# _helpers.tpl
{{/*
Expand the name of the chart.
*/}}
{{- define "cockroachdb.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 56 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "cockroachdb.fullname" -}}
{{- if .Values.fullnameOverride -}}
    {{- .Values.fullnameOverride | trunc 56 | trimSuffix "-" -}}
{{- else -}}
    {{- $name := default .Chart.Name .Values.nameOverride -}}
    {{- if contains $name .Release.Name -}}
        {{- .Release.Name | trunc 56 | trimSuffix "-" -}}
    {{- else -}}
        {{- printf "%s-%s" .Release.Name $name | trunc 56 | trimSuffix "-" -}}
    {{- end -}}
{{- end -}}
{{- end -}}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "cockroachdb.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 56 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create the name of the ServiceAccount to use.
*/}}
{{- define "cockroachdb.tls.serviceAccount.name" -}}
{{- if .Values.tls.serviceAccount.create -}}
    {{- default (include "cockroachdb.fullname" .) .Values.tls.serviceAccount.name -}}
{{- else -}}
    {{- default "default" .Values.tls.serviceAccount.name -}}
{{- end -}}
{{- end -}}

{{/*
Return the appropriate apiVersion for NetworkPolicy.
*/}}
{{- define "cockroachdb.networkPolicy.apiVersion" -}}
{{- if semverCompare ">=1.4-0, <=1.7-0" .Capabilities.KubeVersion.GitVersion -}}
    {{- print "extensions/v1beta1" -}}
{{- else if semverCompare "^1.7-0" .Capabilities.KubeVersion.GitVersion -}}
    {{- print "networking.k8s.io/v1" -}}
{{- end -}}
{{- end -}}

