diff --git a/README.md b/README.md index 6d84df2..40afaa4 100644 --- a/README.md +++ b/README.md @@ -1 +1,3 @@ -# S4-projects \ No newline at end of file +# S4-projects + +![del](https://user-images.githubusercontent.com/96950933/216551396-58ffa498-0148-4a61-97ac-74aaeb0bd115.png) diff --git a/espresso-shop/README.md b/espresso-shop/README.md new file mode 100644 index 0000000..5ade82e --- /dev/null +++ b/espresso-shop/README.md @@ -0,0 +1 @@ +# S3 for all sd bsfdbdffefefed student Project 01 cnadxchhy kjx;cvdsavdgvf diff --git a/espresso-shop/charts/.helmignore b/espresso-shop/charts/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/espresso-shop/charts/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/espresso-shop/charts/S4/espresso/.helmignore b/espresso-shop/charts/S4/espresso/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/espresso-shop/charts/S4/espresso/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/espresso-shop/charts/S4/espresso/delete_all.sh b/espresso-shop/charts/S4/espresso/delete_all.sh new file mode 100644 index 0000000..ca9975e --- /dev/null +++ b/espresso-shop/charts/S4/espresso/delete_all.sh @@ -0,0 +1,13 @@ +#! /bin/bash + +helm delete $(helm list | grep -e epresso-shop-product-catalog -e espresso-shop-reviews -e espresso-shop-web -e postgres -e redis | awk '{print $1}' +) + +kubectl delete pvc data-postgresql-ha-postgresql-0 \ + data-postgresql-ha-postgresql-1 \ + data-postgresql-ha-postgresql-2 \ + data-redis-ha-server-0 \ + data-redis-ha-server-1 \ + data-redis-ha-server-2 -n s4 + +kubectl get all \ No newline at end of file diff --git a/espresso-shop/charts/S4/espresso/deploy.sh b/espresso-shop/charts/S4/espresso/deploy.sh new file mode 100644 index 0000000..3de09f4 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/deploy.sh @@ -0,0 +1,8 @@ +#! /bin/bash +helm install postgresql-ha postgresql-ha +helm install redis-ha redis-ha +helm install espresso-shop-reviews espresso-shop-reviews +helm install epresso-shop-product-catalog espresso-shop-product-catalog +helm install espresso-shop-web espresso-shop-web + +kubectl get all diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/Chart.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/Chart.yaml new file mode 100644 index 0000000..fbd3b88 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/Chart.yaml @@ -0,0 +1,24 @@ +apiVersion: v2 +name: expresso +description: A Helm chart for Kubernetes + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "1.16.0" diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/NOTES.txt b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/NOTES.txt new file mode 100644 index 0000000..f8a73f5 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/NOTES.txt @@ -0,0 +1,22 @@ +1. Get the application URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range $host := .Values.ingress.hosts }} + {{- range .paths }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }} + {{- end }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "expresso.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "expresso.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "expresso.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "expresso.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/_helpers.tpl b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/_helpers.tpl new file mode 100644 index 0000000..60cb154 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "expresso.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "expresso.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "expresso.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "expresso.labels" -}} +helm.sh/chart: {{ include "expresso.chart" . }} +{{ include "expresso.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "expresso.selectorLabels" -}} +app.kubernetes.io/name: {{ include "expresso.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "expresso.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "expresso.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/deployment.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/deployment.yaml new file mode 100644 index 0000000..36e9257 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/deployment.yaml @@ -0,0 +1,70 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Values.app_name }} + # labels: + # app: {{ .Values.labels.app }} + # version: {{ .Values.labels.version }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + selector: + matchLabels: + # labels: + app: {{ .Values.labels.app }} + # version: {{ .Values.labels.version }} + minReadySeconds: {{ .Values.minReadySeconds }} + strategy: + type: {{ .Values.strategy.type }} + rollingUpdate: + maxSurge: {{ .Values.strategy.rollingUpdate.maxSurge }} + maxUnavailable: {{ .Values.strategy.rollingUpdate.maxUnavailable }} + template: + metadata: + labels: + app: {{ .Values.labels.app }} + version: {{ .Values.labels.version }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "expresso.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Values.labels.app }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + envFrom: + - secretRef: + name: {{ .Values.app_name }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: {{ .Values.service.targetPort }} + protocol: TCP + # livenessProbe: + # httpGet: + # path: / + # port: http + # readinessProbe: + # httpGet: + # path: / + # port: http + resources: + {{- toYaml .Values.resources | nindent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/hpa.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/hpa.yaml new file mode 100644 index 0000000..e58e065 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/hpa.yaml @@ -0,0 +1,20 @@ +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ .Values.app_name }} + labels: + app: {{ .Values.labels.app }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ .Values.app_name }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + - type: Resource + resource: + name: {{ .Values.autoscaling.name }} + target: + type: {{ .Values.autoscaling.type }} + averageUtilization: {{ .Values.autoscaling.averageUtilization }} \ No newline at end of file diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/pdb.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/pdb.yaml new file mode 100644 index 0000000..4260641 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/pdb.yaml @@ -0,0 +1,11 @@ +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ .Values.app_name }} + labels: + app: {{ .Values.labels.app }} +spec: + maxUnavailable: {{ .Values.podDisruptionBudget }} + selector: + matchLabels: + app: {{ .Values.labels.app }} \ No newline at end of file diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/secret.yml b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/secret.yml new file mode 100644 index 0000000..08c609b --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/secret.yml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ .Values.app_name }} +type: Opaque +data: + username: {{ .Values.postgres.username }} + password: {{ .Values.postgres.password }} + database: {{ .Values.postgres.database }} diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/service.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/service.yaml new file mode 100644 index 0000000..f8650ab --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ .Values.app_name }}-svc + labels: + app: {{ .Values.labels.app }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: {{ .Values.service.targetPort }} + protocol: TCP + name: http + selector: + app: {{ .Values.labels.app }} \ No newline at end of file diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/serviceaccount.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/serviceaccount.yaml new file mode 100644 index 0000000..da7c53c --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/templates/serviceaccount.yaml @@ -0,0 +1,8 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "expresso.serviceAccountName" . }} + labels: + app: espresso-shop-web +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/values.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/values.yaml new file mode 100644 index 0000000..8e422d5 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-product-catalog/values.yaml @@ -0,0 +1,104 @@ +# Default values for expresso. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 +app_name: espresso-shop-product-catalog + +image: + repository: devopseasylearning2021/s3-project01-espresso-shop-product + pullPolicy: IfNotPresent + tag: "v1.0.0" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + create: true + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "espresso-shop-product-catalog" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +service: + type: ClusterIP + port: 8091 + targetPort: 80 + +ingress: + enabled: true + className: "" + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + hosts: + - host: chart-example.local + paths: + - path: / + pathType: ImplementationSpecific + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +resources: + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 100m + memory: 128Mi + +autoscaling: + enabled: false + minReplicas: 2 + maxReplicas: 5 + name: cpu + type: Utilization + averageUtilization: 50 + # targetMemoryUtilizationPercentage: 80 + +nodeSelector: {} +tolerations: [] +affinity: {} +labels: + app: espresso-shop-product-catalog + version: v1 + +connection: + productKey: ProductCatalogUrl + productionValue: "http://espresso-shop-product-catalog-svc:8091" + reviewKey: ReviewsUrl + reviewValue: "http://espresso-shop-reviews-svc:8092" + +podDisruptionBudget: 1 + +minReadySeconds: 5 +strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 1 + maxUnavailable: 1 + +postgres: + username: "postgres" + password: "TlhZJmdlcCNTWG4qNnJ1VkpMdldkekRyIVZhV3hNKkJF" + database: "espresso" \ No newline at end of file diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-reviews/Chart.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/Chart.yaml new file mode 100644 index 0000000..fbd3b88 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/Chart.yaml @@ -0,0 +1,24 @@ +apiVersion: v2 +name: expresso +description: A Helm chart for Kubernetes + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "1.16.0" diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/NOTES.txt b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/NOTES.txt new file mode 100644 index 0000000..f8a73f5 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/NOTES.txt @@ -0,0 +1,22 @@ +1. Get the application URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range $host := .Values.ingress.hosts }} + {{- range .paths }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }} + {{- end }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "expresso.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "expresso.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "expresso.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "expresso.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/_helpers.tpl b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/_helpers.tpl new file mode 100644 index 0000000..60cb154 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "expresso.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "expresso.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "expresso.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "expresso.labels" -}} +helm.sh/chart: {{ include "expresso.chart" . }} +{{ include "expresso.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "expresso.selectorLabels" -}} +app.kubernetes.io/name: {{ include "expresso.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "expresso.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "expresso.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/deployment-v2.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/deployment-v2.yaml new file mode 100644 index 0000000..1158d0b --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/deployment-v2.yaml @@ -0,0 +1,71 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Values.labels.app2 }} + labels: + app: {{ .Values.app_name }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + selector: + matchLabels: + # labels: + app: {{ .Values.app_name }} + minReadySeconds: {{ .Values.minReadySeconds }} + strategy: + type: {{ .Values.strategy.type }} + rollingUpdate: + maxSurge: {{ .Values.strategy.rollingUpdate.maxSurge }} + maxUnavailable: {{ .Values.strategy.rollingUpdate.maxUnavailable }} + template: + metadata: + labels: + app: {{ .Values.app_name }} + version: {{ .Values.labels.version2 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ .Values.labels.app2 }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + envFrom: + - secretRef: + name: {{ .Values.app_name }} + env: + - name: {{ .Values.connection.productKey }} + value: {{ .Values.connection.productionValue2 }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: {{ .Values.service.targetPort }} + protocol: TCP + # livenessProbe: + # httpGet: + # path: / + # port: http + # readinessProbe: + # httpGet: + # path: / + # port: http + resources: + {{- toYaml .Values.resources | nindent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/deployment.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/deployment.yaml new file mode 100644 index 0000000..9e0a6f6 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/deployment.yaml @@ -0,0 +1,71 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Values.labels.app }} + labels: + app: {{ .Values.app_name }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + selector: + matchLabels: + # labels: + app: {{ .Values.app_name }} + minReadySeconds: {{ .Values.minReadySeconds }} + strategy: + type: {{ .Values.strategy.type }} + rollingUpdate: + maxSurge: {{ .Values.strategy.rollingUpdate.maxSurge }} + maxUnavailable: {{ .Values.strategy.rollingUpdate.maxUnavailable }} + template: + metadata: + labels: + app: {{ .Values.app_name }} + version: {{ .Values.labels.version }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ .Values.app_name }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + env: + - name: {{ .Values.connection.productKey }} + value: {{ .Values.connection.productionValue }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + envFrom: + - secretRef: + name: {{ .Values.app_name }} + ports: + - name: http + containerPort: {{ .Values.service.targetPort }} + protocol: TCP + # livenessProbe: + # httpGet: + # path: / + # port: http + # readinessProbe: + # httpGet: + # path: / + # port: http + resources: + {{- toYaml .Values.resources | nindent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/hpa.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/hpa.yaml new file mode 100644 index 0000000..5690253 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/hpa.yaml @@ -0,0 +1,20 @@ +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ .Values.labels.app }} + labels: + app: {{ .Values.app_name }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ .Values.app_name }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + - type: Resource + resource: + name: {{ .Values.autoscaling.name }} + target: + type: {{ .Values.autoscaling.type }} + averageUtilization: {{ .Values.autoscaling.averageUtilization }} \ No newline at end of file diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/hpa2.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/hpa2.yaml new file mode 100644 index 0000000..d0d06b4 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/hpa2.yaml @@ -0,0 +1,20 @@ +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ .Values.labels.app2 }} + labels: + app: {{ .Values.labels.app2 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ .Values.labels.app2 }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + - type: Resource + resource: + name: {{ .Values.autoscaling.name }} + target: + type: {{ .Values.autoscaling.type }} + averageUtilization: {{ .Values.autoscaling.averageUtilization }} \ No newline at end of file diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/pdb.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/pdb.yaml new file mode 100644 index 0000000..dda50e3 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/pdb.yaml @@ -0,0 +1,11 @@ +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ .Values.labels.app }} + labels: + app: {{ .Values.app_name }} +spec: + maxUnavailable: {{ .Values.podDisruptionBudget }} + selector: + matchLabels: + app: {{ .Values.app_name }} \ No newline at end of file diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/pdb2.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/pdb2.yaml new file mode 100644 index 0000000..d4f3515 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/pdb2.yaml @@ -0,0 +1,11 @@ +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ .Values.labels.app2 }} + labels: + app: {{ .Values.app_name }} +spec: + maxUnavailable: {{ .Values.podDisruptionBudget }} + selector: + matchLabels: + app: {{ .Values.app_name }} \ No newline at end of file diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/secret.yml b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/secret.yml new file mode 100644 index 0000000..08c609b --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/secret.yml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ .Values.app_name }} +type: Opaque +data: + username: {{ .Values.postgres.username }} + password: {{ .Values.postgres.password }} + database: {{ .Values.postgres.database }} diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/service.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/service.yaml new file mode 100644 index 0000000..6248109 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/service.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ .Values.app_name }}-svc + labels: + app: {{ .Values.app_name }} + version: {{ .Values.labels.version }} + version2: {{ .Values.labels.version2 }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: {{ .Values.service.targetPort }} + protocol: TCP + name: http + selector: + app: {{ .Values.app_name }} \ No newline at end of file diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/serviceaccount.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/serviceaccount.yaml new file mode 100644 index 0000000..2b6dcc6 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/serviceaccount.yaml @@ -0,0 +1,8 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .Values.labels.app }} + labels: + app: {{ .Values.app_name }} +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/serviceaccount2.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/serviceaccount2.yaml new file mode 100644 index 0000000..a4a283a --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/templates/serviceaccount2.yaml @@ -0,0 +1,8 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .Values.labels.app2 }} + labels: + app: {{ .Values.app_name }} +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-reviews/values.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/values.yaml new file mode 100644 index 0000000..3e9d4e7 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-reviews/values.yaml @@ -0,0 +1,109 @@ +# Default values for expresso. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 +app_name: espresso-shop-reviews +image: + repository: devopseasylearning2021/s3-project01-espresso-shop-review + pullPolicy: IfNotPresent + tag: "v1.0.0" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + create: true + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "espresso-shop-reviews-v1" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +service: + type: ClusterIP + port: 8092 + targetPort: 80 + +ingress: + enabled: true + className: "" + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + hosts: + - host: chart-example.local + paths: + - path: / + pathType: ImplementationSpecific + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +resources: + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 100m + memory: 128Mi + +autoscaling: + enabled: false + minReplicas: 2 + maxReplicas: 5 + name: cpu + type: Utilization + averageUtilization: 50 + # targetMemoryUtilizationPercentage: 80 + +nodeSelector: {} +tolerations: [] +affinity: {} +labels: + app: espresso-shop-reviews-v1 + version: v1 + version2: v2 + app2: espresso-shop-reviews-v2 + +connection: + productKey: SERVICE_VERSION + productionValue: "v1" + productionValue2: "v2" + + +podDisruptionBudget: 1 + +minReadySeconds: 5 +strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 1 + maxUnavailable: 1 + +postgres: + username: "postgres" + password: "TlhZJmdlcCNTWG4qNnJ1VkpMdldkekRyIVZhV3hNKkJF" + database: "espresso" + + + + \ No newline at end of file diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-web/Chart.