c-07, c-08

charts/graylog/README.md

@@ -19,6 +19,7 @@ Official Helm chart for Graylog.
   * [Scale Graylog](#scale-graylog)
   * [Scale DataNode](#scale-datanode)
   * [Scale MongoDB](#scale-mongodb)
+  * [MongoDB Topology](#mongodb-topology)
   * [Modify Graylog `server.conf` parameters](#modify-graylog-serverconf-parameters)
   * [Customize deployed Kubernetes resources](#customize-deployed-kubernetes-resources)
   * [Add inputs](#add-inputs)
@@ -263,6 +264,31 @@ helm upgrade graylog graylog/graylog -n graylog --set datanode.replicas=5 --reus
 helm upgrade graylog graylog/graylog -n graylog --set mongodb.replicas=4 --reuse-values
 ```
 
+### MongoDB Topology
+
+By default, the chart deploys MongoDB with a **production-recommended topology**: 3 data-bearing replicas with no arbiters. This configuration:
+- Supports `w:majority` writes even with one replica down
+- Handles rolling upgrades and maintenance gracefully
+- Provides true high availability without cost overhead
+
+**Example: Default production topology**
+```yaml
+mongodb:
+  replicas: 3
+  arbiters: 0
+```
+
+For **cost-optimized test/staging environments**, you may use the Primary-Secondary-Arbiter (PSA) topology instead. However, be aware that this topology is not recommended by MongoDB for production use:
+
+```yaml
+mongodb:
+  replicas: 2
+  arbiters: 1
+```
+
+> [!WARNING]
+> With PSA topology, if one data-bearing replica fails, `w:majority` writes will stall until the member recovers.
+
 ## Modify Graylog `server.conf` parameters
 
 ```sh

charts/graylog/templates/NOTES.txt

@@ -13,8 +13,9 @@ SUMMARY
   {{- if .Values.mongodb.communityResource.enabled }}
   {{- $mongoReplicaCount := .Values.mongodb.replicas | int }}
   {{- $mongoArbiterCount := .Values.mongodb.arbiters | int }}
-  - {{ $mongoReplicaCount }} replicas{{ if $mongoArbiterCount }} (+ {{ $mongoArbiterCount }} arbiter){{ end }} for MongoDB, running as a replica set in Primary{{ if gt 1 $mongoReplicaCount }}-Secondary{{ end }}{{ if $mongoArbiterCount }}-Arbiter{{ end }} mode.
-  {{ if mod (add $mongoArbiterCount $mongoReplicaCount | int) 2 | eq 0 }}
+  {{- $totalMembers := add $mongoReplicaCount $mongoArbiterCount }}
+  - {{ $mongoReplicaCount }} data-bearing replicas{{ if $mongoArbiterCount }} (+ {{ $mongoArbiterCount }} arbiter{{ if gt $mongoArbiterCount 1 }}s{{ end }}){{ end }} for MongoDB, running as a replica set in Primary{{ if gt $mongoReplicaCount 1 }}-Secondary{{ if gt $mongoReplicaCount 2 }}-Secondary{{ end }}{{ end }}{{ if $mongoArbiterCount }}-Arbiter{{ end }} mode.
+  {{ if mod $totalMembers 2 | eq 0 }}
   WARNING: An odd number of workers (replicas + arbiters) is preferred for MongoDB Replica Sets.
   {{- end }}
   {{- end }}

charts/graylog/templates/custom/mongo-rs.yaml

@@ -52,6 +52,22 @@ spec:
       template:
         spec:
           serviceAccountName: {{ include "graylog.mongodb.serviceAccountName" . }}
+          affinity:
+            podAntiAffinity:
+              preferredDuringSchedulingIgnoredDuringExecution:
+                - weight: 100
+                  podAffinityTerm:
+                    labelSelector:
+                      matchExpressions:
+                        - key: app.kubernetes.io/instance
+                          operator: In
+                          values:
+                            - {{ .Release.Name }}
+                        - key: app
+                          operator: In
+                          values:
+                            - mongodb
+                    topologyKey: kubernetes.io/hostname
       volumeClaimTemplates:
         - metadata:
             name: data-volume

