Kubernetes Configuration Guide
Generic Configuration Service provides a centralized configuration service, which provides support across applications to manage configurations by using API based interface. This microservice supports deployment distribution and provides a stateless API interface and has a dedicated data store (database) to persist configurations uploaded through the API interface.
The following table defines the property of Start Scripts in the guide.
| PROPERTY | DEFAULT VALUE | POSSIBLE VALUES | DESCRIPTION |
|---|---|---|---|
| Database Properties | |||
| database_Key |
Mongo: mongodb Postgresql: postgresql |
Specifies the name of the database server and possible values are mongodb and postgresql. | |
| db_Enable_Secret | N | Y, N | A Secret is an object that contains a small amount of sensitive data such as a password, a token, or a key and allows to fetch the DB username and password through Kubernetes (k8s) secrets for MySQL DB if it is set to Y. |
| database_Name | systemgenericconfig | Specifies the name of the database used in sql server. | |
| Mongo | |||
| db_Username db_Password |
Postgresql genericconfigusr genericconfigpass |
To interact with a database, first connect to the server and supply username (uid) and password that match the server login. | |
| db_Connection _Url | Mongodb mongodb://mongodb-0. mongodb-svc.mongodb.svc. cluster.local:27017 |
MongoDB The following is the general form of the connection URL for shared cluster: mongodb://<hostname>:<port>,<hostname>:<port> mongodb://mongos0.example.com:27017,mongos1.example.com:27017,mongos2.example.com: 27017 |
|
|
Postgresql jdbc:postgresql://gc- postgresqldb-service. postgresql.svc.cluster.local: 5432/genericconfigdb |
mongodb:// -- A required prefix to identify that this is a string in the standard connection format. host[:port] -- The host (and optional port number) where the mongo instance for a sharded cluster is running. The user can specify a hostname, IP address, or UNIX domain socket. Specify as many hosts as appropriate for deployment topology. If the port number is not specified, the default port 27017 is used. |
||
| Postgresql: | |||
| We are using postgresql by default. With JDBC, a database is represented by a URL. jdbc:postgresql://host:port/database | |||
|
host -- The hostname of the server, defaults to a local host. To specify an IPv6 address, the host parameter should be enclosed with square brackets as shown below. jdbc:postgresql://[::1]:5740/accounting. |
|||
|
port -- The port number the server is listening on. Defaults to the PostgreSQL™ standard port number (5432). database -- The database name. |
|||
| encryption_Key encryption_Algorithm | temenos PBEWithMD5AndTripleDES | Indicates the key or password and algorithm to encrypt the plain text. | |
| Image Properties | |||
| tag | Specifies the release version of the image | ||
|
api_Image ingester_ Image scheduler_Image dbinit_Image |
temenos/ms- genericconfig-service temenos/ms- genericconfig-ingester temenos/ms- genericconfig-scheduler temenos/ms- genericconfig-dbscripts |
Specifies the name of Images for API, ingester, scheduler, and dbinit that are pushed to external repositories. Consider external repository as acr.azurecr.io and tag is 21.0.0. | |
| env_Name | Specifies the environment name which is added as a respective pod prefix. | ||
|
gc_Image_Pull _Secret dbinit_Image_ Pull_Secret |
Docker registry secret contains the Oracle Cloud Infrastructure credentials to use when pulling the image. The user needs to specify the image to pull from Container Registry, including the repository location and the Docker registry secret to use, in the application manifest file. kubectl: To create secret docker-registry <secret-name> --docker-server=<region-key>.ocir.io -- docker-username='<tenancy-namespace>/<oci-username>' --docker-password='<oci-auth- token>' --docker-email='<email-address>' gc_Image_Pull_Secret and dbinit_Image_Pull_Secret specifies the <secret-name>, that is used in the manifest file to refer to the already created secret. |
||
| Logger Properties | |||
| logger_Root_Level | INFO | INFO, DEBUG, ERROR | Specifies the configuration parameter for logging. INFO logger level is maintained by default. |
| Rolling Update | |||
| rolling_Update | false | true, false | Rolling updates allow deployment updates to take place with zero downtime by incidentally updating pods instances with new ones. |
| api_MaxSurge ingester_MaxSurge | 1 | Specifies the maximum number of pods that can be created over the desired number of pods. | |
| api_MaxUnavailable ingester_MaxUnavailable | 0 | Indicates the maximum number of pods that are unavailable during the update process. | |
| config_Location | svc/genericconfig-configmap. yaml | Indicates the location specified for the configmap.yaml. |
The following table defines the property of values.yaml in the guide.