{{/*
Return the appropriate apiVersion for StatefulSets
*/}}
{{- define "cockroachdb.statefulset.apiVersion" -}}
{{- if semverCompare "<1.12-0" .Capabilities.KubeVersion.GitVersion -}}
    {{- print "apps/v1beta1" -}}
{{- else -}}
    {{- print "apps/v1" -}}
{{- end -}}
{{- end -}}
 # client.yaml
kind: Pod
apiVersion: v1
metadata:
  name: {{ template "cockroachdb.fullname" . }}-test
  namespace: {{ .Release.Namespace | quote }}
{{- if .Values.networkPolicy.enabled }}
  labels:
    {{ template "cockroachdb.fullname" . }}-client: "true"
{{- end }}
  annotations:
    helm.sh/hook: test-success
spec:
  restartPolicy: Never
{{- if .Values.image.credentials }}
  imagePullSecrets:
    - name: {{ template "cockroachdb.fullname" . }}.db.registry
{{- end }}
  {{- if .Values.tls.certs.provided }}
  volumes:
    - name: client-certs
      {{- if .Values.tls.certs.tlsSecret }}
      projected:
        sources:
        - secret:
            name: {{ .Values.tls.certs.clientRootSecret }}
            items:
            - key: ca.crt
              path: ca.crt
              mode: 0400
            - key: tls.crt
              path: client.root.crt
              mode: 0400
            - key: tls.key
              path: client.root.key
              mode: 0400
      {{- else }}
      secret:
        secretName: {{ .Values.tls.certs.clientRootSecret }}
        defaultMode: 0400
      {{- end }}
  {{- end }}
  containers:
    - name: client-test
      image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
      imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
      {{- if .Values.tls.certs.provided }}
      volumeMounts:
      - name: client-certs
        mountPath: /cockroach-certs
      {{- end }}
      command:
        - /cockroach/cockroach
        - sql
        {{- if .Values.tls.certs.provided }}
        - --certs-dir
        - /cockroach-certs
        {{- else }}
        - --insecure
        {{- end}}
        - --host
        - {{ template "cockroachdb.fullname" . }}-public.{{ .Release.Namespace }}
        - --port
        - {{ .Values.service.ports.grpc.external.port | quote }}
        - -e
        - SHOW DATABASES;
 # clusterrole.yaml
{{- if and .Values.tls.enabled (not .Values.tls.certs.provided) }}
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ template "cockroachdb.fullname" . }}
  namespace: {{ .Release.Namespace | quote }}
  labels:
    helm.sh/chart: {{ template "cockroachdb.chart" . }}
    app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
  {{- with .Values.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
rules:
  - apiGroups: ["certificates.k8s.io"]
    resources: ["certificatesigningrequests"]
    verbs: ["create", "get", "watch"]
{{- end }} # clusterrolebinding.yaml
{{- if and .Values.tls.enabled (not .Values.tls.certs.provided) }}
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ template "cockroachdb.fullname" . }}
  namespace: {{ .Release.Namespace | quote }}
  labels:
    helm.sh/chart: {{ template "cockroachdb.chart" . }}
    app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
  {{- with .Values.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ template "cockroachdb.fullname" . }}
subjects:
  - kind: ServiceAccount
    name: {{ template "cockroachdb.tls.serviceAccount.name" . }}
    namespace: {{ .Release.Namespace | quote }}
{{- end }} # job.init.yaml
{{- if not (index .Values.conf `single-node`) }}
kind: Job
apiVersion: batch/v1
metadata:
  name: {{ template "cockroachdb.fullname" . }}-init
  namespace: {{ .Release.Namespace | quote }}
  labels:
    helm.sh/chart: {{ template "cockroachdb.chart" . }}
    app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
  {{- with .Values.init.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
  {{- with .Values.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
        app.kubernetes.io/instance: {{ .Release.Name | quote }}
      {{- with .Values.init.labels }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
    {{- with .Values.init.annotations }}
      annotations: {{- toYaml . | nindent 8 }}
    {{- end }}
    spec:
      restartPolicy: OnFailure
      terminationGracePeriodSeconds: 0
    {{- if or .Values.image.credentials (and .Values.tls.enabled .Values.tls.init.image.credentials (not .Values.tls.certs.provided)) }}
      imagePullSecrets:
      {{- if .Values.image.credentials }}
        - name: {{ template "cockroachdb.fullname" . }}.db.registry
      {{- end }}
      {{- if and .Values.tls.enabled .Values.tls.init.image.credentials (not .Values.tls.certs.provided) }}
        - name: {{ template "cockroachdb.fullname" . }}.init-certs.registry
      {{- end }}
    {{- end }}
    {{- if and .Values.tls.enabled (not .Values.tls.certs.provided)}}
      serviceAccountName: {{ template "cockroachdb.tls.serviceAccount.name" . }}
      initContainers:
        # The init-certs container sends a CSR (certificate signing request) to
        # the Kubernetes cluster.
        # You can see pending requests using:
        #   kubectl get csr
        # CSRs can be approved using:
        #   kubectl certificate approve <csr-name>
        #
        # In addition to the Node certificate and key, the init-certs entrypoint
        # will symlink the cluster CA to the certs directory.
        - name: init-certs
          image: "{{ .Values.tls.init.image.repository }}:{{ .Values.tls.init.image.tag }}"
          imagePullPolicy: {{ .Values.tls.init.image.pullPolicy | quote }}
          command:
            - /bin/ash
            - -ecx
            - >-
              /request-cert
              -namespace=${POD_NAMESPACE}
              -certs-dir=/cockroach-certs/
              -symlink-ca-from=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
              -type=client
              -user=root
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          volumeMounts:
            - name: client-certs
              mountPath: /cockroach-certs/
    {{- end }}
    {{- with .Values.init.affinity }}
      affinity: {{- toYaml . | nindent 8 }}
    {{- end }}
    {{- with .Values.init.nodeSelector }}
      nodeSelector: {{- toYaml . | nindent 8 }}
    {{- end }}
    {{- with .Values.init.tolerations }}
      tolerations: {{- toYaml . | nindent 8 }}
    {{- end }}
      containers:
        - name: cluster-init
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
          # Run the command in an `while true` loop because this Job is bound
          # to come up before the CockroachDB Pods (due to the time needed to
          # get PersistentVolumes attached to Nodes), and sleeping 5 seconds
          # between attempts is much better than letting the Pod fail when
          # the init command does and waiting out Kubernetes' non-configurable
          # exponential back-off for Pod restarts.
          # Command completes either when cluster initialization succeeds,
          # or when cluster has been initialized already.
          command:
            - /bin/bash
            - -c
            - >-
              while true; do
              initOUT=$(set -x;
              /cockroach/cockroach init
              {{- if .Values.tls.enabled }}
              --certs-dir=/cockroach-certs/
              {{- else }}
              --insecure
              {{- end }}
              --host={{ template "cockroachdb.fullname" . }}-0.{{ template "cockroachdb.fullname" . -}}
                     :{{ .Values.service.ports.grpc.internal.port | int64 }}
              2>&1);
              initRC="$?";
              echo $initOUT;
              [[ "$initRC" == "0" ]] && exit 0;
              [[ "$initOUT" == *"cluster has already been initialized"* ]] && exit 0;
              sleep 5;
              done
        {{- if .Values.tls.enabled }}
