feat(etcd-backup-recover): creating the Helm chart

argocd-helm-charts/etcd-backup-restore/Chart.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+description: Helm chart for etcd with backup-restore support.
+name: etcd-backup-restore
+version: 0.1.0

argocd-helm-charts/etcd-backup-restore/templates/_helpers.tpl

@@ -0,0 +1,9 @@
+{{- define "gcs.credentialsConfig" -}}
+{{- if .Values.backup.tokenAuth.enabled -}}
+{{- .Values.backup.gcs.credentialsConfig | toYaml }}
+credential_source:
+  file: /var/.gcp/token
+  format:
+    type: text
+{{- end -}}
+{{- end -}}

argocd-helm-charts/etcd-backup-restore/templates/etcd-backup-secret.yaml

@@ -0,0 +1,76 @@
+# {{- if and .Values.backup.storageProvider (not (eq .Values.backup.storageProvider "Local")) }}
+# apiVersion: v1
+# kind: Secret
+# metadata:
+#   name: {{ .Release.Name }}-etcd-backup
+#   namespace: {{ .Release.Namespace }}
+#   labels:
+#     app.kubernetes.io/name: etcd
+#     app.kubernetes.io/managed-by: {{ .Release.Service }}
+#     app.kubernetes.io/instance: {{ .Release.Name }}
+# type: Opaque
+# data:
+# {{- if eq .Values.backup.storageProvider "S3" }}
+#   region: {{ .Values.backup.s3.region | b64enc }}
+#   {{- if .Values.backup.tokenAuth.enabled }}
+#   roleARN: {{ .Values.backup.s3.roleARN | b64enc }}
+#   {{- else }}
+#   secretAccessKey: {{ .Values.backup.s3.secretAccessKey | b64enc }}
+#   accessKeyID: {{ .Values.backup.s3.accessKeyID | b64enc }}
+#   {{- end }}
+#   {{- if .Values.backup.s3.s3ForcePathStyle }}
+#   s3ForcePathStyle: {{ .Values.backup.s3.s3ForcePathStyle | b64enc}}
+#   {{- end }}
+#   {{- if .Values.backup.s3.endpoint }}
+#   endpoint: {{ .Values.backup.s3.endpoint | b64enc }}
+#   {{- end }}
+# {{- else if eq .Values.backup.storageProvider "ABS" }}
+#   storageAccount: {{ .Values.backup.abs.storageAccount | b64enc }}
+#   storageKey : {{ .Values.backup.abs.storageKey | b64enc }}
+#   {{- if .Values.backup.abs.emulatorEnabled }}
+#   emulatorEnabled: {{ .Values.backup.abs.emulatorEnabled | b64enc}}
+#   {{- end }}
+#   {{- if .Values.backup.abs.domain }}
+#   domain: {{ .Values.backup.abs.domain | b64enc}}
+#   {{- end }}
+# {{- else if eq .Values.backup.storageProvider "GCS" }}
+#   {{- if .Values.backup.tokenAuth.enabled }}
+#   credentialsConfig: {{ include "gcs.credentialsConfig" . | fromYaml | toJson | b64enc }}
+#   projectID: {{ .Values.backup.gcs.projectID }}
+#   {{- else }}
+#   serviceaccount.json : {{ .Values.backup.gcs.serviceAccountJson | b64enc }}
+#   {{- end }}
+#   {{- if .Values.backup.gcs.storageAPIEndpoint }}
+#   storageAPIEndpoint: {{ .Values.backup.gcs.storageAPIEndpoint | b64enc}}
+#   {{- end }}
+#   {{- if .Values.backup.gcs.emulatorEnabled }}
+#   emulatorEnabled: {{ .Values.backup.gcs.emulatorEnabled | b64enc}}
+#   {{- end }}
+# {{- else if eq .Values.backup.storageProvider "Swift" }}
+#   authURL: {{ .Values.backup.swift.authURL | b64enc }}
+#   domainName: {{ .Values.backup.swift.domainName | b64enc }}
+#   username: {{ .Values.backup.swift.username | b64enc }}
+#   password: {{ .Values.backup.swift.password | b64enc }}
+#   tenantName: {{ .Values.backup.swift.tenantName | b64enc }}
+#   regionName: {{ .Values.backup.swift.regionName | b64enc}}
+# {{- else if eq .Values.backup.storageProvider "OSS" }}
+#   endpoint: {{ .Values.backup.oss.endpoint | b64enc }}
+#   accessKeySecret: {{ .Values.backup.oss.accessKeySecret | b64enc }}
+#   accessKeyID: {{ .Values.backup.oss.accessKeyID | b64enc }}
+# {{- else if eq .Values.backup.storageProvider "OCS"}}
+#   accessKeyID: {{ .Values.backup.ocs.accessKeyID | b64enc }}
+#   secretAccessKey: {{ .Values.backup.ocs.secretAccessKey | b64enc }}
+#   endpoint: {{ .Values.backup.ocs.endpoint | b64enc }}
+#   region: {{ .Values.backup.ocs.region | b64enc }}
+# {{- else if eq .Values.backup.storageProvider "ECS" }}
+#   endpoint: {{ .Values.backup.ecs.endpoint | b64enc }}
+#   accessKeyID: {{ .Values.backup.ecs.accessKeyID | b64enc }}
+#   secretAccessKey: {{ .Values.backup.ecs.secretAccessKey | b64enc }}
+#   {{- if .Values.backup.ecs.disableSsl }}
+#   disableSsl: {{ .Values.backup.ecs.disableSsl | b64enc}}
+#   {{- end }}
+#   {{- if .Values.backup.ecs.insecureSkipVerify }}
+#   insecureSkipVerify: {{ .Values.backup.ecs.insecureSkipVerify | b64enc }}
+#   {{- end }}
+# {{- end }}
+# {{- end }}

