RockteMQ-AI commented on code in PR #61: URL: https://github.com/apache/rocketmq-operator/pull/61#discussion_r3839464121
########## example/rocketmq_v1alpha1_rocketmq_feature_cluster.yaml: ########## @@ -0,0 +1,180 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: broker-config +data: + # BROKER_MEM sets the broker JVM, if set to "" then Xms = Xmx = max(min(1/2 ram, 1024MB), min(1/4 ram, 8GB)) + BROKER_MEM: " -Xms2g -Xmx2g -Xmn1g " + broker-common.conf: | + # brokerClusterName, brokerName, brokerId are automatically generated by the operator and do not set it manually!!! + deleteWhen=04 + fileReservedTime=48 + flushDiskType=ASYNC_FLUSH + # set brokerRole to ASYNC_MASTER or SYNC_MASTER. DO NOT set to SLAVE because the replica instance will automatically be set!!! + brokerRole=ASYNC_MASTER + +--- +apiVersion: rocketmq.apache.org/v1alpha1 +kind: Broker +metadata: + # name of broker cluster + name: broker +spec: + # size is the number of the broker cluster, each broker cluster contains a master broker and [replicaPerGroup] replica brokers. + size: 1 + # nameServers is the [ip:port] list of name service + nameServers: "" + # replicaPerGroup is the number of each broker cluster + replicaPerGroup: 0 + # brokerImage is the customized docker image repo of the RocketMQ broker + brokerImage: apacherocketmq/rocketmq-broker:4.5.0-alpine-operator-0.3.0 + # imagePullPolicy is the image pull policy + imagePullPolicy: Always + # resources describes the compute resource requirements and limits + resources: + requests: + memory: "2048Mi" + cpu: "250m" + limits: + memory: "12288Mi" + cpu: "500m" + # allowRestart defines whether allow pod restart + allowRestart: true + # storageMode can be EmptyDir, HostPath, StorageClass + storageMode: EmptyDir + # hostPath is the local path to store data + hostPath: /tmp/data/rocketmq/broker + # scalePodName is [Broker name]-[broker group number]-master-0 + scalePodName: broker-0-master-0 + # env defines custom env, e.g. BROKER_MEM + env: + - name: BROKER_MEM + valueFrom: + configMapKeyRef: + name: broker-config + key: BROKER_MEM + # volumes defines the broker.conf + volumes: + - name: broker-config + configMap: + name: broker-config + items: + - key: broker-common.conf + path: broker-common.conf + # volumeClaimTemplates defines the storageClass + volumeClaimTemplates: + - metadata: + name: broker-storage + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 8Gi + selector: + matchLabels: + app: broker-storage-pv +--- +apiVersion: rocketmq.apache.org/v1alpha1 +kind: NameService +metadata: + name: name-service +spec: + # size is the the name service instance number of the name service cluster + size: 1 + # nameServiceImage is the customized docker image repo of the RocketMQ name service + nameServiceImage: apacherocketmq/rocketmq-nameserver:4.5.0-alpine-operator-0.3.0 + # imagePullPolicy is the image pull policy + imagePullPolicy: Always + # hostNetwork can be true or false + hostNetwork: true + podAnnotations: + prometheus.io/path: /metrics + prometheus.io/port: "5557" + prometheus.io/scrape: "true" + securityContext: + allowPrivilegeEscalation: true + runAsUser: 0 Review Comment: The NameService securityContext sets allowPrivilegeEscalation: true, runAsUser: 0, runAsGroup: 0. This example is intended as a copyable template, and running the name server as root with privilege escalation enabled is a poor security pattern for an Apache-shipped reference. Consider a non-root runAsUser (the alpine image supports a dedicated UID) and allowPrivilegeEscalation: false, or at minimum document the risk and make it opt-in. ########## pkg/apis/rocketmq/v1alpha1/broker_types.go: ########## @@ -56,6 +56,21 @@ type BrokerSpec struct { VolumeClaimTemplates []corev1.PersistentVolumeClaim `json:"volumeClaimTemplates"` // The name of pod where the metadata from ScalePodName string `json:"scalePodName"` + // Affinity, affinity and anti-affinity scheduling Review Comment: New pointer/slice/map fields (Affinity, SecurityContext, ImagePullSecrets, Tolerations, NodeSelector, PodAnnotations) were added to BrokerSpec, but the PR does not include updates to zz_generated_deepcopy.go. If the generated DeepCopyInto is not regenerated, these fields are shallow-copied: Affinity/SecurityContext pointers and NodeSelector/PodAnnotations maps will be shared between the informer cache and the object handed to the reconciler. Any mutation corrupts the shared cache and can cause cross-reconcile state corruption. Run the operator-sdk/k8s codegen to regenerate deepcopy for both broker_types.go and nameservice_types.go. ########## pkg/controller/broker/broker_controller.go: ########## @@ -401,8 +401,15 @@ func (r *ReconcileBroker) getBrokerStatefulSet(broker *rocketmqv1alpha1.Broker, Template: corev1.PodTemplateSpec{ ObjectMeta: metav1.ObjectMeta{ Labels: ls, + Annotations: broker.Spec.PodAnnotations, Review Comment: The new pod-scheduling fields are wired into getBrokerStatefulSet (Annotations, Affinity, SecurityContext, ImagePullSecrets, Tolerations, NodeSelector, PriorityClassName) and similarly into nameservice_controller.go, but no test changes accompany this PR. There is no coverage verifying that CR-spec values propagate to the rendered StatefulSet PodTemplateSpec, nor that nil/empty values (e.g. unset Affinity, empty PriorityClassName) render safely. Add reconciler tests asserting these fields pass through correctly. ########## deploy/crds/rocketmq_v1alpha1_broker_crd.yaml: ########## @@ -79,6 +79,31 @@ spec: items: type: object type: array + affinity: Review Comment: The new complex Kubernetes types (affinity, securityContext, tolerations, imagePullSecrets items) are declared as bare type: object/item type: object with no OpenAPI v3 properties. This provides no server-side validation, so malformed scheduling rules are accepted silently and only surface as Pod creation errors later. For a cleaner CRD (and better kubectl explain output), define the full schema via x-kubernetes-preserve-unknown-fields or the concrete property trees. Same applies to rocketmq_v1alpha1_nameservice_crd.yaml. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