          volumeMounts:
            - name: client-certs
              mountPath: /cockroach-certs/
        {{- end }}
        {{- with .Values.init.resources }}
          resources: {{- toYaml . | nindent 12 }}
        {{- end }}
    {{- if .Values.tls.enabled }}
      volumes:
        - name: client-certs
          {{- if .Values.tls.certs.provided }}
          {{- if .Values.tls.certs.tlsSecret }}
          projected:
            sources:
            - secret:
                name: {{ .Values.tls.certs.clientRootSecret }}
                items:
                - key: ca.crt
                  path: ca.crt
                  mode: 0400
                - key: tls.crt
                  path: client.root.crt
                  mode: 0400
                - key: tls.key
                  path: client.root.key
                  mode: 0400
          {{- else }}
          secret:
            secretName: {{ .Values.tls.certs.clientRootSecret }}
            defaultMode: 0400
          {{- end }}
          {{- else }}
          emptyDir: {}
          {{- end }}
    {{- end }}
{{- end }}
 # networkpolicy.yaml
{{- if .Values.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ template "cockroachdb.networkPolicy.apiVersion" . }}
metadata:
  name: {{ template "cockroachdb.tls.serviceAccount.name" . }}
  namespace: {{ .Release.Namespace | quote }}
  labels:
    helm.sh/chart: {{ template "cockroachdb.chart" . }}
    app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
  {{- with .Values.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
      app.kubernetes.io/instance: {{ .Release.Name | quote }}
    {{- with .Values.statefulset.labels }}
      {{- toYaml . | nindent 6 }}
    {{- end }}
  ingress:
    - ports:
        - port: grpc
    {{- with .Values.networkPolicy.ingress.grpc }}
      from:
        # Allow connections via custom rules.
        {{- toYaml . | nindent 8 }}
        # Allow client connection via pre-considered label.
        - podSelector:
            matchLabels:
              {{ template "cockroachdb.fullname" . }}-client: "true"
        # Allow other CockroachDBs to connect to form a cluster.
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
              app.kubernetes.io/instance: {{ .Release.Name | quote }}
            {{- with .Values.statefulset.labels }}
              {{- toYaml . | nindent 14 }}
            {{- end }}
      {{- if gt (.Values.statefulset.replicas | int64) 1 }}
        # Allow init Job to connect to bootstrap a cluster.
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
              app.kubernetes.io/instance: {{ .Release.Name | quote }}
            {{- with .Values.init.labels }}
              {{- toYaml . | nindent 14 }}
            {{- end }}
      {{- end }}
    {{- end }}
    # Allow connections to admin UI and for Prometheus.
    - ports:
        - port: http
    {{- with .Values.networkPolicy.ingress.http }}
      from: {{- toYaml . | nindent 8 }}
    {{- end }}
{{- end }}
 # poddisruptionbudget.yaml
kind: PodDisruptionBudget
apiVersion: policy/v1beta1
metadata:
  name: {{ template "cockroachdb.fullname" . }}-budget
  namespace: {{ .Release.Namespace | quote }}
  labels:
    helm.sh/chart: {{ template "cockroachdb.chart" . }}
    app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
  {{- with .Values.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
      app.kubernetes.io/instance: {{ .Release.Name | quote }}
    {{- with .Values.statefulset.labels }}
      {{- toYaml . | nindent 6 }}
    {{- end }}
  maxUnavailable: {{ .Values.statefulset.budget.maxUnavailable | int64 }}
 # role.yaml
{{- if .Values.tls.enabled }}
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ template "cockroachdb.fullname" . }}
  namespace: {{ .Release.Namespace | quote }}
  labels:
    helm.sh/chart: {{ template "cockroachdb.chart" . }}
    app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
  {{- with .Values.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    {{- if .Values.tls.certs.provided }}
    verbs: ["get"]
    {{- else }}
    verbs: ["create", "get"]
    {{- end }}
{{- end }}
 # rolebinding.yaml
{{- if .Values.tls.enabled }}
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ template "cockroachdb.fullname" . }}
  namespace: {{ .Release.Namespace | quote }}
  labels:
    helm.sh/chart: {{ template "cockroachdb.chart" . }}
    app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
  {{- with .Values.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ template "cockroachdb.fullname" . }}
subjects:
  - kind: ServiceAccount
    name: {{ template "cockroachdb.tls.serviceAccount.name" . }}
    namespace: {{ .Release.Namespace | quote }}
{{- end }}
 # secret.registry.yaml
{{- range $name, $cred := dict "db" (.Values.image.credentials) "init-certs" (.Values.tls.init.image.credentials) }}
{{- if not (empty $cred) }}
{{- if or (and (eq $name "init-certs") $.Values.tls.enabled) (ne $name "init-certs") }}
---
kind: Secret
apiVersion: v1
metadata:
  name: {{ template "cockroachdb.fullname" $ }}.{{ $name }}.registry
  namespace: {{ $.Release.Namespace | quote }}
  labels:
    helm.sh/chart: {{ template "cockroachdb.chart" $ }}
    app.kubernetes.io/name: {{ template "cockroachdb.name" $ }}
    app.kubernetes.io/instance: {{ $.Release.Name | quote }}
    app.kubernetes.io/managed-by: {{ $.Release.Service | quote }}
  {{- with $.Values.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
type: kubernetes.io/dockerconfigjson
data:
  .dockerconfigjson: {{ printf `{"auths":{%s:{"auth":"%s"}}}` ($cred.registry | quote) (printf "%s:%s" $cred.username $cred.password | b64enc) | b64enc | quote }}
{{- end }}
{{- end }}
{{- end }}
 # service.discovery.yaml
# This service only exists to create DNS entries for each pod in
# the StatefulSet such that they can resolve each other's IP addresses.
# It does not create a load-balanced ClusterIP and should not be used directly
# by clients in most circumstances.
kind: Service
apiVersion: v1
metadata:
  name: {{ template "cockroachdb.fullname" . }}
  namespace: {{ .Release.Namespace | quote }}
  labels:
    helm.sh/chart: {{ template "cockroachdb.chart" . }}
    app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
  {{- with .Values.service.discovery.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
  {{- with .Values.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
  annotations:
    # Use this annotation in addition to the actual field below because the
    # annotation will stop being respected soon, but the field is broken in
    # some versions of Kubernetes:
    # https://github.com/kubernetes/kubernetes/issues/58662
    service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
    # Enable automatic monitoring of all instances when Prometheus is running
    # in the cluster.
    prometheus.io/scrape: "true"
    prometheus.io/path: _status/vars
    prometheus.io/port: {{ .Values.service.ports.http.port | quote }}
  {{- with .Values.service.discovery.annotations }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
  clusterIP: None
  # We want all Pods in the StatefulSet to have their addresses published for
  # the sake of the other CockroachDB Pods even before they're ready, since they
  # have to be able to talk to each other in order to become ready.
  publishNotReadyAddresses: true
  ports:
  {{- $ports := .Values.service.ports }}
    # The main port, served by gRPC, serves Postgres-flavor SQL, inter-node
    # traffic and the CLI.
    - name: {{ $ports.grpc.external.name | quote }}
      port: {{ $ports.grpc.external.port | int64 }}
      targetPort: grpc
  {{- if ne ($ports.grpc.internal.port | int64) ($ports.grpc.external.port | int64) }}
    - name: {{ $ports.grpc.internal.name | quote }}