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-web/Chart.yaml new file mode 100644 index 0000000..fbd3b88 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-web/Chart.yaml @@ -0,0 +1,24 @@ +apiVersion: v2 +name: expresso +description: A Helm chart for Kubernetes + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "1.16.0" diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/NOTES.txt b/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/NOTES.txt new file mode 100644 index 0000000..f8a73f5 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/NOTES.txt @@ -0,0 +1,22 @@ +1. Get the application URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range $host := .Values.ingress.hosts }} + {{- range .paths }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }} + {{- end }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "expresso.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "expresso.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "expresso.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "expresso.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/_helpers.tpl b/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/_helpers.tpl new file mode 100644 index 0000000..60cb154 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "expresso.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "expresso.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "expresso.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "expresso.labels" -}} +helm.sh/chart: {{ include "expresso.chart" . }} +{{ include "expresso.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "expresso.selectorLabels" -}} +app.kubernetes.io/name: {{ include "expresso.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "expresso.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "expresso.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/deployment.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/deployment.yaml new file mode 100644 index 0000000..bbb2716 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/deployment.yaml @@ -0,0 +1,71 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Values.app_name }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + selector: + matchLabels: + # labels: + app: {{ .Values.labels.app }} + minReadySeconds: {{ .Values.minReadySeconds }} + strategy: + type: {{ .Values.strategy.type }} + rollingUpdate: + maxSurge: {{ .Values.strategy.rollingUpdate.maxSurge }} + maxUnavailable: {{ .Values.strategy.rollingUpdate.maxUnavailable }} + template: + metadata: + labels: + app: {{ .Values.labels.app }} + version: {{ .Values.labels.version }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "expresso.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Values.labels.app }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + envFrom: + - secretRef: + name: {{ .Values.app_name }} + env: + - name: {{ .Values.connection.productKey }} + value: {{ .Values.connection.productionValue }} + - name: {{ .Values.connection.reviewKey }} + value: {{ .Values.connection.reviewValue }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: {{ .Values.service.targetPort }} + protocol: TCP + # livenessProbe: + # httpGet: + # path: / + # port: http + # readinessProbe: + # httpGet: + # path: / + # port: http + resources: + {{- toYaml .Values.resources | nindent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/hpa.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/hpa.yaml new file mode 100644 index 0000000..e58e065 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/hpa.yaml @@ -0,0 +1,20 @@ +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ .Values.app_name }} + labels: + app: {{ .Values.labels.app }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ .Values.app_name }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + - type: Resource + resource: + name: {{ .Values.autoscaling.name }} + target: + type: {{ .Values.autoscaling.type }} + averageUtilization: {{ .Values.autoscaling.averageUtilization }} \ No newline at end of file diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/pdb.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/pdb.yaml new file mode 100644 index 0000000..4260641 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/pdb.yaml @@ -0,0 +1,11 @@ +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ .Values.app_name }} + labels: + app: {{ .Values.labels.app }} +spec: + maxUnavailable: {{ .Values.podDisruptionBudget }} + selector: + matchLabels: + app: {{ .Values.labels.app }} \ No newline at end of file diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/secret.yml b/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/secret.yml new file mode 100644 index 0000000..c685ae4 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/secret.yml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ .Values.app_name }} +type: Opaque +data: + authKey: {{ .Values.redis.authKey }} + password: {{ .Values.redis.password }} \ No newline at end of file diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/service.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/service.yaml new file mode 100644 index 0000000..51bce00 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/service.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ .Values.app_name }}-svc + labels: + app: {{ .Values.labels.app }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: {{ .Values.service.targetPort }} + nodePort: {{ .Values.service.nodePort }} + protocol: TCP + name: http + selector: + app: {{ .Values.labels.app }} + diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/serviceaccount.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/serviceaccount.yaml new file mode 100644 index 0000000..da7c53c --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-web/templates/serviceaccount.yaml @@ -0,0 +1,8 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "expresso.serviceAccountName" . }} + labels: + app: espresso-shop-web +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/espresso-shop-web/values.yaml b/espresso-shop/charts/S4/espresso/espresso-shop-web/values.yaml new file mode 100644 index 0000000..dedb6d6 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/espresso-shop-web/values.yaml @@ -0,0 +1,104 @@ +# Default values for expresso. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 +app_name: espresso-shop-web + +image: + repository: devopseasylearning2021/s3-project01-espresso-shop + pullPolicy: IfNotPresent + tag: "v1.0.0" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + create: true + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "espresso-shop-web" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +service: + type: NodePort + port: 8090 + targetPort: 80 + nodePort: 30007 + +ingress: + enabled: true + className: "" + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + hosts: + - host: chart-example.local + paths: + - path: / + pathType: ImplementationSpecific + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +resources: + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 100m + memory: 128Mi + +autoscaling: + enabled: false + minReplicas: 2 + maxReplicas: 5 + name: cpu + type: Utilization + averageUtilization: 50 + # targetMemoryUtilizationPercentage: 80 + +nodeSelector: {} +tolerations: [] +affinity: {} +labels: + app: espresso-shop-web + version: v1 + +connection: + productKey: ProductCatalogUrl + productionValue: "http://espresso-shop-product-catalog-svc:8091" + reviewKey: ReviewsUrl + reviewValue: "http://espresso-shop-reviews-svc:8092" + +podDisruptionBudget: 1 + +minReadySeconds: 5 +strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 1 + maxUnavailable: 1 + +redis: + authKey: "UDJReU4lKl9DVG40N1AyemNETDNla24mSw==" + password: "Ykd1TlFjLTJWWDhaVjk5P2tIeTg0VXBzRVVqelheeVAlemo=" \ No newline at end of file diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/.helmignore b/espresso-shop/charts/S4/espresso/postgresql-ha/.helmignore new file mode 100644 index 0000000..f0c1319 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/Chart.lock b/espresso-shop/charts/S4/espresso/postgresql-ha/Chart.lock new file mode 100644 index 0000000..a91d1ed --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: common + repository: https://charts.bitnami.com/bitnami + version: 2.1.2 +digest: sha256:1c365a4551a2f4098e9584dc176b289c10437c679c7c3e2ec6153cabf863e1a4 +generated: "2022-11-01T11:24:26.996449075Z" diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/Chart.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/Chart.yaml new file mode 100644 index 0000000..fbf0183 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/Chart.yaml @@ -0,0 +1,33 @@ +annotations: + category: Database +apiVersion: v2 +appVersion: 15.1.0 +dependencies: +- name: common + repository: https://charts.bitnami.com/bitnami + tags: + - bitnami-common + version: 2.x.x +description: This PostgreSQL cluster solution includes the PostgreSQL replication + manager, an open-source tool for managing replication and failover on PostgreSQL + clusters. +home: https://github.com/bitnami/charts/tree/main/bitnami/postgresql-ha +icon: https://bitnami.com/assets/stacks/postgresql/img/postgresql-stack-220x234.png +keywords: +- postgresql +- repmgr +- pgpool +- postgres +- database +- sql +- replication +- cluster +- high availability +maintainers: +- name: Bitnami + url: https://github.com/bitnami/charts +name: postgresql-ha +sources: +- https://github.com/bitnami/containers/tree/main/bitnami/postgresql +- https://www.postgresql.org/ +version: 10.0.7 diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/README.md b/espresso-shop/charts/S4/espresso/postgresql-ha/README.md new file mode 100644 index 0000000..36dacce --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/README.md @@ -0,0 +1,905 @@ + + +# PostgreSQL HA packaged by Bitnami + +This PostgreSQL cluster solution includes the PostgreSQL replication manager, an open-source tool for managing replication and failover on PostgreSQL clusters. + +[Overview of PostgreSQL HA](https://www.postgresql.org/) + +Trademarks: This software listing is packaged by Bitnami. The respective trademarks mentioned in the offering are owned by the respective companies, and use of them does not imply any affiliation or endorsement. + +## TL;DR + +```console +$ helm repo add my-repo https://charts.bitnami.com/bitnami +$ helm install my-release my-repo/postgresql-ha +``` + +## Introduction + +This [Helm](https://github.com/kubernetes/helm) chart installs [PostgreSQL](https://www.postgresql.org/) with HA architecture in a Kubernetes cluster. Welcome to [contribute](https://github.com/bitnami/charts/blob/main/CONTRIBUTING.md) to Helm Chart for PostgreSQL HA. + +This Helm chart has been developed based on [bitnami/postgresql](https://github.com/bitnami/charts/tree/main/bitnami/postgresql) chart but including some changes to guarantee high availability such as: + +- A new deployment, service have been added to deploy [Pgpool-II](https://pgpool.net/mediawiki/index.php/Main_Page) to act as proxy for PostgreSQL backend. It helps to reduce connection overhead, acts as a load balancer for PostgreSQL, and ensures database node failover. +- Replacing `bitnami/postgresql` with `bitnami/postgresql-repmgr` which includes and configures [repmgr](https://repmgr.org/). Repmgr ensures standby nodes assume the primary role when the primary node is unhealthy. + +Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters. + +## Prerequisites + +- Kubernetes 1.19+ +- Helm 3.2.0+ + +## Installing the Chart + +Install the PostgreSQL HA helm chart with a release name `my-release`: + +```console +$ helm repo add my-repo https://charts.bitnami.com/bitnami +$ helm install my-release my-repo/postgresql-ha +``` + +## Uninstalling the Chart + +To uninstall/delete the `my-release` deployment: + +```console +$ helm delete --purge my-release +``` + +Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manually delete the PVCs. + +## Parameters + +### Global parameters + +| Name | Description | Value | +| ---------------------------------- | ----------------------------------------------------------------------------------------------- | ----- | +| `global.imageRegistry` | Global Docker image registry | `""` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | +| `global.storageClass` | Global StorageClass for Persistent Volume(s) | `""` | +| `global.postgresql.username` | PostgreSQL username (overrides `postgresql.username`) | `""` | +| `global.postgresql.password` | PostgreSQL password (overrides `postgresql.password`) | `""` | +| `global.postgresql.database` | PostgreSQL database (overrides `postgresql.database`) | `""` | +| `global.postgresql.repmgrUsername` | PostgreSQL repmgr username (overrides `postgresql.repmgrUsername`) | `""` | +| `global.postgresql.repmgrPassword` | PostgreSQL repmgr password (overrides `postgresql.repmgrpassword`) | `""` | +| `global.postgresql.repmgrDatabase` | PostgreSQL repmgr database (overrides `postgresql.repmgrDatabase`) | `""` | +| `global.postgresql.existingSecret` | Name of existing secret to use for PostgreSQL passwords (overrides `postgresql.existingSecret`) | `""` | +| `global.ldap.bindpw` | LDAP bind password (overrides `ldap.bindpw`) | `""` | +| `global.ldap.existingSecret` | Name of existing secret to use for LDAP passwords (overrides `ldap.existingSecret`) | `""` | +| `global.pgpool.adminUsername` | Pgpool Admin username (overrides `pgpool.adminUsername`) | `""` | +| `global.pgpool.adminPassword` | Pgpool Admin password (overrides `pgpool.adminPassword`) | `""` | +| `global.pgpool.existingSecret` | Pgpool existing secret | `""` | + + +### Common parameters + +| Name | Description | Value | +| ------------------------ | --------------------------------------------------------------------------------------------------- | --------------- | +| `kubeVersion` | Override Kubernetes version | `""` | +| `nameOverride` | String to partially override common.names.fullname template (will maintain the release name) | `""` | +| `fullnameOverride` | String to fully override common.names.fullname template | `""` | +| `namespaceOverride` | String to fully override common.names.namespace | `""` | +| `commonLabels` | Common labels to add to all resources (sub-charts are not considered). Evaluated as a template | `{}` | +| `commonAnnotations` | Common annotations to add to all resources (sub-charts are not considered). Evaluated as a template | `{}` | +| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` | +| `extraDeploy` | Array of extra objects to deploy with the release (evaluated as a template) | `[]` | +| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | +| `diagnosticMode.command` | Command to override all containers in the deployment | `[]` | +| `diagnosticMode.args` | Args to override all containers in the deployment | `[]` | + + +### PostgreSQL with Repmgr parameters + +| Name | Description | Value | +| ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------- | +| `postgresql.image.registry` | PostgreSQL with Repmgr image registry | `docker.io` | +| `postgresql.image.repository` | PostgreSQL with Repmgr image repository | `bitnami/postgresql-repmgr` | +| `postgresql.image.tag` | PostgreSQL with Repmgr image tag | `15.1.0-debian-11-r0` | +| `postgresql.image.digest` | PostgreSQL image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `postgresql.image.pullPolicy` | PostgreSQL with Repmgr image pull policy | `IfNotPresent` | +| `postgresql.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | +| `postgresql.image.debug` | Specify if debug logs should be enabled | `false` | +| `postgresql.labels` | Labels to add to the StatefulSet. Evaluated as template | `{}` | +| `postgresql.podLabels` | Labels to add to the StatefulSet pods. Evaluated as template | `{}` | +| `postgresql.replicaCount` | Number of replicas to deploy. Use an odd number. Having 3 replicas is the minimum to get quorum when promoting a new primary. | `3` | +| `postgresql.updateStrategy.type` | Postgresql statefulset strategy type | `RollingUpdate` | +| `postgresql.containerPorts.postgresql` | PostgreSQL port | `5432` | +| `postgresql.hostAliases` | Deployment pod host aliases | `[]` | +| `postgresql.hostNetwork` | Specify if host network should be enabled for PostgreSQL pod | `false` | +| `postgresql.hostIPC` | Specify if host IPC should be enabled for PostgreSQL pod | `false` | +| `postgresql.podAnnotations` | Additional pod annotations | `{}` | +| `postgresql.podAffinityPreset` | PostgreSQL pod affinity preset. Ignored if `postgresql.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `postgresql.podAntiAffinityPreset` | PostgreSQL pod anti-affinity preset. Ignored if `postgresql.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `postgresql.nodeAffinityPreset.type` | PostgreSQL node affinity preset type. Ignored if `postgresql.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `postgresql.nodeAffinityPreset.key` | PostgreSQL node label key to match Ignored if `postgresql.affinity` is set. | `""` | +| `postgresql.nodeAffinityPreset.values` | PostgreSQL node label values to match. Ignored if `postgresql.affinity` is set. | `[]` | +| `postgresql.affinity` | Affinity for PostgreSQL pods assignment | `{}` | +| `postgresql.nodeSelector` | Node labels for PostgreSQL pods assignment | `{}` | +| `postgresql.tolerations` | Tolerations for PostgreSQL pods assignment | `[]` | +| `postgresql.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `[]` | +| `postgresql.priorityClassName` | Pod priority class | `""` | +| `postgresql.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | +| `postgresql.terminationGracePeriodSeconds` | Seconds PostgreSQL pod needs to terminate gracefully | `""` | +| `postgresql.podSecurityContext.enabled` | Enable security context for PostgreSQL with Repmgr | `true` | +| `postgresql.podSecurityContext.fsGroup` | Group ID for the PostgreSQL with Repmgr filesystem | `1001` | +| `postgresql.containerSecurityContext.enabled` | Enable container security context | `true` | +| `postgresql.containerSecurityContext.runAsUser` | User ID for the PostgreSQL with Repmgr container | `1001` | +| `postgresql.containerSecurityContext.runAsNonRoot` | Set PostgreSQL with Repmgr containers' Security Context runAsNonRoot | `true` | +| `postgresql.containerSecurityContext.readOnlyRootFilesystem` | Set PostgreSQL with Repmgr containers' Security Context runAsNonRoot | `false` | +| `postgresql.command` | Override default container command (useful when using custom images) | `[]` | +| `postgresql.args` | Override default container args (useful when using custom images) | `[]` | +| `postgresql.lifecycleHooks` | LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template | `{}` | +| `postgresql.extraEnvVars` | Array containing extra environment variables | `[]` | +| `postgresql.extraEnvVarsCM` | ConfigMap with extra environment variables | `""` | +| `postgresql.extraEnvVarsSecret` | Secret with extra environment variables | `""` | +| `postgresql.extraVolumes` | Extra volumes to add to the deployment | `[]` | +| `postgresql.extraVolumeMounts` | Extra volume mounts to add to the container. Normally used with `extraVolumes`. | `[]` | +| `postgresql.initContainers` | Extra init containers to add to the deployment | `[]` | +| `postgresql.sidecars` | Extra sidecar containers to add to the deployment | `[]` | +| `postgresql.resources.limits` | The resources limits for the container | `{}` | +| `postgresql.resources.requests` | The requested resources for the container | `{}` | +| `postgresql.livenessProbe.enabled` | Enable livenessProbe | `true` | +| `postgresql.