openssl.cnf) EOF {{- end }} {{- if and .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled (eq .Values.externalAccess.service.type "LoadBalancer") }} - name: auto-discovery image: {{ include "mongodb.externalAccess.autoDiscovery.image" . }} imagePullPolicy: {{ .Values.externalAccess.autoDiscovery.image.pullPolicy | quote }} command: - /scripts/auto-discovery.sh env: - name: MY_POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: SHARED_FILE value: "/shared/info.txt" {{- if .Values.externalAccess.autoDiscovery.resources }} resources: {{- toYaml .Values.externalAccess.autoDiscovery.resources | nindent 12 }} {{- end }} volumeMounts: - name: shared mountPath: /shared - name: scripts mountPath: /scripts/auto-discovery.sh subPath: auto-discovery.sh {{- end }} {{- end }} containers: - name: mongodb image: {{ include "mongodb.image" . }} imagePullPolicy: {{ .Values.image.pullPolicy | quote }} {{- if .Values.containerSecurityContext.enabled }} securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} {{- end }} {{- if .Values.command }} command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }} {{- else }} command: - /scripts/setup.sh {{- end }} {{- if .Values.args }} args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }} {{- end }} env: - name: BITNAMI_DEBUG value: {{ ternary "true" "false" .Values.image.debug | quote }} {{- if and .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled (eq .Values.externalAccess.service.type "LoadBalancer") }} - name: SHARED_FILE value: "/shared/info.txt" {{- end }} - name: MY_POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: MY_POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: K8S_SERVICE_NAME value: "{{ include "mongodb.fullname" . }}-headless" - name: MONGODB_INITIAL_PRIMARY_HOST value: "{{ include "mongodb.fullname" . }}-0.$(K8S_SERVICE_NAME).$(MY_POD_NAMESPACE).svc.{{ .Values.clusterDomain }}" - name: MONGODB_REPLICA_SET_NAME value: {{ .Values.replicaSetName | quote }} {{- if and .Values.replicaSetHostnames (not .Values.externalAccess.enabled) }} - name: MONGODB_ADVERTISED_HOSTNAME value: "$(MY_POD_NAME).$(K8S_SERVICE_NAME).$(MY_POD_NAMESPACE).svc.{{ .Values.clusterDomain }}" {{- end }} {{- if .Values.auth.username }} - name: MONGODB_USERNAME value: {{ .Values.auth.username | quote }} {{- end }} {{- if .Values.auth.database }} - name: MONGODB_DATABASE value: {{ .Values.auth.database | quote }} {{- end }} {{- if .Values.auth.enabled }} {{- if and .Values.auth.username .Values.auth.database }} - name: MONGODB_PASSWORD valueFrom: secretKeyRef: name: {{ include "mongodb.secretName" . }} key: mongodb-password {{- end }} - name: MONGODB_ROOT_PASSWORD valueFrom: secretKeyRef: name: {{ include "mongodb.secretName" . }} key: mongodb-root-password - name: MONGODB_REPLICA_SET_KEY valueFrom: secretKeyRef: name: {{ include "mongodb.secretName" . }} key: mongodb-replica-set-key {{- end }} - name: ALLOW_EMPTY_PASSWORD value: {{ ternary "no" "yes" .Values.auth.enabled | quote }} - name: MONGODB_SYSTEM_LOG_VERBOSITY value: {{ .Values.systemLogVerbosity | quote }} - name: MONGODB_DISABLE_SYSTEM_LOG value: {{ ternary "yes" "no" .Values.disableSystemLog | quote }} - name: MONGODB_ENABLE_IPV6 value: {{ ternary "yes" "no" .Values.enableIPv6 | quote }} - name: MONGODB_ENABLE_DIRECTORY_PER_DB value: {{ ternary "yes" "no" .Values.directoryPerDB | quote }} {{- if .Values.tls.enabled }} - name: MONGODB_EXTRA_FLAGS value: --tlsMode=requireTLS --tlsCertificateKeyFile=/certs/mongodb.pem --tlsCAFile=/certs/mongodb-ca-cert {{- end }} {{- if .Values.extraFlags }} - name: MONGODB_EXTRA_FLAGS value: {{ .Values.extraFlags | join " " | quote }} {{- end }} {{- if .Values.tls.enabled }} - name: MONGODB_CLIENT_EXTRA_FLAGS value: --tls --tlsCertificateKeyFile=/certs/mongodb.pem --tlsCAFile=/certs/mongodb-ca-cert {{- end }} {{- if .Values.extraEnvVars }} {{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }} {{- end }} {{- if or .Values.extraEnvVarsCM .Values.extraEnvVarsSecret }} envFrom: {{- if .Values.extraEnvVarsCM }} - configMapRef: name: {{ tpl .Values.extraEnvVarsCM . | quote }} {{- end }} {{- if .Values.extraEnvVarsSecret }} - secretRef: name: {{ tpl .Values.extraEnvVarsSecret . | quote }} {{- end }} {{- end }} ports: - containerPort: 27017 name: mongodb {{- if .Values.livenessProbe.enabled }} livenessProbe: exec: command: - mongo {{- if .Values.tls.enabled }} - --tls - --tlsCertificateKeyFile=/certs/mongodb.pem - --tlsCAFile=/certs/mongodb-ca-cert {{- end }} - --eval - "db.adminCommand('ping')" initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.livenessProbe.periodSeconds }} timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} successThreshold: {{ .Values.livenessProbe.successThreshold }} failureThreshold: {{ .Values.livenessProbe.failureThreshold }} {{- else if .Values.customLivenessProbe }} livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }} {{- end }} {{- if .Values.readinessProbe.enabled }} readinessProbe: exec: command: - mongo {{- if .Values.tls.enabled }} - --tls - --tlsCertificateKeyFile=/certs/mongodb.pem - --tlsCAFile=/certs/mongodb-ca-cert {{- end }} - --eval - "db.adminCommand('ping')" initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.readinessProbe.periodSeconds }} timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} successThreshold: {{ .Values.readinessProbe.successThreshold }} failureThreshold: {{ .Values.readinessProbe.failureThreshold }} {{- else if .Values.customReadinessProbe }} readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }} {{- end }} {{- if .Values.resources }} resources: {{- toYaml .Values.resources | nindent 12 }} {{- end }} volumeMounts: - name: datadir mountPath: {{ .Values.persistence.mountPath }} subPath: {{ .Values.persistence.subPath }} {{- if or .Values.initdbScriptsConfigMap .Values.initdbScripts }} - name: custom-init-scripts mountPath: /docker-entrypoint-initdb.d {{- end }} {{- if or .Values.configuration .Values.existingConfigmap }} - name: config mountPath: /opt/bitnami/mongodb/conf/mongodb.conf subPath: mongodb.conf {{- end }} - name: scripts mountPath: /scripts/setup.sh subPath: setup.sh {{- if and .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled (eq .Values.externalAccess.service.type "LoadBalancer") }} - name: shared mountPath: /shared {{- end }} {{- if .Values.tls.enabled }} - name: certs mountPath: /certs {{- end }} {{- if .Values.extraVolumeMounts }} {{- toYaml .Values.extraVolumeMounts | nindent 12 }} {{- end }} {{- if .Values.metrics.enabled }} - name: metrics image: {{ template "mongodb.metrics.image" . }} imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} {{- if .Values.containerSecurityContext.enabled }} securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} {{- end }} command: - /bin/bash - -ec args: - | /bin/mongodb_exporter --mongodb.uri "{{ include "mongodb.mongodb_exporter.uri" . }}" {{ .Values.metrics.extraFlags }} env: {{- if .Values.auth.enabled }} - name: MONGODB_ROOT_PASSWORD valueFrom: secretKeyRef: name: {{ include "mongodb.secretName" . }} key: mongodb-root-password {{- end }} volumeMounts: {{- if .Values.tls.enabled }} - name: certs mountPath: /certs {{- end }} ports: - name: metrics containerPort: 9216 {{- if .Values.metrics.livenessProbe.enabled }} livenessProbe: httpGet: path: / port: metrics initialDelaySeconds: {{ .Values.metrics.livenessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.metrics.livenessProbe.periodSeconds }} timeoutSeconds: {{ .Values.metrics.livenessProbe.timeoutSeconds }} failureThreshold: {{ .Values.metrics.livenessProbe.failureThreshold }} successThreshold: {{ .Values.metrics.livenessProbe.successThreshold }} {{- end }} {{- if .Values.metrics.readinessProbe.enabled }} readinessProbe: httpGet: path: / port: metrics initialDelaySeconds: {{ .Values.metrics.readinessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.metrics.readinessProbe.periodSeconds }} timeoutSeconds: {{ .Values.metrics.readinessProbe.timeoutSeconds }} failureThreshold: {{ .Values.metrics.readinessProbe.failureThreshold }} successThreshold: {{ .Values.metrics.readinessProbe.successThreshold }} {{- end }} {{- if .Values.metrics.resources }} resources: {{- toYaml .Values.metrics.resources | nindent 12 }} {{- end }} {{- end }} {{- if .Values.sidecars }} {{- include "common.tplvalues.render" (dict "value" .Values.sidecars "context" $) | nindent 8 }} {{- end }} volumes: {{- if or .Values.initdbScriptsConfigMap .Values.initdbScripts }} - name: custom-init-scripts configMap: name: {{ template "mongodb.initdbScriptsCM" . }} {{- end }} {{- if or .Values.configuration .Values.existingConfigmap }} - name: config configMap: name: {{ include "mongodb.configmapName" . }} {{- end }} {{- if and .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled (eq .Values.externalAccess.service.type "LoadBalancer") }} - name: shared emptyDir: {} {{- end }} - name: scripts configMap: name: {{ include "mongodb.fullname" . }}-scripts defaultMode: 0755 {{- if .Values.extraVolumes }} {{- toYaml .Values.extraVolumes | nindent 8 }} {{- end }} {{- if .Values.tls.enabled }} - name: certs emptyDir: {} - name: certs-volume secret: secretName: {{ template "mongodb.caSecretName" . }} items: - key: mongodb-ca-cert path: mongodb-ca-cert mode: 511 - key: mongodb-ca-key path: mongodb-ca-key mode: 511 {{- end }} {{- if not .Values.persistence.enabled }} - name: datadir emptyDir: {} {{- else }} volumeClaimTemplates: - metadata: name: datadir {{- if .Values.persistence.annotations }} annotations: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.annotations "context" $) | nindent 10 }} {{- end }} spec: accessModes: {{- range .Values.persistence.accessModes }} - {{ . | quote }} {{- end }} resources: requests: storage: {{ .Values.persistence.size | quote }} {{- if .Values.persistence.volumeClaimTemplates.selector }} selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.volumeClaimTemplates.selector "context" $) | nindent 10 }} {{- end }} {{ include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) }} {{- end }} {{- end }} {{- end }}