bitflicker64 commented on code in PR #3402:
URL: https://github.com/apache/hugegraph/pull/3402#discussion_r4368421499
##########
helm/hugegraph/templates/seatunnel.yaml:
##########
@@ -0,0 +1,239 @@
+{{/*
+Licensed to the Apache Software Foundation (ASF) under one or more
+contributor license agreements. See the NOTICE file distributed with
+this work for additional information regarding copyright ownership.
+The ASF licenses this file to You under the Apache License, Version 2.0
+(the "License"); you may not use this file except in compliance with
+the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+Based on Apache SeaTunnel v3.0.0 hybrid Kubernetes resources:
+https://github.com/apache/seatunnel/blob/v3.0.0/docs/zh/getting-started/kubernetes/hybrid-cluster-mode.md
+Use its DNS discovery alternative, so Kubernetes API RBAC is unnecessary.
+*/}}
+
+{{- define "hugegraph.seatunnel.config" -}}
+{{- $name := include "hugegraph.seatunnel.name" . -}}
+{{- $dns := printf "%s-headless.%s.svc" $name .Release.Namespace -}}
+{{- $data := dict -}}
+{{- $hazelcast := dict "hazelcast" (dict
+ "cluster-name" $name
+ "network" (dict
+ "port" (dict "auto-increment" false "port" 5801)
+ "join" (dict "kubernetes" (dict "enabled" true "service-dns" $dns
"service-port" 5801 "service-dns-timeout" 10)))
+ "properties" (dict "hazelcast.logging.type" "log4j2")) -}}
+{{- $_ := set $data "hazelcast.yaml" ($hazelcast | toYaml) -}}
+{{- $client := dict "hazelcast-client" (dict
+ "cluster-name" $name
+ "properties" (dict "hazelcast.logging.type" "log4j2")
+ "connection-strategy" (dict "connection-retry" (dict
"cluster-connect-timeout-millis" 7000))
+ "network" (dict "cluster-members" (list (printf "%s:5801" $dns)))) -}}
+{{- $_ := set $data "hazelcast-client.yaml" ($client | toYaml) -}}
+{{- $engine := dict "seatunnel" (dict "engine" (dict
+ "backup-count" (ternary 0 1 (eq .Values.seatunnel.mode "standalone"))
+ "history-job-expire-minutes" 1440
+ "classloader-cache-mode" true
+ "slot-service" (dict "dynamic-slot" true)
+ "checkpoint" (dict "interval" 180000 "timeout" 30000 "storage" (dict
+ "type" "hdfs" "max-retained" 3 "plugin-config" (dict
+ "namespace" "/tmp/seatunnel/checkpoint/" "storage.type" "hdfs"
"fs.defaultFS" "file:///tmp/")))
+ "http" (dict "enable-http" true "port" 8080 "enable-dynamic-port" false)))
-}}
+{{- $_ := set $data "seatunnel.yaml" ($engine | toYaml) -}}
+{{/* The upstream script appends jvm_options after JAVA_OPTS; set heap in that
file. */}}
+{{- $_ := set $data "jvm_options" (.Values.seatunnel.javaOpts | replace " "
"\n") -}}
+{{- range $path, $_ := .Files.Glob "examples/seatunnel/hugegraph-*.conf" -}}
+{{- $_ := set $data (base $path) ($.Files.Get $path) -}}
+{{- end -}}
+{{- range $filename, $content := .Values.seatunnel.config -}}
+{{- $_ := set $data $filename $content -}}
+{{- end -}}
+{{- toYaml $data -}}
+{{- end -}}
+
+{{- if (.Values.seatunnel | default dict).enabled }}
+{{- include "hugegraph.resolveValues" . }}
+{{- include "hugegraph.validateValues" . }}
+{{- $name := include "hugegraph.seatunnel.name" . }}
+{{- $config := omit (include "hugegraph.seatunnel.config" . | fromYaml)
"seatunnel.yaml" }}
+{{- $svc := .Values.seatunnel.service }}
+{{- $env := list
+ (dict "name" "SEATUNNEL_HOME" "value" "/opt/seatunnel")
+ (dict "name" "HG_HOST" "value" (printf "%s.%s.svc" (include
"hugegraph.server.name" .) .Release.Namespace))
+ (dict "name" "HG_PORT" "value" (.Values.server.port | toString))
+ (dict "name" "HG_PROTOCOL" "value" "http")
+ (dict "name" "HG_USERNAME" "value" "admin")
+ (dict "name" "HG_GRAPH_SPACE" "value" .Values.server.graphSpace)
+ (dict "name" "HG_GRAPH_NAME" "value" "graph_a") }}
+{{- $password := dict "name" "HG_PASSWORD" "value" "" }}
+{{- if .Values.server.auth.enabled }}
+{{- $password = dict "name" "HG_PASSWORD" "valueFrom" (dict "secretKeyRef"
(dict
+ "name" (include "hugegraph.server.authSecretName" .)
