Update to InfluxDB Enterprise 1.9.5 (#368)

.github/workflows/helm-charts-test.yaml

@@ -46,10 +46,16 @@ jobs:
           kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.15.1/cert-manager.yaml
           sleep 30 # wait for CertManager
           kubectl apply -f ./charts/influxdb-enterprise/example-resources.yaml
+          kubectl create secret generic influxdb-license --from-literal=INFLUXDB_ENTERPRISE_LICENSE_KEY=${INFLUXDB_ENTERPRISE_LICENSE_KEY}
+        env:
+          INFLUXDB_ENTERPRISE_LICENSE_KEY: "${{ secrets.INFLUXDB_ENTERPRISE_LICENSE_KEY }}"
         if: steps.list-changed.outputs.changed == 'true'
 
       - name: Run chart-testing (install)
-        run: ct install
-        env:
-          INFLUXDB_ENTERPRISE_LICENSE_KEY: "${{ secrets.INFLUXDB_ENTERPRISE_LICENSE_KEY }}"
+        run: ct install --namespace=default
+
+# When https://github.com/helm/chart-testing/issues/212 is fixed, this can be used to set the license key instead of using env from secret
+#        run: ct install --namespace=default --helm-extra-args="--set license.key=${INFLUXDB_ENTERPRISE_LICENSE_KEY}"
+#        env:
+#          INFLUXDB_ENTERPRISE_LICENSE_KEY: "${{ secrets.INFLUXDB_ENTERPRISE_LICENSE_KEY }}"
         if: steps.list-changed.outputs.changed == 'true'

charts/influxdb-enterprise/Chart.yaml

 apiVersion: v1
-version: 0.1.13
-appVersion: 1.8.5
+version: 0.1.14
+appVersion: 1.9.5
 engine: gotpl
 
 name: influxdb-enterprise
-type: application
 description: Run InfluxDB Enterprise on Kubernetes
 keywords:
   - influxdb

charts/influxdb-enterprise/ci/env-secret-values.yaml

+# Default values for influxdb-enterprise.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+nameOverride: ""
+fullnameOverride: ""
+imagePullSecrets: []
+
+# License-key and license-path are mutually exclusive. Use only one and leave the other blank.
+license: {}
+  # You can put your license key here for testing this chart out,
+  # but we STRONGLY recommend using a license file stored in a secret
+  # when you ship to production.
+  # key: ""
+  # secret:
+  #   name: influxdb-license
+  #   key: json
+
+# Service account to use for deployment
+# If the name is not specified default account will be used
+serviceAccount:
+  create: false
+  name: ''
+  annotations: {}
+
+## The name of a secret in the same kubernetes namespace which contain values
+## to be added to the environment.
+## This can be used, for example, to set the INFLUXDB_ENTERPRISE_LICENSE_KEY
+## or INFLUXDB_ENTERPRISE_LICENSE_PATH environment variable.
+envFromSecret: influxdb-license
+
+# A secret with keys "username" and "password" is required
+# This bootstrap configuration allows you to configure
+# some parts of the InfluxDB system at install time.
+#
+# This job ONLY runs once, after the first `helm upgrade --install`
+# or `helm install`
+#
+# This job WILL NOT run on upgrades
+#
+bootstrap:
+  # This section allows you to enable authentication'
+  # of the data nodes, which will create a username
+  # and password for your "admin" account.
+  # A secret should be provided, which will have the keys
+  # "username" and "password" available.
+  auth:
+    secretName: influxdb-auth
+  # This section allows you to use DDL and DML to define
+  # databases, retention policies, and inject some data.
+  # When using the configMap setting, the keys "ddl" and "dml"
+  # must exist, even if one of them is empty.
+  # DDL is executed before DML, to enforce databases and retention policies
+  # to exist.
+  ddldml: {}
+    # configMap: influxdb-ddl-dml
+    # resources: {}
+
+
+# Sets the tagged version of the docker image that you want to run, will default to latest
+# The suffix is if you are pulling from influx repo, example images will be influxdb:1.8.0-meta and influxdb:1.8.0-data
+# If set to true, the suffix won't be added
+# image:
+#  tag: v1.eg.whatever
+#  ignoresuffix: true | false
+
+meta:
+  replicas: 1
+  image: {}
+    # override: true
+    # pullPolicy: IfNotPresent
+    # repository: influxdb
+  # nodeSelector: {}
+  # tolerations: []
+  affinity:
+    podAntiAffinity:
+      preferredDuringSchedulingIgnoredDuringExecution:
+      - weight: 1
+        podAffinityTerm:
+          labelSelector:
+            matchExpressions:
+            - key: influxdb.influxdata.com/component
+              operator: In
+              values:
+              - meta
+          topologyKey: kubernetes.io/hostname
+  # podAnnotations: {}
+  #
+  # podSecurityContext: {}
+  #   fsGroup: 2000
+  #
+  # This allows you to run the pods as a non-privileged user, set to the uid
+  # securityContext: {}
+  #   runAsUser: 2000
+  #   runAsGroup: 2000
+  #  capabilities:
+  #    drop:
+  #    - ALL
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+  #
+  # These are the commands that will be run before influxdb is started
+  # preruncmds:
+  #   - cmd: ls -l
+  #     description: We want to see what's in the directory
+  #   - cmd: stat $HOME/somefile
+  #     description: And we run a second command
+  # This secret needs a key called "secret" and it should be a long random string
+  # Please see docs for shared-internal-secret:
+  # https://docs.influxdata.com/enterprise_influxdb/v1.8/administration/config-data-nodes/#meta-internal-shared-secret
+  sharedSecret:
+    secretName: influxdb-shared-secret
+  #
+  ## Persist data to a persistent volume
+  ##
+  persistence:
+    enabled: false
+    ## A manually managed Persistent Volume and Claim
+    ## Requires persistence.enabled: true
+    ## If defined, PVC must be created manually before volume will be bound
+    # existingClaim:
+    ## influxdb data Persistent Volume Storage Class
+    ## If defined, storageClassName: <storageClass>
+    ## If set to "-", storageClassName: "", which disables dynamic provisioning
+    ## If undefined (the default) or set to null, no storageClassName spec is
+    ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
+    ##   GKE, AWS & OpenStack)
+    ##
+    # storageClass: "-"
+    # annotations:
+    # accessMode: ReadWriteOnce
+    # size: 8Gi
+  # Pick one
+  podDisruptionBudget:
+    # maxUnavailable: 2
+    minAvailable: 2
+  https:
+    # If you need to debug the data nodes registration with the meta nodes, we recommend
+    # that you comment out the active curl command in the data-configmap and uncomment the following
+    # line, which has -v / debugging enabled.
+    enabled: true
+    # The `useCertManager` option, when set to true, will
+    # automatically create the certificate resources for you.
+    # You do not need to set the secret.name when using this flag.
+    useCertManager: true
+    secret:
+      name: influxdb-tls
+      # crt: tls.crt
+      # key: tls.key
+      # ca: ca.crt
+      # caSecret: secret-name # only use if different from the above
+    insecure: true
+
+
+data:
+  replicas: 1
+  image: {}
+    # override: true
+    # pullPolicy: IfNotPresent
+    # repository: influxdb
+  # nodeSelector: {}
+  # tolerations: []
+  affinity:
+    podAntiAffinity:
+      preferredDuringSchedulingIgnoredDuringExecution:
+      - weight: 1
+        podAffinityTerm:
+          labelSelector:
+            matchExpressions:
+            - key: influxdb.influxdata.com/component
+              operator: In
+              values:
+              - data
+          topologyKey: kubernetes.io/hostname
+  # podAnnotations: {}
+  #
+  # podSecurityContext: {}
+  #   fsGroup: 2000
+  #
+  # This allows you to run the pods as a non-privileged user, set to the uid
+  # securityContext: {}
+  #   runAsUser: 2000
+  #   runAsGroup: 2000
+  #  capabilities:
+  #    drop:
+  #    - ALL
+  #  capabilities:
+  #    drop:
+  #    - ALL
+  #
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+  #
+  # These are the commands that will be run before influxdb is started
+  # preruncmds:
+  #   - cmd: ls -l
+  #     description: We want to see what's in the directory
+  #   - cmd: stat $HOME/somefile
+  #     description: And we run a second command
+  #
+  ## Persist data to a persistent volume
+  ##
+  ## Specify a service type
+  ## NodePort is default
+  ## ref: http://kubernetes.io/docs/user-guide/services/
+  ##
+  service:
+    ## Specify a service type
+    ## ClusterIP is default
+    ## ref: http://kubernetes.io/docs/user-guide/services/
+    ## Add annotations to service
+    # annotations: {}
+    type: ClusterIP
+    # loadBalancerIP: ""
+    # externalIPs: []
+    # externalTrafficPolicy: ""
+  persistence:
+    enabled: false
+    ## A manually managed Persistent Volume and Claim
+    ## Requires persistence.enabled: true
+    ## If defined, PVC must be created manually before volume will be bound
+    # existingClaim:
+    ## influxdb data Persistent Volume Storage Class
+    ## If defined, storageClassName: <storageClass>
+    ## If set to "-", storageClassName: "", which disables dynamic provisioning
+    ## If undefined (the default) or set to null, no storageClassName spec is
+    ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
+    ##   GKE, AWS & OpenStack)
+    ##
+    # storageClass: "-"
+    # annotations:
+    # accessMode: ReadWriteOnce
+    # size: 8Gi
+  https:
+    # If you need to debug the data nodes registration with the meta nodes, we recommend
+    # that you comment out the active curl command in the data-configmap and uncomment the following
+    # line, which has -v / debugging enabled.
+    enabled: true
+    # The `useCertManager` option, when set to true, will
+    # automatically create the certificate resources for you.
+    # You do not need to set the secret.name when using this flag.
+    useCertManager: true
+    secret:
+      name: influxdb-tls
+      # crt: tls.crt
+      # key: tls.key
+      # ca: ca.crt
+      # caSecret: secret-name # only use if different from the above
+    insecure: true

charts/influxdb-enterprise/templates/data-configmap.yaml

@@ -27,7 +27,7 @@ data:
       {{ if .Values.license.key }}
       # license-key and license-path are mutually exclusive, use only one and leave the other blank
       license-key = "{{ .Values.license.key }}" #✨ mutually exclusive with license-path
-      {{ else }}
+      {{ else if .Values.license.secret }}
       # license-key and license-path are mutually exclusive, use only one and leave the other blank
       license-path = "/var/run/secrets/influxdb/license.json"
       {{ end }}

charts/influxdb-enterprise/templates/data-statefulset.yaml

@@ -88,6 +88,11 @@ spec:
           env:
           - name: RELEASE_NAME
             value: {{ include "influxdb-enterprise.fullname" . }}
+          {{- if .Values.envFromSecret }}
+          envFrom:
+          - secretRef:
+              name: {{ .Values.envFromSecret }}
+          {{- end }}
           ports:
             - name: http
               containerPort: 8086

charts/influxdb-enterprise/templates/meta-configmap.yaml

@@ -14,7 +14,7 @@ data:
       {{ if .Values.license.key }}
       # license-key and license-path are mutually exclusive, use only one and leave the other blank
       license-key = "{{ .Values.license.key }}" #✨ mutually exclusive with license-path
-      {{ else }}
+      {{ else if .Values.license.secret }}
       # license-key and license-path are mutually exclusive, use only one and leave the other blank
       license-path = "/var/run/secrets/influxdb/license.json"
       {{ end }}

charts/influxdb-enterprise/templates/meta-statefulset.yaml

@@ -91,6 +91,11 @@ spec:
                 secretKeyRef:
                   name: {{ .Values.meta.sharedSecret.secretName }}
                   key: secret
+          {{- if .Values.envFromSecret }}
+          envFrom:
+            - secretRef:
+                name: {{ .Values.envFromSecret }}
+          {{- end }}
           ports:
             - name: http
               containerPort: 8091

charts/influxdb-enterprise/values.yaml

@@ -7,7 +7,7 @@ fullnameOverride: ""
 imagePullSecrets: []
 
 # License-key and license-path are mutually exclusive. Use only one and leave the other blank.
-license:
+license: {}
   # You can put your license key here for testing this chart out,
   # but we STRONGLY recommend using a license file stored in a secret
   # when you ship to production.
@@ -23,6 +23,12 @@ serviceAccount:
   name: ''
   annotations: {}
 
+## The name of a secret in the same kubernetes namespace which contain values
+## to be added to the environment.
+## This can be used, for example, to set the INFLUXDB_ENTERPRISE_LICENSE_KEY
+## or INFLUXDB_ENTERPRISE_LICENSE_PATH environment variable.
+# envFromSecret: influxdb-license
+
 # A secret with keys "username" and "password" is required
 # This bootstrap configuration allows you to configure
 # some parts of the InfluxDB system at install time.