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | +| `postgresql.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `postgresql.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `postgresql.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `postgresql.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `postgresql.readinessProbe.enabled` | Enable readinessProbe | `true` | +| `postgresql.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `postgresql.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `postgresql.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `postgresql.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `postgresql.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `postgresql.startupProbe.enabled` | Enable startupProbe | `false` | +| `postgresql.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `postgresql.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `postgresql.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | +| `postgresql.startupProbe.failureThreshold` | Failure threshold for startupProbe | `10` | +| `postgresql.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `postgresql.customLivenessProbe` | Override default liveness probe | `{}` | +| `postgresql.customReadinessProbe` | Override default readiness probe | `{}` | +| `postgresql.customStartupProbe` | Override default startup probe | `{}` | +| `postgresql.pdb.create` | Specifies whether to create a Pod disruption budget for PostgreSQL with Repmgr | `false` | +| `postgresql.pdb.minAvailable` | Minimum number / percentage of pods that should remain scheduled | `1` | +| `postgresql.pdb.maxUnavailable` | Maximum number / percentage of pods that may be made unavailable | `""` | +| `postgresql.username` | PostgreSQL username | `postgres` | +| `postgresql.password` | PostgreSQL password | `""` | +| `postgresql.database` | PostgreSQL database | `""` | +| `postgresql.existingSecret` | PostgreSQL password using existing secret | `""` | +| `postgresql.postgresPassword` | PostgreSQL password for the `postgres` user when `username` is not `postgres` | `""` | +| `postgresql.usePasswordFile` | Set to `true` to mount PostgreSQL secret as a file instead of passing environment variable | `""` | +| `postgresql.repmgrUsePassfile` | Set to `true` to configure repmgrl to use `passfile` instead of `password` vars*:*:*:username:password" and use it to configure Repmgr instead of using password (Requires Postgresql 10+, otherwise ignored) | `""` | +| `postgresql.repmgrPassfilePath` | Custom path where `passfile` will be stored | `""` | +| `postgresql.upgradeRepmgrExtension` | Upgrade repmgr extension in the database | `false` | +| `postgresql.pgHbaTrustAll` | Configures PostgreSQL HBA to trust every user | `false` | +| `postgresql.syncReplication` | Make the replication synchronous. This will wait until the data is synchronized in all the replicas before other query can be run. This ensures the data availability at the expenses of speed. | `false` | +| `postgresql.repmgrUsername` | PostgreSQL Repmgr username | `repmgr` | +| `postgresql.repmgrPassword` | PostgreSQL Repmgr password | `""` | +| `postgresql.repmgrDatabase` | PostgreSQL Repmgr database | `repmgr` | +| `postgresql.repmgrLogLevel` | Repmgr log level (DEBUG, INFO, NOTICE, WARNING, ERROR, ALERT, CRIT or EMERG) | `NOTICE` | +| `postgresql.repmgrConnectTimeout` | Repmgr backend connection timeout (in seconds) | `5` | +| `postgresql.repmgrReconnectAttempts` | Repmgr backend reconnection attempts | `2` | +| `postgresql.repmgrReconnectInterval` | Repmgr backend reconnection interval (in seconds) | `3` | +| `postgresql.repmgrFenceOldPrimary` | Set if fencing of old primary in multiple primary situation is desired | `false` | +| `postgresql.repmgrChildNodesCheckInterval` | Repmgr child nodes check interval (in seconds) | `5` | +| `postgresql.repmgrChildNodesConnectedMinCount` | Repmgr minimum number of connected child nodes before being considered as failed primary for fencing | `1` | +| `postgresql.repmgrChildNodesDisconnectTimeout` | Repmgr time before node will be fenced when insufficient child nodes are detected (in seconds) | `30` | +| `postgresql.usePgRewind` | Use pg_rewind for standby failover (experimental) | `false` | +| `postgresql.audit.logHostname` | Add client hostnames to the log file | `true` | +| `postgresql.audit.logConnections` | Add client log-in operations to the log file | `false` | +| `postgresql.audit.logDisconnections` | Add client log-outs operations to the log file | `false` | +| `postgresql.audit.pgAuditLog` | Add operations to log using the pgAudit extension | `""` | +| `postgresql.audit.pgAuditLogCatalog` | Log catalog using pgAudit | `off` | +| `postgresql.audit.clientMinMessages` | Message log level to share with the user | `error` | +| `postgresql.audit.logLinePrefix` | Template string for the log line prefix | `""` | +| `postgresql.audit.logTimezone` | Timezone for the log timestamps | `""` | +| `postgresql.sharedPreloadLibraries` | Shared preload libraries (comma-separated list) | `pgaudit, repmgr` | +| `postgresql.maxConnections` | Maximum total connections | `""` | +| `postgresql.postgresConnectionLimit` | Maximum connections for the postgres user | `""` | +| `postgresql.dbUserConnectionLimit` | Maximum connections for the created user | `""` | +| `postgresql.tcpKeepalivesInterval` | TCP keepalives interval | `""` | +| `postgresql.tcpKeepalivesIdle` | TCP keepalives idle | `""` | +| `postgresql.tcpKeepalivesCount` | TCP keepalives count | `""` | +| `postgresql.statementTimeout` | Statement timeout | `""` | +| `postgresql.pghbaRemoveFilters` | Comma-separated list of patterns to remove from the pg_hba.conf file | `""` | +| `postgresql.extraInitContainers` | Extra init containers | `[]` | +| `postgresql.repmgrConfiguration` | Repmgr configuration | `""` | +| `postgresql.configuration` | PostgreSQL configuration | `""` | +| `postgresql.pgHbaConfiguration` | PostgreSQL client authentication configuration | `""` | +| `postgresql.configurationCM` | Name of existing ConfigMap with configuration files | `""` | +| `postgresql.extendedConf` | Extended PostgreSQL configuration (appended to main or default configuration). Implies `volumePermissions.enabled`. | `""` | +| `postgresql.extendedConfCM` | ConfigMap with PostgreSQL extended configuration | `""` | +| `postgresql.initdbScripts` | Dictionary of initdb scripts | `{}` | +| `postgresql.initdbScriptsCM` | ConfigMap with scripts to be run at first boot | `""` | +| `postgresql.initdbScriptsSecret` | Secret with scripts to be run at first boot | `""` | +| `postgresql.tls.enabled` | Enable TLS traffic support for end-client connections | `false` | +| `postgresql.tls.preferServerCiphers` | Whether to use the server's TLS cipher preferences rather than the client's | `true` | +| `postgresql.tls.certificatesSecret` | Name of an existing secret that contains the certificates | `""` | +| `postgresql.tls.certFilename` | Certificate filename | `""` | +| `postgresql.tls.certKeyFilename` | Certificate key filename | `""` | + + +### Pgpool parameters + +| Name | Description | Value | +| -------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | --------------------- | +| `pgpool.image.registry` | Pgpool image registry | `docker.io` | +| `pgpool.image.repository` | Pgpool image repository | `bitnami/pgpool` | +| `pgpool.image.tag` | Pgpool image tag | `4.3.3-debian-11-r28` | +| `pgpool.image.digest` | Pgpool image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `pgpool.image.pullPolicy` | Pgpool image pull policy | `IfNotPresent` | +| `pgpool.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | +| `pgpool.image.debug` | Specify if debug logs should be enabled | `false` | +| `pgpool.customUsers` | Additional users that will be performing connections to the database using | `{}` | +| `pgpool.usernames` | Comma or semicolon separated list of postgres usernames | `""` | +| `pgpool.passwords` | Comma or semicolon separated list of the associated passwords for the users above | `""` | +| `pgpool.hostAliases` | Deployment pod host aliases | `[]` | +| `pgpool.customUsersSecret` | Name of a secret containing the usernames and passwords of accounts that will be added to pgpool_passwd | `""` | +| `pgpool.existingSecret` | Pgpool admin password using existing secret | `""` | +| `pgpool.srCheckDatabase` | Name of the database to perform streaming replication checks | `postgres` | +| `pgpool.labels` | Labels to add to the Deployment. Evaluated as template | `{}` | +| `pgpool.podLabels` | Labels to add to the pods. Evaluated as template | `{}` | +| `pgpool.serviceLabels` | Labels to add to the service. Evaluated as template | `{}` | +| `pgpool.customLivenessProbe` | Override default liveness probe | `{}` | +| `pgpool.customReadinessProbe` | Override default readiness probe | `{}` | +| `pgpool.customStartupProbe` | Override default startup probe | `{}` | +| `pgpool.command` | Override default container command (useful when using custom images) | `[]` | +| `pgpool.args` | Override default container args (useful when using custom images) | `[]` | +| `pgpool.lifecycleHooks` | LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template | `{}` | +| `pgpool.extraEnvVars` | Array containing extra environment variables | `[]` | +| `pgpool.extraEnvVarsCM` | ConfigMap with extra environment variables | `""` | +| `pgpool.extraEnvVarsSecret` | Secret with extra environment variables | `""` | +| `pgpool.extraVolumes` | Extra volumes to add to the deployment | `[]` | +| `pgpool.extraVolumeMounts` | Extra volume mounts to add to the container. Normally used with `extraVolumes` | `[]` | +| `pgpool.initContainers` | Extra init containers to add to the deployment | `[]` | +| `pgpool.sidecars` | Extra sidecar containers to add to the deployment | `[]` | +| `pgpool.replicaCount` | The number of replicas to deploy | `1` | +| `pgpool.podAnnotations` | Additional pod annotations | `{}` | +| `pgpool.priorityClassName` | Pod priority class | `""` | +| `pgpool.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | +| `pgpool.terminationGracePeriodSeconds` | Seconds pgpool pod needs to terminate gracefully | `""` | +| `pgpool.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `[]` | +| `pgpool.podAffinityPreset` | Pgpool pod affinity preset. Ignored if `pgpool.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `pgpool.podAntiAffinityPreset` | Pgpool pod anti-affinity preset. Ignored if `pgpool.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `pgpool.nodeAffinityPreset.type` | Pgpool node affinity preset type. Ignored if `pgpool.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `pgpool.nodeAffinityPreset.key` | Pgpool node label key to match Ignored if `pgpool.affinity` is set. | `""` | +| `pgpool.nodeAffinityPreset.values` | Pgpool node label values to match. Ignored if `pgpool.affinity` is set. | `[]` | +| `pgpool.affinity` | Affinity for Pgpool pods assignment | `{}` | +| `pgpool.nodeSelector` | Node labels for Pgpool pods assignment | `{}` | +| `pgpool.tolerations` | Tolerations for Pgpool pods assignment | `[]` | +| `pgpool.podSecurityContext.enabled` | Enable security context for Pgpool | `true` | +| `pgpool.podSecurityContext.fsGroup` | Group ID for the Pgpool filesystem | `1001` | +| `pgpool.containerSecurityContext.enabled` | Enable container security context | `true` | +| `pgpool.containerSecurityContext.runAsUser` | User ID for the Pgpool container | `1001` | +| `pgpool.containerSecurityContext.runAsNonRoot` | Set Pgpool containers' Security Context runAsNonRoot | `true` | +| `pgpool.containerSecurityContext.readOnlyRootFilesystem` | Set Pgpool containers' Security Context runAsNonRoot | `false` | +| `pgpool.resources.limits` | The resources limits for the container | `{}` | +| `pgpool.resources.requests` | The requested resources for the container | `{}` | +| `pgpool.livenessProbe.enabled` | Enable livenessProbe | `true` | +| `pgpool.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | +| `pgpool.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `pgpool.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `pgpool.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `5` | +| `pgpool.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `pgpool.readinessProbe.enabled` | Enable readinessProbe | `true` | +| `pgpool.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `pgpool.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `pgpool.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `pgpool.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `5` | +| `pgpool.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `pgpool.startupProbe.enabled` | Enable startupProbe | `false` | +| `pgpool.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `pgpool.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `pgpool.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | +| `pgpool.startupProbe.failureThreshold` | Failure threshold for startupProbe | `10` | +| `pgpool.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `pgpool.pdb.create` | Specifies whether a Pod disruption budget should be created for Pgpool pods | `false` | +| `pgpool.pdb.minAvailable` | Minimum number / percentage of pods that should remain scheduled | `1` | +| `pgpool.pdb.maxUnavailable` | Maximum number / percentage of pods that may be made unavailable | `""` | +| `pgpool.updateStrategy` | Strategy used to replace old Pods by new ones | `{}` | +| `pgpool.containerPorts.postgresql` | Pgpool port | `5432` | +| `pgpool.minReadySeconds` | How many seconds a pod needs to be ready before killing the next, during update | `""` | +| `pgpool.adminUsername` | Pgpool Admin username | `admin` | +| `pgpool.adminPassword` | Pgpool Admin password | `""` | +| `pgpool.usePasswordFile` | Set to `true` to mount pgpool secret as a file instead of passing environment variable | `""` | +| `pgpool.authenticationMethod` | Pgpool authentication method. Use 'md5' for PSQL < 14. | `scram-sha-256` | +| `pgpool.logConnections` | Log all client connections (PGPOOL_ENABLE_LOG_CONNECTIONS) | `false` | +| `pgpool.logHostname` | Log the client hostname instead of IP address (PGPOOL_ENABLE_LOG_HOSTNAME) | `true` | +| `pgpool.logPerNodeStatement` | Log every SQL statement for each DB node separately (PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT) | `false` | +| `pgpool.logLinePrefix` | Format of the log entry lines (PGPOOL_LOG_LINE_PREFIX) | `""` | +| `pgpool.clientMinMessages` | Log level for clients | `error` | +| `pgpool.numInitChildren` | The number of preforked Pgpool-II server processes. It is also the concurrent | `""` | +| `pgpool.reservedConnections` | Number of reserved connections. When zero, excess connection block. When non-zero, excess connections are refused with an error message. | `1` | +| `pgpool.maxPool` | The maximum number of cached connections in each child process (PGPOOL_MAX_POOL) | `""` | +| `pgpool.childMaxConnections` | The maximum number of client connections in each child process (PGPOOL_CHILD_MAX_CONNECTIONS) | `""` | +| `pgpool.childLifeTime` | The time in seconds to terminate a Pgpool-II child process if it remains idle (PGPOOL_CHILD_LIFE_TIME) | `""` | +| `pgpool.clientIdleLimit` | The time in seconds to disconnect a client if it remains idle since the last query (PGPOOL_CLIENT_IDLE_LIMIT) | `""` | +| `pgpool.connectionLifeTime` | The time in seconds to terminate the cached connections to the PostgreSQL backend (PGPOOL_CONNECTION_LIFE_TIME) | `""` | +| `pgpool.useLoadBalancing` | Use Pgpool Load-Balancing | `true` | +| `pgpool.loadBalancingOnWrite` | LoadBalancer on write actions behavior | `transaction` | +| `pgpool.configuration` | Pgpool configuration | `""` | +| `pgpool.configurationCM` | ConfigMap with Pgpool configuration | `""` | +| `pgpool.initdbScripts` | Dictionary of initdb scripts | `{}` | +| `pgpool.initdbScriptsCM` | ConfigMap with scripts to be run every time Pgpool container is initialized | `""` | +| `pgpool.initdbScriptsSecret` | Secret with scripts to be run every time Pgpool container is initialized | `""` | +| `pgpool.tls.enabled` | Enable TLS traffic support for end-client connections | `false` | +| `pgpool.tls.autoGenerated` | Create self-signed TLS certificates. Currently only supports PEM certificates | `false` | +| `pgpool.tls.preferServerCiphers` | Whether to use the server's TLS cipher preferences rather than the client's | `true` | +| `pgpool.tls.certificatesSecret` | Name of an existing secret that contains the certificates | `""` | +| `pgpool.tls.certFilename` | Certificate filename | `""` | +| `pgpool.tls.certKeyFilename` | Certificate key filename | `""` | +| `pgpool.tls.certCAFilename` | CA Certificate filename | `""` | + + +### LDAP parameters + +| Name | Description | Value | +| ------------------------------- | ------------------------------------------------------------ | ------------ | +| `ldap.enabled` | Enable LDAP support | `false` | +| `ldap.existingSecret` | Name of existing secret to use for LDAP passwords | `""` | +| `ldap.uri` | LDAP URL beginning in the form `ldap[s]://:` | `""` | +| `ldap.basedn` | LDAP base DN | `""` | +| `ldap.binddn` | LDAP bind DN | `""` | +| `ldap.bindpw` | LDAP bind password | `""` | +| `ldap.bslookup` | LDAP base lookup | `""` | +| `ldap.scope` | LDAP search scope | `""` | +| `ldap.tlsReqcert` | LDAP TLS check on server certificates | `""` | +| `ldap.nssInitgroupsIgnoreusers` | LDAP ignored users | `root,nslcd` | + + +### Other Parameters + +| Name | Description | Value | +| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ------- | +| `rbac.create` | Create Role and RoleBinding (required for PSP to work) | `false` | +| `rbac.rules` | Custom RBAC rules to set | `[]` | +| `serviceAccount.create` | Enable creation of ServiceAccount for Airflow pods | `false` | +| `serviceAccount.name` | The name of the ServiceAccount to use. | `""` | +| `serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` | +| `serviceAccount.automountServiceAccountToken` | Allows auto mount of ServiceAccountToken on the serviceAccount created | `true` | +| `psp.create` | Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later | `false` | + + +### Metrics parameters + +| Name | Description | Value | +| -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------- | +| `metrics.enabled` | Enable PostgreSQL Prometheus exporter | `false` | +| `metrics.image.registry` | PostgreSQL Prometheus exporter image registry | `docker.io` | +| `metrics.image.repository` | PostgreSQL Prometheus exporter image repository | `bitnami/postgres-exporter` | +| `metrics.image.tag` | PostgreSQL Prometheus exporter image tag | `0.11.1-debian-11-r27` | +| `metrics.image.digest` | PostgreSQL Prometheus exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `metrics.image.pullPolicy` | PostgreSQL Prometheus exporter image pull policy | `IfNotPresent` | +| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | +| `metrics.image.debug` | Specify if debug logs should be enabled | `false` | +| `metrics.podSecurityContext.enabled` | Enable security context for PostgreSQL Prometheus exporter | `true` | +| `metrics.podSecurityContext.runAsUser` | User ID for the PostgreSQL Prometheus exporter container | `1001` | +| `metrics.resources.limits` | The resources limits for the container | `{}` | +| `metrics.resources.requests` | The requested resources for the container | `{}` | +| `metrics.containerPorts.http` | Prometheus metrics exporter port | `9187` | +| `metrics.livenessProbe.enabled` | Enable livenessProbe | `true` | +| `metrics.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | +| `metrics.