Deploying Hazelcast Enterprise on Kubernetes with Helm
This chart bootstraps a Hazelcast Enterprise and Management Center deployments on a Kubernetes cluster using the Helm package manager.
Prerequisites | Useful resources |
---|---|
Kubernetes 1.14+ |
Quickstart
Hazelcast Platform Enterprise requires a license key. If you don’t have a license key, you can request one at the Hazelcast website.
helm repo add hazelcast https://hazelcast-charts.s3.amazonaws.com/
helm repo update
helm install my-release hazelcast/hazelcast-enterprise --set hazelcast.licenseKey=<license_key>
For users who already added hazelcast
repo to their local helm client before; you need to run helm repo add
command again to use latest charts at the new chart repo.
helm repo list
NAME URL
hazelcast https://hazelcast.github.io/charts/
...
helm repo add hazelcast https://hazelcast-charts.s3.amazonaws.com/
NAME URL
hazelcast https://hazelcast-charts.s3.amazonaws.com/
...
Installing the Chart
To install the chart with the release name my-release
:
helm install my-release hazelcast/hazelcast-enterprise --set hazelcast.licenseKey=<license_key>
The command deploys Hazelcast on the Kubernetes cluster in the default configuration. The configuration section lists the parameters that can be configured during installation.
List all releases using helm list command.
|
Uninstalling the Chart
To uninstall/delete the my-release
deployment:
helm uninstall my-release
The command removes all the Kubernetes components associated with the chart and deletes the release.
Configuration
The following table lists the configurable parameters of the Hazelcast chart and their default values.
Parameter | Description | Default |
---|---|---|
image.repository |
Hazelcast Image name |
hazelcast/hazelcast-enterprise |
image.tag |
Hazelcast Image tag |
{VERSION} |
image.pullPolicy |
Image pull policy |
IfNotPresent |
image.pullSecrets |
Specify docker-registry secret names as an array |
nil |
cluster.memberCount |
Number of Hazelcast members |
3 |
hazelcast.enabled |
Turn on and off Hazelcast application |
true |
hazelcast.licenseKey |
Hazelcast Enterprise License Key |
nil |
hazelcast.licenseKeySecretName |
Kubernetes Secret Name, where Hazelcast Enterprise License Key is stored (can be used instead of licenseKey) |
nil |
hazelcast.updateClusterVersionAfterRollingUpgrade |
Enable Hazelcast cluster auto version upgrade after the rolling upgrade procedure |
true |
hazelcast.javaOpts |
Additional JAVA_OPTS properties for Hazelcast member |
nil |
hazelcast.loggingLevel |
Level of Hazelcast logs (OFF, FATAL, ERROR, WARN, INFO, DEBUG, TRACE and ALL) |
nil |
hazelcast.existingConfigMap |
ConfigMap which contains Hazelcast configuration file(s) that are used instead hazelcast.yaml embedded into values.yaml |
nil |
hazelcast.yaml |
Hazelcast YAML Configuration (hazelcast.yaml embedded into values.yaml) |
{DEFAULT_HAZELCAST_YAML} |
hazelcast.configurationFiles |
Hazelcast configuration files |
nil |
annotations |
Hazelcast Statefulset annotations |
nil |
affinity |
Hazelcast Node affinity |
nil |
tolerations |
Hazelcast Node tolerations |
nil |
nodeSelector |
Hazelcast Node labels for pod assignment |
nil |
topologySpreadConstraints |
Control how Pods are spread across the cluster |
{} |
hostPort |
Port under which Hazelcast PODs are exposed on the host machines |
nil |
customPorts |
Whole ports section to customize how Hazelcast container ports are defined |
nil |
labels |
Extra labels to add to the statefulset |
{} |
podLabels |
Extra labels to add to the pod container metadata |
{} |
priorityClassName |
Custom priority class name |
<undefined> |
gracefulShutdown.enabled |
Turn on and off Graceful Shutdown |
true |
gracefulShutdown.maxWaitSeconds |
Maximum time to wait for the Hazelcast POD to shut down |
600 |
livenessProbe.enabled |
Turn on and off liveness probe |
true |
livenessProbe.initialDelaySeconds |
Delay before liveness probe is initiated |
30 |
livenessProbe.periodSeconds |
How often to perform the probe |
10 |
livenessProbe.timeoutSeconds |
When the probe times out |
5 |
livenessProbe.successThreshold |
Minimum consecutive successes for the probe to be considered successful after having failed |
1 |