argocd-helm-charts/etcd-backup-restore/templates/etcd-ca-secret.yaml

@@ -0,0 +1,14 @@
+{{- if .Values.tls.etcd }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-etcd-ca
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: etcd
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+type: Opaque
+data:
+  bundle.crt: {{ .Values.tls.etcd.ca | b64enc }}
+{{- end }}

argocd-helm-charts/etcd-backup-restore/templates/etcd-client-service.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-etcd-client
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: etcd
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  type: ClusterIP
+  sessionAffinity: None
+  selector:
+    app.kubernetes.io/name: etcd
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  ports:
+  - name: client
+    protocol: TCP
+    port: {{ .Values.servicePorts.etcd.client }}
+    targetPort: {{ .Values.servicePorts.etcd.client }}
+  - name: peer
+    protocol: TCP
+    port: {{ .Values.servicePorts.etcd.peer }}
+    targetPort: {{ .Values.servicePorts.etcd.peer }}
+  - name: backuprestore
+    protocol: TCP
+    port: {{ .Values.servicePorts.etcdBackupRestore.server }}
+    targetPort: {{ .Values.servicePorts.etcdBackupRestore.server }}
+

argocd-helm-charts/etcd-backup-restore/templates/etcd-client-tls-secret.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.tls.etcd }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-etcd-client-tls
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: etcd
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+type: kubernetes.io/tls
+data:
+  tls.crt: {{ .Values.tls.etcd.client.crt | b64enc }}
+  tls.key: {{ .Values.tls.etcd.client.key | b64enc }}
+{{- end }}

