diff --git a/pkg/apis/vault/v1alpha1/types.go b/pkg/apis/vault/v1alpha1/types.go index 87128b7..f7e6e21 100644 --- a/pkg/apis/vault/v1alpha1/types.go +++ b/pkg/apis/vault/v1alpha1/types.go @@ -73,6 +73,9 @@ type VaultServiceSpec struct { // TLS policy of vault nodes TLS *TLSPolicy `json:"TLS,omitempty"` + + // PersistentVolumeClaimSpec for the ETCD Cluster + PersistentVolumeClaimSpec *v1.PersistentVolumeClaimSpec `json:"persistentVolumeClaimSpec,omitempty"` } // PodPolicy defines the policy for pods owned by vault operator. diff --git a/pkg/util/k8sutil/vault.go b/pkg/util/k8sutil/vault.go index 44c6cb8..1d9ec7b 100644 --- a/pkg/util/k8sutil/vault.go +++ b/pkg/util/k8sutil/vault.go @@ -75,34 +75,69 @@ func EtcdPeerTLSSecretName(vaultName string) string { // waits for all of its members to be ready. func DeployEtcdCluster(etcdCRCli etcdCRClient.Interface, v *api.VaultService) error { size := 3 - etcdCluster := &etcdCRAPI.EtcdCluster{ - TypeMeta: metav1.TypeMeta{ - Kind: etcdCRAPI.EtcdClusterResourceKind, - APIVersion: etcdCRAPI.SchemeGroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: EtcdNameForVault(v.Name), - Namespace: v.Namespace, - Labels: LabelsForVault(v.Name), - }, - Spec: etcdCRAPI.ClusterSpec{ - Size: size, - TLS: &etcdCRAPI.TLSPolicy{ - Static: &etcdCRAPI.StaticTLS{ - Member: &etcdCRAPI.MemberSecret{ - PeerSecret: EtcdPeerTLSSecretName(v.Name), - ServerSecret: EtcdServerTLSSecretName(v.Name), + etcdCluster := &etcdCRAPI.EtcdCluster{} + + if v.Spec.PersistentVolumeClaimSpec != nil { // If a PersistentVolumeClaimSpec is made in the vault manifest + etcdCluster = &etcdCRAPI.EtcdCluster{ // Deploy the etcd Cluster with the PVC spec + TypeMeta: metav1.TypeMeta{ + Kind: etcdCRAPI.EtcdClusterResourceKind, + APIVersion: etcdCRAPI.SchemeGroupVersion.String(), + }, + ObjectMeta: metav1.ObjectMeta{ + Name: EtcdNameForVault(v.Name), + Namespace: v.Namespace, + Labels: LabelsForVault(v.Name), + }, + Spec: etcdCRAPI.ClusterSpec{ + Size: size, + TLS: &etcdCRAPI.TLSPolicy{ + Static: &etcdCRAPI.StaticTLS{ + Member: &etcdCRAPI.MemberSecret{ + PeerSecret: EtcdPeerTLSSecretName(v.Name), + ServerSecret: EtcdServerTLSSecretName(v.Name), + }, + OperatorSecret: EtcdClientTLSSecretName(v.Name), }, - OperatorSecret: EtcdClientTLSSecretName(v.Name), + }, + Pod: &etcdCRAPI.PodPolicy{ + EtcdEnv: []v1.EnvVar{{ + Name: "ETCD_AUTO_COMPACTION_RETENTION", + Value: "1", + }}, + PersistentVolumeClaimSpec: v.Spec.PersistentVolumeClaimSpec, }, }, - Pod: &etcdCRAPI.PodPolicy{ - EtcdEnv: []v1.EnvVar{{ - Name: "ETCD_AUTO_COMPACTION_RETENTION", - Value: "1", - }}, + } + } else { // Otherwise, deploy default etcd cluster with no PVCs (ephemeral) + etcdCluster = &etcdCRAPI.EtcdCluster{ + TypeMeta: metav1.TypeMeta{ + Kind: etcdCRAPI.EtcdClusterResourceKind, + APIVersion: etcdCRAPI.SchemeGroupVersion.String(), }, - }, + ObjectMeta: metav1.ObjectMeta{ + Name: EtcdNameForVault(v.Name), + Namespace: v.Namespace, + Labels: LabelsForVault(v.Name), + }, + Spec: etcdCRAPI.ClusterSpec{ + Size: size, + TLS: &etcdCRAPI.TLSPolicy{ + Static: &etcdCRAPI.StaticTLS{ + Member: &etcdCRAPI.MemberSecret{ + PeerSecret: EtcdPeerTLSSecretName(v.Name), + ServerSecret: EtcdServerTLSSecretName(v.Name), + }, + OperatorSecret: EtcdClientTLSSecretName(v.Name), + }, + }, + Pod: &etcdCRAPI.PodPolicy{ + EtcdEnv: []v1.EnvVar{{ + Name: "ETCD_AUTO_COMPACTION_RETENTION", + Value: "1", + }}, + }, + }, + } } if v.Spec.Pod != nil { etcdCluster.Spec.Pod.Resources = v.Spec.Pod.Resources