livenessProbe.failureThreshold |
Minimum consecutive failures for the probe to be considered failed after having succeeded. |
3 |
livenessProbe.path |
URL path that will be called to check liveness. |
/hazelcast/health/node-state |
livenessProbe.port |
Port that will be used in liveness probe calls. |
nil |
livenessProbe.scheme |
HTTPS or HTTP scheme. |
HTTP |
readinessProbe.enabled |
Turn on and off readiness probe |
true |
readinessProbe.initialDelaySeconds |
Delay before readiness probe is initiated |
30 |
readinessProbe.periodSeconds |
How often to perform the probe |
10 |
readinessProbe.timeoutSeconds |
When the probe times out |
1 |
readinessProbe.successThreshold |
Minimum consecutive successes for the probe to be considered successful after having failed |
1 |
readinessProbe.failureThreshold |
Minimum consecutive failures for the probe to be considered failed after having succeeded. |
3 |
readinessProbe.path |
URL path that will be called to check readiness. |
/hazelcast/health/ready |
readinessProbe.port |
Port that will be used in readiness probe calls. |
nil |
readinessProbe.scheme |
HTTPS or HTTP scheme. |
HTTP |
resources.limits.cpu |
CPU resource limit |
default |
resources.limits.memory |
Memory resource limit |
default |
resources.requests.cpu |
CPU resource requests |
default |
resources.requests.memory |
Memory resource requests |
default |
podDisruptionBudget.maxUnavailable |
Number of max unavailable pods |
|
podDisruptionBudget.minAvailable |
Number of min available pods |
|
service.create |
Enable installing Service |
true |
service.name |
Name of the existing service for configuring Hazelcast Kubernetes discovery plugin. The field is taken into account only when |
nil |
service.type |
Kubernetes service type ( |
ClusterIP |
service.port |
Kubernetes service port |
5701 |
service.clusterIP |
IP of the service, |
None |
service.loadBalancerIP |
IP of the load-balancer service |
|
service.annotations |
Extra annotations for the Hazelcast service |
{} |
service.labels |
Extra labels for the Hazelcast service |
{} |
rbac.create |
Enable installing RBAC Role authorization |
true |
rbac.useClusterRole |
If |
true |
serviceAccount.create |
Enable installing Service Account |
true |
serviceAccount.automountToken |
Whether the token associated with the service account should be automatically mounted |
true |
serviceAccount.name |
Name of Service Account, if not set, the name is generated using the fullname template |
nil |
securityContext.enabled |
Enables Security Context for Hazelcast and Management Center |
true |
securityContext.runAsUser |
User ID used to run the Hazelcast and Management Center containers |
65534 |
securityContext.runAsGroup |
Primary Group ID used to run all processes in the Hazelcast Jet and Hazelcast Jet Management Center containers |
65534 |
securityContext.fsGroup |
Group ID associated with the Hazelcast and Management Center container |
65534 |
securityContext.readOnlyRootFilesystem |
Enables readOnlyRootFilesystem in the Hazelcast security context |
true |
persistence.enabled |
Turn on and off Hazelcast Persistence feature (Hazelcast configuration must be also updated with the map/cache configuration) |
false |
persistence.existingClaim |
Name of the existing Persistence Volume Claim, if not defined, a new is created |
nil |
persistence.accessModes |
Access Modes of the new Persistent Volume Claim |
ReadWriteOnce |
persistence.size |
Size of the new Persistent Volume Claim |
8Gi |
persistence.hostPath |
Path of node machine used for persistent storage; if defined, it’s used instead of Persistent Volume Claim |
nil |
jet.enabled |
Turn on and off Hazelcast Jet engine |
true |
metrics.enabled |
Turn on and off JMX Prometheus metrics available at |
false |
metrics.service.type |
Type of the metrics service |
ClusterIP |
metrics.service.port |
Port of the |
8080 |
metrics.service.loadBalancerIP |
IP to be used to access metric service for |
nil |
metrics.service.annotations |
Annotations for the Prometheus discovery |
|
metrics.service.serviceMonitor.enabled |
Enable to create ServiceMonitor resource |
false |
metrics.service.serviceMonitor.namespace |
The namespace in which the ServiceMonitor will be created |
|
