values.yaml

clusterInfo: {}

image:
  repository: cockroachdb/cockroach
  tag: v23.1.22
  pullPolicy: IfNotPresent
  credentials: {}
    # registry: docker.io
    # username: john_doe
    # password: changeme


# Additional labels to apply to all Kubernetes resources created by this chart.
labels: {}
  # app.kubernetes.io/part-of: my-app


# Cluster's default DNS domain.
# You should overwrite it if you're using a different one,
# otherwise CockroachDB nodes discovery won't work.
clusterDomain: cluster.local


conf:
  # An ordered list of CockroachDB node attributes.
  # Attributes are arbitrary strings specifying machine capabilities.
  # Machine capabilities might include specialized hardware or number of cores
  # (e.g. "gpu", "x16c").
  attrs: []
    # - x16c
    # - gpu

  # Total size in bytes for caches, shared evenly if there are multiple
  # storage devices. Size suffixes are supported (e.g. `1GB` and `1GiB`).
  # A percentage of physical memory can also be specified (e.g. `.25`).
  cache: 1GB

  # Sets a name to verify the identity of a cluster.
  # The value must match between all nodes specified via `conf.join`.
  # This can be used as an additional verification when either the node or
  # cluster, or both, have not yet been initialized and do not yet know their
  # cluster ID.
  # To introduce a cluster name into an already-initialized cluster, pair this
  # option with `conf.disable-cluster-name-verification: yes`.
  cluster-name: ""

  # Tell the server to ignore `conf.cluster-name` mismatches.
  # This is meant for use when opting an existing cluster into starting to use
  # cluster name verification, or when changing the cluster name.
  # The cluster should be restarted once with `conf.cluster-name` and
  # `conf.disable-cluster-name-verification: yes` combined, and once all nodes
  # have been updated to know the new cluster name, the cluster can be restarted
  # again with `conf.disable-cluster-name-verification: no`.
  # This option has no effect if `conf.cluster-name` is not specified.
  disable-cluster-name-verification: false

  # The addresses for connecting a CockroachDB nodes to an existing cluster.
  # If you are deploying a second CockroachDB instance that should join a first
  # one, use the below list to join to the existing instance.
  # Each item in the array should be a FQDN (and port if needed) resolvable by
  # new Pods.
  join: []

  # New logging configuration.
  log:
    enabled: false
    # https://www.cockroachlabs.com/docs/v21.1/configure-logs
    config: {}
      # file-defaults:
      #   dir: /custom/dir/path/
      # fluent-defaults:
      #   format: json-fluent
      # sinks:
      #   stderr:
      #     channels: [DEV]

  # Logs at or above this threshold to STDERR. Ignored when "log" is enabled
  logtostderr: INFO

  # Maximum storage capacity available to store temporary disk-based data for
  # SQL queries that exceed the memory budget (e.g. join, sorts, etc are
  # sometimes able to spill intermediate results to disk).
  # Accepts numbers interpreted as bytes, size suffixes (e.g. `32GB` and
  # `32GiB`) or a percentage of disk size (e.g. `10%`).
  # The location of the temporary files is within the first store dir.
  # If expressed as a percentage, `max-disk-temp-storage` is interpreted
  # relative to the size of the storage device on which the first store is
  # placed. The temp space usage is never counted towards any store usage
  # (although it does share the device with the first store) so, when
  # configuring this, make sure that the size of this temp storage plus the size
  # of the first store don't exceed the capacity of the storage device.
  # If the first store is an in-memory one (i.e. `type=mem`), then this
  # temporary "disk" data is also kept in-memory.
  # A percentage value is interpreted as a percentage of the available internal
  # memory.
  # max-disk-temp-storage: 0GB

  # Maximum allowed clock offset for the cluster. If observed clock offsets
  # exceed this limit, servers will crash to minimize the likelihood of
  # reading inconsistent data. Increasing this value will increase the time
  # to recovery of failures as well as the frequency of uncertainty-based
  # read restarts.
  # Note, that this value must be the same on all nodes in the cluster.
  # In order to change it, all nodes in the cluster must be stopped
  # simultaneously and restarted with the new value.
  # max-offset: 500ms