      port: {{ $ports.grpc.internal.port | int64 }}
      targetPort: grpc
  {{- end }}
    # The secondary port serves the UI as well as health and debug endpoints.
    - name: {{ $ports.http.name | quote }}
      port: {{ $ports.http.port | int64 }}
      targetPort: http
  selector:
    app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
  {{- with .Values.statefulset.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
 # service.public.yaml
# This Service is meant to be used by clients of the database.
# It exposes a ClusterIP that will automatically load balance connections
# to the different database Pods.
kind: Service
apiVersion: v1
metadata:
  name: {{ template "cockroachdb.fullname" . }}-public
  namespace: {{ .Release.Namespace | quote }}
  labels:
    helm.sh/chart: {{ template "cockroachdb.chart" . }}
    app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
  {{- with .Values.service.public.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
  {{- with .Values.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
{{- with .Values.service.public.annotations }}
  annotations: {{- toYaml . | nindent 4 }}
{{- end }}
spec:
  type: {{ .Values.service.public.type | quote }}
  ports:
  {{- $ports := .Values.service.ports }}
    # The main port, served by gRPC, serves Postgres-flavor SQL, inter-node
    # traffic and the CLI.
    - name: {{ $ports.grpc.external.name | quote }}
      port: {{ $ports.grpc.external.port | int64 }}
      targetPort: grpc
  {{- if ne ($ports.grpc.internal.port | int64) ($ports.grpc.external.port | int64) }}
    - name: {{ $ports.grpc.internal.name | quote }}
      port: {{ $ports.grpc.internal.port | int64 }}
      targetPort: grpc
  {{- end }}
    # The secondary port serves the UI as well as health and debug endpoints.
    - name: {{ $ports.http.name | quote }}
      port: {{ $ports.http.port | int64 }}
      targetPort: http
  selector:
    app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
  {{- with .Values.statefulset.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
 # serviceaccount.yaml
{{- if and .Values.tls.enabled .Values.tls.serviceAccount.create }}
kind: ServiceAccount
apiVersion: v1
metadata:
  name: {{ template "cockroachdb.tls.serviceAccount.name" . }}
  namespace: {{ .Release.Namespace | quote }}
  labels:
    helm.sh/chart: {{ template "cockroachdb.chart" . }}
    app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
  {{- with .Values.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
{{- end }}
 # statefulset.yaml
kind: StatefulSet
apiVersion: {{ template "cockroachdb.statefulset.apiVersion" . }}
metadata:
  name: {{ template "cockroachdb.fullname" . }}
  namespace: {{ .Release.Namespace | quote }}
  labels:
    helm.sh/chart: {{ template "cockroachdb.chart" . }}
    app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
  {{- with .Values.statefulset.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
  {{- with .Values.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
  serviceName: {{ template "cockroachdb.fullname" . }}
  replicas: {{ .Values.statefulset.replicas | int64 }}
  updateStrategy: {{- toYaml .Values.statefulset.updateStrategy | nindent 4 }}
  podManagementPolicy: {{ .Values.statefulset.podManagementPolicy | quote }}
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
      app.kubernetes.io/instance: {{ .Release.Name | quote }}
    {{- with .Values.statefulset.labels }}
      {{- toYaml . | nindent 6 }}
    {{- end }}
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
        app.kubernetes.io/instance: {{ .Release.Name | quote }}
      {{- with .Values.statefulset.labels }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.labels }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
    {{- with .Values.statefulset.annotations }}
      annotations: {{- toYaml . | nindent 8 }}
    {{- end }}
    spec:
    {{- if or .Values.image.credentials (and .Values.tls.enabled .Values.tls.init.image.credentials (not .Values.tls.certs.provided)) }}
      imagePullSecrets:
      {{- if .Values.image.credentials }}
        - name: {{ template "cockroachdb.fullname" . }}.db.registry
      {{- end }}
      {{- if and .Values.tls.enabled .Values.tls.init.image.credentials (not .Values.tls.certs.provided) }}
        - name: {{ template "cockroachdb.fullname" . }}.init-certs.registry
      {{- end }}
    {{- end }}
    {{- if .Values.tls.enabled }}
      serviceAccountName: {{ template "cockroachdb.tls.serviceAccount.name" . }}
      {{- if not .Values.tls.certs.provided }}
      initContainers:
        # The init-certs container sends a CSR (certificate signing request) to
        # the Kubernetes cluster.
        # You can see pending requests using:
        #   kubectl get csr
        # CSRs can be approved using:
        #   kubectl certificate approve <csr-name>
        #
        # All addresses used to contact a Node must be specified in the
        # `--addresses` arg.
        #
        # In addition to the Node certificate and key, the init-certs entrypoint
        # will symlink the cluster CA to the certs directory.
        - name: init-certs
          image: "{{ .Values.tls.init.image.repository }}:{{ .Values.tls.init.image.tag }}"
          imagePullPolicy: {{ .Values.tls.init.image.pullPolicy | quote }}
          command:
            - /bin/ash
            - -ecx
            - >-
              /request-cert
              -namespace=${POD_NAMESPACE}
              -certs-dir=/cockroach-certs/
              -symlink-ca-from=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
              -type=node
              -addresses=localhost,127.0.0.1,$(hostname -f),$(hostname -f|cut -f 1-2 -d '.'),{{ template "cockroachdb.fullname" . }}-public,{{ template "cockroachdb.fullname" . }}-public.$(hostname -f|cut -f 3- -d '.')
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          volumeMounts:
            - name: certs
              mountPath: /cockroach-certs/
      {{- end }}
    {{- end }}
    {{- if or .Values.statefulset.nodeAffinity .Values.statefulset.podAffinity .Values.statefulset.podAntiAffinity }}
      affinity:
      {{- with .Values.statefulset.nodeAffinity }}
        nodeAffinity: {{- toYaml . | nindent 10 }}
      {{- end }}
      {{- with .Values.statefulset.podAffinity }}
        podAffinity: {{- toYaml . | nindent 10 }}
      {{- end }}
      {{- if .Values.statefulset.podAntiAffinity }}
        podAntiAffinity:
        {{- if .Values.statefulset.podAntiAffinity.type }}
        {{- if eq .Values.statefulset.podAntiAffinity.type "hard" }}
          requiredDuringSchedulingIgnoredDuringExecution:
            - topologyKey: kubernetes.io/hostname
              labelSelector:
                matchLabels:
                  app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
                  app.kubernetes.io/instance: {{ .Release.Name | quote }}
                {{- with .Values.statefulset.labels }}
                  {{- toYaml . | nindent 18 }}
                {{- end }}
        {{- else if eq .Values.statefulset.podAntiAffinity.type "soft" }}
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: {{ .Values.statefulset.podAntiAffinity.weight | int64 }}
              podAffinityTerm:
                topologyKey: kubernetes.io/hostname
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
                    app.kubernetes.io/instance: {{ .Release.Name | quote }}
                  {{- with .Values.statefulset.labels }}
                    {{- toYaml . | nindent 20 }}
                  {{- end }}
        {{- end }}
        {{- else }}
          {{- toYaml .Values.statefulset.podAntiAffinity | nindent 10 }}
        {{- end }}
      {{- end }}
    {{- end }}
    {{- with .Values.statefulset.nodeSelector }}