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `metrics.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `metrics.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `metrics.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `metrics.readinessProbe.enabled` | Enable readinessProbe | `true` | +| `metrics.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `metrics.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `metrics.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `metrics.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `metrics.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `metrics.startupProbe.enabled` | Enable startupProbe | `false` | +| `metrics.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `metrics.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `metrics.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | +| `metrics.startupProbe.failureThreshold` | Failure threshold for startupProbe | `10` | +| `metrics.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `metrics.customLivenessProbe` | Override default liveness probe | `{}` | +| `metrics.customReadinessProbe` | Override default readiness probe | `{}` | +| `metrics.customStartupProbe` | Override default startup probe | `{}` | +| `metrics.service.type` | PostgreSQL Prometheus exporter metrics service type | `ClusterIP` | +| `metrics.service.ports.metrics` | PostgreSQL Prometheus exporter metrics service port | `9187` | +| `metrics.service.nodePorts.metrics` | PostgreSQL Prometheus exporter Node Port | `""` | +| `metrics.service.clusterIP` | PostgreSQL Prometheus exporter metrics service Cluster IP | `""` | +| `metrics.service.loadBalancerIP` | PostgreSQL Prometheus exporter service Load Balancer IP | `""` | +| `metrics.service.loadBalancerSourceRanges` | PostgreSQL Prometheus exporter service Load Balancer sources | `[]` | +| `metrics.service.externalTrafficPolicy` | PostgreSQL Prometheus exporter service external traffic policy | `Cluster` | +| `metrics.annotations` | Annotations for PostgreSQL Prometheus exporter service | `{}` | +| `metrics.customMetrics` | Additional custom metrics | `{}` | +| `metrics.extraEnvVars` | Array containing extra environment variables | `[]` | +| `metrics.extraEnvVarsCM` | ConfigMap with extra environment variables | `""` | +| `metrics.extraEnvVarsSecret` | Secret with extra environment variables | `""` | +| `metrics.serviceMonitor.enabled` | if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`) | `false` | +| `metrics.serviceMonitor.namespace` | Optional namespace which Prometheus is running in | `""` | +| `metrics.serviceMonitor.interval` | How frequently to scrape metrics (use by default, falling back to Prometheus' default) | `""` | +| `metrics.serviceMonitor.scrapeTimeout` | Service monitor scrape timeout | `""` | +| `metrics.serviceMonitor.annotations` | Additional annotations for the ServiceMonitor | `{}` | +| `metrics.serviceMonitor.labels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | `{}` | +| `metrics.serviceMonitor.selector` | Defaults to what's used if you follow CoreOS Prometheus Install Instructions (https://github.com/bitnami/charts/tree/main/bitnami/kube-prometheus#tldr) | `{}` | +| `metrics.serviceMonitor.relabelings` | ServiceMonitor relabelings. Value is evaluated as a template | `[]` | +| `metrics.serviceMonitor.metricRelabelings` | ServiceMonitor metricRelabelings. Value is evaluated as a template | `[]` | +| `metrics.serviceMonitor.honorLabels` | Specify honorLabels parameter to add the scrape endpoint | `false` | +| `metrics.serviceMonitor.jobLabel` | The name of the label on the target service to use as the job name in prometheus. | `""` | + + +### Volume permissions parameters + +| Name | Description | Value | +| ------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | +| `volumePermissions.enabled` | Enable init container to adapt volume permissions | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image repository | `bitnami/bitnami-shell` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `11-debian-11-r50` | +| `volumePermissions.image.digest` | Init container volume-permissions image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` | +| `volumePermissions.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | +| `volumePermissions.podSecurityContext.runAsUser` | Init container volume-permissions User ID | `0` | +| `volumePermissions.resources.limits` | The resources limits for the container | `{}` | +| `volumePermissions.resources.requests` | The requested resources for the container | `{}` | + + +### Persistence parameters + +| Name | Description | Value | +| --------------------------- | --------------------------------------------------------------------------------------- | --------------------- | +| `persistence.enabled` | Enable data persistence | `true` | +| `persistence.existingClaim` | A manually managed Persistent Volume and Claim | `""` | +| `persistence.storageClass` | Persistent Volume Storage Class | `""` | +| `persistence.mountPath` | The path the volume will be mounted at, useful when using different PostgreSQL images. | `/bitnami/postgresql` | +| `persistence.accessModes` | List of access modes of data volume | `["ReadWriteOnce"]` | +| `persistence.size` | Persistent Volume Claim size | `8Gi` | +| `persistence.annotations` | Persistent Volume Claim annotations | `{}` | +| `persistence.labels` | Persistent Volume Claim labels | `{}` | +| `persistence.selector` | Selector to match an existing Persistent Volume (this value is evaluated as a template) | `{}` | + + +### Traffic Exposure parameters + +| Name | Description | Value | +| ----------------------------------------------------- | --------------------------------------------------------------------------------------------- | ------------ | +| `service.type` | Kubernetes service type (`ClusterIP`, `NodePort` or `LoadBalancer`) | `ClusterIP` | +| `service.ports.postgresql` | PostgreSQL port | `5432` | +| `service.portName` | PostgreSQL service port name | `postgresql` | +| `service.nodePorts.postgresql` | Kubernetes service nodePort | `""` | +| `service.loadBalancerIP` | Load balancer IP if service type is `LoadBalancer` | `""` | +| `service.loadBalancerSourceRanges` | Addresses that are allowed when service is LoadBalancer | `[]` | +| `service.clusterIP` | Set the Cluster IP to use | `""` | +| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | +| `service.extraPorts` | Extra ports to expose (normally used with the `sidecar` value) | `[]` | +| `service.sessionAffinity` | Control where client requests go, to the same pod or round-robin | `None` | +| `service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | +| `service.annotations` | Provide any additional annotations for PostgreSQL service | `{}` | +| `service.serviceLabels` | Labels for PostgreSQL service | `{}` | +| `networkPolicy.enabled` | Enable NetworkPolicy | `false` | +| `networkPolicy.allowExternal` | Don't require client label for connections | `true` | +| `networkPolicy.egressRules.denyConnectionsToExternal` | Enable egress rule that denies outgoing traffic outside the cluster, except for DNS (port 53) | `false` | +| `networkPolicy.egressRules.customRules` | Custom network policy rule | `{}` | + + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```console +$ helm install my-release \ + --set postgresql.password=password \ + my-repo/postgresql-ha +``` + +The above command sets the password for user `postgres` to `password`. + +> NOTE: Once this chart is deployed, it is not possible to change the application's access credentials, such as usernames or passwords, using Helm. To change these application credentials after deployment, delete any persistent volumes (PVs) used by the chart and re-deploy it, or use the application's built-in administrative tools if available. + +Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example, + +```console +$ helm install my-release \ + -f values.yaml \ + bitnami/postgresql-ha +``` + +## Configuration and installation details + +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + +### Use a different PostgreSQL version + +To modify the application version used in this chart, specify a different version of the image using the `image.tag` parameter and/or a different repository using the `image.repository` parameter. Refer to the [chart documentation for more information on these parameters and how to use them with images from a private registry](https://docs.bitnami.com/kubernetes/infrastructure/postgresql-ha/configuration/change-image-version/). + +### Use a volume for /dev/shm + +When working with huge databeses, `/dev/shm` can run out of space. A way to fix this is to use the `postgresql.extraVolumes` and `postgresql.extraVolumeMounts` values. In the example below, we set an `emptyDir` volume with 512Mb: + +```yaml +postgresql: + extraVolumes: + - name: dshm + emptyDir: + medium: Memory + sizeLimit: 512Mi + extraVolumeMounts: + - name: dshm + mountPath: /dev/shm +``` + +### Configure the way how to expose PostgreSQL + +- **ClusterIP**: Exposes the service on a cluster-internal IP. Choosing this value makes the service only reachable from within the cluster. Set `service.type=ClusterIP` to choose this service type. +- **NodePort**: Exposes the service on each Node's IP at a static port (the NodePort). You will be able to contact the NodePort service, from outside the cluster, by requesting `NodeIP:NodePort`. Set `service.type=NodePort` to choose this service type. +- **LoadBalancer**: Exposes the service externally using a cloud provider's load balancer. Set `service.type=LoadBalancer` to choose this service type. + +### Adjust permissions of persistent volume mountpoint + +As the images run as non-root by default, it is necessary to adjust the ownership of the persistent volumes so that the containers can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. + +### Securing traffic using TLS + +Learn how to [configure TLS authentication](/<%= platform_path %>/infrastructure/postgresql-ha/administration/enable-tls-ingress/) + +### LDAP + +LDAP support can be enabled in the chart by specifying the `ldap.` parameters while creating a release. The following parameters should be configured to properly enable the LDAP support in the chart. + +- **ldap.enabled**: Enable LDAP support. Defaults to `false`. +- **ldap.uri**: LDAP URL beginning in the form `ldap[s]://:`. No defaults. +- **ldap.base**: LDAP base DN. No defaults. +- **ldap.binddn**: LDAP bind DN. No defaults. +- **ldap.bindpw**: LDAP bind password. No defaults. +- **ldap.bslookup**: LDAP base lookup. No defaults. +- **ldap.nss_initgroups_ignoreusers**: LDAP ignored users. `root,nslcd`. +- **ldap.scope**: LDAP search scope. No defaults. +- **ldap.tls_reqcert**: LDAP TLS check on server certificates. No defaults. + +For example: + +```bash +ldap.enabled="true" +ldap.uri="ldap://my_ldap_server" +ldap.base="dc=example\,dc=org" +ldap.binddn="cn=admin\,dc=example\,dc=org" +ldap.bindpw="admin" +ldap.bslookup="ou=group-ok\,dc=example\,dc=org" +ldap.nss_initgroups_ignoreusers="root\,nslcd" +ldap.scope="sub" +ldap.tls_reqcert="demand" +``` + +Next, login to the PostgreSQL server using the `psql` client and add the PAM authenticated LDAP users. + +> Note: Parameters including commas must be escaped as shown in the above example. + +### repmgr.conf / postgresql.conf / pg_hba.conf / pgpool.conf files as configMap + +This helm chart also supports to customize the whole configuration file. + +You can specify the Pgpool, PostgreSQL and Repmgr configuration using the `pgpool.configuration`, `postgresql.configuration`, `postgresql.pgHbaConfiguration`, and `postgresql.repmgrConfiguration` parameters. The corresponding files will be mounted as ConfigMap to the containers and it will be used for configuring Pgpool, Repmgr and the PostgreSQL server. + +In addition to this option, you can also set an external ConfigMap(s) with all the configuration files. This is done by setting the `postgresql.configurationCM` and `pgpool.configurationCM` parameters. Note that this will override the previous options. + +### Allow settings to be loaded from files other than the default `postgresql.conf` + +If you don't want to provide the whole PostgreSQL configuration file and only specify certain parameters, you can specify the extended configuration using the `postgresql.extendedConf` parameter. A file will be mounted as configMap to the containers adding/overwriting the default configuration using the `include_dir` directive that allows settings to be loaded from files other than the default `postgresql.conf`. + +In addition to this option, you can also set an external ConfigMap with all the extra configuration files. This is done by setting the `postgresql.extendedConfCM` parameter. Note that this will override the previous option. + +### Initialize a fresh instance + +The [Bitnami PostgreSQL with Repmgr](https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr) image allows you to use your custom scripts to initialize a fresh instance. You can specify custom scripts using the `initdbScripts` parameter as dict so they can be consumed as a ConfigMap. + +In addition to this option, you can also set an external ConfigMap with all the initialization scripts. This is done by setting the `initdbScriptsCM` parameter. Note that this will override the two previous options. If your initialization scripts contain sensitive information such as credentials or passwords, you can use the `initdbScriptsSecret` parameter. + +The above parameters (`initdbScripts`, `initdbScriptsCM`, and `initdbScriptsSecret`) are supported in both StatefulSet by prepending `postgresql` or `pgpool` to the parameter, depending on the use case (see above parameters table). + +The allowed extensions are `.sh`, `.sql` and `.sql.gz` in the **postgresql** container while only `.sh` in the case of the **pgpool** one. + ++info: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#initializing-a-new-instance and https://github.com/bitnami/containers/tree/main/bitnami/pgpool#initializing-with-custom-scripts + +### Use of global variables + +In more complex scenarios, we may have the following tree of dependencies + +```bash + +--------------+ + | | + +------------+ Chart 1 +-----------+ + | | | | + | --------+------+ | + | | | + | | | + | | | + | | | + v v v ++-------+------+ +--------+------+ +--------+------+ +| | | | | | +| PostgreSQL HA | | Sub-chart 1 | | Sub-chart 2 | +|---------------|--|-------------|--|-------------| ++--------------+ +---------------+ +---------------+ +``` + +The three charts below depend on the parent chart Chart 1. However, subcharts 1 and 2 may need to connect to PostgreSQL HA as well. In order to do so, subcharts 1 and 2 need to know the PostgreSQL HA credentials, so one option for deploying could be deploy Chart 1 with the following parameters: + +```bash +postgresql.postgresqlPassword=testtest +subchart1.postgresql.postgresqlPassword=testtest +subchart2.postgresql.postgresqlPassword=testtest +postgresql.postgresqlDatabase=db1 +subchart1.postgresql.postgresqlDatabase=db1 +subchart2.postgresql.postgresqlDatabase=db1 +``` + +If the number of dependent sub-charts increases, installing the chart with parameters can become increasingly difficult. An alternative would be to set the credentials using global variables as follows: + +```bash +global.postgresql.postgresqlPassword=testtest +global.postgresql.postgresqlDatabase=db1 +``` + +This way, the credentials will be available in all of the subcharts. + +## Persistence + +The data is persisted by default using PVC templates in the PostgreSQL statefulset. You can disable the persistence setting the `persistence.enabled` parameter to `false`. +A default `StorageClass` is needed in the Kubernetes cluster to dynamically provision the volumes. Specify another StorageClass in the `persistence.storageClass` or set `persistence.existingClaim` if you have already existing persistent volumes to use. + +### Setting Pod's affinity + +This chart allows you to set your custom affinity using the `XXX.affinity` paremeter(s). Find more information about Pod's affinity in the [kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity). + +As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/main/bitnami/common#affinities) chart. To do so, set the `XXX.podAffinityPreset`, `XXX.podAntiAffinityPreset`, or `XXX.nodeAffinityPreset` parameters. + +## Troubleshooting + +Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). + +## Upgrading + +It's necessary to specify the existing passwords while performing a upgrade to ensure the secrets are not updated with invalid randomly generated passwords. Remember to specify the existing values of the `postgresql.password` and `postgresql.repmgrPassword` parameters when upgrading the chart: + +```bash +$ helm upgrade my-release my-repo/postgresql-ha \ + --set postgresql.password=[POSTGRES_PASSWORD] \ + --set postgresql.repmgrPassword=[REPMGR_PASSWORD] +``` + +> Note: you need to substitute the placeholders _[POSTGRES_PASSWORD]_, and _[REPMGR_PASSWORD]_ with the values obtained from instructions in the installation notes. + +> Note: As general rule, it is always wise to do a backup before the upgrading procedures. + +### To 10.0.0 + +This major version changes the default PostgreSQL image from 14.x to 15.x. Follow the [official instructions](https://www.postgresql.org/docs/15/upgrading.html) to upgrade to 15.x. + +### To 9.0.0 + +This chart major version updates the PostgreSQL image's version to the latest major, `v14`, as well as standarizes the templates and values. These changes can be sumarised in the following: + +- Image parameters that used `imageNameImage` are now under `imageName.image` +- `containerPort` parameters are now found by `containerPorts.xxxx` +- `service.port` parameters are now found by `service.ports.xxxx` +- `imageName.securityContext` parameters are now under `imageName.podSecurityContext` +- `serviceAccount.enabled` parameter has been renamed to `serviceAccount.create` +- `postgresql.updateStrategyType` parameter has been renamed to `postgresql.updateStrategy.type` +- Added the `pgpool.authenticationMethod` parameter. Use "md5" for older PSQL versions and the default value of "scram-sha-256" when using PSQL > v14. + +> Note: Keep in mind you will find an error such as the one below when upgrading since the new chart major version also bumps the application version. To workaround this issue you need to upgrade the database, please refer to the [official PostgreSQL documentation](https://www.postgresql.org/docs/current/upgrading.html) for more information about this. + +``` +postgresql-repmgr 14:41:21.00 INFO ==> Setting up streaming replication slave... +postgresql-repmgr 14:41:21.04 INFO ==> Starting PostgreSQL in background... +waiting for server to start....2022-04-12 14:41:21.069 GMT [220] FATAL: database files are incompatible with server +2022-04-12 14:41:21.069 GMT [220] DETAIL: The data directory was initialized by PostgreSQL version 11, which is not compatible with this version 14.2. +pg_ctl: could not start server +``` + +### To 8.0.0 + +A new major version of repmgr (5.3) was included. To upgrade to this major version, it's necessary to upgrade the repmgr extension installed on the database. To do so, follow the steps below: + +- Reduce your PostgreSQL setup to one replica (primary node) and upgrade to `8.0.0`, enabling the repmgr extension upgrade: + +```bash +$ helm upgrade my-release --version 8.0.0 my-repo/postgresql-ha \ + --set postgresql.password=[POSTGRESQL_PASSWORD] \ + --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ + --set postgresql.replicaCount=1 \ + --set postgresql.upgradeRepmgrExtension=true +``` + +- Scale your PostgreSQL setup to the original number of replicas: + +```bash +$ helm upgrade my-release --version 8.0.0 my-repo/postgresql-ha \ + --set postgresql.password=[POSTGRESQL_PASSWORD] \ + --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ + --set postgresql.replicaCount=[NUMBER_OF_REPLICAS] +``` + +> Note: you need to substitute the placeholders _[POSTGRESQL_PASSWORD]_, and _[REPMGR_PASSWORD]_ with the values obtained from instructions in the installation notes. + +### To 6.4.0 + +Support for adding custom configuration files or initialization scripts by placing them under the "files" directory in the working directory was removed. This functionality was very confusing for users since they do not usually clone the repo nor they fetch the charts to their working directories. +As an alternative to this feature, users can still use the equivalent parameters available in the `values.yaml` to load their custom configuration & scripts. + +### To 6.0.0 + +[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. + +**What changes were introduced in this major version?