Skip to content

Commit

Permalink
feat(instance): remove all group dep from instance controllers
Browse files Browse the repository at this point in the history 
Signed-off-by: liubo02 <[email protected]>
  • Loading branch information
@liubog2008
liubog2008 committed Dec 19, 2024
1 parent aebd8d9 commit 652df2b
Show file tree
Hide file tree
Showing 29 changed files with 481 additions and 418 deletions.
25 changes: 20 additions & 5 deletions apis/core/v1alpha1/common_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ const (
// Since the tidb operator will overlay the user-specified config with some operator-managed fields,
// if we hash the overlayed config, with the evolving TiDB Operator, the hash may change,
// potentially triggering an unexpected rolling update.
// Instead, we choose to hash the user-specified config,
// Instead, we choose to hash the user-specified config,
// and the worst case is that users expect a reboot but it doesn't happen.
LabelKeyConfigHash = LabelKeyPrefix + "config-hash"
)
Expand Down Expand Up @@ -112,11 +112,11 @@ const (
type ConfigUpdateStrategy string

const (
// ConfigUpdateStrategyInPlace updates config without restarting.
ConfigUpdateStrategyInPlace ConfigUpdateStrategy = "InPlace"
// ConfigUpdateStrategyHotReload updates config without restarting.
ConfigUpdateStrategyHotReload ConfigUpdateStrategy = "HotReload"

// ConfigUpdateStrategyRollingUpdate performs a rolling-update to apply changed configs.
ConfigUpdateStrategyRollingUpdate ConfigUpdateStrategy = "RollingUpdate"
// ConfigUpdateStrategyRestart performs a restart to apply changed configs.
ConfigUpdateStrategyRestart ConfigUpdateStrategy = "Restart"
)

// ObjectMeta is defined for replacing the embedded metav1.ObjectMeta
Expand Down Expand Up @@ -300,6 +300,21 @@ type GroupStatus struct {
UpdatedReplicas int32 `json:"updatedReplicas,omitempty"`
}

type UpdateStrategy struct {
// Config determines how the configuration change is applied to the cluster.
// Valid values are "Restart" (by default) and "HotReload".
// +kubebuilder:validation:Enum=Restart;HotReload
// +kubebuilder:default="Restart"
Config ConfigUpdateStrategy `json:"config,omitempty"`
}

// TLS defines a common tls config for all components
// Now it only support enable or disable.
// TODO(liubo02): add more tls configs
type TLS struct {
Enabled bool `json:"enabled,omitempty"`
}

// ComponentAccessor is the interface to access details of instances/groups managed by TiDB Operator.
type ComponentAccessor interface {
GetName() string
Expand Down
18 changes: 3 additions & 15 deletions apis/core/v1alpha1/pd_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -153,10 +153,6 @@ func (in *PDGroup) IsHealthy() bool {
return true
}

func (in *PDGroup) MountClusterClientSecret() bool {
return in.Spec.MountClusterClientSecret != nil && *in.Spec.MountClusterClientSecret
}

func (in *PDGroup) GetClientPort() int32 {
if in.Spec.Template.Spec.Server.Ports.Client != nil {
return in.Spec.Template.Spec.Server.Ports.Client.Port
Expand Down Expand Up @@ -287,17 +283,8 @@ type PDGroupSpec struct {
// If it's true, it cannot be set to false for security
Bootstrapped bool `json:"bootstrapped,omitempty"`

// MountClusterClientSecret indicates whether to mount `cluster-client-secret` to the Pod.
MountClusterClientSecret *bool `json:"mountClusterClientSecret,omitempty"`

SchedulePolicies []SchedulePolicy `json:"schedulePolicies,omitempty"`

// ConfigUpdateStrategy determines how the configuration change is applied to the cluster.
// Valid values are "RollingUpdate" (by default) and "InPlace".
// +kubebuilder:validation:Enum=RollingUpdate;InPlace
// +kubebuilder:default="RollingUpdate"
ConfigUpdateStrategy ConfigUpdateStrategy `json:"configUpdateStrategy,omitempty"`