      nodeSelector: {{- toYaml . | nindent 8 }}
    {{- end }}
    {{- with .Values.statefulset.tolerations }}
      tolerations: {{- toYaml . | nindent 8 }}
    {{- end }}
      # No pre-stop hook is required, a SIGTERM plus some time is all that's
      # needed for graceful shutdown of a node.
      terminationGracePeriodSeconds: 60
      containers:
        - name: db
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
          args:
            - shell
            - -ecx
            # The use of qualified `hostname -f` is crucial:
            # Other nodes aren't able to look up the unqualified hostname.
            #
            # `--join` CLI flag is hardcoded to exactly 3 Pods, because:
            # 1. Having `--join` value depending on `statefulset.replicas`
            #    will trigger undesired restart of existing Pods when
            #    StatefulSet is scaled up/down. We want to scale without
            #    restarting existing Pods.
            # 2. At least one Pod in `--join` is enough to successfully
            #    join CockroachDB cluster and gossip with all other existing
            #    Pods, even if there are 3 or more Pods.
            # 3. It's harmless for `--join` to have 3 Pods even for 1-Pod
            #    clusters, while it gives us opportunity to scale up even if
            #    some Pods of existing cluster are down (for whatever reason).
            # See details explained here:
            # https://github.com/helm/charts/pull/18993#issuecomment-558795102
            - >-
              exec /cockroach/cockroach
            {{- if index .Values.conf `single-node` }}
              start-single-node
            {{- else }}
              start --join=
              {{- if .Values.conf.join }}
                {{- join `,` .Values.conf.join -}}
              {{- else }}
                {{- range $i, $_ := until 3 -}}
                  {{- if gt $i 0 -}},{{- end -}}
                  ${STATEFULSET_NAME}-{{ $i }}.${STATEFULSET_FQDN}:{{ $.Values.service.ports.grpc.internal.port | int64 -}}
                {{- end -}}
              {{- end }}
              --advertise-host=$(hostname).${STATEFULSET_FQDN}
            {{- with index .Values.conf `cluster-name` }}
              --cluster-name={{ . }}
            {{- if index $.Values.conf `disable-cluster-name-verification` }}
              --disable-cluster-name-verification
            {{- end }}
            {{- end }}
            {{- end }}
              --logtostderr={{ .Values.conf.logtostderr }}
            {{- if .Values.tls.enabled }}
              --certs-dir=/cockroach/cockroach-certs/
            {{- else }}
              --insecure
            {{- end }}
            {{- with .Values.conf.attrs }}
              --attrs={{ join `:` . }}
            {{- end }}
              --http-port={{ index .Values.conf `http-port` | int64 }}
              --port={{ .Values.conf.port | int64 }}
              --cache={{ .Values.conf.cache }}
              --max-disk-temp-storage={{ index .Values.conf `max-disk-temp-storage` }}
              --max-offset={{ index .Values.conf `max-offset` }}
              --max-sql-memory={{ index .Values.conf `max-sql-memory` }}
            {{- with .Values.conf.locality }}
              --locality={{ . }}
            {{- end }}
            {{- with index .Values.conf `sql-audit-dir` }}
              --sql-audit-dir={{ . }}
            {{- end }}
            {{- range .Values.statefulset.args }}
              {{ . }}
            {{- end }}
          env:
            - name: STATEFULSET_NAME
              value: {{ template "cockroachdb.fullname" . }}
            - name: STATEFULSET_FQDN
              value: {{ template "cockroachdb.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
            - name: COCKROACH_CHANNEL
              value: kubernetes-helm
          {{- with .Values.statefulset.env }}
            {{- toYaml . | nindent 12 }}
          {{- end }}
          ports:
            - name: grpc
              containerPort: {{ .Values.conf.port | int64 }}
              protocol: TCP
            - name: http
              containerPort: {{ index .Values.conf `http-port` | int64 }}
              protocol: TCP
          volumeMounts:
            - name: datadir
              mountPath: /cockroach/cockroach-data/
          {{- if .Values.tls.enabled }}
            - name: certs
              mountPath: /cockroach/cockroach-certs/
          {{- end }}
          {{- range .Values.statefulset.secretMounts }}
            - name: {{ printf "secret-%s" . | quote }}
              mountPath: {{ printf "/etc/cockroach/secrets/%s" . | quote }}
              readOnly: true
          {{- end }}
          livenessProbe:
            httpGet:
              path: /health
              port: http
            {{- if .Values.tls.enabled }}
              scheme: HTTPS
            {{- end }}
            initialDelaySeconds: 30
            periodSeconds: 5
          readinessProbe:
            httpGet:
              path: /health?ready=1
              port: http
            {{- if .Values.tls.enabled }}
              scheme: HTTPS
            {{- end }}
            initialDelaySeconds: 10
            periodSeconds: 5
            failureThreshold: 2
        {{- with .Values.statefulset.resources }}
          resources: {{- toYaml . | nindent 12 }}
        {{- end }}
      volumes:
        - name: datadir
        {{- if .Values.storage.persistentVolume.enabled }}
          persistentVolumeClaim:
            claimName: datadir
        {{- else if .Values.storage.hostPath }}
          hostPath:
            path: {{ .Values.storage.hostPath | quote }}
        {{- else }}
          emptyDir: {}
        {{- end }}
      {{- if .Values.tls.enabled }}
        - name: certs
          {{- if .Values.tls.certs.provided }}
          {{- if .Values.tls.certs.tlsSecret }}
          projected:
            sources:
            - secret:
                name: {{ .Values.tls.certs.nodeSecret }}
                items:
                - key: ca.crt
                  path: ca.crt
                  mode: 0400
                - key: tls.crt
                  path: node.crt
                  mode: 0400
                - key: tls.key
                  path: node.key
                  mode: 0400
          {{- else }}
          secret:
            secretName: {{ .Values.tls.certs.nodeSecret }}
            defaultMode: 0400
          {{- end }}
          {{- else }}
          emptyDir: {}
          {{- end }}
      {{- end }}
      {{- range .Values.statefulset.secretMounts }}
        - name: {{ printf "secret-%s" . | quote }}
          secret:
            secretName: {{ . | quote }}
      {{- end }}
{{- if .Values.storage.persistentVolume.enabled }}
  volumeClaimTemplates:
    - metadata:
        name: datadir
        labels:
          app.kubernetes.io/name: {{ template "cockroachdb.name" . }}
          app.kubernetes.io/instance: {{ .Release.Name | quote }}
        {{- with .Values.storage.persistentVolume.labels }}
          {{- toYaml . | nindent 10 }}
        {{- end }}
        {{- with .Values.labels }}
          {{- toYaml . | nindent 10 }}
        {{- end }}
      {{- with .Values.storage.persistentVolume.annotations }}
        annotations: {{- toYaml . | nindent 10 }}
      {{- end }}
      spec:
        accessModes: ["ReadWriteOnce"]
      {{- if .Values.storage.persistentVolume.storageClass }}
      {{- if (eq "-" .Values.storage.persistentVolume.storageClass) }}
        storageClassName: ""
      {{- else }}
        storageClassName: {{ .Values.storage.persistentVolume.storageClass | quote}}
      {{- end }}
      {{- end }}
        resources:
          requests:
            storage: {{ .Values.storage.persistentVolume.size | quote }}
{{- end }}

image:
  repository: cockroachdb/cockroach
  tag: v19.2.5
  pullPolicy: IfNotPresent
  credentials: {}
    # registry: docker.io
    # username: john_doe
    # password: changeme


# Additional labels to apply to all Kubernetes resources created by this chart.
labels: {}
  # app.kubernetes.io/part-of: my-app


# Cluster's default DNS domain.
# You should overwrite it if you're using a different one,
# otherwise CockroachDB nodes discovery won't work.
clusterDomain: cluster.local


conf:
  # An ordered list of CockroachDB node attributes.
  # Attributes are arbitrary strings specifying machine capabilities.
  # Machine capabilities might include specialized hardware or number of cores
  # (e.g. "gpu", "x16c").
  attrs: []
    # - x16c
    # - gpu

  # Total size in bytes for caches, shared evenly if there are multiple
  # storage devices. Size suffixes are supported (e.g. `1GB` and `1GiB`).
  # A percentage of physical memory can also be specified (e.g. `.25`).
  cache: 25%

  # Sets a name to verify the identity of a cluster.
  # The value must match between all nodes specified via `conf.join`.
  # This can be used as an additional verification when either the node or
  # cluster, or both, have not yet been initialized and do not yet know their
  # cluster ID.
  # To introduce a cluster name into an already-initialized cluster, pair this
  # option with `conf.disable-cluster-name-verification: yes`.
  cluster-name: ""

  # Tell the server to ignore `conf.cluster-name` mismatches.
  # This is meant for use when opting an existing cluster into starting to use
  # cluster name verification, or when changing the cluster name.
  # The cluster should be restarted once with `conf.cluster-name` and
  # `conf.disable-cluster-name-verification: yes` combined, and once all nodes
  # have been updated to know the new cluster name, the cluster can be restarted
  # again with `conf.disable-cluster-name-verification: no`.
  # This option has no effect if `conf.cluster-name` is not specified.
  disable-cluster-name-verification: no