metrics.service.serviceMonitor.labels |
Additional labels for the ServiceMonitor |
{} |
metrics.service.serviceMonitor.interval |
The interval at which metrics should be scraped |
30s |
metrics.service.serviceMonitor.scrapeTimeout |
The timeout after which the scrape is ended |
|
metrics.service.serviceMonitor.relabellings |
Metrics RelabelConfigs to apply to samples before scraping |
|
metrics.service.serviceMonitor.metricRelabelings |
Metrics RelabelConfigs to apply to samples before ingestion |
|
metrics.service.serviceMonitor.honorLabels |
Specify honorLabels parameter to add the scrape endpoint |
false |
metrics.prometheusRule.enabled |
Enable to create PrometheusRule resource |
false |
metrics.prometheusRule.namespace |
The namespace in which the PrometheusRule will be created |
|
metrics.prometheusRule.labels |
Additional labels for the PrometheusRule |
{} |
metrics.prometheusRule.rules |
Array of rules to define in PrometheusRule |
|
secretsMountName |
Secret name that is mounted as |
nil |
customVolume |
Configuration for a volume mounted as |
nil |
externalVolume |
Configuration for a volume mounted as |
nil |
initContainers |
List of init containers to add to the Hazelcast Statefulset’s pod spec. |
|
sidecarContainers |
List of sidecar containers to add to the Hazelcast Statefulset’s pod spec. |
|
env |
Additional Environment variables |
|
mancenter.enabled |
Turn on and off Management Center application |
true |
mancenter.image.repository |
Hazelcast Management Center Image name |
hazelcast/management-center |
mancenter.image.tag |
Hazelcast Management Center Image tag (NOTE: must be the same or one minor release greater than Hazelcast image version) |
{VERSION} |
mancenter.image.pullPolicy |
Image pull policy |
IfNotPresent |
mancenter.image.pullSecrets |
Specify docker-registry secret names as an array |
nil |
mancenter.contextPath |
The value for the |
nil |
mancenter.ssl |
Enable SSL for Management Center |
false |
mancenter.devMode.enabled |
Dev mode is for the Hazelcast clusters running on your local for development or evaluation purposes and it provides quick access to the Management Center without requiring any security credentials |
false |
mancenter.javaOpts |
Additional JAVA_OPTS properties for Hazelcast Management Center |
nil |
mancenter.loggingLevel |
Level of Management Center logs (OFF, FATAL, ERROR, WARN, INFO, DEBUG, TRACE and ALL) |
nil |
mancenter.licenseKey |
License Key for Hazelcast Management Center, if not provided, can be filled in the web interface |
nil |
mancenter.licenseKeySecretName |
Kubernetes Secret Name, where Management Center License Key is stored (can be used instead of licenseKey) |
nil |
mancenter.adminCredentialsSecretName |
Kubernetes Secret Name for admin credentials. Secret has to contain |
nil |
mancenter.annotations |
Management Center Statefulset annotations |
nil |
mancenter.affinity |
Management Center Node affinity |
nil |
mancenter.tolerations |
Management Center Node tolerations |
nil |
mancenter.nodeSelector |
Hazelcast Management Center node labels for pod assignment |
nil |
mancenter.topologySpreadConstraints |
Control how Pods are spread across the cluster |
{} |
mancenter.labels |
Extra labels to add to the mancenter statefulset |
{} |
mancenter.podLabels |
Extra labels to add to the mancenter pod container metadata |
{} |
mancenter.priorityClassName |
Custom priority class name |
<undefined> |
mancenter.resources |
CPU/Memory resource requests/limits |
nil |
mancenter.persistence.enabled |
Enable Persistent Volume for Hazelcast Management |
true |
mancenter.persistence.existingClaim |
Name of the existing Persistence Volume Claim, if not defined, a new is created |
nil |
mancenter.persistence.accessModes |
Access Modes of the new Persistent Volume Claim |
ReadWriteOnce |
mancenter.persistence.size |
Size of the new Persistent Volume Claim |
8Gi |
mancenter.persistence.storageClass |
Storage class name used for Management Center |
nil |
mancenter.persistence.subPath |
Path within the volume from which the container’s volume should be mounted. Defaults to "" (volume’s root). |
nil |
mancenter.persistence.subPathExpr |