Template PDTemplate `json:"template"`
}

Expand All @@ -314,8 +301,9 @@ type PDTemplateSpec struct {
// Default is pingcap/pd
Image *string `json:"image,omitempty"`
// Server defines server config for PD
Server PDServer `json:"server,omitempty"`
Resources ResourceRequirements `json:"resources,omitempty"`
Server PDServer `json:"server,omitempty"`
Resources ResourceRequirements `json:"resources,omitempty"`
UpdateStrategy UpdateStrategy `json:"updateStrategy,omitempty"`
// Config defines config file of PD
Config ConfigFile `json:"config"`
// Volumes defines persistent volumes of PD
Expand Down
109 changes: 54 additions & 55 deletions apis/core/v1alpha1/tidb_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,6 @@
package v1alpha1

import (
"fmt"
"strings"

corev1 "k8s.io/api/core/v1"
Expand Down Expand Up @@ -46,10 +45,10 @@ const (
)

const (
// TiDBServerTLSVolumeName is the volume name for the TLS secret used by TLS communication between TiDB server and MySQL client.
TiDBServerTLSVolumeName = NamePrefix + "tidb-server-tls"
// TiDBServerTLSMountPath is the volume mount path for the TLS secret used by TLS communication between TiDB server and MySQL client.
TiDBServerTLSMountPath = "/var/lib/tidb-server-tls"
// TiDBSQLTLSVolumeName is the volume name for the TLS secret used by TLS communication between TiDB server and MySQL client.
TiDBSQLTLSVolumeName = NamePrefix + "tidb-sql-tls"
// TiDBSQLTLSMountPath is the volume mount path for the TLS secret used by TLS communication between TiDB server and MySQL client.
TiDBSQLTLSMountPath = "/var/lib/tidb-sql-tls"
)

const (
Expand Down Expand Up @@ -313,29 +312,8 @@ type TiDBGroupSpec struct {
// Service defines some fields used to override the default service.
Service *TiDBService `json:"service,omitempty"`

// Whether enable the TLS connection between the TiDB server and MySQL client.
TLSClient *TiDBTLSClient `json:"tlsClient,omitempty"`

// BootstrapSQLConfigMapName is the name of the ConfigMap which contains the bootstrap SQL file with the key `bootstrap-sql`,
// which will only be executed when a TiDB cluster bootstrap on the first time.
// The field should be set ONLY when create the first TiDB group for a cluster, since it only take effect on the first time bootstrap.
// Only v6.5.1+ supports this feature.
BootstrapSQLConfigMapName *string `json:"bootstrapSQLConfigMapName,omitempty"`

// Whether enable `tidb_auth_token` authentication method.
// To enable this feature, a K8s secret named `<clusterName>-tidb-auth-token-jwks-secret` must be created to store the JWKs.
// ref: https://docs.pingcap.com/tidb/stable/security-compatibility-with-mysql#tidb_auth_token
// Defaults to false.
TiDBAuthToken *TiDBAuthToken `json:"tidbAuthToken,omitempty"`

SchedulePolicies []SchedulePolicy `json:"schedulePolicies,omitempty"`

// ConfigUpdateStrategy determines how the configuration change is applied to the cluster.
// Valid values are "RollingUpdate" (by default) and "InPlace".
// +kubebuilder:validation:Enum=RollingUpdate;InPlace
// +kubebuilder:default="RollingUpdate"
ConfigUpdateStrategy ConfigUpdateStrategy `json:"configUpdateStrategy,omitempty"`

Template TiDBTemplate `json:"template"`
}

Expand All @@ -357,7 +335,10 @@ type TiDBTemplateSpec struct {
// Resources defines resource required by TiDB.
Resources ResourceRequirements `json:"resources,omitempty"`
// Config defines config file of TiDB.
Config ConfigFile `json:"config"`
Config ConfigFile `json:"config"`
UpdateStrategy UpdateStrategy `json:"updateStrategy,omitempty"`

Security *TiDBSecurity `json:"security,omitempty"`
// Volumes defines data volume of TiDB, it is optional.
Volumes []Volume `json:"volumes,omitempty"`

Expand All @@ -372,6 +353,25 @@ type TiDBTemplateSpec struct {
Overlay *Overlay `json:"overlay,omitempty"`
}

type TiDBSecurity struct {
// Whether enable the TLS connection between the TiDB server and MySQL client.
// TODO(liubo02): rename the TiDBTLSClient struct,
TLS *TiDBTLS `json:"tls,omitempty"`

// BootstrapSQL refer to a configmap which contains the bootstrap SQL file with the key `bootstrap-sql`,
// which will only be executed when a TiDB cluster bootstrap on the first time.
// The field should be set ONLY when create the first TiDB group for a cluster, since it only take effect on the first time bootstrap.
// Only v6.5.1+ supports this feature.
// TODO(liubo02): move to cluster spec
BootstrapSQL *corev1.LocalObjectReference `json:"bootstrapSQL,omitempty"`

