cockroachdb / cockroachdb/helm-charts

Chart doesn't set requests/limits for "release-name"-init Job's own init container

Open
#34 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
105
Forks
152
Avg merge
4d 23h
Merged PRs (30d)
5

Description

Just as the title says. The root of the problem appears to be that the `job.init.yaml` template pulls in `init.resources` config from values for the _containers_ config, but not for the _initContainers_.

`containers` stanza:

```
containers:
- name: cluster-init
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
[...]
{{- with .Values.init.resources }}
resources: {{- toYaml . | nindent 12 }}
{{- end }}
```

vs. `initContainers` stanza with no mention of `Values.init.resources`:

```
initContainers:
# The init-certs container sends a CSR (certificate signing request) to
# the Kubernetes cluster.
# You can see pending requests using:
# kubectl get csr
# CSRs can be approved using:
# kubectl certificate approve
#
# In addition to the Node certificate and key, the init-certs entrypoint
# will symlink the cluster CA to the certs directory.
- name: init-certs
image: "{{ .Values.tls.init.image.repository }}:{{ .Values.tls.init.image.tag }}"
imagePullPolicy: {{ .Values.tls.init.image.pullPolicy | quote }}
command:
- /bin/ash
- -ecx
- >-
/request-cert
-namespace=${POD_NAMESPACE}
-certs-dir=/cockroach-certs/
-symlink-ca-from=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-type=client
-user=root
env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
volumeMounts:
- name: client-certs
mountPath: /cockroach-certs/
```

The stated goal of making these configurable values is to allow folks who are using Resource Quotas to avoid errors with the init job, but Resource Quotas apply to _all_ containers in a pod, including init containers.

In order for this to work, we have to apply the logic to the initContainers as well. If we don't, users see this and are left scratching their heads as to why the chart isn't doing what the docs say it should:

```
$ kubectl describe job.batch/crdb-cockroachdb-init
Name: crdb-cockroachdb-init
Namespace: auth-login-dev
Selector: controller-uid=5bc8024e-8f65-4a33-a04b-f4a36ca49b34
Labels: app.kubernetes.io/component=init
app.kubernetes.io/instance=crdb
app.kubernetes.io/managed-by=Helm
app.kubernetes.io/name=cockroachdb
helm.sh/chart=cockroachdb-4.1.11
Annotations: meta.helm.sh/release-name: crdb
meta.helm.sh/release-namespace: auth-login-dev
Parallelism: 1
Completions: 1
Pods Statuses: 0 Running / 0 Succeeded / 0 Failed
Pod Template:
Labels: app.kubernetes.io/component=init
app.kubernetes.io/instance=crdb
app.kubernetes.io/name=cockroachdb
controller-uid=5bc8024e-8f65-4a33-a04b-f4a36ca49b34
job-name=crdb-cockroachdb-init
Service Account: crdb-cockroachdb
Init Containers:
init-certs:
Image: cockroachdb/cockroach-k8s-request-cert:0.4
Port:
Host Port:
Command:
/bin/ash
-ecx
/request-cert -namespace=${POD_NAMESPACE} -certs-dir=/cockroach-certs/ -symlink-ca-from=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt -type=client -user=root
Environment:
POD_NAMESPACE: (v1:metadata.namespace)
Mounts:
/cockroach-certs/ from client-certs (rw)
Containers:
cluster-init:
Image: cockroachdb/cockroach:v20.1.8
Port:
Host Port:
Command:
/bin/bash
-c
while true; do initOUT=$(set -x; /cockroach/cockroach init --certs-dir=/cockroach-certs/ --host=crdb-cockroachdb-0.keycloak-crdb-cockroachdb:26257 2>&1); initRC="$?"; echo $initOUT; [[ "$initRC" == "0" ]] && exit 0; [[ "$initOUT" == *"cluster has already been initialized"* ]] && exit 0; sleep 5; done
Limits:
cpu: 10m
memory: 128Mi
Requests:
cpu: 10m
memory: 128Mi
Environment:
Mounts:
/cockroach-certs/ from client-certs (rw)
Volumes:
client-certs:
Type: EmptyDir (a temporary directory that shares a pod's lifetime)
Medium:
SizeLimit:
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Warning FailedCreate 28s job-controller Error creating: pods "crdb-cockroachdb-init-vw46d" is forbidden: failed quota: compute-resources: must specify limits.memory,requests.cpu,requests.memory

Jira issue: HELM-39

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.