Install the Aerospike Kubernetes Operator from OperatorHub
In Kubernetes 1.23 and later, Pod Security Admission (PSA) is enabled by default. Make sure the namespace where the Aerospike Operator is installed has either baseline
or privileged
Pod Security Standard level set.
The restricted
level is not supported by Aerospike. The default Pod Security Standard level in Kubernetes 1.23 is privileged
.
For more details, see Apply Pod Security Standards.
Requirements
- Install Kubectl.
- You need a running Kubernetes cluster.
- For a quick start, install minikube to create a local cluster.
- See the Kubernetes documentation to explore other options.
Install AKO
Install the Operator Lifecycle Manager (OLM) on your Kubernetes cluster.
curl -sL https://github.com/operator-framework/operator-lifecycle-manager/releases/download/v0.31.0/install.sh | bash -s v0.31.0
Install AKO on your Kubernetes cluster.
kubectl create -f https://operatorhub.io/install/aerospike-kubernetes-operator.yaml
Verify that AKO's Cluster Service Version (CSV) is in the
Succeeded
phase.kubectl get csv -n operators aerospike-kubernetes-operator.v4.0.0 -w
You will see output similar to the following.
NAME DISPLAY VERSION REPLACES PHASE
aerospike-kubernetes-operator.v4.0.0 Aerospike Kubernetes Operator 4.0.0 Succeeded
Check AKO logs
AKO runs as two replicas by default for higher availability. Run the following command to follow the logs for the AKO pods.
kubectl -n operators logs -f deployment/aerospike-operator-controller-manager manager
Sample output:
2025-02-04T07:59:36Z INFO setup Initializing webhook certificate watcher using provided certificates {"webhook-cert-path": "/tmp/k8s-webhook-server/serving-certs", "webhook-cert-name": "tls.crt", "webhook-cert-key": "tls.key"}
2025-02-04T07:59:36Z INFO controller-runtime.certwatcher Updated current TLS certificate
2025-02-04T07:59:36Z INFO setup Init aerospike-server config schemas
2025-02-04T07:59:36Z DEBUG setup Config schema added {"version": "6.3.0"}
2025-02-04T07:59:36Z DEBUG setup Config schema added {"version": "6.4.0"}
2025-02-04T07:59:36Z DEBUG setup Config schema added {"version": "7.0.0"}
2025-02-04T07:59:36Z DEBUG setup Config schema added {"version": "7.1.0"}
2025-02-04T07:59:36Z DEBUG setup Config schema added {"version": "7.2.0"}
2025-02-04T07:59:36Z DEBUG setup Config schema added {"version": "6.0.0"}
2025-02-04T07:59:36Z DEBUG setup Config schema added {"version": "6.1.0"}
2025-02-04T07:59:36Z DEBUG setup Config schema added {"version": "6.2.0"}
2025-02-04T07:59:36Z DEBUG setup Config schema added {"version": "8.0.0"}
2025-02-04T07:59:36Z INFO controller-runtime.builder Registering a mutating webhook {"GVK": "asdb.aerospike.com/v1, Kind=AerospikeCluster", "path": "/mutate-asdb-aerospike-com-v1-aerospikecluster"}
2025-02-04T07:59:36Z INFO controller-runtime.webhook Registering webhook {"path": "/mutate-asdb-aerospike-com-v1-aerospikecluster"}
2025-02-04T07:59:36Z INFO controller-runtime.builder Registering a validating webhook {"GVK": "asdb.aerospike.com/v1, Kind=AerospikeCluster", "path": "/validate-asdb-aerospike-com-v1-aerospikecluster"}
2025-02-04T07:59:36Z INFO controller-runtime.webhook Registering webhook {"path": "/validate-asdb-aerospike-com-v1-aerospikecluster"}
2025-02-04T07:59:36Z INFO controller-runtime.builder Registering a mutating webhook {"GVK": "asdb.aerospike.com/v1beta1, Kind=AerospikeBackupService", "path": "/mutate-asdb-aerospike-com-v1beta1-aerospikebackupservice"}
2025-02-04T07:59:36Z INFO controller-runtime.webhook Registering webhook {"path": "/mutate-asdb-aerospike-com-v1beta1-aerospikebackupservice"}
2025-02-04T07:59:36Z INFO controller-runtime.builder Registering a validating webhook {"GVK": "asdb.aerospike.com/v1beta1, Kind=AerospikeBackupService", "path": "/validate-asdb-aerospike-com-v1beta1-aerospikebackupservice"}
2025-02-04T07:59:36Z INFO controller-runtime.webhook Registering webhook {"path": "/validate-asdb-aerospike-com-v1beta1-aerospikebackupservice"}
2025-02-04T07:59:36Z INFO controller-runtime.builder Registering a mutating webhook {"GVK": "asdb.aerospike.com/v1beta1, Kind=AerospikeBackup", "path": "/mutate-asdb-aerospike-com-v1beta1-aerospikebackup"}
2025-02-04T07:59:36Z INFO controller-runtime.webhook Registering webhook {"path": "/mutate-asdb-aerospike-com-v1beta1-aerospikebackup"}
2025-02-04T07:59:36Z INFO controller-runtime.builder Registering a validating webhook {"GVK": "asdb.aerospike.com/v1beta1, Kind=AerospikeBackup", "path": "/validate-asdb-aerospike-com-v1beta1-aerospikebackup"}
2025-02-04T07:59:36Z INFO controller-runtime.webhook Registering webhook {"path": "/validate-asdb-aerospike-com-v1beta1-aerospikebackup"}
2025-02-04T07:59:36Z INFO controller-runtime.builder Registering a mutating webhook {"GVK": "asdb.aerospike.com/v1beta1, Kind=AerospikeRestore", "path": "/mutate-asdb-aerospike-com-v1beta1-aerospikerestore"}
2025-02-04T07:59:36Z INFO controller-runtime.webhook Registering webhook {"path": "/mutate-asdb-aerospike-com-v1beta1-aerospikerestore"}
2025-02-04T07:59:36Z INFO controller-runtime.builder Registering a validating webhook {"GVK": "asdb.aerospike.com/v1beta1, Kind=AerospikeRestore", "path": "/validate-asdb-aerospike-com-v1beta1-aerospikerestore"}
2025-02-04T07:59:36Z INFO controller-runtime.webhook Registering webhook {"path": "/validate-asdb-aerospike-com-v1beta1-aerospikerestore"}
2025-02-04T07:59:36Z INFO setup Adding webhook certificate watcher to manager
2025-02-04T07:59:36Z INFO setup Starting manager
2025-02-04T07:59:36Z INFO controller-runtime.metrics Starting metrics server
2025-02-04T07:59:36Z INFO setup disabling http/2
2025-02-04T07:59:36Z INFO starting server {"name": "health probe", "addr": "[::]:8081"}
2025-02-04T07:59:36Z INFO controller-runtime.webhook Starting webhook server
2025-02-04T07:59:36Z INFO setup disabling http/2
2025-02-04T07:59:36Z INFO controller-runtime.webhook Serving webhook server {"host": "", "port": 9443}
Grant permissions to the target namespaces
Grant additional permissions by configuring ServiceAccounts and RoleBindings/ClusterRoleBindings for the target Kubernetes namespace where the Aerospike clusters are created. AKO is installed in the operators
namespace.
You can use the kubectl
or akoctl
tools to grant permissions for the aerospike
namespace.
- kubectl
- akoctl
Create the Kubernetes namespace if not already created.
kubectl create namespace aerospike
Create a service account.
kubectl -n aerospike create serviceaccount aerospike-operator-controller-manager
Create a RoleBinding or ClusterRoleBinding to attach this service account to the
aerospike-cluster
ClusterRole. This ClusterRole is created as part of AKO installation and grants Aerospike cluster permissions to the service account.For using the Kubernetes native, pod-only network to connect to the Aerospike cluster, create a RoleBinding with the following command:
kubectl -n aerospike create rolebinding aerospike-cluster --clusterrole=aerospike-cluster --serviceaccount=aerospike:aerospike-operator-controller-manager
For connecting to the Aerospike cluster from outside Kubernetes, create a ClusterRoleBinding with the following command:
kubectl create clusterrolebinding aerospike-cluster --clusterrole=aerospike-cluster --serviceaccount=aerospike:aerospike-operator-controller-manager
tipFor attaching multiple service accounts of different namespaces at one time, add multiple
--serviceaccount
parameters to the previous command.Example: To attach service accounts of the aerospike and aerospike1 namespaces:
kubectl create clusterrolebinding aerospike-cluster --clusterrole=aerospike-cluster --serviceaccount=aerospike:aerospike-operator-controller-manager --serviceaccount=aerospike1:aerospike-operator-controller-manager
If the required ClusterRoleBinding already exists in the cluster, edit it to attach a new service account.
kubectl edit clusterrolebinding aerospike-cluster
The
kubectl edit
command launches an editor. Append the following lines to thesubjects
section:# A new entry for aerospike.
# Replace aerospike with your namespace
- kind: ServiceAccount
name: aerospike-operator-controller-manager
namespace: aerospikeSave and ensure that the changes are applied.
For instructions on installing the akoctl
plugin, see akoctl installation.
For using the Kubernetes native, pod-only network to connect to the Aerospike cluster, grant namespace scope permissions:
kubectl akoctl auth create -n aerospike --cluster-scope=false
For connecting to the Aerospike cluster from outside Kubernetes, grant cluster scope permissions:
kubectl akoctl auth create -n aerospike
To grant permissions for multiple namespaces at the same time, specify a comma-separated namespace list with the
-n
flag.kubectl akoctl auth create -n aerospike,aerospike1