// Whether enable `tidb_auth_token` authentication method.
// To enable this feature, a K8s secret named `<groupName>-tidb-auth-token-jwks-secret` must be created to store the JWKs.
// ref: https://docs.pingcap.com/tidb/stable/security-compatibility-with-mysql#tidb_auth_token
// Defaults to false.
AuthToken *TiDBAuthToken `json:"authToken,omitempty"`
}

type TiDBServer struct {
// Port defines all ports listened by TiDB.
Ports TiDBPorts `json:"ports,omitempty"`
Expand Down Expand Up @@ -437,7 +437,7 @@ type TiDBService struct {
Type corev1.ServiceType `json:"type,omitempty"`
}

type TiDBTLSClient struct {
type TiDBTLS struct {
// When enabled, TiDB will accept TLS encrypted connections from MySQL clients.
// The steps to enable this feature:
// 1. Generate a TiDB server-side certificate and a client-side certifiacete for the TiDB cluster.
Expand All @@ -446,29 +446,29 @@ type TiDBTLSClient struct {
// - use the K8s built-in certificate signing system signed certificates: https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/
// - or use cert-manager signed certificates: https://cert-manager.io/
// 2. Create a K8s Secret object which contains the TiDB server-side certificate created above.
// The name of this Secret must be: <clusterName>-<groupName>-server-secret.
// kubectl create secret generic <clusterName>-<groupName>-server-secret --namespace=<namespace> --from-file=tls.crt=<path/to/tls.crt> --from-file=tls.key=<path/to/tls.key> --from-file=ca.crt=<path/to/ca.crt>
// The name of this Secret must be: <groupName>-tidb-server-secret.
// kubectl create secret generic <groupName>-tidb-server-secret --namespace=<namespace> --from-file=tls.crt=<path/to/tls.crt> --from-file=tls.key=<path/to/tls.key> --from-file=ca.crt=<path/to/ca.crt>
// 3. Create a K8s Secret object which contains the TiDB client-side certificate created above which will be used by TiDB Operator.
// The name of this Secret must be: <clusterName>-<groupName>-client-secret.
// kubectl create secret generic <clusterName>-<groupName>-client-secret --namespace=<namespace> --from-file=tls.crt=<path/to/tls.crt> --from-file=tls.key=<path/to/tls.key> --from-file=ca.crt=<path/to/ca.crt>
// The name of this Secret must be: <groupName>-tidb-client-secret.
// kubectl create secret generic <groupName>-tidb-client-secret --namespace=<namespace> --from-file=tls.crt=<path/to/tls.crt> --from-file=tls.key=<path/to/tls.key> --from-file=ca.crt=<path/to/ca.crt>
// 4. Set Enabled to `true`.
Enabled bool `json:"enabled,omitempty"`
MySQL *TLS `json:"mysql,omitempty"`

// TODO(csuzhangxc): usage of the following fields
// TODO(liubo02): uncomment them after it's worked

// DisableClientAuthn will skip client's certificate validation from the TiDB server.
// Optional: defaults to false
DisableClientAuthn bool `json:"disableClientAuthn,omitempty"`
// DisableClientAuthn bool `json:"disableClientAuthn,omitempty"`

// SkipInternalClientCA will skip TiDB server's certificate validation for internal components like Initializer, Dashboard, etc.
// Optional: defaults to false
SkipInternalClientCA bool `json:"skipInternalClientCA,omitempty"`
// SkipInternalClientCA bool `json:"skipInternalClientCA,omitempty"`
}

type TiDBAuthToken struct {
// Enabled indicates whether the `tidb_auth_token` authentication method is enabled.
// Defaults to false.
Enabled bool `json:"enabled,omitempty"`
// Secret name of jwks
JWKs corev1.LocalObjectReference `json:"jwks"`
}

type TiDBGroupStatus struct {
Expand Down Expand Up @@ -499,29 +499,28 @@ type TiDBStatus struct {
CommonStatus `json:",inline"`
}

// IsTLSClientEnabled returns whether the TLS between TiDB server and MySQL client is enabled.
func (in *TiDBGroup) IsTLSClientEnabled() bool {
return in.Spec.TLSClient != nil && in.Spec.TLSClient.Enabled
// IsMySQLTLSEnabled returns whether the TLS between TiDB server and MySQL client is enabled.
func (in *TiDB) IsMySQLTLSEnabled() bool {
return in.Spec.Security != nil && in.Spec.Security.TLS != nil && in.Spec.Security.TLS.MySQL != nil && in.Spec.Security.TLS.MySQL.Enabled
}

// TiDBServerTLSSecretName returns the secret name used in TiDB server for the TLS between TiDB server and MySQL client.
func (in *TiDBGroup) TiDBServerTLSSecretName() string {
return fmt.Sprintf("%s-tidb-server-secret", in.Name)
}