** + +- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. +- Move dependency information from the *requirements.yaml* to the *Chart.yaml* +- After running `helm dependency update`, a *Chart.lock* file is generated containing the same structure used in the previous *requirements.lock* +- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts + +**Considerations when upgrading to this version** + +- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues +- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore +- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 + +**Useful links** + +- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ +- https://helm.sh/docs/topics/v2_v3_migration/ +- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ + +### To 5.2.0 + +A new version of repmgr (5.2.0) was included. To upgrade to this version, it's necessary to upgrade the repmgr extension installed on the database. To do so, follow the steps below: + +- Reduce your PostgreSQL setup to one replica (primary node) and upgrade to `5.2.0`, enabling the repmgr extension upgrade: + +```bash +$ helm upgrade my-release --version 5.2.0 my-repo/postgresql-ha \ + --set postgresql.password=[POSTGRESQL_PASSWORD] \ + --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ + --set postgresql.replicaCount=1 \ + --set postgresql.upgradeRepmgrExtension=true +``` + +- Scale your PostgreSQL setup to the original number of replicas: + +```bash +$ helm upgrade my-release --version 5.2.0 my-repo/postgresql-ha \ + --set postgresql.password=[POSTGRESQL_PASSWORD] \ + --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ + --set postgresql.replicaCount=[NUMBER_OF_REPLICAS] +``` + +> Note: you need to substitute the placeholders _[POSTGRESQL_PASSWORD]_, and _[REPMGR_PASSWORD]_ with the values obtained from instructions in the installation notes (`helm get notes RELEASE_NAME`). + +### To 5.0.0 + +This release uses parallel deployment for the postgresql statefullset. This should fix the issues related to not being able to restart the cluster under some contions where the master node is not longer node `-0`. +This version is next major version to v3.x.y + +- To upgrade to this version you will need to delete the deployment, keep the PVCs and launch a new deployment keeping the deployment name. + +```bash +$ # e.g. Previous deployment v3.9.1 +$ helm install my-release \ + --set postgresql.password=[POSTGRESQL_PASSWORD] \ + --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ + my-repo/postgresql-ha --version 3.9.1 + +$ # Update repository information +$ helm repo update + +$ # upgrade to v5.0.0 +$ helm delete my-release +$ helm install my-release \ + --set postgresql.password=[POSTGRESQL_PASSWORD] \ + --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ + my-repo/postgresql-ha --version 5.0.0 +``` + +### To 4.0.x + +Due to an error handling the version numbers these versions are actually part of the 3.x versions and not a new major version. + +### To 3.0.0 + +A new major version of repmgr (5.1.0) was included. To upgrade to this major version, it's necessary to upgrade the repmgr extension installed on the database. To do so, follow the steps below: + +- Reduce your PostgreSQL setup to one replica (primary node) and upgrade to `3.0.0`, enabling the repmgr extension upgrade: + +```bash +$ helm upgrade my-release --version 3.0.0 my-repo/postgresql-ha \ + --set postgresql.password=[POSTGRESQL_PASSWORD] \ + --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ + --set postgresql.replicaCount=1 \ + --set postgresql.upgradeRepmgrExtension=true +``` + +- Scale your PostgreSQL setup to the original number of replicas: + +```bash +$ helm upgrade my-release --version 3.0.0 my-repo/postgresql-ha \ + --set postgresql.password=[POSTGRESQL_PASSWORD] \ + --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ + --set postgresql.replicaCount=[NUMBER_OF_REPLICAS] +``` + +> Note: you need to substitute the placeholders _[POSTGRESQL_PASSWORD]_, and _[REPMGR_PASSWORD]_ with the values obtained from instructions in the installation notes. + +### To 2.0.0 + +The [Bitnami Pgpool](https://github.com/bitnami/containers/tree/main/bitnami/pgpool) image was migrated to a "non-root" user approach. Previously the container ran as the `root` user and the Pgpool daemon was started as the `pgpool` user. From now on, both the container and the Pgpool daemon run as user `1001`. You can revert this behavior by setting the parameters `pgpool.containerSecurityContext.runAsUser`, and `pgpool.securityContext.fsGroup` to `0`. + +Consequences: + +- No backwards compatibility issues are expected since all the data is at PostgreSQL pods, and Pgpool uses a deployment without persistence. Therefore, upgrades should work smoothly from `1.x.x` versions. +- Environment variables related to LDAP configuration were renamed removing the `PGPOOL_` prefix. For instance, to indicate the LDAP URI to use, you must set `LDAP_URI` instead of `PGPOOL_LDAP_URI` + +### To 1.0.0 + +A new major version of repmgr (5.0.0) was included. To upgrade to this major version, it's necessary to upgrade the repmgr extension installed on the database. To do so, follow the steps below: + +- Reduce your PostgreSQL setup to one replica (primary node) and upgrade to `1.0.0`, enabling the repmgr extension upgrade: + +```bash +$ helm upgrade my-release --version 1.0.0 my-repo/postgresql-ha \ + --set postgresql.password=[POSTGRESQL_PASSWORD] \ + --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ + --set postgresql.replicaCount=1 \ + --set postgresql.upgradeRepmgrExtension=true +``` + +- Scale your PostgreSQL setup to the original number of replicas: + +```bash +$ helm upgrade my-release --version 1.0.0 my-repo/postgresql-ha \ + --set postgresql.password=[POSTGRESQL_PASSWORD] \ + --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ + --set postgresql.replicaCount=[NUMBER_OF_REPLICAS] +``` + +> Note: you need to substitute the placeholders _[POSTGRESQL_PASSWORD]_, and _[REPMGR_PASSWORD]_ with the values obtained from instructions in the installation notes. + +### To 0.4.0 + +In this version, the chart will use PostgreSQL-Repmgr container images with the Postgis extension included. The version used in Postgresql version 10, 11 and 12 is Postgis 2.5, and in Postgresql 9.6 is Postgis 2.3. Postgis has been compiled with the following dependencies: + +- protobuf +- protobuf-c +- json-c +- geos +- proj +- gdal + +## Bitnami Kubernetes Documentation + +Bitnami Kubernetes documentation is available at [https://docs.bitnami.com/](https://docs.bitnami.com/). You can find there the following resources: + +- [Documentation for PostgreSQL HA Helm chart](https://docs.bitnami.com/kubernetes/infrastructure/postgresql-ha/) +- [Get Started with Kubernetes guides](https://docs.bitnami.com/kubernetes/) +- [Bitnami Helm charts documentation](https://docs.bitnami.com/kubernetes/apps/) +- [Kubernetes FAQs](https://docs.bitnami.com/kubernetes/faq/) +- [Kubernetes Developer guides](https://docs.bitnami.com/tutorials/) + +## License + +Copyright © 2022 Bitnami + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. \ No newline at end of file diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/.helmignore b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/.helmignore new file mode 100644 index 0000000..50af031 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/.helmignore @@ -0,0 +1,22 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/Chart.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/Chart.yaml new file mode 100644 index 0000000..6f0c3a6 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/Chart.yaml @@ -0,0 +1,23 @@ +annotations: + category: Infrastructure +apiVersion: v2 +appVersion: 2.1.2 +description: A Library Helm Chart for grouping common logic between bitnami charts. + This chart is not deployable by itself. +home: https://github.com/bitnami/charts/tree/main/bitnami/common +icon: https://bitnami.com/downloads/logos/bitnami-mark.png +keywords: +- common +- helper +- template +- function +- bitnami +maintainers: +- name: Bitnami + url: https://github.com/bitnami/charts +name: common +sources: +- https://github.com/bitnami/charts +- https://www.bitnami.com/ +type: library +version: 2.1.2 diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/README.md b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/README.md new file mode 100644 index 0000000..a2ecd60 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/README.md @@ -0,0 +1,350 @@ +# Bitnami Common Library Chart + +A [Helm Library Chart](https://helm.sh/docs/topics/library_charts/#helm) for grouping common logic between bitnami charts. + +## TL;DR + +```yaml +dependencies: + - name: common + version: 1.x.x + repository: https://charts.bitnami.com/bitnami +``` + +```bash +$ helm dependency update +``` + +```yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "common.names.fullname" . }} +data: + myvalue: "Hello World" +``` + +## Introduction + +This chart provides a common template helpers which can be used to develop new charts using [Helm](https://helm.sh) package manager. + +Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters. + +## Prerequisites + +- Kubernetes 1.19+ +- Helm 3.2.0+ + +## Parameters + +The following table lists the helpers available in the library which are scoped in different sections. + +### Affinities + +| Helper identifier | Description | Expected Input | +|-------------------------------|------------------------------------------------------|------------------------------------------------| +| `common.affinities.nodes.soft` | Return a soft nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` | +| `common.affinities.nodes.hard` | Return a hard nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` | +| `common.affinities.pods.soft` | Return a soft podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` | +| `common.affinities.pods.hard` | Return a hard podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` | + +### Capabilities + +| Helper identifier | Description | Expected Input | +|------------------------------------------------|------------------------------------------------------------------------------------------------|-------------------| +| `common.capabilities.kubeVersion` | Return the target Kubernetes version (using client default if .Values.kubeVersion is not set). | `.` Chart context | +| `common.capabilities.cronjob.apiVersion` | Return the appropriate apiVersion for cronjob. | `.` Chart context | +| `common.capabilities.deployment.apiVersion` | Return the appropriate apiVersion for deployment. | `.` Chart context | +| `common.capabilities.statefulset.apiVersion` | Return the appropriate apiVersion for statefulset. | `.` Chart context | +| `common.capabilities.ingress.apiVersion` | Return the appropriate apiVersion for ingress. | `.` Chart context | +| `common.capabilities.rbac.apiVersion` | Return the appropriate apiVersion for RBAC resources. | `.` Chart context | +| `common.capabilities.crd.apiVersion` | Return the appropriate apiVersion for CRDs. | `.` Chart context | +| `common.capabilities.policy.apiVersion` | Return the appropriate apiVersion for podsecuritypolicy. | `.` Chart context | +| `common.capabilities.networkPolicy.apiVersion` | Return the appropriate apiVersion for networkpolicy. | `.` Chart context | +| `common.capabilities.apiService.apiVersion` | Return the appropriate apiVersion for APIService. | `.` Chart context | +| `common.capabilities.hpa.apiVersion` | Return the appropriate apiVersion for Horizontal Pod Autoscaler | `.` Chart context | +| `common.capabilities.supportsHelmVersion` | Returns true if the used Helm version is 3.3+ | `.` Chart context | + +### Errors + +| Helper identifier | Description | Expected Input | +|-----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------| +| `common.errors.upgrade.passwords.empty` | It will ensure required passwords are given when we are upgrading a chart. If `validationErrors` is not empty it will throw an error and will stop the upgrade action. | `dict "validationErrors" (list $validationError00 $validationError01) "context" $` | + +### Images + +| Helper identifier | Description | Expected Input | +|-----------------------------|------------------------------------------------------|---------------------------------------------------------------------------------------------------------| +| `common.images.image` | Return the proper and full image name | `dict "imageRoot" .Values.path.to.the.image "global" $`, see [ImageRoot](#imageroot) for the structure. | +| `common.images.pullSecrets` | Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead) | `dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global` | +| `common.images.renderPullSecrets` | Return the proper Docker Image Registry Secret Names (evaluates values as templates) | `dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $` | + +### Ingress + +| Helper identifier | Description | Expected Input | +|-------------------------------------------|-------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.ingress.backend` | Generate a proper Ingress backend entry depending on the API version | `dict "serviceName" "foo" "servicePort" "bar"`, see the [Ingress deprecation notice](https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/) for the syntax differences | +| `common.ingress.supportsPathType` | Prints "true" if the pathType field is supported | `.` Chart context | +| `common.ingress.supportsIngressClassname` | Prints "true" if the ingressClassname field is supported | `.` Chart context | +| `common.ingress.certManagerRequest` | Prints "true" if required cert-manager annotations for TLS signed certificates are set in the Ingress annotations | `dict "annotations" .Values.path.to.the.ingress.annotations` | + +### Labels + +| Helper identifier | Description | Expected Input | +|-----------------------------|-----------------------------------------------------------------------------|-------------------| +| `common.labels.standard` | Return Kubernetes standard labels | `.` Chart context | +| `common.labels.matchLabels` | Labels to use on `deploy.spec.selector.matchLabels` and `svc.spec.selector` | `.` Chart context | + +### Names + +| Helper identifier | Description | Expected Input | +|-----------------------------------|-----------------------------------------------------------------------|-------------------| +| `common.names.name` | Expand the name of the chart or use `.Values.nameOverride` | `.` Chart context | +| `common.names.fullname` | Create a default fully qualified app name. | `.` Chart context | +| `common.names.namespace` | Allow the release namespace to be overridden | `.` Chart context | +| `common.names.fullname.namespace` | Create a fully qualified app name adding the installation's namespace | `.` Chart context | +| `common.names.chart` | Chart name plus version | `.` Chart context | + +### Secrets + +| Helper identifier | Description | Expected Input | +|---------------------------|--------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.secrets.name` | Generate the name of the secret. | `dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $` see [ExistingSecret](#existingsecret) for the structure. | +| `common.secrets.key` | Generate secret key. | `dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName"` see [ExistingSecret](#existingsecret) for the structure. | +| `common.passwords.manage` | Generate secret password or retrieve one if already created. | `dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $`, length, strong and chartNAme fields are optional. | +| `common.secrets.exists` | Returns whether a previous generated secret already exists. | `dict "secret" "secret-name" "context" $` | + +### Storage + +| Helper identifier | Description | Expected Input | +|-------------------------------|---------------------------------------|---------------------------------------------------------------------------------------------------------------------| +| `common.storage.class` | Return the proper Storage Class | `dict "persistence" .Values.path.to.the.persistence "global" $`, see [Persistence](#persistence) for the structure. | + +### TplValues + +| Helper identifier | Description | Expected Input | +|---------------------------|----------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.tplvalues.render` | Renders a value that contains template | `dict "value" .Values.path.to.the.Value "context" $`, value is the value should rendered as template, context frequently is the chart context `$` or `.