argocd-helm-charts/etcd-backup-restore/templates/etcd-configmap.yaml

@@ -0,0 +1,142 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-etcd-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: etcd
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+data:
+  etcd.conf.yaml: |-
+    {{- $replicas := int .Values.replicas }}
+    # precompute the peer scheme based on whether or not the peer is tls enabled
+    {{- $peerScheme := "http" }}
+    {{- if .Values.tls.etcd.peer }}
+    {{- $peerScheme = "https" }}
+    {{- end }}
+    # store the root context for later use
+    {{- $root := . }}
+    # store the optional member name prefix
+    {{- $memberNamePrefix := .Values.memberNamePrefix | default "" }}
+    # store the cluster entries in a list to be used for the initial-cluster configuration
+    {{- $clusterEntries := list }}
+    {{- range $i := until $replicas }}
+    {{- $podName := printf "%s-etcd-%d" $root.Release.Name $i }}
+    {{- $memberName := $podName }}
+    {{- if $memberNamePrefix }}
+    {{- $memberName = printf "%s-%s" $memberNamePrefix $podName }}
+    {{- end }}
+    {{- $entry := printf "%s=%s://%s-etcd-%d.%s-etcd-peer.%s.svc:%d" $memberName $peerScheme $root.Release.Name $i $root.Release.Name $root.Release.Namespace (int $root.Values.servicePorts.etcd.peer) }}
+    {{- $clusterEntries = append $clusterEntries $entry }}
+    {{- end }}
+
+    # Human-readable name for this member.
+    name: {{ .Release.Name }}-etcd
+
+    # Path to the data directory.
+    data-dir: /var/etcd/data/new.etcd
+
+    # metrics configuration
+    metrics: basic
+
+    # Number of committed transactions to trigger a snapshot to disk.
+    snapshot-count: 75000
+
+    # Raise alarms when backend size exceeds the given quota. 0 means use the
+    # default quota.
+    {{- if .Values.backup.etcdQuotaBytes }}
+    quota-backend-bytes: {{ int $.Values.backup.etcdQuotaBytes }}
+    {{- end }}
+
+    # List of comma separated URLs to listen on for client traffic.
+    listen-client-urls: {{ if .Values.tls.etcd }}https{{ else }}http{{ end }}://0.0.0.0:{{ .Values.servicePorts.etcd.client }}
+
+    # List of comma separated URLs to listen on for peer traffic.
+    listen-peer-urls: {{ $peerScheme }}://0.0.0.0:{{ .Values.servicePorts.etcd.peer }}
+
+    # List of each member's client URLs to advertise to the public.
+    # Each member should include it's client URLs under the member name.
+    advertise-client-urls:
+      {{- range $i := until $replicas }}
+      {{- $podName := printf "%s-etcd-%d" $root.Release.Name $i }}
+      {{- $memberName := $podName }}
+      {{- if $memberNamePrefix }}
+      {{- $memberName = printf "%s-%s" $memberNamePrefix $podName }}
+      {{- end }}
+      {{ $memberName }}:
+      - {{ if $root.Values.tls.etcd }}https{{ else }}http{{ end }}://{{ $root.Release.Name }}-etcd-{{ $i }}.{{ $root.Release.Name }}-etcd-peer.{{ $root.Release.Namespace }}.svc:{{ $root.Values.servicePorts.etcd.client }}
+      {{- end }}
+
+    # List of each member's peer URLs to advertise to the public
+    # Each member should include it's peer URLs under the member name.
+    initial-advertise-peer-urls:
+      {{- range $i := until $replicas }}
+      {{- $podName := printf "%s-etcd-%d" $root.Release.Name $i }}
+      {{- $memberName := $podName }}
+      {{- if $memberNamePrefix }}
+      {{- $memberName = printf "%s-%s" $memberNamePrefix $podName }}
+      {{- end }}
+      {{ $memberName }}:
+      - {{ $peerScheme }}://{{ $root.Release.Name }}-etcd-{{ $i }}.{{ $root.Release.Name }}-etcd-peer.{{ $root.Release.Namespace }}.svc:{{ $root.Values.servicePorts.etcd.peer }}
+      {{- end }}
+
+    # List of server endpoints with which this cluster should be started
+    initial-cluster: {{ join "," $clusterEntries }}
+
+    # Initial cluster token for the etcd cluster during bootstrap.
+    initial-cluster-token: 'etcd-cluster'
+
+    # Initial cluster state ('new' or 'existing').
+    initial-cluster-state: 'new'
+
+    {{- if .Values.autoCompaction }}
+    # auto-compaction-mode ("periodic" or "revision").
+    {{- if .Values.autoCompaction.mode }}
+    auto-compaction-mode: {{ .Values.autoCompaction.mode }}
+    {{- end }}
+
+    # auto-compaction-retention defines Auto compaction retention length for etcd.
+    {{- if .Values.autoCompaction.retentionLength }}
+    auto-compaction-retention: {{ .Values.autoCompaction.retentionLength }}
+    {{- end }}
+    {{- end }}
+
+    {{- if $memberNamePrefix }}
+    # Optional prefix prepended to the pod name to form the etcd member name.
+    member-name-prefix: {{ $memberNamePrefix }}
+    {{- end }}
+
+{{- if .Values.tls.etcd }}
+    client-transport-security:
+      # Path to the etcd server TLS cert file.
+      cert-file: /var/etcd/ssl/server/tls.crt
+
+      # Path to the etcd server TLS key file.
+      key-file: /var/etcd/ssl/server/tls.key
+
+      # Enable client cert authentication.
+      client-cert-auth: true
+
+      # Path to the etcd server TLS trusted CA cert file.
+      trusted-ca-file: /var/etcd/ssl/ca/bundle.crt
+
+      auto-tls: false
+  {{- if .Values.tls.etcd.peer }}
+    peer-transport-security:
+      # Path to the etcd peer server TLS cert file.
+      cert-file: /var/etcd/ssl/peer/server/tls.crt
+
+      # Path to the etcd peer server TLS key file.
+      key-file: /var/etcd/ssl/peer/server/tls.key
+
+      # Enable peer client cert authentication.
+      client-cert-auth: true
+
+      # Path to the etcd peer server TLS trusted CA cert file.
+      trusted-ca-file: /var/etcd/ssl/peer/ca/bundle.crt
+
+      auto-tls: false
+  {{- end }}
+{{- end }}

