4 changed files with 377 additions and 551 deletions
@ -0,0 +1,267 @@ |
|||||
|
apiVersion: v1 |
||||
|
kind: ConfigMap |
||||
|
metadata: |
||||
|
annotations: |
||||
|
argocd.argoproj.io/sync-wave: "5" |
||||
|
labels: |
||||
|
app.kubernetes.io/name: postgresql |
||||
|
app.kubernetes.io/version: '13' |
||||
|
app.kubernetes.io/component: postgresql-server |
||||
|
app.kubernetes.io/instance: postgresql-server |
||||
|
name: postgresql-config |
||||
|
namespace: {{ .Values.projectName | quote }} |
||||
|
data: |
||||
|
ssl.conf: | |
||||
|
ssl = on |
||||
|
# The TLS certificate & key are generated using the OpenShift's service serving |
||||
|
# certificate secrets via corresponding annotation of the PostgreSQL service |
||||
|
# and stored into a read-only persistent volume, corresponding to the OpenShift |
||||
|
# secret. |
||||
|
# |
||||
|
# Later the 'postgresql-pre-start/enable_ssl.sh' script, present in this |
||||
|
# repository, copies the generated TLS certificate & key to by current UID |
||||
|
# writable "/var/run/postgresql/pki" directory, so it's possible to correct |
||||
|
# the permissions of the TLS private key to mode required by PostgreSQL server |
||||
|
ssl_cert_file = '/var/run/postgresql/pki/tls.crt' # PostgreSQL server certificate |
||||
|
ssl_key_file = '/var/run/postgresql/pki/tls.key' # PostgreSQL server private key |
||||
|
ssl_ca_file = '/run/secrets/kubernetes.io/serviceaccount/ca.crt' # OpenShift CA |
||||
|
--- |
||||
|
apiVersion: v1 |
||||
|
kind: ConfigMap |
||||
|
metadata: |
||||
|
annotations: |
||||
|
argocd.argoproj.io/sync-wave: "5" |
||||
|
labels: |
||||
|
app.kubernetes.io/name: postgresql |
||||
|
app.kubernetes.io/version: '13' |
||||
|
app.kubernetes.io/component: postgresql-server |
||||
|
app.kubernetes.io/instance: postgresql-server |
||||
|
name: postgresql-prestart-hook |
||||
|
namespace: {{ .Values.projectName | quote }} |
||||
|
data: |
||||
|
enable_ssl.sh: | |
||||
|
#!/usr/bin/env bash |
||||
|
|
||||
|
set -eu |
||||
|
|
||||
|
# Copy the TLS certificate & key generated by the OpenShift's service serving |
||||
|
# certificate secrets from "/etc/pki/postgresql" (which is mounted read-only, |
||||
|
# since coming from secret) to "/var/run/postgresql/pki", so it's possible to |
||||
|
# correct the permissions of the TLS private key as required below |
||||
|
SOURCE_DIR="/etc/pki/postgresql" |
||||
|
DESTINATION_DIR="/var/run/postgresql/pki" |
||||
|
if [ ! -d "${DESTINATION_DIR}" ]; then |
||||
|
mkdir -p "${DESTINATION_DIR}" |
||||
|
fi |
||||
|
cp "${SOURCE_DIR}"/tls.{crt,key} "${DESTINATION_DIR}" |
||||
|
|
||||
|
# PostgreSQL will fail to start and throw an error like: |
||||
|
# |
||||
|
# FATAL: private key file "/path/to/key" has group or world access |
||||
|
# File must have permissions u=rw (0600) or less if owned by the database user, or permissions u=rw,g=r (0640) or less if owned by root. |
||||
|
# |
||||
|
# if the permissions of the TLS private key are incorrect. |
||||
|
# |
||||
|
# Thus correct the permissions so PostgreSQL server can start successfully |
||||
|
chmod 0600 "${DESTINATION_DIR}/tls.key" |
||||
|
--- |
||||
|
apiVersion: v1 |
||||
|
kind: ConfigMap |
||||
|
metadata: |
||||
|
annotations: |
||||
|