` | + +### Utils + +| Helper identifier | Description | Expected Input | +|--------------------------------|------------------------------------------------------------------------------------------|------------------------------------------------------------------------| +| `common.utils.fieldToEnvVar` | Build environment variable name given a field. | `dict "field" "my-password"` | +| `common.utils.secret.getvalue` | Print instructions to get a secret value. | `dict "secret" "secret-name" "field" "secret-value-field" "context" $` | +| `common.utils.getValueFromKey` | Gets a value from `.Values` object given its key path | `dict "key" "path.to.key" "context" $` | +| `common.utils.getKeyFromList` | Returns first `.Values` key with a defined value or first of the list if all non-defined | `dict "keys" (list "path.to.key1" "path.to.key2") "context" $` | + +### Validations + +| Helper identifier | Description | Expected Input | +|--------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.validations.values.single.empty` | Validate a value must not be empty. | `dict "valueKey" "path.to.value" "secret" "secret.name" "field" "my-password" "subchart" "subchart" "context" $` secret, field and subchart are optional. In case they are given, the helper will generate a how to get instruction. See [ValidateValue](#validatevalue) | +| `common.validations.values.multiple.empty` | Validate a multiple values must not be empty. It returns a shared error for all the values. | `dict "required" (list $validateValueConf00 $validateValueConf01) "context" $`. See [ValidateValue](#validatevalue) | +| `common.validations.values.mariadb.passwords` | This helper will ensure required password for MariaDB are not empty. It returns a shared error for all the values. | `dict "secret" "mariadb-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mariadb chart and the helper. | +| `common.validations.values.mysql.passwords` | This helper will ensure required password for MySQL are not empty. It returns a shared error for all the values. | `dict "secret" "mysql-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mysql chart and the helper. | +| `common.validations.values.postgresql.passwords` | This helper will ensure required password for PostgreSQL are not empty. It returns a shared error for all the values. | `dict "secret" "postgresql-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use postgresql chart and the helper. | +| `common.validations.values.redis.passwords` | This helper will ensure required password for Redis® are not empty. It returns a shared error for all the values. | `dict "secret" "redis-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use redis chart and the helper. | +| `common.validations.values.cassandra.passwords` | This helper will ensure required password for Cassandra are not empty. It returns a shared error for all the values. | `dict "secret" "cassandra-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use cassandra chart and the helper. | +| `common.validations.values.mongodb.passwords` | This helper will ensure required password for MongoDB® are not empty. It returns a shared error for all the values. | `dict "secret" "mongodb-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mongodb chart and the helper. | + +### Warnings + +| Helper identifier | Description | Expected Input | +|------------------------------|----------------------------------|------------------------------------------------------------| +| `common.warnings.rollingTag` | Warning about using rolling tag. | `ImageRoot` see [ImageRoot](#imageroot) for the structure. | + +## Special input schemas + +### ImageRoot + +```yaml +registry: + type: string + description: Docker registry where the image is located + example: docker.io + +repository: + type: string + description: Repository and image name + example: bitnami/nginx + +tag: + type: string + description: image tag + example: 1.16.1-debian-10-r63 + +pullPolicy: + type: string + description: Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + +pullSecrets: + type: array + items: + type: string + description: Optionally specify an array of imagePullSecrets (evaluated as templates). + +debug: + type: boolean + description: Set to true if you would like to see extra information on logs + example: false + +## An instance would be: +# registry: docker.io +# repository: bitnami/nginx +# tag: 1.16.1-debian-10-r63 +# pullPolicy: IfNotPresent +# debug: false +``` + +### Persistence + +```yaml +enabled: + type: boolean + description: Whether enable persistence. + example: true + +storageClass: + type: string + description: Ghost data Persistent Volume Storage Class, If set to "-", storageClassName: "" which disables dynamic provisioning. + example: "-" + +accessMode: + type: string + description: Access mode for the Persistent Volume Storage. + example: ReadWriteOnce + +size: + type: string + description: Size the Persistent Volume Storage. + example: 8Gi + +path: + type: string + description: Path to be persisted. + example: /bitnami + +## An instance would be: +# enabled: true +# storageClass: "-" +# accessMode: ReadWriteOnce +# size: 8Gi +# path: /bitnami +``` + +### ExistingSecret + +```yaml +name: + type: string + description: Name of the existing secret. + example: mySecret +keyMapping: + description: Mapping between the expected key name and the name of the key in the existing secret. + type: object + +## An instance would be: +# name: mySecret +# keyMapping: +# password: myPasswordKey +``` + +#### Example of use + +When we store sensitive data for a deployment in a secret, some times we want to give to users the possibility of using theirs existing secrets. + +```yaml +# templates/secret.yaml +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.names.fullname" . }} + labels: + app: {{ include "common.names.fullname" . }} +type: Opaque +data: + password: {{ .Values.password | b64enc | quote }} + +# templates/dpl.yaml +--- +... + env: + - name: PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "common.secrets.name" (dict "existingSecret" .Values.existingSecret "context" $) }} + key: {{ include "common.secrets.key" (dict "existingSecret" .Values.existingSecret "key" "password") }} +... + +# values.yaml +--- +name: mySecret +keyMapping: + password: myPasswordKey +``` + +### ValidateValue + +#### NOTES.txt + +```console +{{- $validateValueConf00 := (dict "valueKey" "path.to.value00" "secret" "secretName" "field" "password-00") -}} +{{- $validateValueConf01 := (dict "valueKey" "path.to.value01" "secret" "secretName" "field" "password-01") -}} + +{{ include "common.validations.values.multiple.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} +``` + +If we force those values to be empty we will see some alerts + +```console +$ helm install test mychart --set path.to.value00="",path.to.value01="" + 'path.to.value00' must not be empty, please add '--set path.to.value00=$PASSWORD_00' to the command. To get the current value: + + export PASSWORD_00=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-00}" | base64 -d) + + 'path.to.value01' must not be empty, please add '--set path.to.value01=$PASSWORD_01' to the command. To get the current value: + + export PASSWORD_01=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-01}" | base64 -d) +``` + +## Upgrading + +### To 1.0.0 + +[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. + +**What changes were introduced in this major version?** + +- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. +- Use `type: library`. [Here](https://v3.helm.sh/docs/faq/#library-chart-support) you can find more information. +- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts + +**Considerations when upgrading to this version** + +- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues +- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore +- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 + +**Useful links** + +- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ +- https://helm.sh/docs/topics/v2_v3_migration/ +- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ + +## License + +Copyright © 2022 Bitnami + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_affinities.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_affinities.tpl new file mode 100644 index 0000000..497068f --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_affinities.tpl @@ -0,0 +1,98 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Return a soft nodeAffinity definition +{{ include "common.affinities.nodes.soft" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes.soft" -}} +preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: {{ .key }} + operator: In + values: + {{- range .values }} + - {{ . | quote }} + {{- end }} + weight: 1 +{{- end -}} + +{{/* +Return a hard nodeAffinity definition +{{ include "common.affinities.nodes.hard" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes.hard" -}} +requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: {{ .key }} + operator: In + values: + {{- range .values }} + - {{ . | quote }} + {{- end }} +{{- end -}} + +{{/* +Return a nodeAffinity definition +{{ include "common.affinities.nodes" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes" -}} + {{- if eq .type "soft" }} + {{- include "common.affinities.nodes.soft" . -}} + {{- else if eq .type "hard" }} + {{- include "common.affinities.nodes.hard" . -}} + {{- end -}} +{{- end -}} + +{{/* +Return a soft podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods.soft" (dict "component" "FOO" "extraMatchLabels" .Values.extraMatchLabels "context" $) -}} +*/}} +{{- define "common.affinities.pods.soft" -}} +{{- $component := default "" .component -}} +{{- $extraMatchLabels := default (dict) .extraMatchLabels -}} +preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: {{- (include "common.labels.matchLabels" .context) | nindent 10 }} + {{- if not (empty $component) }} + {{ printf "app.kubernetes.io/component: %s" $component }} + {{- end }} + {{- range $key, $value := $extraMatchLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + topologyKey: kubernetes.io/hostname + weight: 1 +{{- end -}} + +{{/* +Return a hard podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods.hard" (dict "component" "FOO" "extraMatchLabels" .Values.extraMatchLabels "context" $) -}} +*/}} +{{- define "common.affinities.pods.hard" -}} +{{- $component := default "" .component -}} +{{- $extraMatchLabels := default (dict) .extraMatchLabels -}} +requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: {{- (include "common.labels.matchLabels" .context) | nindent 8 }} + {{- if not (empty $component) }} + {{ printf "app.kubernetes.io/component: %s" $component }} + {{- end }} + {{- range $key, $value := $extraMatchLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + topologyKey: kubernetes.io/hostname +{{- end -}} + +{{/* +Return a podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.pods" -}} + {{- if eq .type "soft" }} + {{- include "common.affinities.pods.soft" . -}} + {{- else if eq .type "hard" }} + {{- include "common.affinities.pods.hard" . -}} + {{- end -}} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_capabilities.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_capabilities.tpl new file mode 100644 index 0000000..9d9b760 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_capabilities.tpl @@ -0,0 +1,154 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Return the target Kubernetes version +*/}} +{{- define "common.capabilities.kubeVersion" -}} +{{- if .Values.global }} + {{- if .Values.global.kubeVersion }} + {{- .Values.global.kubeVersion -}} + {{- else }} + {{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}} + {{- end -}} +{{- else }} +{{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for poddisruptionbudget. +*/}} +{{- define "common.capabilities.policy.apiVersion" -}} +{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "policy/v1beta1" -}} +{{- else -}} +{{- print "policy/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for networkpolicy. +*/}} +{{- define "common.capabilities.networkPolicy.apiVersion" -}} +{{- if semverCompare "<1.7-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for cronjob. +*/}} +{{- define "common.capabilities.cronjob.apiVersion" -}} +{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "batch/v1beta1" -}} +{{- else -}} +{{- print "batch/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for deployment. +*/}} +{{- define "common.capabilities.deployment.apiVersion" -}} +{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for statefulset. +*/}} +{{- define "common.capabilities.statefulset.apiVersion" -}} +{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "apps/v1beta1" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for ingress. +*/}} +{{- define "common.capabilities.ingress.apiVersion" -}} +{{- if .Values.ingress -}} +{{- if .Values.ingress.apiVersion -}} +{{- .Values.ingress.apiVersion -}} +{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "networking.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end }} +{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "networking.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for RBAC resources. +*/}} +{{- define "common.capabilities.rbac.apiVersion" -}} +{{- if semverCompare "<1.17-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "rbac.authorization.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "rbac.authorization.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for CRDs. +*/}} +{{- define "common.capabilities.crd.apiVersion" -}} +{{- if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "apiextensions.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "apiextensions.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for APIService. +*/}} +{{- define "common.capabilities.apiService.apiVersion" -}} +{{- if semverCompare "<1.10-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "apiregistration.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "apiregistration.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for Horizontal Pod Autoscaler. +*/}} +{{- define "common.capabilities.hpa.apiVersion" -}} +{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .context) -}} +{{- if .beta2 -}} +{{- print "autoscaling/v2beta2" -}} +{{- else -}} +{{- print "autoscaling/v2beta1" -}} +{{- end -}} +{{- else -}} +{{- print "autoscaling/v2" -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if the used Helm version is 3.3+. +A way to check the used Helm version was not introduced until version 3.3.0 with .Capabilities.HelmVersion, which contains an additional "{}}" structure. +This check is introduced as a regexMatch instead of {{ if .Capabilities.HelmVersion }} because checking for the key HelmVersion in <3.3 results in a "interface not found" error. +**To be removed when the catalog's minimun Helm version is 3.3** +*/}} +{{- define "common.capabilities.supportsHelmVersion" -}} +{{- if regexMatch "{(v[0-9])*[^}]*}}$" (.Capabilities | toString ) }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_errors.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_errors.tpl new file mode 100644 index 0000000..a79cc2e --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_errors.tpl @@ -0,0 +1,23 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Through error when upgrading using empty passwords values that must not be empty. + +Usage: +{{- $validationError00 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password00" "secret" "secretName" "field" "password-00") -}} +{{- $validationError01 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password01" "secret" "secretName" "field" "password-01") -}} +{{ include "common.errors.upgrade.passwords.empty" (dict "validationErrors" (list $validationError00 $validationError01) "context" $) }} + +Required password params: + - validationErrors - String - Required. List of validation strings to be return, if it is empty it won't throw error. + - context - Context - Required. Parent context. +*/}} +{{- define "common.errors.upgrade.passwords.empty" -}} + {{- $validationErrors := join "" .validationErrors -}} + {{- if and $validationErrors .context.Release.IsUpgrade -}} + {{- $errorString := "\nPASSWORDS ERROR: You must provide your current passwords when upgrading the release." -}} + {{- $errorString = print $errorString "\n Note that even after reinstallation, old credentials may be needed as they may be kept in persistent volume claims." -}} + {{- $errorString = print $errorString "\n Further information can be obtained at https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues/#credential-errors-while-upgrading-chart-releases" -}} + {{- $errorString = print $errorString "\n%s" -}} + {{- printf $errorString $validationErrors | fail -}} + {{- end -}} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_images.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_images.tpl new file mode 100644 index 0000000..46c659e --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_images.tpl @@ -0,0 +1,76 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Return the proper image name +{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" $) }} +*/}} +{{- define "common.images.image" -}} +{{- $registryName := .imageRoot.registry -}} +{{- $repositoryName := .imageRoot.repository -}} +{{- $separator := ":" -}} +{{- $termination := .imageRoot.tag | toString -}} +{{- if .global }} + {{- if .global.imageRegistry }} + {{- $registryName = .global.imageRegistry -}} + {{- end -}} +{{- end -}} +{{- if .imageRoot.digest }} + {{- $separator = "@" -}} + {{- $termination = .imageRoot.digest | toString -}} +{{- end -}} +{{- printf "%s/%s%s%s" $registryName $repositoryName $separator $termination -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead) +{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }} +*/}} +{{- define "common.images.pullSecrets" -}} + {{- $pullSecrets := list }} + + {{- if .global }} + {{- range .global.imagePullSecrets -}} + {{- $pullSecrets = append $pullSecrets . -}} + {{- end -}} + {{- end -}} + + {{- range .images -}} + {{- range .pullSecrets -}} + {{- $pullSecrets = append $pullSecrets . -}} + {{- end -}} + {{- end -}} + + {{- if (not (empty $pullSecrets)) }} +imagePullSecrets: + {{- range $pullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names evaluating values as templates +{{ include "common.images.renderPullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $) }} +*/}} +{{- define "common.images.renderPullSecrets" -}} + {{- $pullSecrets := list }} + {{- $context := .context }} + + {{- if $context.Values.global }} + {{- range $context.Values.global.imagePullSecrets -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}} + {{- end -}} + {{- end -}} + + {{- range .images -}} + {{- range .pullSecrets -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}} + {{- end -}} + {{- end -}} + + {{- if (not (empty $pullSecrets)) }} +imagePullSecrets: + {{- range $pullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_ingress.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_ingress.tpl new file mode 100644 index 0000000..831da9c --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_ingress.tpl @@ -0,0 +1,68 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Generate backend entry that is compatible with all Kubernetes API versions. + +Usage: +{{ include "common.ingress.backend" (dict "serviceName" "backendName" "servicePort" "backendPort" "context" $) }} + +Params: + - serviceName - String. Name of an existing service backend + - servicePort - String/Int. Port name (or number) of the service. It will be translated to different yaml depending if it is a string or an integer. + - context - Dict - Required. The context for the template evaluation. +*/}} +{{- define "common.ingress.backend" -}} +{{- $apiVersion := (include "common.capabilities.ingress.apiVersion" .context) -}} +{{- if or (eq $apiVersion "extensions/v1beta1") (eq $apiVersion "networking.k8s.io/v1beta1") -}} +serviceName: {{ .serviceName }} +servicePort: {{ .servicePort }} +{{- else -}} +service: + name: {{ .serviceName }} + port: + {{- if typeIs "string" .servicePort }} + name: {{ .servicePort }} + {{- else if or (typeIs "int" .servicePort) (typeIs "float64" .servicePort) }} + number: {{ .servicePort | int }} + {{- end }} +{{- end -}} +{{- end -}} + +{{/* +Print "true" if the API pathType field is supported +Usage: +{{ include "common.ingress.supportsPathType" . }} +*/}} +{{- define "common.ingress.supportsPathType" -}} +{{- if (semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .)) -}} +{{- print "false" -}} +{{- else -}} +{{- print "true" -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if the ingressClassname field is supported +Usage: +{{ include "common.ingress.supportsIngressClassname" . }} +*/}} +{{- define "common.ingress.supportsIngressClassname" -}} +{{- if semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "false" -}} +{{- else -}} +{{- print "true" -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if cert-manager required annotations for TLS signed +certificates are set in the Ingress annotations +Ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations +Usage: +{{ include "common.ingress.certManagerRequest" ( dict "annotations" .Values.path.to.the.ingress.annotations ) }} +*/}} +{{- define "common.ingress.certManagerRequest" -}} +{{ if or (hasKey .annotations "cert-manager.io/cluster-issuer") (hasKey .annotations "cert-manager.io/issuer") (hasKey .annotations "kubernetes.io/tls-acme") }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_labels.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_labels.tpl new file mode 100644 index 0000000..252066c --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_labels.tpl @@ -0,0 +1,18 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Kubernetes standard labels +*/}} +{{- define "common.labels.standard" -}} +app.kubernetes.io/name: {{ include "common.names.name" . }} +helm.sh/chart: {{ include "common.names.chart" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end -}} + +{{/* +Labels to use on deploy.spec.selector.matchLabels and svc.spec.selector +*/}} +{{- define "common.labels.matchLabels" -}} +app.kubernetes.io/name: {{ include "common.names.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_names.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_names.tpl new file mode 100644 index 0000000..1bdac8b --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_names.tpl @@ -0,0 +1,70 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "common.names.