  # Maximum memory capacity available to store temporary data for SQL clients,
  # including prepared queries and intermediate data rows during query
  # execution. Accepts numbers interpreted as bytes, size suffixes
  # (e.g. `1GB` and `1GiB`) or a percentage of physical memory (e.g. `.25`).
  max-sql-memory: 1GB

  # An ordered, comma-separated list of key-value pairs that describe the
  # topography of the machine. Topography might include country, datacenter
  # or rack designations. Data is automatically replicated to maximize
  # diversities of each tier. The order of tiers is used to determine
  # the priority of the diversity, so the more inclusive localities like
  # country should come before less inclusive localities like datacenter.
  # The tiers and order must be the same on all nodes. Including more tiers
  # is better than including fewer. For example:
  #   locality: country=us,region=us-west,datacenter=us-west-1b,rack=12
  #   locality: country=ca,region=ca-east,datacenter=ca-east-2,rack=4
  #   locality: planet=earth,province=manitoba,colo=secondary,power=3
  locality: ""

  # Run CockroachDB instances in standalone mode with replication disabled
  # (replication factor = 1).
  # Enabling this option makes the following values to be ignored:
  # - `conf.cluster-name`
  # - `conf.disable-cluster-name-verification`
  # - `conf.join`
  #
  # WARNING: Enabling this option makes each deployed Pod as a STANDALONE
  #          CockroachDB instance, so the StatefulSet does NOT FORM A CLUSTER.
  #          Don't use this option for production deployments unless you clearly
  #          understand what you're doing.
  #          Usually, this option is intended to be used in conjunction with
  #          `statefulset.replicas: 1` for temporary one-time deployments (like
  #          running E2E tests, for example).
  single-node: false

  # If non-empty, create a SQL audit log in the specified directory.
  sql-audit-dir: ""

  # CockroachDB's port to listen to inter-communications and client connections.
  port: 26257

  # CockroachDB's port to listen to HTTP requests.
  http-port: 8080

  # CockroachDB's data mount path.
  path: cockroach-data

  # CockroachDB's storage configuration https://www.cockroachlabs.com/docs/v21.1/cockroach-start.html#storage
  # Uses --store flag
  store:
    enabled: false
    # Should be empty or 'mem'
    type:
    # Required for type=mem. If type and size is empty - storage.persistentVolume.size is used
    size:
    # Arbitrary strings, separated by colons, specifying disk type or capability
    attrs:

statefulset:
  replicas: 2
  updateStrategy:
    type: RollingUpdate
  podManagementPolicy: Parallel
  budget:
    maxUnavailable: 1

  # List of additional command-line arguments you want to pass to the
  # `cockroach start` command.
  args:
    - --experimental-dns-srv
    # - --disable-cluster-name-verification

  # List of extra environment variables to pass into container
  env: []
    # - name: COCKROACH_ENGINE_MAX_SYNC_DURATION
    #   value: "24h"

  # List of Secrets names in the same Namespace as the CockroachDB cluster,
  # which shall be mounted into `/etc/cockroach/secrets/` for every cluster
  # member.
  secretMounts: []

  # Additional labels to apply to this StatefulSet and all its Pods.
  labels:
    app: cockroachdb
    app.kubernetes.io/heritage: statefulset

  # Additional annotations to apply to the Pods of this StatefulSet.
  annotations: {}
  # Additional annotations to apply to this StatefulSet.
  statefulsetAnnotations: {}

