nested-etcd-statefulset-template.yaml

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: {{.nestedetcdName}}
  namespace: {{.nestedetcdNamespace}}
spec:
  replicas: {{.nestedetcdStsReplicas}}
  revisionHistoryLimit: 10
  serviceName: {{.nestedetcdName}}
  selector:
    matchLabels:
      component-name: {{.nestedetcdName}}
  # etcd will not be updated, unless it is deleted
  updateStrategy:
    type: OnDelete
  template:
    metadata:
      labels:
        component-name: {{.nestedetcdName}}
    spec:
      subdomain: etcd
      containers:
      - name: {{.nestedetcdName}}
        image: virtualcluster/etcd-v3.4.0
        imagePullPolicy: Always
        command:
        - etcd
        # pass the pod name(hostname) to container for composing the advertise-urls args
        env:
        - name: HOSTNAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        args:
        - --name=$(HOSTNAME)
        - --trusted-ca-file=/etc/kubernetes/pki/root/tls.crt
        - --client-cert-auth
        - --cert-file=/etc/kubernetes/pki/etcd/tls.crt
        - --key-file=/etc/kubernetes/pki/etcd/tls.key
        - --peer-client-cert-auth
        - --peer-trusted-ca-file=/etc/kubernetes/pki/root/tls.crt
        - --peer-cert-file=/etc/kubernetes/pki/etcd/tls.crt
        - --peer-key-file=/etc/kubernetes/pki/etcd/tls.key
        - --listen-peer-urls=https://0.0.0.0:2380
        - --listen-client-urls=https://0.0.0.0:2379
        - --initial-advertise-peer-urls=https://$(HOSTNAME).{{.nestedetcdName}}:2380
        # we use a headless service to encapsulate each pod
        - --advertise-client-urls=https://$(HOSTNAME).{{.nestedetcdName}}:2379
        - --initial-cluster-state=new
        - --initial-cluster-token=vc-etcd
        - --data-dir=/var/lib/etcd/data
        # --initial-cluster option will be set during runtime based on the number of replicas
        livenessProbe:
          exec:
            command:
            - sh
            - -c
            - ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/root/tls.crt --cert=/etc/kubernetes/pki/etcd/tls.crt --key=/etc/kubernetes/pki/etcd/tls.key endpoint health
          failureThreshold: 8
          initialDelaySeconds: 60
          timeoutSeconds: 15
        readinessProbe:
          exec:
            command:
            - sh
            - -c
            - ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/root/tls.crt --cert=/etc/kubernetes/pki/etcd/tls.crt --key=/etc/kubernetes/pki/etcd/tls.key endpoint health
          failureThreshold: 8
          initialDelaySeconds: 15
          periodSeconds: 2
          timeoutSeconds: 15
        volumeMounts:
        - mountPath: /etc/kubernetes/pki/etcd
          name: {{.nestedControlPlaneName}}-etcd-client-cert
          readOnly: true
        - mountPath: /etc/kubernetes/pki/root
          name: {{.nestedControlPlaneName}}-etcd
          readOnly: true
      volumes:
      - name: {{.nestedControlPlaneName}}-etcd-client-cert
        secret:
          defaultMode: 420
          secretName: {{.nestedControlPlaneName}}-etcd-client-cert
      - name: {{.nestedControlPlaneName}}-etcd
        secret:
          defaultMode: 420
          secretName: {{.nestedControlPlaneName}}-etcd