Expanded path within the volume from which the container’s volume should be mounted. Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container’s environment. Defaults to "" (volume’s root). SubPathExpr and SubPath are mutually exclusive. |
nil |
mancenter.service.type |
Kubernetes service type ( |
LoadBalancer |
mancenter.service.port |
Kubernetes service port |
8080 |
mancenter.service.loadBalancerIP |
IP to be used to access management center for |
nil |
mancenter.service.annotations |
Extra annotations for the mancenter service |
{} |
mancenter.service.labels |
Extra labels for the mancenter service |
{} |
mancenter.livenessProbe.enabled |
Turn on and off liveness probe |
true |
mancenter.livenessProbe.initialDelaySeconds |
Delay before liveness probe is initiated |
30 |
mancenter.livenessProbe.periodSeconds |
How often to perform the probe |
10 |
mancenter.livenessProbe.timeoutSeconds |
When the probe times out |
5 |
mancenter.livenessProbe.successThreshold |
Minimum consecutive successes for the probe to be considered successful after having failed |
1 |
mancenter.livenessProbe.failureThreshold |
Minimum consecutive failures for the probe to be considered failed after having succeeded. |
3 |
mancenter.readinessProbe.enabled |
Turn on and off readiness probe |
true |
mancenter.readinessProbe.initialDelaySeconds |
Delay before readiness probe is initiated |
30 |
mancenter.readinessProbe.periodSeconds |
How often to perform the probe |
10 |
mancenter.readinessProbe.timeoutSeconds |
When the probe times out |
1 |
mancenter.readinessProbe.successThreshold |
Minimum consecutive successes for the probe to be considered successful after having failed |
1 |
mancenter.readinessProbe.failureThreshold |
Minimum consecutive failures for the probe to be considered failed after having succeeded. |
3 |
mancenter.ingress.enabled |
Enable ingress for the management center |
false |
mancenter.ingress.annotations |
Any annotations for the ingress |
{} |
mancenter.ingress.hosts |
List of hostnames for ingress, see values.yaml for example |
|
mancenter.ingress.tls |
List of TLS configuration for ingress, see values.yaml for example |
|
mancenter.clusterConfig.create |
Cluster config creation will create the connection to the Hazelcast cluster based on the hazelcast-client.yaml file embedded into values |
true |
externalAccess.enabled |
Enable external access to hazelcast nodes |
false |
externalAccess.service.type |
Kubernetes Service type for external access. It can be NodePort or LoadBalancer |
LoadBalancer |
externalAccess.service.loadBalancerIPs |
Array of load balancer IPs for hazelcast nodes |
|
externalAccess.service.loadBalancerSourceRanges |
Address(es) that are allowed when service is LoadBalancer |
|
externalAccess.service.nodePorts |
Array of node ports used to configure hazelcast external listener when service type is NodePort |
|
externalAccess.service.labels |
Extra labels for the services for external access |
{} |
extraDeploy |
Array of extra objects to deploy with the release |
Specify each parameter using the --set key=value,key=value
argument to helm install
. For example,
helm install my-release hazelcast/hazelcast \
--set hazelcast.licenseKey=<license_key>,cluster.memberCount=3
The above command sets number of Hazelcast members to 3.
Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,
helm install my-release hazelcast/hazelcast -f values.yaml
You can use the default values.yaml with the hazelcast.license filled in.
|
Some of the Hazelcast Enterprise features requires setting securityContext.readOnlyRootFilesystem parameter to false . This is the case for the Hot Restart feature or enabling security with OpenSSL. In such cases where readOnlyRootFilesystem needs to be set to true (i.e. a Pod Security Policy requirement), for Hot Restart to work the JVM parameter -Djava.io.tmpdir should be set to a writable location (for example a custom volume).
|
Notable changes
2.8.0
Hazelcast REST Endpoints are no longer enabled by default and the parameter hazelcast.rest
is no longer available. If you want to enable REST, please add the related endpoint-groups
to the Hazelcast Configuration. For example:
rest-api:
enabled: true
endpoint-groups:
HEALTH_CHECK:
enabled: true
CLUSTER_READ:
enabled: true
CLUSTER_WRITE:
enabled: true