  # Affinity rules for scheduling Pods of this StatefulSet on Nodes.
  # https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity
  nodeAffinity: {}
  # Inter-Pod Affinity rules for scheduling Pods of this StatefulSet.
  # https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#inter-pod-affinity-and-anti-affinity
  podAffinity: {}
  # Anti-affinity rules for scheduling Pods of this StatefulSet.
  # https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#inter-pod-affinity-and-anti-affinity
  # You may either toggle options below for default anti-affinity rules,
  # or specify the whole set of anti-affinity rules instead of them.
  podAntiAffinity:
    # The topologyKey to be used.
    # Can be used to spread across different nodes, AZs, regions etc.
    topologyKey: kubernetes.io/hostname
    # Type of anti-affinity rules: either `soft`, `hard` or empty value (which
    # disables anti-affinity rules).
    type: soft
    # Weight for `soft` anti-affinity rules.
    # Does not apply for other anti-affinity types.
    weight: 100

  # Node selection constraints for scheduling Pods of this StatefulSet.
  # https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
  nodeSelector: {}

  # PriorityClassName given to Pods of this StatefulSet
  # https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
  priorityClassName: ""

  # Taints to be tolerated by Pods of this StatefulSet.
  # https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
  tolerations:
    - effect: NoSchedule
      key: node-role.kubernetes.io/master
      operator: Exists
  # https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
  topologySpreadConstraints:
    maxSkew: 1
    topologyKey: topology.kubernetes.io/node
    whenUnsatisfiable: ScheduleAnyway

  # Uncomment the following resources definitions or pass them from
  # command line to control the CPU and memory resources allocated
  # by Pods of this StatefulSet.
  resources:
    limits:
      cpu: 2
      memory: 4Gi
    requests:
      cpu: 1
      memory: 500Mi

  # Custom Liveness probe
  # https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-a-liveness-http-request
  customLivenessProbe: {}
    # httpGet:
    #   path: /health
    #   port: http
    #   scheme: HTTPS
    # initialDelaySeconds: 30
    # periodSeconds: 5

  # Custom Rediness probe
  # https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes
  customReadinessProbe: {}
    # httpGet:
    #   path: /health
    #   port: http
    #   scheme: HTTPS
    # initialDelaySeconds: 30
    # periodSeconds: 5

service:
  ports:
    # You can set a different external and internal gRPC ports and their name.
    grpc:
      external:
        port: 26257
        name: grpc
      # If the port number is different than `external.port`, then it will be
      # named as `internal.name` in Service.
      internal:
        port: 26257
        # If using Istio set it to `cockroach`.
        name: grpc-internal
    http:
      port: 8080
      name: http

  # This Service is meant to be used by clients of the database.
  # It exposes a ClusterIP that will automatically load balance connections
  # to the different database Pods.
  public:
    type: LoadBalancer
    # "Local" is a prefer setting for LoadBalancer type Service, it's less impactful for ClusterIP
    # Local or Cluster
    externalTrafficPolicy: Local
    # Additional labels to apply to this Service.
    labels:
      app.kubernetes.io/component: cockroachdb
    # Additional annotations to apply to this Service.
    annotations: {}
    #  metallb.universe.tf/address-pool: custom-ip-pool

  internal:
    enabled: true
    labels:
      app.kubernetes.io/component: cockroachdb
    annotations: {}

  # This service only exists to create DNS entries for each pod in
  # the StatefulSet such that they can resolve each other's IP addresses.
  # It does not create a load-balanced ClusterIP and should not be used directly
  # by clients in most circumstances.
  discovery:
    # Additional labels to apply to this Service.
    labels:
      app.kubernetes.io/prom: scrape

    # Additional annotations to apply to this Service.
    annotations: {}

# CockroachDB's ingress for web ui.
ingress:
  enabled: true
  className: nginx
  labels: {}
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    nginx.ingress.kubernetes.io/rewrite-target: /
  hosts: ['crdb-console.example.com']
  # - cockroachlabs.com
  tls:
    - hosts:
        - crdb-console.example.com
      secretName: crdb-ingress-tls

# CockroachDB's Prometheus operator ServiceMonitor support
serviceMonitor:
  enabled: true
  labels: {}
  annotations: {}
  interval: 10s
  # scrapeTimeout: 10s
  # Limits the ServiceMonitor to the current namespace if set to `true`.
  namespaced: true