argocd.argoproj.io/sync-wave: "5" |
||||
|
labels: |
||||
|
app.kubernetes.io/name: postgresql |
||||
|
app.kubernetes.io/version: '13' |
||||
|
app.kubernetes.io/component: postgresql-server |
||||
|
app.kubernetes.io/instance: postgresql-server |
||||
|
name: postgresql-start-hook |
||||
|
namespace: {{ .Values.projectName | quote }} |
||||
|
data: |
||||
|
create_db_user.sh: | |
||||
|
#!/usr/bin/env bash |
||||
|
|
||||
|
for file in /var/run/demo-seed/*-database-password; do |
||||
|
filename="$(basename $file)" |
||||
|
user="${filename%-database-password}" |
||||
|
echo "Creating user $user..." |
||||
|
psql -q -c "CREATE USER \"$user\" WITH ENCRYPTED PASSWORD '$(cat $file)';" || true |
||||
|
echo "Creating database $user..." |
||||
|
psql -q -c "CREATE DATABASE \"$user\" OWNER \"$user\";" || true |
||||
|
done |
||||
|
--- |
||||
|
apiVersion: v1 |
||||
|
kind: Service |
||||
|
metadata: |
||||
|
annotations: |
||||
|
argocd.argoproj.io/sync-wave: "5" |
||||
|
service.alpha.openshift.io/serving-cert-secret-name: postgresql-ssl |
||||
|
labels: |
||||
|
app.kubernetes.io/name: postgresql |
||||
|
app.kubernetes.io/version: '13' |
||||
|
app.kubernetes.io/component: postgresql-server |
||||
|
app.kubernetes.io/instance: postgresql-server |
||||
|
name: postgresql-server |
||||
|
namespace: {{ .Values.projectName | quote }} |
||||
|
spec: |
||||
|
ports: |
||||
|
- port: 5432 |
||||
|
targetPort: 5432 |
||||
|
selector: |
||||
|
app.kubernetes.io/name: postgresql |
||||
|
app.kubernetes.io/component: postgresql-server |
||||
|
app.kubernetes.io/instance: postgresql-server |
||||
|
--- |
||||
|
apiVersion: v1 |
||||
|
kind: Service |
||||
|
metadata: |
||||
|
annotations: |
||||
|
argocd.argoproj.io/sync-wave: "5" |
||||
|
labels: |
||||
|
app.kubernetes.io/name: postgresql |
||||
|
app.kubernetes.io/version: '13' |
||||
|
app.kubernetes.io/component: postgresql-server |
||||
|
app.kubernetes.io/instance: postgresql-server |
||||
|
name: postgresql |
||||
|
namespace: {{ .Values.projectName | quote }} |
||||
|
spec: |
||||
|
clusterIP: None # Headless service |
||||
|
ports: |
||||
|
- port: 5432 |
||||
|
targetPort: 5432 |
||||
|
selector: |
||||
|
app.kubernetes.io/name: postgresql |
||||
|
app.kubernetes.io/component: postgresql-server |
||||
|
app.kubernetes.io/instance: postgresql-server |
||||
|
--- |
||||
|
apiVersion: apps/v1 |
||||
|
kind: StatefulSet |
||||
|
metadata: |
||||
|
annotations: |
||||
|
argocd.argoproj.io/sync-wave: "5" |
||||
|
labels: |
||||
|
app.kubernetes.io/name: postgresql |
||||
|
app.kubernetes.io/version: '13' |
||||
|
app.kubernetes.io/component: postgresql-server |
||||
|
app.kubernetes.io/instance: postgresql-server |
||||
|
name: postgresql |
||||
|
namespace: {{ .Values.projectName | quote }} |
||||
|
spec: |
||||
|
selector: |
||||
|
matchLabels: |
||||
|
app.kubernetes.io/name: postgresql |
||||
|
app.kubernetes.io/component: postgresql-server |
||||
|
app.kubernetes.io/instance: postgresql-server |
||||
|
serviceName: "postgresql" |
||||
|
replicas: 1 |
||||
|
minReadySeconds: 10 |
||||
|
template: |
||||
|
metadata: |
||||
|
labels: |
||||
|
app.kubernetes.io/name: postgresql |
||||
|
app.kubernetes.io/component: postgresql-server |
||||
|
app.kubernetes.io/instance: postgresql-server |