// TiDBClientTLSSecretName returns the secret name used in MySQL client for the TLS between TiDB server and MySQL client.
func (in *TiDBGroup) TiDBClientTLSSecretName() string {
return fmt.Sprintf("%s-tidb-client-secret", in.Name)
// MySQLTLSSecretName returns the secret name used in TiDB server for the TLS between TiDB server and MySQL client.
func (in *TiDB) MySQLTLSSecretName() string {
prefix, _ := in.NamePrefixAndSuffix()
return prefix + "-tidb-server-secret"
}

func (in *TiDBGroup) IsBootstrapSQLEnabled() bool {
return in.Spec.BootstrapSQLConfigMapName != nil && *in.Spec.BootstrapSQLConfigMapName != ""
func (in *TiDB) IsBootstrapSQLEnabled() bool {
return in.Spec.Security != nil && in.Spec.Security.BootstrapSQL != nil
}

func (dbg *TiDBGroup) IsTokenBasedAuthEnabled() bool {
return dbg.Spec.TiDBAuthToken != nil && dbg.Spec.TiDBAuthToken.Enabled
func (in *TiDB) IsTokenBasedAuthEnabled() bool {
return in.Spec.Security != nil && in.Spec.Security.AuthToken != nil
}

func (dbg *TiDBGroup) TiDBAuthTokenJWKSSecretName() string {
return fmt.Sprintf("%s-tidb-auth-token-jwks-secret", dbg.Spec.Cluster.Name)
func (in *TiDB) AuthTokenJWKSSecretName() string {
if in.IsTokenBasedAuthEnabled() {
return in.Spec.Security.AuthToken.JWKs.Name
}
return ""
}
12 changes: 5 additions & 7 deletions apis/core/v1alpha1/tiflash_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -300,13 +300,8 @@ type TiFlashGroupSpec struct {
Replicas *int32 `json:"replicas"`
Version string `json:"version"`

// ConfigUpdateStrategy determines how the configuration change is applied to the cluster.
// Valid values are "RollingUpdate" (by default) and "InPlace".
// +kubebuilder:validation:Enum=RollingUpdate;InPlace
// +kubebuilder:default="RollingUpdate"
ConfigUpdateStrategy ConfigUpdateStrategy `json:"configUpdateStrategy,omitempty"`
SchedulePolicies []SchedulePolicy `json:"schedulePolicies,omitempty"`
Template TiFlashTemplate `json:"template"`
SchedulePolicies []SchedulePolicy `json:"schedulePolicies,omitempty"`
Template TiFlashTemplate `json:"template"`
}

type TiFlashTemplate struct {
Expand All @@ -326,6 +321,9 @@ type TiFlashTemplateSpec struct {

// Config defines config file of TiFlash
Config ConfigFile `json:"config"`

UpdateStrategy UpdateStrategy `json:"updateStrategy,omitempty"`

// ProxyConfig defines config file of TiFlash proxy
ProxyConfig ConfigFile `json:"proxyConfig,omitempty"`

Expand Down
16 changes: 2 additions & 14 deletions apis/core/v1alpha1/tikv_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -151,10 +151,6 @@ func (in *TiKVGroup) GetDesiredReplicas() int32 {
return *in.Spec.Replicas
}

func (in *TiKVGroup) MountClusterClientSecret() bool {
return in.Spec.MountClusterClientSecret != nil && *in.Spec.MountClusterClientSecret
}

func (in *TiKVGroup) GetDesiredVersion() string {
return in.Spec.Version
}
Expand Down Expand Up @@ -291,19 +287,10 @@ type TiKVGroupSpec struct {
Replicas *int32 `json:"replicas"`
Version string `json:"version"`

// MountClusterClientSecret indicates whether to mount `cluster-client-secret` to the Pod.
MountClusterClientSecret *bool `json:"mountClusterClientSecret,omitempty"`

// +listType=map
// +listMapKey=type
SchedulePolicies []SchedulePolicy `json:"schedulePolicies,omitempty"`

// ConfigUpdateStrategy determines how the configuration change is applied to the cluster.
// Valid values are "RollingUpdate" (by default) and "InPlace".
// +kubebuilder:validation:Enum=RollingUpdate;InPlace
// +kubebuilder:default="RollingUpdate"
ConfigUpdateStrategy ConfigUpdateStrategy `json:"configUpdateStrategy,omitempty"`

Template TiKVTemplate `json:"template"`
}

Expand All @@ -324,7 +311,8 @@ type TiKVTemplateSpec struct {
// Resources defines resource required by TiKV
Resources ResourceRequirements `json:"resources,omitempty"`
// Config defines config file of TiKV
Config ConfigFile `json:"config"`
Config ConfigFile `json:"config"`
UpdateStrategy UpdateStrategy `json:"updateStrategy,omitempty"`
// Volumes defines data volume of TiKV
Volumes []Volume `json:"volumes"`

Expand Down
Loading

0 comments on commit 652df2b

Please sign in to comment.