| PROPERTY | DEFAULT VALUE | POSSIBLE VALUES | DESCRIPTION |
|---|---|---|---|
| Config Map | |||
| location | /svc/ms-adapterms-configmap.yaml | Specifies the location for the configmap.yaml. | |
| Rolling Update | |||
| enabled | false | true, false | Rolling updates allow deployment updates to take place with zero downtime by incrementally updating pods instances with new ones. |
|
maxsurge maxunavailable |
1 0 |
Indicates the maximum number of pods that can be created over the desired number of pods. Indicates the maximum number of pods that are unavailable during the update process. |
|
| Replica Count | |||
|
genericconfigapi commandingester |
1 | Replica Count is used to specify the number of pod instances running in a cluster at any given time to prevent users from losing access to their application when a pod fails or is inaccessible. | |
| Kafka Topic | Kafka topic names are the categories used to organize messages. Each topic has a name that is unique across the entire Kafka cluster. | ||
| topicpartitions | 1 | Kafka topics are divided into several partitions. While the topic is a logical concept in Kafka, a partition is the smallest storage unit that holds a subset of records owned by a topic. | |
| replicas | 1 | Replicas are used to specify the number of pod instances running in a cluster at any given time to prevent users from losing access to their application when a pod fails or is inaccessible. | |
|
inboxtopic inboxerrortopic outboxtopic |
ms-genericconfig-inbox-topic ms-genericconfig-error-topic ms-genericconfig-outbox |
The topic name is specified for genericconfig inbox when the event is produced. Error topic name specified for genericconfig inbox when there is an error when the event is produced. Error topic name specified for genericconfig inbox when there is an error when the event is consumed. |
|
| retentionms | 7200000 | A topic-level property for log retention time is retention.ms. | |
| segmentbytes | 1073741824 | When the log segment has reached the size specified by the log, segment.bytes parameter is set at default 1 GB, the log segment is closed and a new one is opened. After the log segment is closed, it can be considered for expiration (by log.retention.ms or log.retention.bytes). | |
| consumergroupid | genericconfigcg | Specifies the id of the consumer group of a topic in genericconfigms. | |
| Image | |||
| tag | DEV | Specifies the release version of the image. | |
| pullPolicy | IfNotPresent |
When creating the POD, one can specify the imagePullPolicyspecification, which guides the Kubelet service on how to pull the specified image during an update.
|
|
|
Repository genericconfigapi genericconfigingester genericconfigscheduler |
temenos/ms-genericconfig-service temenos/ms-genericconfig-ingester temenos/ms-genericconfig-scheduler |
Specifies the name of Images for API that are pushed to external repositories. Consider external repository as acr.azurecr.io and tag as 21.0.0. | |
| imagePullSecrets |
Docker registry secret contains the Oracle Cloud Infrastructure credentials to use in order to pull the image and the image needs to be specified to pull from Container Registry (including the repository location and the Docker registry secret to use), in the application manifest file. kubectl - To create secret docker-registry <secret-name> -- docker-server=<region-key>.ocir.io --docker- username='<tenancy-namespace>/<oci-username>' --docker- password='<oci-auth-token>' --docker-email='<email- address>' . imagePullSecrets specifies the <secret-name>, that is used in the manifest file to refer to the already created secret. |
||
| Deployment | |||
|
apiname schedulername ingestername |
genericconfig-api genericconfig-cache-update-job genericconfig-command-ingester |
Kubernetes Deployment is used to tell Kubernetes how to create or modify instances of the pods that hold a containerized application. Deployments can scale the number of replica pods, enable the rollout of updated code in a controlled manner, or roll back to an earlier deployment version if necessary and specifies the name of the image to be loaded for API, ingester, and scheduler. | |
| Service Name | |||
|
apiname ingestername |
genericconfig-gcapisvc genericconfig-command-ingester-svc |
This service is responsible for enabling network access to a set of pods and specifies the Kubernetes service name for API, and ingester. | |
| Database | |||
| DATABASE_KEY | mongodb, postgresql |
Specifies the name of the database server and the possible values are mongodb and postgresql. |
|
|
MONGO_CRED POSTGRESQL_CRED |
N | A Secret is an object that contains a small amount of sensitive data such as a password, a token, or a key. which allows to fetch the DB username and password through k8s secrets for DB if secret is set to Y. | |
| MONGODB_DBNAME | Specifies the name of the database used in sql server. | ||
| MONGODB_CONNECTION STR | mongodb://mongodb-0.mongodb-svc. mongodb.svc.cluster.local:27017,mongodb-1. mongodb-svc.mongodb.svc.cluster.local: 27017,mongodb-2.mongodb-svc.mongodb.svc. cluster.local:27017 |
The general form of the connection URL is as follows: oracle: jdbc:oracle:thin:@<host_or_ip>:1521:<db_name> db2: jdbc:db2://<host_or_ip>:50000/<db_name> ms-sql: jdbc:sqlserver://<host_or_ip>:1433; databaseName=<db_name> mongodb: mongodb://[username:password@]host1[:port1][,... hostN[:portN]][/[defaultauthdb][?options]] The general form of the connection URL for shared cluster is as follows: mongodb://<hostname>:<port>,<hostname>:<port> mongodb:// -- A required prefix to identify that this is a string in the standard connection format. host[: port] -- The host (and optional port number) where mongos instance for a sharded cluster is running. The user can specify a hostname, IP address, or UNIX domain socket. Specify as many hosts as appropriate for deployment topology. If a port number is not specified, the default port 27017 is used. |
|
| POSTGRESQL_CONNECTION URL |
oracle: jdbc:oracle:thin:@<host_or_ip>:1521:<db_name> db2: jdbc:db2://<host_or_ip>:50000/<db_name> ms-sql: jdbc:sqlserver://<host_or_ip>:1433; databaseName=<db_name> mongodb: mongodb://[username:password@]host1[:port1][,... hostN[:portN]][/[defaultauthdb][?options]] postgresql jdbc:postgresql://host:port/database With JDBC, a database is represented by a URL as shown below. jdbc:postgresql://host:port/database host -- The hostname of the server. Defaults to localhost. To specify an IPv6 address, the user must enclose the host parameter with square brackets, as shown below. jdbc:postgresql://[::1]:5740/accounting port -- The port number the server is listening on. Defaults to the PostgreSql database -- The database name. |
||
| POSTGRESQL_POOLSIZE | 10 | Specifies the number of connections maintained in the pool. | |
| POSTGRESQL_USERNAME | adapterserviceusr | To interact with a database, the user first needs to connect to the server with username (uid) to login to the server. | |
| POSTGRESQL_PASSWORD | adapterservicepass | To interact with a database, first connect to the server and give password (uid) for the server login. | |
|
temn_msf_db_pass_encryption_key temn_msf_db_pass_encryption_algorithm |
temenos PBEWithMD5AndTripleDES |
Encrypting the plain text, need some inputs for example, a Password and an Algorithm that is used to decrypt an encrypted input. These two values are mandatory to encrypt the plain text. | |
| Kafka | |||
| temnmsfstreamvendor | kafka | Specifies the vendor used to process messages to a topic. By default, we are using Kafka as a vendor. | |
| temnqueueimpl | kafka | Specifies the queue used to identify the listener container (processing messages). | |
| kafkabootstrapservers | my-cluster-kafka-bootstrap.kafka:9092 |
Specifies a list of host or port pairs for establishing the initial connection to the Kafka cluster. A host and port pair uses : as the separator as shown below. localhost:9092 localhost:9092,another.host: 9092 |
|
| schema_registry_url | http://schema-registry-svc.kafka.svc.cluster.local | Schema Registry in Kafka is used to store Avro Schemas. The schema registry URL is used to connect schema registry in kafka. | |
| Schema Registry | |||
| SCHEMA_REGISTRY_KAFKASTORE_BOOTSTRAP_SERVERS | PLAINTEXT://my-cluster-kafka-bootstrap.kafka: 9092 | Bootstrap servers are used to coordinate Schema Registry instances (leader election), and store schema data. | |
| SCHEMA_REGISTRY_HOST_NAME | schema-registry | Hostname is used to publish ZooKeeper for clients to use. | |
| SCHEMA_REGISTRY_LISTENERS | http://0.0.0.0:8081 | Listeners that listen for API requests over either HTTP or HTTPS. If multiple listeners are configured, the first listener port is used for its identity. | |