||||
|
spec: |
||||
|
terminationGracePeriodSeconds: 10 |
||||
|
containers: |
||||
|
- env: |
||||
|
- name: POSTGRESQL_USER |
||||
|
value: admin |
||||
|
- name: POSTGRESQL_PASSWORD |
||||
|
valueFrom: |
||||
|
secretKeyRef: |
||||
|
name: demo-seed |
||||
|
key: postgresql-admin-password |
||||
|
- name: POSTGRESQL_DATABASE |
||||
|
value: admin |
||||
|
- name: POSTGRESQL_MAX_CONNECTIONS |
||||
|
- name: POSTGRESQL_MAX_PREPARED_TRANSACTIONS |
||||
|
- name: POSTGRESQL_SHARED_BUFFERS |
||||
|
image: registry.redhat.io/rhel8/postgresql-13:latest |
||||
|
imagePullPolicy: Always |
||||
|
livenessProbe: |
||||
|
failureThreshold: 3 |
||||
|
initialDelaySeconds: 90 |
||||
|
periodSeconds: 10 |
||||
|
successThreshold: 1 |
||||
|
tcpSocket: |
||||
|
port: 5432 |
||||
|
timeoutSeconds: 10 |
||||
|
name: postgresql-server |
||||
|
ports: |
||||
|
- containerPort: 5432 |
||||
|
protocol: TCP |
||||
|
readinessProbe: |
||||
|
exec: |
||||
|
command: |
||||
|
- /bin/sh |
||||
|
- -i |
||||
|
- -c |
||||
|
- PGSSLMODE=require psql -h 127.0.0.1 -U $POSTGRESQL_USER -q -d $POSTGRESQL_DATABASE |
||||
|
-c 'SELECT 1' |
||||
|
failureThreshold: 3 |
||||
|
periodSeconds: 10 |
||||
|
initialDelaySeconds: 90 |
||||
|
successThreshold: 1 |
||||
|
timeoutSeconds: 10 |
||||
|
resources: {} |
||||
|
terminationMessagePath: /dev/termination-log |
||||
|
terminationMessagePolicy: File |
||||
|
volumeMounts: |
||||
|
- mountPath: /var/lib/pgsql/data |
||||
|
name: postgresql-data |
||||
|
- mountPath: /etc/pki/postgresql |
||||
|
name: postgresql-ssl |
||||
|
readOnly: true |
||||
|
- mountPath: /opt/app-root/src/postgresql-cfg |
||||
|
name: postgresql-config |
||||
|
readOnly: true |
||||
|
- mountPath: /opt/app-root/src/postgresql-pre-start |
||||
|
name: postgresql-prestart-hook |
||||
|
readOnly: true |
||||
|
- mountPath: /opt/app-root/src/postgresql-start |
||||
|
name: postgresql-start-hook |
||||
|
readOnly: true |
||||
|
- mountPath: /var/run/demo-seed |
||||
|
name: demo-seed |
||||
|
readOnly: true |
||||
|
volumes: |
||||
|
- name: postgresql-data |
||||
|
persistentVolumeClaim: |
||||
|
claimName: postgresql-data |
||||
|
- name: postgresql-ssl |
||||
|
secret: |
||||
|
secretName: postgresql-ssl |
||||
|
- name: postgresql-config |
||||
|
configMap: |
||||
|
name: postgresql-config |
||||
|
- name: postgresql-prestart-hook |
||||
|
configMap: |
||||
|
name: postgresql-prestart-hook |
||||
|
defaultMode: 0755 |
||||
|
- name: postgresql-start-hook |
||||
|
configMap: |
||||
|
name: postgresql-start-hook |
||||
|
defaultMode: 0755 |
||||
|
- name: demo-seed |
||||
|
secret: |
||||
|
secretName: demo-seed |
||||
|
--- |
||||
|
apiVersion: v1 |
||||
|
kind: PersistentVolumeClaim |
||||
|
metadata: |
||||
|
annotations: |
||||
|
argocd.argoproj.io/sync-wave: "5" |
||||
|
labels: |
||||
|
app.kubernetes.io/name: postgresql |
||||
|
app.kubernetes.io/version: '13' |
||||
|
app.kubernetes.io/component: postgresql-server |
||||
|
app.kubernetes.io/instance: postgresql-server |
||||
|
name: postgresql-data |
||||
|
namespace: {{ .Values.projectName | quote }} |
||||
|
spec: |
||||
|
accessModes: |
||||
|
- ReadWriteOnce |
||||
|
resources: |
||||
|
requests: |
||||
|
storage: 1Gi |
||||
Loading…
Reference in new issue