charts/graylog/templates/policy/pdb/datanode.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.datanode.podDisruptionBudget.enabled }}
+{{- if and .Values.datanode.enabled .Values.datanode.podDisruptionBudget.enabled }}
 {{- if ge (include "graylog.datanode.replicas" . | int) 1 }}
 apiVersion: policy/v1
 kind: PodDisruptionBudget

charts/graylog/templates/service/ingress/graylog.yaml

@@ -48,7 +48,10 @@ spec:
   {{- end }}
   rules:
     {{- range .Values.ingress.web.hosts }}
-    - http:
+    - {{ with .host -}}
+      host: {{ . | quote }}
+      {{- end }}
+      http:
         paths:
           {{- range .paths | default (list $defaultPath) }}
           - path: {{ .path | default $defaultPath.path }}
@@ -58,8 +61,5 @@ spec:
               {{- toYaml . | nindent 14 }}
             {{- end }}
           {{- end }}
-      {{ with .host -}}
-      host: {{ . | quote }}
-      {{- end }}
     {{- end }}
 {{- end }}

charts/graylog/templates/workload/statefulsets/datanode.yaml

@@ -142,8 +142,24 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       affinity:
-      {{- with .Values.datanode.affinity }}
-        {{- toYaml . | nindent 8 }}
+      {{- if .Values.datanode.affinity }}
+        {{- toYaml .Values.datanode.affinity | nindent 8 }}
+      {{- else }}
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchExpressions:
+                    - key: app.kubernetes.io/instance
+                      operator: In
+                      values:
+                        - {{ .Release.Name }}
+                    - key: app
+                      operator: In
+                      values:
+                        - graylog-datanode
+                topologyKey: kubernetes.io/hostname
       {{- end }}
       {{- if and .Values.datanode.persistence.data.enabled .Values.datanode.persistence.nativeLibs.enabled | not }}
       volumes:

charts/graylog/templates/workload/statefulsets/graylog.yaml

@@ -188,8 +188,24 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       affinity:
-      {{- with .Values.graylog.affinity }}
-        {{- toYaml . | nindent 8 }}
+      {{- if .Values.graylog.affinity }}
+        {{- toYaml .Values.graylog.affinity | nindent 8 }}
+      {{- else }}
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchExpressions:
+                    - key: app.kubernetes.io/instance
+                      operator: In
+                      values:
+                        - {{ .Release.Name }}
+                    - key: app
+                      operator: In
+                      values:
+                        - graylog-app
+                topologyKey: kubernetes.io/hostname
       {{- end }}
       volumes:
       - name: init-script

charts/graylog/values.yaml

@@ -204,8 +204,11 @@ graylog:
     timeoutSeconds: 5
     failureThreshold: 6
     successThreshold: 1
+  # PodDisruptionBudgets are enabled by default for production deployments
+  # They prevent cluster upgrades and maintenance from disrupting all instances
+  # Set enabled: false only for non-production clusters or single-replica deployments
   podDisruptionBudget:
-    enabled: false
+    enabled: true
     minAvailable: 1
   podSecurityContext:
     # fsGroup is required to make mounted volumes writable
@@ -321,8 +324,11 @@ datanode:
     timeoutSeconds: 5
     failureThreshold: 6
     successThreshold: 1
+  # PodDisruptionBudgets are enabled by default for production deployments
+  # They prevent cluster upgrades and maintenance from disrupting all instances
+  # Set enabled: false only for non-production clusters or single-replica deployments
   podDisruptionBudget:
-    enabled: false
+    enabled: true
     minAvailable: 2
   podSecurityContext:
     fsGroup: 999
@@ -400,8 +406,12 @@ mongodb:
   communityResource:
     enabled: true
   version: "7.0.25"
-  replicas: 2
-  arbiters: 1
+  # For production deployments, use 3 data-bearing replicas with no arbiters.
+  # This configuration supports w:majority writes even with one replica down.
+  # For cost-optimized test/staging environments, use the PSA topology instead:
+  # replicas: 2, arbiters: 1
+  replicas: 3
+  arbiters: 0
   persistence:
     storageClass: ""
     size: