remove servicemanager, add security context to containers

helm/templates/_helpers.tpl

@@ -182,44 +182,13 @@ Create the name of the service account to use
 {{- end -}}
 {{- end -}}
 
-{{/*
-Create a default fully qualified pinot servicemanager name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-*/}}
-{{- define "pinot.servicemanager.fullname" -}}
-{{- printf "%s-%s" (include "pinot.fullname" .) .Values.servicemanager.name }}
-{{- end -}}
-
-{{/*
-Create the name of the service account to use
-*/}}
-{{- define "pinot.servicemanager.serviceAccountName" -}}
-{{- if .Values.servicemanager.serviceAccount.create -}}
-{{ default (include "pinot.servicemanager.fullname" .) .Values.servicemanager.serviceAccount.name }}
-{{- else -}}
-{{ default "default" .Values.servicemanager.serviceAccount.name }}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Docker image to use for service manager
-*/}}
-{{/*{{- define "pinot.servicemanager.image" -}}*/}}
-{{/*  {{- if and .Values.servicemanager.image.repository .Values.servicemanager.image.tag -}}*/}}
-{{/*    {{- printf "%s:%s" .Values.servicemanager.image.repository .Values.servicemanager.image.tag }}*/}}
-{{/*    {{- if .Values.servicemanager.image.sha256 -}}*/}}
-{{/*      {{- printf "@sha256:%s" .Values.servicemanager.image.sha256 }}*/}}
-{{/*    {{- end -}}*/}}
-{{/*  {{- else -}}*/}}
-{{/*    {{- printf "%s:%s" .Values.image.repository .Chart.Version }}*/}}
-{{/*  {{- end -}}*/}}
-{{/*{{- end -}}*/}}
-
 {{/*
 Docker image to use for controller, broker, minion and server
 */}}
 {{- define "pinot.image" -}}
-  {{- if .Values.image.registry -}}
+  {{- if .Values.global.image.registry -}}
+    {{- printf "%s/" .Values.global.image.registry }}
+  {{- else if .Values.image.registry -}}
     {{- printf "%s/" .Values.image.registry }}
   {{- end -}}
   {{- if and .Values.image.tagOverride  -}}

helm/templates/broker/statefulset.yml

@@ -92,6 +92,10 @@ spec:
           {{- end }}
           resources:
             {{- toYaml .Values.broker.resources | nindent 12 }}
+          {{- with .Values.broker.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
         {{- if .Values.broker.prometheus.jmx.enabled }}
         - name: prometheus-jmx-exporter
           image: "{{ .Values.broker.prometheus.jmx.image.repository }}:{{ .Values.broker.prometheus.jmx.image.tag }}"
@@ -110,6 +114,10 @@ spec:
           volumeMounts:
             - name: jmx-config
               mountPath: /etc/jmx-config
+          {{- with .Values.broker.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
         {{- end }}
       restartPolicy: Always
       serviceAccountName: {{ include "pinot.broker.serviceAccountName" . }}
@@ -143,7 +151,7 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.broker.securityContext }}
+      {{- with .Values.broker.podSecurityContext }}
       securityContext:
         {{- toYaml . | nindent 8 }}
       {{- end }}

helm/templates/controller/prometheusrules.yaml

@@ -24,7 +24,6 @@ spec:
         summary: 'Pinot segments in Error state'
         message: '{{`{{ $value }}`}} segments in table {{`{{ $labels.table }}`}} are in Error state'
       expr: sum by(pod, table, tabletype) (pinot_controller_segmentsinerrorstate_value) > 0
-      for: 10s
       for: {{ dig "PinotErrorSegments" "for" "1m" .Values.controller.prometheusrule }}
       labels:
         severity: {{ dig "PinotErrorSegments" "severity" "critical" .Values.controller.prometheusrule }}

helm/templates/controller/statefulset.yaml

@@ -122,6 +122,10 @@ spec:
           {{- end }}
           resources:
             {{- toYaml .Values.controller.resources | nindent 12 }}
+          {{- with .Values.controller.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
         {{- if .Values.controller.prometheus.jmx.enabled }}
         - name: prometheus-jmx-exporter
           image: "{{ .Values.controller.prometheus.jmx.image.repository }}:{{ .Values.controller.prometheus.jmx.image.tag }}"
@@ -140,6 +144,10 @@ spec:
           volumeMounts:
             - name: jmx-config
               mountPath: /etc/jmx-config
+          {{- with .Values.controller.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
         {{- end }}
       restartPolicy: Always
       serviceAccountName: {{ include "pinot.controller.serviceAccountName" . }}
@@ -188,7 +196,7 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.controller.securityContext }}
+      {{- with .Values.controller.podSecurityContext }}
       securityContext:
         {{- toYaml . | nindent 8 }}
       {{- end }}

helm/templates/minion/statefulset.yml

@@ -96,6 +96,10 @@ spec:
 #            failureThreshold: {{ .Values.minion.readinessProbe.failureThreshold }}
           resources:
             {{- toYaml .Values.minion.resources | nindent 12 }}
+          {{- with .Values.minion.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
         {{- if .Values.minion.prometheus.jmx.enabled }}
         - name: prometheus-jmx-exporter
           image: "{{ .Values.minion.prometheus.jmx.image.repository }}:{{ .Values.minion.prometheus.jmx.image.tag }}"
@@ -114,6 +118,10 @@ spec:
           volumeMounts:
             - name: jmx-config
               mountPath: /etc/jmx-config
+          {{- with .Values.minion.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
         {{- end }}
       restartPolicy: Always
       serviceAccountName: {{ include "pinot.minion.serviceAccountName" . }}
@@ -152,7 +160,7 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.minion.securityContext }}
+      {{- with .Values.minion.podSecurityContext }}
       securityContext:
         {{- toYaml . | nindent 8 }}
       {{- end }}

helm/templates/server/statefulset.yml

@@ -128,6 +128,10 @@ spec:
             {{- toYaml . | nindent 12 }}
           {{- end }}
           resources: {{ toYaml $tier.resources | nindent 12 }}
+          {{- with $tier.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
         {{- if $tier.prometheus.jmx.enabled }}
         - name: prometheus-jmx-exporter
           image: "{{ $tier.prometheus.jmx.image.repository }}:{{ $tier.prometheus.jmx.image.tag }}"
@@ -146,6 +150,10 @@ spec:
           volumeMounts:
             - name: jmx-config
               mountPath: /etc/jmx-config
+          {{- with $tier.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
         {{- end }}
       restartPolicy: Always
       serviceAccountName: {{ include "pinot.server.serviceAccountName" $ }}
@@ -192,7 +200,7 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with $tier.securityContext }}
+      {{- with $tier.podSecurityContext }}
       securityContext:
         {{- toYaml . | nindent 8 }}
       {{- end }}