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "common.names.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "common.names.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create a default fully qualified dependency name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +Usage: +{{ include "common.names.dependency.fullname" (dict "chartName" "dependency-chart-name" "chartValues" .Values.dependency-chart "context" $) }} +*/}} +{{- define "common.names.dependency.fullname" -}} +{{- if .chartValues.fullnameOverride -}} +{{- .chartValues.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .chartName .chartValues.nameOverride -}} +{{- if contains $name .context.Release.Name -}} +{{- .context.Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .context.Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Allow the release namespace to be overridden for multi-namespace deployments in combined charts. +*/}} +{{- define "common.names.namespace" -}} +{{- if .Values.namespaceOverride -}} +{{- .Values.namespaceOverride -}} +{{- else -}} +{{- .Release.Namespace -}} +{{- end -}} +{{- end -}} + +{{/* +Create a fully qualified app name adding the installation's namespace. +*/}} +{{- define "common.names.fullname.namespace" -}} +{{- printf "%s-%s" (include "common.names.fullname" .) (include "common.names.namespace" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_secrets.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_secrets.tpl new file mode 100644 index 0000000..4267d42 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_secrets.tpl @@ -0,0 +1,165 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Generate secret name. + +Usage: +{{ include "common.secrets.name" (dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $) }} + +Params: + - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user + to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility. + +info: https://github.com/bitnami/charts/tree/main/bitnami/common#existingsecret + - defaultNameSuffix - String - Optional. It is used only if we have several secrets in the same deployment. + - context - Dict - Required. The context for the template evaluation. +*/}} +{{- define "common.secrets.name" -}} +{{- $name := (include "common.names.fullname" .context) -}} + +{{- if .defaultNameSuffix -}} +{{- $name = printf "%s-%s" $name .defaultNameSuffix | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- with .existingSecret -}} +{{- if not (typeIs "string" .) -}} +{{- with .name -}} +{{- $name = . -}} +{{- end -}} +{{- else -}} +{{- $name = . -}} +{{- end -}} +{{- end -}} + +{{- printf "%s" $name -}} +{{- end -}} + +{{/* +Generate secret key. + +Usage: +{{ include "common.secrets.key" (dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName") }} + +Params: + - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user + to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility. + +info: https://github.com/bitnami/charts/tree/main/bitnami/common#existingsecret + - key - String - Required. Name of the key in the secret. +*/}} +{{- define "common.secrets.key" -}} +{{- $key := .key -}} + +{{- if .existingSecret -}} + {{- if not (typeIs "string" .existingSecret) -}} + {{- if .existingSecret.keyMapping -}} + {{- $key = index .existingSecret.keyMapping $.key -}} + {{- end -}} + {{- end }} +{{- end -}} + +{{- printf "%s" $key -}} +{{- end -}} + +{{/* +Generate secret password or retrieve one if already created. + +Usage: +{{ include "common.secrets.passwords.manage" (dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $) }} + +Params: + - secret - String - Required - Name of the 'Secret' resource where the password is stored. + - key - String - Required - Name of the key in the secret. + - providedValues - List - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value. + - length - int - Optional - Length of the generated random password. + - strong - Boolean - Optional - Whether to add symbols to the generated random password. + - chartName - String - Optional - Name of the chart used when said chart is deployed as a subchart. + - context - Context - Required - Parent context. + +The order in which this function returns a secret password: + 1. Already existing 'Secret' resource + (If a 'Secret' resource is found under the name provided to the 'secret' parameter to this function and that 'Secret' resource contains a key with the name passed as the 'key' parameter to this function then the value of this existing secret password will be returned) + 2. Password provided via the values.yaml + (If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned) + 3. Randomly generated secret password + (A new random secret password with the length specified in the 'length' parameter will be generated and returned) + +*/}} +{{- define "common.secrets.passwords.manage" -}} + +{{- $password := "" }} +{{- $subchart := "" }} +{{- $chartName := default "" .chartName }} +{{- $passwordLength := default 10 .length }} +{{- $providedPasswordKey := include "common.utils.getKeyFromList" (dict "keys" .providedValues "context" $.context) }} +{{- $providedPasswordValue := include "common.utils.getValueFromKey" (dict "key" $providedPasswordKey "context" $.context) }} +{{- $secretData := (lookup "v1" "Secret" $.context.Release.Namespace .secret).data }} +{{- if $secretData }} + {{- if hasKey $secretData .key }} + {{- $password = index $secretData .key | quote }} + {{- else }} + {{- printf "\nPASSWORDS ERROR: The secret \"%s\" does not contain the key \"%s\"\n" .secret .key | fail -}} + {{- end -}} +{{- else if $providedPasswordValue }} + {{- $password = $providedPasswordValue | toString | b64enc | quote }} +{{- else }} + + {{- if .context.Values.enabled }} + {{- $subchart = $chartName }} + {{- end -}} + + {{- $requiredPassword := dict "valueKey" $providedPasswordKey "secret" .secret "field" .key "subchart" $subchart "context" $.context -}} + {{- $requiredPasswordError := include "common.validations.values.single.empty" $requiredPassword -}} + {{- $passwordValidationErrors := list $requiredPasswordError -}} + {{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $.context) -}} + + {{- if .strong }} + {{- $subStr := list (lower (randAlpha 1)) (randNumeric 1) (upper (randAlpha 1)) | join "_" }} + {{- $password = randAscii $passwordLength }} + {{- $password = regexReplaceAllLiteral "\\W" $password "@" | substr 5 $passwordLength }} + {{- $password = printf "%s%s" $subStr $password | toString | shuffle | b64enc | quote }} + {{- else }} + {{- $password = randAlphaNum $passwordLength | b64enc | quote }} + {{- end }} +{{- end -}} +{{- printf "%s" $password -}} +{{- end -}} + +{{/* +Reuses the value from an existing secret, otherwise sets its value to a default value. + +Usage: +{{ include "common.secrets.lookup" (dict "secret" "secret-name" "key" "keyName" "defaultValue" .Values.myValue "context" $) }} + +Params: + - secret - String - Required - Name of the 'Secret' resource where the password is stored. + - key - String - Required - Name of the key in the secret. + - defaultValue - String - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value. + - context - Context - Required - Parent context. + +*/}} +{{- define "common.secrets.lookup" -}} +{{- $value := "" -}} +{{- $defaultValue := required "\n'common.secrets.lookup': Argument 'defaultValue' missing or empty" .defaultValue -}} +{{- $secretData := (lookup "v1" "Secret" $.context.Release.Namespace .secret).data -}} +{{- if and $secretData (hasKey $secretData .key) -}} + {{- $value = index $secretData .key -}} +{{- else -}} + {{- $value = $defaultValue | toString | b64enc -}} +{{- end -}} +{{- printf "%s" $value -}} +{{- end -}} + +{{/* +Returns whether a previous generated secret already exists + +Usage: +{{ include "common.secrets.exists" (dict "secret" "secret-name" "context" $) }} + +Params: + - secret - String - Required - Name of the 'Secret' resource where the password is stored. + - context - Context - Required - Parent context. +*/}} +{{- define "common.secrets.exists" -}} +{{- $secret := (lookup "v1" "Secret" $.context.Release.Namespace .secret) }} +{{- if $secret }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_storage.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_storage.tpl new file mode 100644 index 0000000..60e2a84 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_storage.tpl @@ -0,0 +1,23 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Return the proper Storage Class +{{ include "common.storage.class" ( dict "persistence" .Values.path.to.the.persistence "global" $) }} +*/}} +{{- define "common.storage.class" -}} + +{{- $storageClass := .persistence.storageClass -}} +{{- if .global -}} + {{- if .global.storageClass -}} + {{- $storageClass = .global.storageClass -}} + {{- end -}} +{{- end -}} + +{{- if $storageClass -}} + {{- if (eq "-" $storageClass) -}} + {{- printf "storageClassName: \"\"" -}} + {{- else }} + {{- printf "storageClassName: %s" $storageClass -}} + {{- end -}} +{{- end -}} + +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_tplvalues.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_tplvalues.tpl new file mode 100644 index 0000000..2db1668 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_tplvalues.tpl @@ -0,0 +1,13 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Renders a value that contains template. +Usage: +{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $) }} +*/}} +{{- define "common.tplvalues.render" -}} + {{- if typeIs "string" .value }} + {{- tpl .value .context }} + {{- else }} + {{- tpl (.value | toYaml) .context }} + {{- end }} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_utils.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_utils.tpl new file mode 100644 index 0000000..8c22b2a --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_utils.tpl @@ -0,0 +1,62 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Print instructions to get a secret value. +Usage: +{{ include "common.utils.secret.getvalue" (dict "secret" "secret-name" "field" "secret-value-field" "context" $) }} +*/}} +{{- define "common.utils.secret.getvalue" -}} +{{- $varname := include "common.utils.fieldToEnvVar" . -}} +export {{ $varname }}=$(kubectl get secret --namespace {{ .context.Release.Namespace | quote }} {{ .secret }} -o jsonpath="{.data.{{ .field }}}" | base64 -d) +{{- end -}} + +{{/* +Build env var name given a field +Usage: +{{ include "common.utils.fieldToEnvVar" dict "field" "my-password" }} +*/}} +{{- define "common.utils.fieldToEnvVar" -}} + {{- $fieldNameSplit := splitList "-" .field -}} + {{- $upperCaseFieldNameSplit := list -}} + + {{- range $fieldNameSplit -}} + {{- $upperCaseFieldNameSplit = append $upperCaseFieldNameSplit ( upper . ) -}} + {{- end -}} + + {{ join "_" $upperCaseFieldNameSplit }} +{{- end -}} + +{{/* +Gets a value from .Values given +Usage: +{{ include "common.utils.getValueFromKey" (dict "key" "path.to.key" "context" $) }} +*/}} +{{- define "common.utils.getValueFromKey" -}} +{{- $splitKey := splitList "." .key -}} +{{- $value := "" -}} +{{- $latestObj := $.context.Values -}} +{{- range $splitKey -}} + {{- if not $latestObj -}} + {{- printf "please review the entire path of '%s' exists in values" $.key | fail -}} + {{- end -}} + {{- $value = ( index $latestObj . ) -}} + {{- $latestObj = $value -}} +{{- end -}} +{{- printf "%v" (default "" $value) -}} +{{- end -}} + +{{/* +Returns first .Values key with a defined value or first of the list if all non-defined +Usage: +{{ include "common.utils.getKeyFromList" (dict "keys" (list "path.to.key1" "path.to.key2") "context" $) }} +*/}} +{{- define "common.utils.getKeyFromList" -}} +{{- $key := first .keys -}} +{{- $reverseKeys := reverse .keys }} +{{- range $reverseKeys }} + {{- $value := include "common.utils.getValueFromKey" (dict "key" . "context" $.context ) }} + {{- if $value -}} + {{- $key = . }} + {{- end -}} +{{- end -}} +{{- printf "%s" $key -}} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_warnings.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_warnings.tpl new file mode 100644 index 0000000..ae10fa4 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/_warnings.tpl @@ -0,0 +1,14 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Warning about using rolling tag. +Usage: +{{ include "common.warnings.rollingTag" .Values.path.to.the.imageRoot }} +*/}} +{{- define "common.warnings.rollingTag" -}} + +{{- if and (contains "bitnami/" .repository) (not (.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} + +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_cassandra.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_cassandra.tpl new file mode 100644 index 0000000..ded1ae3 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_cassandra.tpl @@ -0,0 +1,72 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate Cassandra required passwords are not empty. + +Usage: +{{ include "common.validations.values.cassandra.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where Cassandra values are stored, e.g: "cassandra-passwords-secret" + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.cassandra.passwords" -}} + {{- $existingSecret := include "common.cassandra.values.existingSecret" . -}} + {{- $enabled := include "common.cassandra.values.enabled" . -}} + {{- $dbUserPrefix := include "common.cassandra.values.key.dbUser" . -}} + {{- $valueKeyPassword := printf "%s.password" $dbUserPrefix -}} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "cassandra-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.cassandra.values.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.cassandra.values.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.cassandra.dbUser.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.dbUser.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled cassandra. + +Usage: +{{ include "common.cassandra.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.cassandra.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.cassandra.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key dbUser + +Usage: +{{ include "common.cassandra.values.key.dbUser" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.cassandra.values.key.dbUser" -}} + {{- if .subchart -}} + cassandra.dbUser + {{- else -}} + dbUser + {{- end -}} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_mariadb.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_mariadb.tpl new file mode 100644 index 0000000..b6906ff --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_mariadb.tpl @@ -0,0 +1,103 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate MariaDB required passwords are not empty. + +Usage: +{{ include "common.validations.values.mariadb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where MariaDB values are stored, e.g: "mysql-passwords-secret" + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.mariadb.passwords" -}} + {{- $existingSecret := include "common.mariadb.values.auth.existingSecret" . -}} + {{- $enabled := include "common.mariadb.values.enabled" . -}} + {{- $architecture := include "common.mariadb.values.architecture" . -}} + {{- $authPrefix := include "common.mariadb.values.key.auth" . -}} + {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} + {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} + {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} + {{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mariadb-root-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} + + {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} + {{- if not (empty $valueUsername) -}} + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mariadb-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + {{- end -}} + + {{- if (eq $architecture "replication") -}} + {{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mariadb-replication-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.mariadb.values.auth.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.auth.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.mariadb.auth.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.auth.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled mariadb. + +Usage: +{{ include "common.mariadb.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.mariadb.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.mariadb.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for architecture + +Usage: +{{ include "common.mariadb.values.architecture" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.architecture" -}} + {{- if .subchart -}} + {{- .context.Values.mariadb.architecture -}} + {{- else -}} + {{- .context.Values.architecture -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key auth + +Usage: +{{ include "common.mariadb.values.key.auth" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.key.auth" -}} + {{- if .subchart -}} + mariadb.auth + {{- else -}} + auth + {{- end -}} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_mongodb.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_mongodb.tpl new file mode 100644 index 0000000..f820ec1 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_mongodb.tpl @@ -0,0 +1,108 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate MongoDB® required passwords are not empty. + +Usage: +{{ include "common.validations.values.mongodb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where MongoDB® values are stored, e.g: "mongodb-passwords-secret" + - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.mongodb.passwords" -}} + {{- $existingSecret := include "common.mongodb.values.auth.existingSecret" . -}} + {{- $enabled := include "common.mongodb.values.enabled" . -}} + {{- $authPrefix := include "common.mongodb.values.key.auth" . -}} + {{- $architecture := include "common.mongodb.values.architecture" . -}} + {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} + {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} + {{- $valueKeyDatabase := printf "%s.database" $authPrefix -}} + {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} + {{- $valueKeyReplicaSetKey := printf "%s.replicaSetKey" $authPrefix -}} + {{- $valueKeyAuthEnabled := printf "%s.enabled" $authPrefix -}} + + {{- $authEnabled := include "common.utils.getValueFromKey" (dict "key" $valueKeyAuthEnabled "context" .context) -}} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") (eq $authEnabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mongodb-root-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} + + {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} + {{- $valueDatabase := include "common.utils.getValueFromKey" (dict "key" $valueKeyDatabase "context" .context) }} + {{- if and $valueUsername $valueDatabase -}} + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mongodb-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + {{- end -}} + + {{- if (eq $architecture "replicaset") -}} + {{- $requiredReplicaSetKey := dict "valueKey" $valueKeyReplicaSetKey "secret" .secret "field" "mongodb-replica-set-key" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredReplicaSetKey -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.mongodb.values.auth.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MongoDb is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.auth.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.mongodb.auth.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.auth.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled mongodb. + +Usage: +{{ include "common.mongodb.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.mongodb.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.mongodb.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key auth + +Usage: +{{ include "common.mongodb.values.key.auth" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.key.auth" -}} + {{- if .subchart -}} + mongodb.auth + {{- else -}} + auth + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for architecture + +Usage: +{{ include "common.mongodb.values.architecture" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.architecture" -}} + {{- if .subchart -}} + {{- .context.Values.mongodb.architecture -}} + {{- else -}} + {{- .context.Values.architecture -}} + {{- end -}} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_mysql.