+ "key" (include "hugegraph.server.authSecretKey" .))) }}
+{{- end }}
+{{- $env = append $env $password }}
+{{- $overrides := dict }}
+{{- range .Values.seatunnel.env }}
+{{- $_ := set $overrides .name true }}
+{{- end }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ $name }}-configs
+ labels:
+ {{- include "hugegraph.labels" . | nindent 4 }}
+ app.kubernetes.io/component: seatunnel
+data:
+ {{- toYaml $config | nindent 2 }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ $name }}-headless
+ labels:
+ {{- include "hugegraph.labels" . | nindent 4 }}
+ app.kubernetes.io/component: seatunnel
+spec:
+ clusterIP: None
+ publishNotReadyAddresses: true
+ ports:
+ - name: hazelcast
+ port: 5801
+ targetPort: hazelcast
+ selector:
+ {{- include "hugegraph.selectorLabels" . | nindent 4 }}
+ app.kubernetes.io/component: seatunnel
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ $name }}
+ labels:
+ {{- include "hugegraph.labels" . | nindent 4 }}
+ app.kubernetes.io/component: seatunnel
+ {{- with $svc.annotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+spec:
+ type: {{ $svc.type }}
+ {{- range $field := list "externalTrafficPolicy" "loadBalancerClass"
"loadBalancerIP" "loadBalancerSourceRanges" "externalIPs" }}
+ {{- with get $svc $field }}
+ {{ $field }}: {{ toYaml . | nindent 4 }}
+ {{- end }}
+ {{- end }}
+ {{- if hasKey $svc "allocateLoadBalancerNodePorts" }}
+ {{- if ne (get $svc "allocateLoadBalancerNodePorts") nil }}
+ allocateLoadBalancerNodePorts: {{ $svc.allocateLoadBalancerNodePorts }}
+ {{- end }}
+ {{- end }}
+ ports:
+ - name: http
+ port: 8080
+ targetPort: http
+ {{- with $svc.nodePort }}
+ nodePort: {{ . }}
+ {{- end }}
+ selector:
+ {{- include "hugegraph.selectorLabels" . | nindent 4 }}
+ app.kubernetes.io/component: seatunnel
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+ name: {{ $name }}
+ labels:
+ {{- include "hugegraph.labels" . | nindent 4 }}
+ app.kubernetes.io/component: seatunnel
+spec:
+ serviceName: {{ $name }}-headless
+ replicas: {{ ternary 1 (int .Values.seatunnel.replicas) (eq
.Values.seatunnel.mode "standalone") }}
+ podManagementPolicy: Parallel
+ selector:
+ matchLabels:
+ {{- include "hugegraph.selectorLabels" . | nindent 6 }}
+ app.kubernetes.io/component: seatunnel
+ template:
+ metadata:
+ labels:
+ {{- include "hugegraph.selectorLabels" . | nindent 8 }}
+ app.kubernetes.io/component: seatunnel
+ annotations:
+ checksum/config: {{ $config | toYaml | sha256sum }}
+ checksum/auth: {{ include "hugegraph.seatunnel.engineConfig" . |
sha256sum }}
+ spec:
+ automountServiceAccountToken: false
+ terminationGracePeriodSeconds: 120
+ {{- with .Values.imagePullSecrets }}
+ imagePullSecrets:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ containers:
Review Comment:
Important: The SeaTunnel Pod is the only workload in the chart with no
container `securityContext` and no way to set one. PD, Store, Server and Hubble
render `allowPrivilegeEscalation: false`, `capabilities.drop: [ALL]` and
`seccompProfile: RuntimeDefault` by default, and expose `podSecurityContext`,
`securityContext`, `nodeSelector`, `tolerations`, `affinity` and
`priorityClassName` (see `pd-statefulset.yaml`). The rendered
`hugegraph-seatunnel` StatefulSet has none of them. Enabling SeaTunnel
therefore adds the least restricted container in the release. In a namespace
that enforces the restricted Pod Security level, which values.yaml says
`podSecurityContext` exists to satisfy, the SeaTunnel Pods are rejected; on
tainted or dedicated nodes they stay Pending. No value can fix either case.
