From e912a163323e2aa29442149f71939e5ab2aa1417 Mon Sep 17 00:00:00 2001 From: alix-graylog Date: Wed, 15 Jul 2026 14:02:57 -0400 Subject: [PATCH] wip --- charts/graylog/README.md | 26 +++++++++++++++++++ charts/graylog/templates/NOTES.txt | 5 ++-- charts/graylog/templates/custom/mongo-rs.yaml | 16 ++++++++++++ .../templates/policy/pdb/datanode.yaml | 2 +- .../templates/service/ingress/graylog.yaml | 8 +++--- .../workload/statefulsets/datanode.yaml | 20 ++++++++++++-- .../workload/statefulsets/graylog.yaml | 20 ++++++++++++-- charts/graylog/values.yaml | 18 ++++++++++--- 8 files changed, 100 insertions(+), 15 deletions(-) diff --git a/charts/graylog/README.md b/charts/graylog/README.md index 51926ca..fe09da2 100644 --- a/charts/graylog/README.md +++ b/charts/graylog/README.md @@ -19,6 +19,7 @@ Official Helm chart for Graylog. * [Scale Graylog](#scale-graylog) * [Scale DataNode](#scale-datanode) * [Scale MongoDB](#scale-mongodb) + * [MongoDB Topology](#mongodb-topology) * [Modify Graylog `server.conf` parameters](#modify-graylog-serverconf-parameters) * [Customize deployed Kubernetes resources](#customize-deployed-kubernetes-resources) * [Add inputs](#add-inputs) @@ -263,6 +264,31 @@ helm upgrade graylog graylog/graylog -n graylog --set datanode.replicas=5 --reus helm upgrade graylog graylog/graylog -n graylog --set mongodb.replicas=4 --reuse-values ``` +### MongoDB Topology + +By default, the chart deploys MongoDB with a **production-recommended topology**: 3 data-bearing replicas with no arbiters. This configuration: +- Supports `w:majority` writes even with one replica down +- Handles rolling upgrades and maintenance gracefully +- Provides true high availability without cost overhead + +**Example: Default production topology** +```yaml +mongodb: + replicas: 3 + arbiters: 0 +``` + +For **cost-optimized test/staging environments**, you may use the Primary-Secondary-Arbiter (PSA) topology instead. However, be aware that this topology is not recommended by MongoDB for production use: + +```yaml +mongodb: + replicas: 2 + arbiters: 1 +``` + +> [!WARNING] +> With PSA topology, if one data-bearing replica fails, `w:majority` writes will stall until the member recovers. + ## Modify Graylog `server.conf` parameters ```sh diff --git a/charts/graylog/templates/NOTES.txt b/charts/graylog/templates/NOTES.txt index 947b623..43aa4b1 100644 --- a/charts/graylog/templates/NOTES.txt +++ b/charts/graylog/templates/NOTES.txt @@ -13,8 +13,9 @@ SUMMARY {{- if .Values.mongodb.communityResource.enabled }} {{- $mongoReplicaCount := .Values.mongodb.replicas | int }} {{- $mongoArbiterCount := .Values.mongodb.arbiters | int }} - - {{ $mongoReplicaCount }} replicas{{ if $mongoArbiterCount }} (+ {{ $mongoArbiterCount }} arbiter){{ end }} for MongoDB, running as a replica set in Primary{{ if gt 1 $mongoReplicaCount }}-Secondary{{ end }}{{ if $mongoArbiterCount }}-Arbiter{{ end }} mode. - {{ if mod (add $mongoArbiterCount $mongoReplicaCount | int) 2 | eq 0 }} + {{- $totalMembers := add $mongoReplicaCount $mongoArbiterCount }} + - {{ $mongoReplicaCount }} data-bearing replicas{{ if $mongoArbiterCount }} (+ {{ $mongoArbiterCount }} arbiter{{ if gt $mongoArbiterCount 1 }}s{{ end }}){{ end }} for MongoDB, running as a replica set in Primary{{ if gt $mongoReplicaCount 1 }}-Secondary{{ if gt $mongoReplicaCount 2 }}-Secondary{{ end }}{{ end }}{{ if $mongoArbiterCount }}-Arbiter{{ end }} mode. + {{ if mod $totalMembers 2 | eq 0 }} WARNING: An odd number of workers (replicas + arbiters) is preferred for MongoDB Replica Sets. {{- end }} {{- end }} diff --git a/charts/graylog/templates/custom/mongo-rs.yaml b/charts/graylog/templates/custom/mongo-rs.yaml index e5544ee..8dce5b4 100644 --- a/charts/graylog/templates/custom/mongo-rs.yaml +++ b/charts/graylog/templates/custom/mongo-rs.yaml @@ -52,6 +52,22 @@ spec: template: spec: serviceAccountName: {{ include "graylog.mongodb.serviceAccountName" . }} + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 100 + podAffinityTerm: + labelSelector: + matchExpressions: + - key: app.kubernetes.io/instance + operator: In + values: + - {{ .Release.Name }} + - key: app + operator: In + values: + - mongodb + topologyKey: kubernetes.io/hostname volumeClaimTemplates: - metadata: name: data-volume diff --git a/charts/graylog/templates/policy/pdb/datanode.yaml b/charts/graylog/templates/policy/pdb/datanode.yaml index 06eb66d..e4cedb4 100644 --- a/charts/graylog/templates/policy/pdb/datanode.yaml +++ b/charts/graylog/templates/policy/pdb/datanode.yaml @@ -1,4 +1,4 @@ -{{- if .Values.datanode.podDisruptionBudget.enabled }} +{{- if and .Values.datanode.enabled .Values.datanode.podDisruptionBudget.enabled }} {{- if ge (include "graylog.datanode.replicas" . | int) 1 }} apiVersion: policy/v1 kind: PodDisruptionBudget diff --git a/charts/graylog/templates/service/ingress/graylog.yaml b/charts/graylog/templates/service/ingress/graylog.yaml index 07129ad..84e47e8 100644 --- a/charts/graylog/templates/service/ingress/graylog.yaml +++ b/charts/graylog/templates/service/ingress/graylog.yaml @@ -48,7 +48,10 @@ spec: {{- end }} rules: {{- range .Values.ingress.web.hosts }} - - http: + - {{ with .host -}} + host: {{ . | quote }} + {{- end }} + http: paths: {{- range .paths | default (list $defaultPath) }} - path: {{ .path | default $defaultPath.path }} @@ -58,8 +61,5 @@ spec: {{- toYaml . | nindent 14 }} {{- end }} {{- end }} - {{ with .host -}} - host: {{ . | quote }} - {{- end }} {{- end }} {{- end }} diff --git a/charts/graylog/templates/workload/statefulsets/datanode.yaml b/charts/graylog/templates/workload/statefulsets/datanode.yaml index dd57f38..4786df4 100644 --- a/charts/graylog/templates/workload/statefulsets/datanode.yaml +++ b/charts/graylog/templates/workload/statefulsets/datanode.yaml @@ -142,8 +142,24 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} affinity: - {{- with .Values.datanode.affinity }} - {{- toYaml . | nindent 8 }} + {{- if .Values.datanode.affinity }} + {{- toYaml .Values.datanode.affinity | nindent 8 }} + {{- else }} + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 100 + podAffinityTerm: + labelSelector: + matchExpressions: + - key: app.kubernetes.io/instance + operator: In + values: + - {{ .Release.Name }} + - key: app + operator: In + values: + - graylog-datanode + topologyKey: kubernetes.io/hostname {{- end }} {{- if and .Values.datanode.persistence.data.enabled .Values.datanode.persistence.nativeLibs.enabled | not }} volumes: diff --git a/charts/graylog/templates/workload/statefulsets/graylog.yaml b/charts/graylog/templates/workload/statefulsets/graylog.yaml index b14444f..9314de6 100644 --- a/charts/graylog/templates/workload/statefulsets/graylog.yaml +++ b/charts/graylog/templates/workload/statefulsets/graylog.yaml @@ -188,8 +188,24 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} affinity: - {{- with .Values.graylog.affinity }} - {{- toYaml . | nindent 8 }} + {{- if .Values.graylog.affinity }} + {{- toYaml .Values.graylog.affinity | nindent 8 }} + {{- else }} + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 100 + podAffinityTerm: + labelSelector: + matchExpressions: + - key: app.kubernetes.io/instance + operator: In + values: + - {{ .Release.Name }} + - key: app + operator: In + values: + - graylog-app + topologyKey: kubernetes.io/hostname {{- end }} volumes: - name: init-script diff --git a/charts/graylog/values.yaml b/charts/graylog/values.yaml index ce0e918..971fdac 100644 --- a/charts/graylog/values.yaml +++ b/charts/graylog/values.yaml @@ -204,8 +204,11 @@ graylog: timeoutSeconds: 5 failureThreshold: 6 successThreshold: 1 + # PodDisruptionBudgets are enabled by default for production deployments + # They prevent cluster upgrades and maintenance from disrupting all instances + # Set enabled: false only for non-production clusters or single-replica deployments podDisruptionBudget: - enabled: false + enabled: true minAvailable: 1 podSecurityContext: # fsGroup is required to make mounted volumes writable @@ -321,8 +324,11 @@ datanode: timeoutSeconds: 5 failureThreshold: 6 successThreshold: 1 + # PodDisruptionBudgets are enabled by default for production deployments + # They prevent cluster upgrades and maintenance from disrupting all instances + # Set enabled: false only for non-production clusters or single-replica deployments podDisruptionBudget: - enabled: false + enabled: true minAvailable: 2 podSecurityContext: fsGroup: 999 @@ -400,8 +406,12 @@ mongodb: communityResource: enabled: true version: "7.0.25" - replicas: 2 - arbiters: 1 + # For production deployments, use 3 data-bearing replicas with no arbiters. + # This configuration supports w:majority writes even with one replica down. + # For cost-optimized test/staging environments, use the PSA topology instead: + # replicas: 2, arbiters: 1 + replicas: 3 + arbiters: 0 persistence: storageClass: "" size: