Skip to main content
Aerospike 8 introduces a new era of real-time transaction processingLearn more
Loading
Version: Operator 4.0.0

Install the Aerospike Kubernetes Operator from OperatorHub

This procedure applies to:

note

For Kubernetes 1.23 version or later, Pod Security Admission (PSA) is enabled by default. Make sure the namespace where the Aerospike Operator is installed has either baseline or privileged Pod Security Standard level set. The restricted level is not supported by Aerospike. The default Pod Security Standard level in Kubernetes 1.23 is privileged. For more details, see Apply Pod Security Standards

1. Install the OLM and Operator​

Install the Operator Lifecycle Manager (OLM) on your Kubernetes cluster with the command:

curl -sL https://github.com/operator-framework/operator-lifecycle-manager/releases/download/v0.31.0/install.sh | bash -s v0.31.0

2. Install the Aerospike Kubernetes Operator​

kubectl create -f https://operatorhub.io/install/aerospike-kubernetes-operator.yaml

3. Verify the Operator is running​

After installation, verify that the Operator's CSV is in the Succeeded phase.

kubectl get csv -n operators aerospike-kubernetes-operator.v4.0.0 -w

You will see output similar to the following:

NAME                                   DISPLAY                         VERSION   REPLACES   PHASE
aerospike-kubernetes-operator.v4.0.0   Aerospike Kubernetes Operator   4.0.0                Succeeded

4. Check Operator logs​

AKO runs as two replicas by default, for higher availability. Run the following command to follow the logs for the AKO pods.

kubectl -n operators logs -f deployment/aerospike-operator-controller-manager manager

Output:

2025-02-04T07:59:36Z    INFO    setup   Initializing webhook certificate watcher using provided certificates    {"webhook-cert-path": "/tmp/k8s-webhook-server/serving-certs", "webhook-cert-name": "tls.crt", "webhook-cert-key": "tls.key"}
2025-02-04T07:59:36Z    INFO    controller-runtime.certwatcher  Updated current TLS certificate
2025-02-04T07:59:36Z    INFO    setup   Init aerospike-server config schemas
2025-02-04T07:59:36Z    DEBUG   setup   Config schema added {"version": "6.3.0"}
2025-02-04T07:59:36Z    DEBUG   setup   Config schema added {"version": "6.4.0"}
2025-02-04T07:59:36Z    DEBUG   setup   Config schema added {"version": "7.0.0"}
2025-02-04T07:59:36Z    DEBUG   setup   Config schema added {"version": "7.1.0"}
2025-02-04T07:59:36Z    DEBUG   setup   Config schema added {"version": "7.2.0"}
2025-02-04T07:59:36Z    DEBUG   setup   Config schema added {"version": "6.0.0"}
2025-02-04T07:59:36Z    DEBUG   setup   Config schema added {"version": "6.1.0"}
2025-02-04T07:59:36Z    DEBUG   setup   Config schema added {"version": "6.2.0"}
2025-02-04T07:59:36Z    DEBUG   setup   Config schema added {"version": "8.0.0"}
2025-02-04T07:59:36Z    INFO    controller-runtime.builder  Registering a mutating webhook  {"GVK": "asdb.aerospike.com/v1, Kind=AerospikeCluster", "path": "/mutate-asdb-aerospike-com-v1-aerospikecluster"}
2025-02-04T07:59:36Z    INFO    controller-runtime.webhook  Registering webhook {"path": "/mutate-asdb-aerospike-com-v1-aerospikecluster"}
2025-02-04T07:59:36Z    INFO    controller-runtime.builder  Registering a validating webhook    {"GVK": "asdb.aerospike.com/v1, Kind=AerospikeCluster", "path": "/validate-asdb-aerospike-com-v1-aerospikecluster"}
2025-02-04T07:59:36Z    INFO    controller-runtime.webhook  Registering webhook {"path": "/validate-asdb-aerospike-com-v1-aerospikecluster"}
2025-02-04T07:59:36Z    INFO    controller-runtime.builder  Registering a mutating webhook  {"GVK": "asdb.aerospike.com/v1beta1, Kind=AerospikeBackupService", "path": "/mutate-asdb-aerospike-com-v1beta1-aerospikebackupservice"}
2025-02-04T07:59:36Z    INFO    controller-runtime.webhook  Registering webhook {"path": "/mutate-asdb-aerospike-com-v1beta1-aerospikebackupservice"}
2025-02-04T07:59:36Z    INFO    controller-runtime.builder  Registering a validating webhook    {"GVK": "asdb.aerospike.com/v1beta1, Kind=AerospikeBackupService", "path": "/validate-asdb-aerospike-com-v1beta1-aerospikebackupservice"}
2025-02-04T07:59:36Z    INFO    controller-runtime.webhook  Registering webhook {"path": "/validate-asdb-aerospike-com-v1beta1-aerospikebackupservice"}
2025-02-04T07:59:36Z    INFO    controller-runtime.builder  Registering a mutating webhook  {"GVK": "asdb.aerospike.com/v1beta1, Kind=AerospikeBackup", "path": "/mutate-asdb-aerospike-com-v1beta1-aerospikebackup"}
2025-02-04T07:59:36Z    INFO    controller-runtime.webhook  Registering webhook {"path": "/mutate-asdb-aerospike-com-v1beta1-aerospikebackup"}
2025-02-04T07:59:36Z    INFO    controller-runtime.builder  Registering a validating webhook    {"GVK": "asdb.aerospike.com/v1beta1, Kind=AerospikeBackup", "path": "/validate-asdb-aerospike-com-v1beta1-aerospikebackup"}
2025-02-04T07:59:36Z    INFO    controller-runtime.webhook  Registering webhook {"path": "/validate-asdb-aerospike-com-v1beta1-aerospikebackup"}
2025-02-04T07:59:36Z    INFO    controller-runtime.builder  Registering a mutating webhook  {"GVK": "asdb.aerospike.com/v1beta1, Kind=AerospikeRestore", "path": "/mutate-asdb-aerospike-com-v1beta1-aerospikerestore"}
2025-02-04T07:59:36Z    INFO    controller-runtime.webhook  Registering webhook {"path": "/mutate-asdb-aerospike-com-v1beta1-aerospikerestore"}
2025-02-04T07:59:36Z    INFO    controller-runtime.builder  Registering a validating webhook    {"GVK": "asdb.aerospike.com/v1beta1, Kind=AerospikeRestore", "path": "/validate-asdb-aerospike-com-v1beta1-aerospikerestore"}
2025-02-04T07:59:36Z    INFO    controller-runtime.webhook  Registering webhook {"path": "/validate-asdb-aerospike-com-v1beta1-aerospikerestore"}
2025-02-04T07:59:36Z    INFO    setup   Adding webhook certificate watcher to manager
2025-02-04T07:59:36Z    INFO    setup   Starting manager
2025-02-04T07:59:36Z    INFO    controller-runtime.metrics  Starting metrics server
2025-02-04T07:59:36Z    INFO    setup   disabling http/2
2025-02-04T07:59:36Z    INFO    starting server {"name": "health probe", "addr": "[::]:8081"}
2025-02-04T07:59:36Z    INFO    controller-runtime.webhook  Starting webhook server
2025-02-04T07:59:36Z    INFO    setup   disabling http/2
2025-02-04T07:59:36Z    INFO    controller-runtime.webhook  Serving webhook server  {"host": "", "port": 9443}

5. Grant permissions to the target namespaces​

The Operator is installed in the operators namespace. Grant additional permission (by configuring ServiceAccounts and RoleBindings/ClusterRoleBindings) for the target Kubernetes namespace where the Aerospike clusters are created.

There are two ways to grant permission for the target namespaces:

  1. Using kubectl
  2. Using akoctl plugin

Using kubectl​

The procedure to use the namespace aerospike is as follows:

Create the namespace​

Create the Kubernetes namespace if not already created:

kubectl create namespace aerospike

Create a service account​

kubectl -n aerospike create serviceaccount aerospike-operator-controller-manager

Create RoleBinding/ClusterRoleBinding for Aerospike cluster​

Next, create a RoleBinding or ClusterRoleBinding as per requirement to attach this service account to ClusterRole aerospike-cluster. This ClusterRole is created as part of AKO installation and grants Aerospike cluster permission to service account.

  • For using Kubernetes native Pod only network to connect to Aerospike cluster create RoleBinding:
kubectl -n aerospike create rolebinding aerospike-cluster --clusterrole=aerospike-cluster --serviceaccount=aerospike:aerospike-operator-controller-manager
  • For connecting to Aerospike cluster from outside Kubernetes create ClusterRoleBinding:
kubectl create clusterrolebinding aerospike-cluster --clusterrole=aerospike-cluster --serviceaccount=aerospike:aerospike-operator-controller-manager
tip

For attaching multiple service accounts of different namespaces in one go, add multiple --serviceaccount params in above command

Example: To attach service accounts of aerospike and aerospike1 namespace
kubectl create clusterrolebinding aerospike-cluster --clusterrole=aerospike-cluster --serviceaccount=aerospike:aerospike-operator-controller-manager --serviceaccount=aerospike1:aerospike-operator-controller-manager

If the required ClusterRoleBinding already exists in cluster, edit it to attach new service account:

kubectl edit clusterrolebinding aerospike-cluster

This command launches an editor. Append the following lines to the subjects section:

  # A new entry for aerospike.
  # Replace aerospike with your namespace
- kind: ServiceAccount
  name: aerospike-operator-controller-manager
  namespace: aerospike

Save and ensure that the changes are applied.

Using akoctl plugin​

For instructions on installing the akoctl plugin, see akoctl installation.

The procedure to use the namespace aerospike is as follows:

  • For using Kubernetes native Pod only network to connect to Aerospike cluster grant namespace scope permission:
kubectl akoctl auth create -n aerospike --cluster-scope=false
  • For connecting to Aerospike cluster from outside Kubernetes grant cluster scope permission:
kubectl akoctl auth create -n aerospike
tip

For granting permission of multiple namespaces in one go, specify comma separated namespace list in -n param

Example: To grant permission for aerospike and aerospike1 namespace
kubectl akoctl auth create -n aerospike,aerospike1
Tags:
Last updated on