  # The addresses for connecting a CockroachDB nodes to an existing cluster.
  # If you are deploying a second CockroachDB instance that should join a first
  # one, use the below list to join to the existing instance.
  # Each item in the array should be a FQDN (and port if needed) resolvable by
  # new Pods.
  join: []

  # Logs at or above this threshold to STDERR.
  logtostderr: INFO

  # Maximum storage capacity available to store temporary disk-based data for
  # SQL queries that exceed the memory budget (e.g. join, sorts, etc are
  # sometimes able to spill intermediate results to disk).
  # Accepts numbers interpreted as bytes, size suffixes (e.g. `32GB` and
  # `32GiB`) or a percentage of disk size (e.g. `10%`).
  # The location of the temporary files is within the first store dir.
  # If expressed as a percentage, `max-disk-temp-storage` is interpreted
  # relative to the size of the storage device on which the first store is
  # placed. The temp space usage is never counted towards any store usage
  # (although it does share the device with the first store) so, when
  # configuring this, make sure that the size of this temp storage plus the size
  # of the first store don't exceed the capacity of the storage device.
  # If the first store is an in-memory one (i.e. `type=mem`), then this
  # temporary "disk" data is also kept in-memory.
  # A percentage value is interpreted as a percentage of the available internal
  # memory.
  max-disk-temp-storage: 0

  # Maximum allowed clock offset for the cluster. If observed clock offsets
  # exceed this limit, servers will crash to minimize the likelihood of
  # reading inconsistent data. Increasing this value will increase the time
  # to recovery of failures as well as the frequency of uncertainty-based
  # read restarts.
  # Note, that this value must be the same on all nodes in the cluster.
  # In order to change it, all nodes in the cluster must be stopped
  # simultaneously and restarted with the new value.
  max-offset: 500ms

  # Maximum memory capacity available to store temporary data for SQL clients,
  # including prepared queries and intermediate data rows during query
  # execution. Accepts numbers interpreted as bytes, size suffixes
  # (e.g. `1GB` and `1GiB`) or a percentage of physical memory (e.g. `.25`).
  max-sql-memory: 25%

  # An ordered, comma-separated list of key-value pairs that describe the
  # topography of the machine. Topography might include country, datacenter
  # or rack designations. Data is automatically replicated to maximize
  # diversities of each tier. The order of tiers is used to determine
  # the priority of the diversity, so the more inclusive localities like
  # country should come before less inclusive localities like datacenter.
  # The tiers and order must be the same on all nodes. Including more tiers
  # is better than including fewer. For example:
  #   locality: country=us,region=us-west,datacenter=us-west-1b,rack=12
  #   locality: country=ca,region=ca-east,datacenter=ca-east-2,rack=4
  #   locality: planet=earth,province=manitoba,colo=secondary,power=3
  locality: ""

  # Run CockroachDB instances in standalone mode with replication disabled
  # (replication factor = 1).
  # Enabling this option makes the following values to be ignored:
  # - `conf.cluster-name`
  # - `conf.disable-cluster-name-verification`
  # - `conf.join`
  #
  # WARNING: Enabling this option makes each deployed Pod as a STANDALONE
  #          CockroachDB instance, so the StatefulSet does NOT FORM A CLUSTER.
  #          Don't use this option for production deployments unless you clearly
  #          understand what you're doing.
  #          Usually, this option is intended to be used in conjunction with
  #          `statefulset.replicas: 1` for temporary one-time deployments (like
  #          running E2E tests, for example).
  single-node: no

  # If non-empty, create a SQL audit log in the specified directory.
  sql-audit-dir: ""

  # CockroachDB's port to listen to inter-communications and client connections.
  port: 26257

  # CockroachDB's port to listen to HTTP requests.
  http-port: 8080


statefulset:
  replicas: 3
  updateStrategy:
    type: RollingUpdate
  podManagementPolicy: Parallel
  budget:
    maxUnavailable: 1

  # List of additional command-line arguments you want to pass to the
  # `cockroach start` command.
  args: []
    # - --disable-cluster-name-verification

  # List of extra environment variables to pass into container
  env: []
    # - name: COCKROACH_ENGINE_MAX_SYNC_DURATION
    #   value: "24h"

  # List of Secrets names in the same Namespace as the CockroachDB cluster,
  # which shall be mounted into `/etc/cockroach/secrets/` for every cluster
  # member.
  secretMounts: []

  # Additional labels to apply to this StatefulSet and all its Pods.
  labels:
    app.kubernetes.io/component: cockroachdb

  # Additional annotations to apply to the Pods of this StatefulSet.
  annotations: {}

  # Affinity rules for scheduling Pods of this StatefulSet on Nodes.
  # https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity
  nodeAffinity: {}
  # Inter-Pod Affinity rules for scheduling Pods of this StatefulSet.
  # https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#inter-pod-affinity-and-anti-affinity
  podAffinity: {}
  # Anti-affinity rules for scheduling Pods of this StatefulSet.
  # https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#inter-pod-affinity-and-anti-affinity
  # You may either toggle options below for default anti-affinity rules,
  # or specify the whole set of anti-affinity rules instead of them.
  podAntiAffinity:
    # Type of anti-affinity rules: either `soft`, `hard` or empty value (which
    # disables anti-affinity rules).
    type: soft
    # Weight for `soft` anti-affinity rules.
    # Does not apply for other anti-affinity types.
    weight: 100