Please add `seatunnel.securityContext` with the same defaults as the other
components, plus `podSecurityContext`, `nodeSelector`, `tolerations`,
`affinity` and `priorityClassName`, wired the sam
e way as `pd-statefulset.yaml`, and cover them in `test_helm_seatunnel.py`.
##########
helm/hugegraph/templates/seatunnel-networkpolicy.yaml:
##########
@@ -0,0 +1,54 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+{{ include "hugegraph.resolveValues" . }}
+{{- if and (.Values.seatunnel | default dict).enabled
.Values.networkPolicy.enabled }}
Review Comment:
Important: In the default `easy` mode this policy is not rendered, because
`networkPolicy.enabled` resolves to false, so Hazelcast port 5801 on
`<name>-headless` and on every SeaTunnel Pod is reachable from any Pod in the
cluster. HTTP Basic does not cover that protocol (docs/seatunnel.md says so),
so any workload can point `seatunnel.sh --master cluster` or a Hazelcast client
at `hugegraph-seatunnel-headless.<ns>.svc:5801` with the predictable cluster
name `hugegraph-seatunnel` and submit a job without credentials. That job runs
in an engine Pod whose environment carries `HG_PASSWORD` from the Server admin
Secret (`helm template` with `examples/values-seatunnel-standalone.yaml`
renders `secretKeyRef: {name: hugegraph-admin, key: password}` and no
NetworkPolicy at all), and which mounts the Basic auth password in
`seatunnel.yaml`. The new entry authentication is therefore bypassable in the
default install, and the docs and NOTES describe 5801 as limited to the trusted
Kubernetes/R
BAC scope, which only holds in strict mode. Please render an ingress policy
for the SeaTunnel Pods whenever `seatunnel.enabled` is true, regardless of
`networkPolicy.enabled`: admit 5801 only from SeaTunnel peers and leave 8080
open in easy mode. Then correct the 5801 wording in docs/seatunnel.md and
NOTES.txt, and add a render test for the easy-mode policy.
##########
helm/hugegraph/templates/NOTES.txt:
##########
@@ -56,6 +59,56 @@ Store waits for a PD quorum before startup. If a Pod remains
in Init, inspect
its init-container logs and PD readiness; see
helm/hugegraph/docs/operations.md#troubleshooting.
Access:
+{{- if (.Values.seatunnel | default dict).enabled }}
+
+ SeaTunnel:
+{{- $stName := include "hugegraph.seatunnel.name" . }}
+{{- $stService := .Values.seatunnel.service | default dict }}
+ 集群内 API: http://{{ $stName }}.{{ .Release.Namespace }}.svc:8080
Review Comment:
Minor: The SeaTunnel block in NOTES.txt, the new README section,
docs/seatunnel.md and the example comments are in Chinese, while the rest of
the chart README, docs/operations.md, docs/distribution.md and the rest of
NOTES.txt are English. The `helm install` output now switches language halfway
through, and operators who do not read Chinese cannot follow the auth, rotation
and 5801 caveats it carries. Please write these in English to match the rest of
the chart; a Chinese translation can sit beside the English docs if wanted.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