# CockroachDB's data persistence.
# If neither `persistentVolume` nor `hostPath` is used, then data will be
# persisted in ad-hoc `emptyDir`.
storage:
  # Absolute path on host to store CockroachDB's data.
  # If not specified, then `emptyDir` will be used instead.
  # If specified, but `persistentVolume.enabled` is `true`, then has no effect.
  hostPath: ""

  # If `enabled` is `true` then a PersistentVolumeClaim will be created and
  # used to store CockroachDB's data, otherwise `hostPath` is used.
  persistentVolume:
    enabled: true

    size: 500Gi

    # If defined, then `storageClassName: <storageClass>`.
    # If set to "-", then `storageClassName: ""`, which disables dynamic
    # provisioning.
    # If undefined or empty (default), then no `storageClassName` spec is set,
    # so the default provisioner will be chosen (gp2 on AWS, standard on
    # GKE, AWS & OpenStack).
    storageClass: ""

    # Additional labels to apply to the created PersistentVolumeClaims.
    labels: {}
    # Additional annotations to apply to the created PersistentVolumeClaims.
    annotations: {}


# Whether to run securely using TLS certificates.
tls:
  enabled: true
  ipAddresses:
    - "127.0.0.1"
  serviceAccount:
    # Specifies whether this ServiceAccount should be created.
    create: true
    # The name of this ServiceAccount to use.
    # If not set and `create` is `true`, then a name is auto-generated.
    name: ""
  copyCerts:
    image: alpine
  certs:
    # Bring your own certs scenario. If provided, tls.init section will be ignored.
    provided: false
    # TLS secrets are created by cert-mananger, for example.
    tlsSecret: false
    # Use cert-manager to issue certificates for mTLS.
    certManager:
      enabled: true
      # Used to tell the chart where the secret for the CA can be found
      existingSecret:
          enabled: true
          name: ca-key-pair
      dnsNames:
        - crdb.example.com

    # Specify an Issuer or a ClusterIssuer to use, when issuing
    # node and client certificates. The values correspond to the
    # issuerRef specified in the certificate.
    certManagerIssuer:
      group: cert-manager.io
      kind: Issuer
      name: crdb-ca
      # Duration of Client certificates in hours
      clientCertDuration: 2160h0m0s
      # Expiry window of client certificates means a window before actual expiry in which client certs should be rotated.
      clientCertExpiryWindow: 720h0m0s
      # Duration of node certificates in hours
      nodeCertDuration: 8760h0m0s
      # Expiry window of node certificates means a window before actual expiry in which node certs should be rotated.
      nodeCertExpiryWindow: 720h0m0s
      # Set organizations
      organizations:
        - crdb
    # Enable if you run cert-manager >=1.0 on K8s <=1.15 with legacy CRDs
    # Legacy CRDs only support cert-manager.io/v1 API Versions
    useCertManagerV1CRDs: true


networkPolicy:
  enabled: false

  ingress:
    # List of sources which should be able to access the CockroachDB Pods via
    # gRPC port. Items in this list are combined using a logical OR operation.
    # Rules for allowing inter-communication are applied automatically.
    # If empty, then connections from any Pod is allowed.
    grpc: []
      # - podSelector:
      #     matchLabels:
      #       app.kubernetes.io/name: my-app-django
      #       app.kubernetes.io/instance: my-app

    # List of sources which should be able to access the CockroachDB Pods via
    # HTTP port. Items in this list are combined using a logical OR operation.
    # If empty, then connections from any Pod is allowed.
    http: []
      # - namespaceSelector:
      #     matchLabels:
      #       project: my-project

toolbox:
  enabled: true
  annotations: {}
  labels:
    app.kubernetes.io/component: toolbox

# https://github.com/stakater/Reloader/tree/master/deployments/kubernetes/chart/reloader
reloader:
  reloader:
    watchGlobally: false
    readOnlyRootFileSystem: true
    resources:
      limits:
        cpu: "100m"
        memory: "512Mi"
      requests:
        cpu: "100m"
        memory: "512Mi"