  # Node selection constraints for scheduling Pods of this StatefulSet.
  # https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
  nodeSelector: {}

  # Taints to be tolerated by Pods of this StatefulSet.
  # https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
  tolerations: []

  # Uncomment the following resources definitions or pass them from
  # command line to control the CPU and memory resources allocated
  # by Pods of this StatefulSet.
  resources: {}
    # limits:
    #   cpu: 100m
    #   memory: 512Mi
    # requests:
    #   cpu: 100m
    #   memory: 512Mi


service:
  ports:
    # You can set a different external and internal gRPC ports and their name.
    grpc:
      external:
        port: 26257
        name: grpc
      # If the port number is different than `external.port`, then it will be
      # named as `internal.name` in Service.
      internal:
        port: 26257
        # If using Istio set it to `cockroach`.
        name: grpc-internal
    http:
      port: 8080
      name: http

  # This Service is meant to be used by clients of the database.
  # It exposes a ClusterIP that will automatically load balance connections
  # to the different database Pods.
  public:
    type: ClusterIP
    # Additional labels to apply to this Service.
    labels:
      app.kubernetes.io/component: cockroachdb
    # Additional annotations to apply to this Service.
    annotations: {}

  # This service only exists to create DNS entries for each pod in
  # the StatefulSet such that they can resolve each other's IP addresses.
  # It does not create a load-balanced ClusterIP and should not be used directly
  # by clients in most circumstances.
  discovery:
    # Additional labels to apply to this Service.
    labels:
      app.kubernetes.io/component: cockroachdb
    # Additional annotations to apply to this Service.
    annotations: {}


# CockroachDB's data persistence.
# If neither `persistentVolume` nor `hostPath` is used, then data will be
# persisted in ad-hoc `emptyDir`.
storage:
  # Absolute path on host to store CockroachDB's data.
  # If not specified, then `emptyDir` will be used instead.
  # If specified, but `persistentVolume.enabled` is `true`, then has no effect.
  hostPath: ""

  # If `enabled` is `true` then a PersistentVolumeClaim will be created and
  # used to store CockroachDB's data, otherwise `hostPath` is used.
  persistentVolume:
    enabled: yes

    size: 100Gi

    # If defined, then `storageClassName: <storageClass>`.
    # If set to "-", then `storageClassName: ""`, which disables dynamic
    # provisioning.
    # If undefined or empty (default), then no `storageClassName` spec is set,
    # so the default provisioner will be chosen (gp2 on AWS, standard on
    # GKE, AWS & OpenStack).
    storageClass: ""

    # Additional labels to apply to the created PersistentVolumeClaims.
    labels: {}
    # Additional annotations to apply to the created PersistentVolumeClaims.
    annotations: {}


# Kubernetes Job which initializes multi-node CockroachDB cluster.
# It's not created if `statefulset.replicas` is `1`.
init:
  # Additional labels to apply to this Job and its Pod.
  labels:
    app.kubernetes.io/component: init

  # Additional annotations to apply to the Pod of this Job.
  annotations: {}

  # Affinity rules for scheduling the Pod of this Job.
  # https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity
  affinity: {}

  # Node selection constraints for scheduling the Pod of this Job.
  # https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
  nodeSelector: {}

  # Taints to be tolerated by the Pod of this Job.
  # https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
  tolerations: []

  # The init Pod runs at cluster creation to initialize CockroachDB. It finishes
  # quickly and doesn't continue to consume resources in the Kubernetes
  # cluster. Normally, you should leave this section commented out, but if your
  # Kubernetes cluster uses Resource Quotas and requires all pods to specify
  # resource requests or limits, you can set those here.
  resources: {}
    # requests:
    #   cpu: "10m"
    #   memory: "128Mi"
    # limits:
    #   cpu: "10m"
    #   memory: "128Mi"


# Whether to run securely using TLS certificates.
tls:
  enabled: no
  serviceAccount:
    # Specifies whether this ServiceAccount should be created.
    create: yes
    # The name of this ServiceAccount to use.
    # If not set and `create` is `true`, then a name is auto-generated.
    name: ""
  certs:
    # Bring your own certs scenario. If provided, tls.init section will be ignored.
    provided: no
    # Secret name for the client root cert.
    clientRootSecret: cockroachdb-root
    # Secret name for node cert.
    nodeSecret: cockroachdb-node
    # Enable if the secret is a dedicated TLS.
    # TLS secrets are created by cert-mananger, for example.
    tlsSecret: no

  init:
    # Image to use for requesting TLS certificates.
    image:
      repository: cockroachdb/cockroach-k8s-request-cert
      tag: "0.4"
      pullPolicy: IfNotPresent
      credentials: {}
        # registry: docker.io
        # username: john_doe
        # password: changeme


networkPolicy:
  enabled: no

  ingress:
    # List of sources which should be able to access the CockroachDB Pods via
    # gRPC port. Items in this list are combined using a logical OR operation.
    # Rules for allowing inter-communication are applied automatically.
    # If empty, then connections from any Pod is allowed.
    grpc: []
      # - podSelector:
      #     matchLabels:
      #       app.kubernetes.io/name: my-app-django
      #       app.kubernetes.io/instance: my-app

    # List of sources which should be able to access the CockroachDB Pods via
    # HTTP port. Items in this list are combined using a logical OR operation.
    # If empty, then connections from any Pod is allowed.
    http: []
      # - namespaceSelector:
      #     matchLabels:
      #       project: my-project
