Operator Resources
Altinity Kubernetes Operator for ClickHouse® Resources
The Altinity Kubernetes Operator for ClickHouse® creates the following resources on installation to support its functions:
- Custom Resource Definition
- Service account
- Cluster Role Binding
- Deployment
Custom Resource Definition
The Kubernetes k8s API is extended with the new Kubernetes Cluster Resource Definition kind:ClickHouseInstallation.
To check the Custom Resource Definition:
kubectl get customresourcedefinitions
Expected result:
NAME CREATED AT
clickhouseinstallations.clickhouse.altinity.com 2022-02-09T17:20:39Z
clickhouseinstallationtemplates.clickhouse.altinity.com 2022-02-09T17:20:39Z
clickhouseoperatorconfigurations.clickhouse.altinity.com 2022-02-09T17:20:39Z
Service Account
The new Service Account clickhouse-operator allows services running from within Pods to be authenticated against the Service Account clickhouse-operator through the apiserver.
To check the Service Account:
kubectl get serviceaccounts -n kube-system
Expected result
NAME SECRETS AGE
attachdetach-controller 1 23d
bootstrap-signer 1 23d
certificate-controller 1 23d
clickhouse-operator 1 5s
clusterrole-aggregation-controller 1 23d
coredns 1 23d
cronjob-controller 1 23d
daemon-set-controller 1 23d
default 1 23d
deployment-controller 1 23d
disruption-controller 1 23d
endpoint-controller 1 23d
endpointslice-controller 1 23d
endpointslicemirroring-controller 1 23d
ephemeral-volume-controller 1 23d
expand-controller 1 23d
generic-garbage-collector 1 23d
horizontal-pod-autoscaler 1 23d
job-controller 1 23d
kube-proxy 1 23d
namespace-controller 1 23d
node-controller 1 23d
persistent-volume-binder 1 23d
pod-garbage-collector 1 23d
pv-protection-controller 1 23d
pvc-protection-controller 1 23d
replicaset-controller 1 23d
replication-controller 1 23d
resourcequota-controller 1 23d
root-ca-cert-publisher 1 23d
service-account-controller 1 23d
service-controller 1 23d
statefulset-controller 1 23d
storage-provisioner 1 23d
token-cleaner 1 23d
ttl-after-finished-controller 1 23d
ttl-controller 1 23d
Cluster Role Binding
The Cluster Role Binding cluster-operator grants permissions defined in a role to a set of users.
Roles are granted to users, groups or service account. These permissions are granted cluster-wide with ClusterRoleBinding.
To check the Cluster Role Binding:
kubectl get clusterrolebinding
Expected result
NAME ROLE AGE
clickhouse-operator-kube-system ClusterRole/clickhouse-operator-kube-system 5s
cluster-admin ClusterRole/cluster-admin 23d
kubeadm:get-nodes ClusterRole/kubeadm:get-nodes 23d
kubeadm:kubelet-bootstrap ClusterRole/system:node-bootstrapper 23d
kubeadm:node-autoapprove-bootstrap ClusterRole/system:certificates.k8s.io:certificatesigningrequests:nodeclient 23d
kubeadm:node-autoapprove-certificate-rotation ClusterRole/system:certificates.k8s.io:certificatesigningrequests:selfnodeclient 23d
kubeadm:node-proxier ClusterRole/system:node-proxier 23d
minikube-rbac ClusterRole/cluster-admin 23d
storage-provisioner ClusterRole/system:persistent-volume-provisioner 23d
system:basic-user ClusterRole/system:basic-user 23d
system:controller:attachdetach-controller ClusterRole/system:controller:attachdetach-controller 23d
system:controller:certificate-controller ClusterRole/system:controller:certificate-controller 23d
system:controller:clusterrole-aggregation-controller ClusterRole/system:controller:clusterrole-aggregation-controller 23d
system:controller:cronjob-controller ClusterRole/system:controller:cronjob-controller 23d
system:controller:daemon-set-controller ClusterRole/system:controller:daemon-set-controller 23d
system:controller:deployment-controller ClusterRole/system:controller:deployment-controller 23d
system:controller:disruption-controller ClusterRole/system:controller:disruption-controller 23d
system:controller:endpoint-controller ClusterRole/system:controller:endpoint-controller 23d
system:controller:endpointslice-controller ClusterRole/system:controller:endpointslice-controller 23d
system:controller:endpointslicemirroring-controller ClusterRole/system:controller:endpointslicemirroring-controller 23d
system:controller:ephemeral-volume-controller ClusterRole/system:controller:ephemeral-volume-controller 23d
system:controller:expand-controller ClusterRole/system:controller:expand-controller 23d
system:controller:generic-garbage-collector ClusterRole/system:controller:generic-garbage-collector 23d
system:controller:horizontal-pod-autoscaler ClusterRole/system:controller:horizontal-pod-autoscaler 23d
system:controller:job-controller ClusterRole/system:controller:job-controller 23d
system:controller:namespace-controller ClusterRole/system:controller:namespace-controller 23d
system:controller:node-controller ClusterRole/system:controller:node-controller 23d
system:controller:persistent-volume-binder ClusterRole/system:controller:persistent-volume-binder 23d
system:controller:pod-garbage-collector ClusterRole/system:controller:pod-garbage-collector 23d
system:controller:pv-protection-controller ClusterRole/system:controller:pv-protection-controller 23d
system:controller:pvc-protection-controller ClusterRole/system:controller:pvc-protection-controller 23d
system:controller:replicaset-controller ClusterRole/system:controller:replicaset-controller 23d
system:controller:replication-controller ClusterRole/system:controller:replication-controller 23d
system:controller:resourcequota-controller ClusterRole/system:controller:resourcequota-controller 23d
system:controller:root-ca-cert-publisher ClusterRole/system:controller:root-ca-cert-publisher 23d
system:controller:route-controller ClusterRole/system:controller:route-controller 23d
system:controller:service-account-controller ClusterRole/system:controller:service-account-controller 23d
system:controller:service-controller ClusterRole/system:controller:service-controller 23d
system:controller:statefulset-controller ClusterRole/system:controller:statefulset-controller 23d
system:controller:ttl-after-finished-controller ClusterRole/system:controller:ttl-after-finished-controller 23d
system:controller:ttl-controller ClusterRole/system:controller:ttl-controller 23d
system:coredns ClusterRole/system:coredns 23d
system:discovery ClusterRole/system:discovery 23d
system:kube-controller-manager ClusterRole/system:kube-controller-manager 23d
system:kube-dns ClusterRole/system:kube-dns 23d
system:kube-scheduler ClusterRole/system:kube-scheduler 23d
system:monitoring ClusterRole/system:monitoring 23d
system:node ClusterRole/system:node 23d
system:node-proxier ClusterRole/system:node-proxier 23d
system:public-info-viewer ClusterRole/system:public-info-viewer 23d
system:service-account-issuer-discovery ClusterRole/system:service-account-issuer-discovery 23d
system:volume-scheduler ClusterRole/system:volume-scheduler 23d
Cluster Role Binding Example
As an example, the role cluster-admin is granted to a service account clickhouse-operator:
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: clickhouse-operator
namespace: kube-system
Deployment
The Deployment clickhouse-operator runs in the kube-system namespace.
To check the Deployment:
kubectl get deployments --namespace kube-system
Expected result
NAME READY UP-TO-DATE AVAILABLE AGE
clickhouse-operator 1/1 1 1 5s
coredns 1/1 1 1 23d
References from the Kubernetes documentation
- CustomResourceDefinitions
- Configure Service Accounts for Pods
- RoleBinding and ClusterRoleBinding
- Deployments