| SCHEMA_REGISTRY_CUB _KAFKA_TIMEOUT | 500 | The timeout for initialization of the Kafka store, including the creation of the Kafka topic that stores schema data. | |
| SCHEMA_REGISTRY_CUB _ZK_TIMEOUT | 500 | Specifies the ZooKeeper session timeout. | |
| SCHEMA_REGISTRY_KAFKASTORE_SECURITY_PROTOCOL | PLAINTEXT | The security protocol to use when connecting with Kafka, when there is an underlying persistent storage. | |
| Security | |||
| temn_msf_security_authz_enabled | false | Enable or disable the XACML policy authorization. XACML policy authorization is used to configure security policies and access rights to information for APIs. | |
| temn_entitlement_service_enabled | false | Entitlement microservice status is enabled or disabled. | |
| Logger | |||
| root_level | INFO | DEBUG, INFO, ERROR | Specifies the configuration parameter for logging. INFO logger level is maintained by default. |
| Service | |||
|
genericconfigapi: type: LoadBalancer port: 7006 genericconfigingester type: LoadBalancer port: 7017 |
A Service in Kubernetes is a REST object, similar to a pod. Like all REST objects, the user can post a service definition to the API server to create a new instance. Specifies the port, type for the adapterms API, and ingester service. When the Service type is set to LoadBalancer, Kubernetes provides functionality equivalent to type equals ClusterIP to pods within the cluster and extends it by programming the load balancer (external to Kubernetes) with entries for the nodes hosting the relevant Kubernetes pods. |
||
| Ports | Specifies the port, name, protocol, and target port for the eventstore API service. | ||
| name | http | A formally defined set of rules for communication between a client (the network resource requesting data or services) and a server (the resource that receives and responds to the request). | |
| port | 8080 | A port number is a way to identify a specific process to which an internet or other network message is to be forwarded when it arrives at a server. | |
| protocol | TCP | The default protocol for Services is TCP. The user can also use other supported protocols. | |
| targetport | 8080 | A Service can map any incoming port to a target port. By default, and for convenience, the target port is set to the same value as the port field. | |
| Logging | |||
|
# socketHost: "192.168.1.37" # socketPort: "4560" exportType: #"socket" protocol: #TCP |
Logging can be collecting, storing, and analyzing distributed logs. Here Logstash is used for creating an ingestion pipeline for collecting logs from multiple devices and stored in Elasticsearch storage for visualizing and analyzing through Grafana. To enable logging sockethost, SockerPort, and exportType, the protocol should be uncommented and the required port and host address should be given. |
||
| Tracing | |||
| enabled | false | true, false | To enable tracing, it should be changed to true. |
| port | Port number of tracer back end service. | ||
| host | Host of any tracer back end service (Currently we are using Jaeger). | ||
| Metrics | |||
| exporterPort | 9091 | ||
| exporterHost | 192.168.228.1 93 | ||
| publisherPort | 9091 | Specifies the PushGateway service exposed port, publisherPort should be uncommented and required port should be mentioned. | |
| publisherHost | 192.168.228.1 93 | Specifies the PushGateway service exposed hostname, publisherHost should be uncommented and required port should be mentioned. | |
| metricsDisabled | true | true, false | To enable metrics monitoring in microservices publisherPort, publisherHost can be configured with pushgateway port and host address. Metrics can be disabled by default and to enable, change the value to false. |
| Resources | |||
|
api: cpulimit: "100m" memorylimit: 1.5G java: heaplimit: ' -XX: +UnlockExperimentalVMOptions -XX: +UseCGroupMemoryLimitForHeap -XX: MaxRAMPercentage=75.0 ' ingester: cpulimit: "100m" memorylimit: 1G java: heaplimit: ' -XX: +UnlockExperimentalVMOptions-XX: +UseCGroupMemoryLimitForHeap-XX: MaxRAMPercentage=75.0 ' |
Resource management for pods or containers -- Kubernetes uses to control resources such as CPU, memory and can declare limits for CPU and memory for all pod containers.
|
||
|
scheduler: cpulimit: "100m" memorylimit: 1G java: heaplimit: ' -XX: +UnlockExperimentalVMOptions -XX: +UseCGroupMemoryLimitFo rHeap -XX: MaxRAMPercentage=75.0 ' |
In this topic