argocd-helm-charts/etcd-backup-restore/templates/etcd-peer-ca-secret.yaml

@@ -0,0 +1,14 @@
+{{- if .Values.tls.etcd.peer }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-etcd-peer-ca
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: etcd
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+type: Opaque
+data:
+  bundle.crt: {{ .Values.tls.etcd.peer.ca | b64enc }}
+{{- end }}

argocd-helm-charts/etcd-backup-restore/templates/etcd-peer-server-tls-secret.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.tls.etcd.peer }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-etcd-peer-server-tls
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: etcd
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+type: kubernetes.io/tls
+data:
+  tls.crt: {{ .Values.tls.etcd.peer.server.crt | b64enc }}
+  tls.key: {{ .Values.tls.etcd.peer.server.key | b64enc }}
+{{- end }}

argocd-helm-charts/etcd-backup-restore/templates/etcd-peer-service.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-etcd-peer
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: etcd
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  publishNotReadyAddresses: true
+  type: ClusterIP
+  clusterIP: None
+  clusterIPs:
+    - None
+  internalTrafficPolicy: Cluster
+  ipFamilyPolicy: SingleStack
+  sessionAffinity: None
+  selector:
+    app.kubernetes.io/name: etcd
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  ports:
+  - name: peer
+    protocol: TCP
+    port: {{ .Values.servicePorts.etcd.peer }}
+    targetPort: {{ .Values.servicePorts.etcd.peer }}
+

argocd-helm-charts/etcd-backup-restore/templates/etcd-server-tls-secret.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.tls.etcd }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-etcd-server-tls
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: etcd
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+type: kubernetes.io/tls
+data:
+  tls.crt: {{ .Values.tls.etcd.server.crt | b64enc }}
+  tls.key: {{ .Values.tls.etcd.server.key | b64enc }}
+{{- end }}