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_mysql.tpl new file mode 100644 index 0000000..74472a0 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_mysql.tpl @@ -0,0 +1,103 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate MySQL required passwords are not empty. + +Usage: +{{ include "common.validations.values.mysql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where MySQL values are stored, e.g: "mysql-passwords-secret" + - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.mysql.passwords" -}} + {{- $existingSecret := include "common.mysql.values.auth.existingSecret" . -}} + {{- $enabled := include "common.mysql.values.enabled" . -}} + {{- $architecture := include "common.mysql.values.architecture" . -}} + {{- $authPrefix := include "common.mysql.values.key.auth" . -}} + {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} + {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} + {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} + {{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mysql-root-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} + + {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} + {{- if not (empty $valueUsername) -}} + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mysql-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + {{- end -}} + + {{- if (eq $architecture "replication") -}} + {{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mysql-replication-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.mysql.values.auth.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false +*/}} +{{- define "common.mysql.values.auth.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.mysql.auth.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.auth.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled mysql. + +Usage: +{{ include "common.mysql.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.mysql.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.mysql.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for architecture + +Usage: +{{ include "common.mysql.values.architecture" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false +*/}} +{{- define "common.mysql.values.architecture" -}} + {{- if .subchart -}} + {{- .context.Values.mysql.architecture -}} + {{- else -}} + {{- .context.Values.architecture -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key auth + +Usage: +{{ include "common.mysql.values.key.auth" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false +*/}} +{{- define "common.mysql.values.key.auth" -}} + {{- if .subchart -}} + mysql.auth + {{- else -}} + auth + {{- end -}} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_postgresql.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_postgresql.tpl new file mode 100644 index 0000000..164ec0d --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_postgresql.tpl @@ -0,0 +1,129 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate PostgreSQL required passwords are not empty. + +Usage: +{{ include "common.validations.values.postgresql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where postgresql values are stored, e.g: "postgresql-passwords-secret" + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.postgresql.passwords" -}} + {{- $existingSecret := include "common.postgresql.values.existingSecret" . -}} + {{- $enabled := include "common.postgresql.values.enabled" . -}} + {{- $valueKeyPostgresqlPassword := include "common.postgresql.values.key.postgressPassword" . -}} + {{- $valueKeyPostgresqlReplicationEnabled := include "common.postgresql.values.key.replicationPassword" . -}} + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + {{- $requiredPostgresqlPassword := dict "valueKey" $valueKeyPostgresqlPassword "secret" .secret "field" "postgresql-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlPassword -}} + + {{- $enabledReplication := include "common.postgresql.values.enabled.replication" . -}} + {{- if (eq $enabledReplication "true") -}} + {{- $requiredPostgresqlReplicationPassword := dict "valueKey" $valueKeyPostgresqlReplicationEnabled "secret" .secret "field" "postgresql-replication-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlReplicationPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to decide whether evaluate global values. + +Usage: +{{ include "common.postgresql.values.use.global" (dict "key" "key-of-global" "context" $) }} +Params: + - key - String - Required. Field to be evaluated within global, e.g: "existingSecret" +*/}} +{{- define "common.postgresql.values.use.global" -}} + {{- if .context.Values.global -}} + {{- if .context.Values.global.postgresql -}} + {{- index .context.Values.global.postgresql .key | quote -}} + {{- end -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.postgresql.values.existingSecret" (dict "context" $) }} +*/}} +{{- define "common.postgresql.values.existingSecret" -}} + {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "existingSecret" "context" .context) -}} + + {{- if .subchart -}} + {{- default (.context.Values.postgresql.existingSecret | quote) $globalValue -}} + {{- else -}} + {{- default (.context.Values.existingSecret | quote) $globalValue -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled postgresql. + +Usage: +{{ include "common.postgresql.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.postgresql.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.postgresql.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key postgressPassword. + +Usage: +{{ include "common.postgresql.values.key.postgressPassword" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.key.postgressPassword" -}} + {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "postgresqlUsername" "context" .context) -}} + + {{- if not $globalValue -}} + {{- if .subchart -}} + postgresql.postgresqlPassword + {{- else -}} + postgresqlPassword + {{- end -}} + {{- else -}} + global.postgresql.postgresqlPassword + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled.replication. + +Usage: +{{ include "common.postgresql.values.enabled.replication" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.enabled.replication" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.postgresql.replication.enabled -}} + {{- else -}} + {{- printf "%v" .context.Values.replication.enabled -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key replication.password. + +Usage: +{{ include "common.postgresql.values.key.replicationPassword" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.key.replicationPassword" -}} + {{- if .subchart -}} + postgresql.replication.password + {{- else -}} + replication.password + {{- end -}} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_redis.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_redis.tpl new file mode 100644 index 0000000..dcccfc1 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_redis.tpl @@ -0,0 +1,76 @@ + +{{/* vim: set filetype=mustache: */}} +{{/* +Validate Redis® required passwords are not empty. + +Usage: +{{ include "common.validations.values.redis.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where redis values are stored, e.g: "redis-passwords-secret" + - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.redis.passwords" -}} + {{- $enabled := include "common.redis.values.enabled" . -}} + {{- $valueKeyPrefix := include "common.redis.values.keys.prefix" . -}} + {{- $standarizedVersion := include "common.redis.values.standarized.version" . }} + + {{- $existingSecret := ternary (printf "%s%s" $valueKeyPrefix "auth.existingSecret") (printf "%s%s" $valueKeyPrefix "existingSecret") (eq $standarizedVersion "true") }} + {{- $existingSecretValue := include "common.utils.getValueFromKey" (dict "key" $existingSecret "context" .context) }} + + {{- $valueKeyRedisPassword := ternary (printf "%s%s" $valueKeyPrefix "auth.password") (printf "%s%s" $valueKeyPrefix "password") (eq $standarizedVersion "true") }} + {{- $valueKeyRedisUseAuth := ternary (printf "%s%s" $valueKeyPrefix "auth.enabled") (printf "%s%s" $valueKeyPrefix "usePassword") (eq $standarizedVersion "true") }} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $useAuth := include "common.utils.getValueFromKey" (dict "key" $valueKeyRedisUseAuth "context" .context) -}} + {{- if eq $useAuth "true" -}} + {{- $requiredRedisPassword := dict "valueKey" $valueKeyRedisPassword "secret" .secret "field" "redis-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRedisPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled redis. + +Usage: +{{ include "common.redis.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.redis.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.redis.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right prefix path for the values + +Usage: +{{ include "common.redis.values.key.prefix" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false +*/}} +{{- define "common.redis.values.keys.prefix" -}} + {{- if .subchart -}}redis.{{- else -}}{{- end -}} +{{- end -}} + +{{/* +Checks whether the redis chart's includes the standarizations (version >= 14) + +Usage: +{{ include "common.redis.values.standarized.version" (dict "context" $) }} +*/}} +{{- define "common.redis.values.standarized.version" -}} + + {{- $standarizedAuth := printf "%s%s" (include "common.redis.values.keys.prefix" .) "auth" -}} + {{- $standarizedAuthValues := include "common.utils.getValueFromKey" (dict "key" $standarizedAuth "context" .context) }} + + {{- if $standarizedAuthValues -}} + {{- true -}} + {{- end -}} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_validations.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_validations.tpl new file mode 100644 index 0000000..9a814cf --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/templates/validations/_validations.tpl @@ -0,0 +1,46 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate values must not be empty. + +Usage: +{{- $validateValueConf00 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-00") -}} +{{- $validateValueConf01 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-01") -}} +{{ include "common.validations.values.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} + +Validate value params: + - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" + - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" + - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" +*/}} +{{- define "common.validations.values.multiple.empty" -}} + {{- range .required -}} + {{- include "common.validations.values.single.empty" (dict "valueKey" .valueKey "secret" .secret "field" .field "context" $.context) -}} + {{- end -}} +{{- end -}} + +{{/* +Validate a value must not be empty. + +Usage: +{{ include "common.validations.value.empty" (dict "valueKey" "mariadb.password" "secret" "secretName" "field" "my-password" "subchart" "subchart" "context" $) }} + +Validate value params: + - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" + - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" + - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" + - subchart - String - Optional - Name of the subchart that the validated password is part of. +*/}} +{{- define "common.validations.values.single.empty" -}} + {{- $value := include "common.utils.getValueFromKey" (dict "key" .valueKey "context" .context) }} + {{- $subchart := ternary "" (printf "%s." .subchart) (empty .subchart) }} + + {{- if not $value -}} + {{- $varname := "my-value" -}} + {{- $getCurrentValue := "" -}} + {{- if and .secret .field -}} + {{- $varname = include "common.utils.fieldToEnvVar" . -}} + {{- $getCurrentValue = printf " To get the current value:\n\n %s\n" (include "common.utils.secret.getvalue" .) -}} + {{- end -}} + {{- printf "\n '%s' must not be empty, please add '--set %s%s=$%s' to the command.%s" .valueKey $subchart .valueKey $varname $getCurrentValue -}} + {{- end -}} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/values.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/values.yaml new file mode 100644 index 0000000..f2df68e --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/charts/common/values.yaml @@ -0,0 +1,5 @@ +## bitnami/common +## It is required by CI/CD tools and processes. +## @skip exampleValue +## +exampleValue: common-chart diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/NOTES.txt b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/NOTES.txt new file mode 100644 index 0000000..7203edb --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/NOTES.txt @@ -0,0 +1,101 @@ +CHART NAME: {{ .Chart.Name }} +CHART VERSION: {{ .Chart.Version }} +APP VERSION: {{ .Chart.AppVersion }} + +{{- $clusterDomain:= .Values.clusterDomain }} +** Please be patient while the chart is being deployed ** + +{{- if .Values.diagnosticMode.enabled }} +The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with: + + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }} + +Get the list of pods by executing: + + kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }} + +Access the pod you want to debug by executing + + kubectl exec --namespace {{ .Release.Namespace }} -ti -- bash + +In order to replicate the container startup scripts, check the /opt/bitnami/scripts folder. + + Default PostgreSQL startup command + + /opt/bitnami/scripts/postgresql-repmgr/entrypoint.sh /opt/bitnami/scripts/postgresql-repmgr/run.sh + + Default PgPool startup command + + /opt/bitnami/scripts/pgpool/entrypoint.sh /opt/bitnami/scripts/pgpool/run.sh + +{{- else }} +PostgreSQL can be accessed through Pgpool via port {{ .Values.service.ports.postgresql }} on the following DNS name from within your cluster: + + {{ include "postgresql-ha.pgpool" . }}.{{ .Release.Namespace }}.svc.{{ $clusterDomain }} + +Pgpool acts as a load balancer for PostgreSQL and forward read/write connections to the primary node while read-only connections are forwarded to standby nodes. + +To get the password for {{ (include "postgresql-ha.postgresqlUsername" .) | quote }} run: + + export POSTGRES_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "postgresql-ha.postgresqlSecretName" . }} -o jsonpath="{.data.password}" | base64 -d) + +To get the password for {{ (include "postgresql-ha.postgresqlRepmgrUsername" .) | quote }} run: + + export REPMGR_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "postgresql-ha.postgresqlSecretName" . }} -o jsonpath="{.data.repmgr-password}" | base64 -d) + +To connect to your database run the following command: + + kubectl run {{ include "common.names.fullname" . }}-client --rm --tty -i --restart='Never' --namespace {{ .Release.Namespace }} --image {{ include "postgresql-ha.postgresql.image" . }} --env="PGPASSWORD=$POSTGRES_PASSWORD" {{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}--labels="{{ include "common.names.fullname" . }}-client=true" {{- end }} \ + --command -- psql -h {{ include "postgresql-ha.pgpool" . }} -p {{ .Values.service.ports.postgresql }} -U {{ include "postgresql-ha.postgresqlUsername" . }}{{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} -d {{ include "postgresql-ha.postgresqlDatabase" . }}{{- end }} + +{{- if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} + +Note: Since NetworkPolicy is enabled, only pods with label "{{ include "common.names.fullname" . }}-client=true" will be able to connect to this PostgreSQL cluster. + +{{- end }} + +To connect to your database from outside the cluster execute the following commands: + +{{- if contains "NodePort" .Values.service.type }} + + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "postgresql-ha.pgpool" . }} + PGPASSWORD="$POSTGRES_PASSWORD" psql -h $NODE_IP -p $NODE_PORT -U {{ include "postgresql-ha.postgresqlUsername" . }}{{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} -d {{ include "postgresql-ha.postgresqlDatabase" . }}{{- end }} + +{{- else if contains "LoadBalancer" .Values.service.type }} + + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ include "postgresql-ha.pgpool" . }} + + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "postgresql-ha.pgpool" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}") + PGPASSWORD="$POSTGRES_PASSWORD" psql -h $SERVICE_IP -p {{ .Values.service.ports.postgresql }} -U {{ include "postgresql-ha.postgresqlUsername" . }}{{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} -d {{ include "postgresql-ha.postgresqlDatabase" . }}{{- end }} + +{{- else if contains "ClusterIP" .Values.service.type }} + + kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "postgresql-ha.pgpool" . }} {{ .Values.service.ports.postgresql }}:{{ .Values.service.ports.postgresql }} & + psql -h 127.0.0.1 -p {{ .Values.service.ports.postgresql }} -U {{ include "postgresql-ha.postgresqlUsername" . }}{{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} -d {{ include "postgresql-ha.postgresqlDatabase" . }}{{- end }} + +{{- end }} +{{- end }} + +{{- include "postgresql-ha.validateValues" . }} +{{- include "postgresql-ha.checkRollingTags" . }} + +{{- $passwordValidationErrors := list -}} +{{- $requiredPasswords := list -}} +{{- if not (include "postgresql-ha.postgresql.existingSecretProvided" . ) }} +{{- $secretName := include "postgresql-ha.postgresqlSecretName" . -}} +{{- $requiredPostgresqlPassword := dict "valueKey" "postgresql.password" "secret" $secretName "field" "password" "context" $ -}} +{{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlPassword -}} +{{- $requiredRepmgrPassword := dict "valueKey" "postgresql.repmgrPassword" "secret" $secretName "field" "repmgr-password" "context" $ -}} +{{- $requiredPasswords = append $requiredPasswords $requiredRepmgrPassword -}} +{{- end }} +{{- if not (include "postgresql-ha.pgpool.existingSecretProvided" . ) }} +{{- $secretName := include "postgresql-ha.pgpoolSecretName" . -}} +{{- $requiredPgpoolPassword := dict "valueKey" "pgpool.adminPassword" "secret" $secretName "field" "admin-password" "context" $ -}} +{{- $requiredPasswords = append $requiredPasswords $requiredPgpoolPassword -}} +{{- end }} +{{- $passwordValidationErrors = include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .) -}} + +{{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $) -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/_helpers.tpl b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/_helpers.tpl new file mode 100644 index 0000000..fe13428 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/_helpers.tpl @@ -0,0 +1,715 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Fully qualified app name for PostgreSQL +*/}} +{{- define "postgresql-ha.postgresql" -}} +{{- if .Values.fullnameOverride -}} +{{- printf "%s-postgresql" .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- printf "%s-postgresql" .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s-postgresql" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Fully qualified app name for Pgpool +*/}} +{{- define "postgresql-ha.pgpool" -}} +{{- if .Values.fullnameOverride -}} +{{- printf "%s-pgpool" .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- printf "%s-pgpool" .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s-pgpool" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Fully qualified app name for LDAP +*/}} +{{- define "postgresql-ha.ldap" -}} +{{- if .Values.fullnameOverride -}} +{{- printf "%s-ldap" .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- printf "%s-ldap" .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s-ldap" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + + +{{/* + Create the name of the service account to use + */}} +{{- define "postgresql-ha.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper PostgreSQL image name +*/}} +{{- define "postgresql-ha.postgresql.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.postgresql.image "global" .Values.global ) -}} +{{- end -}} + +{{/* +Return the proper Pgpool image name +*/}} +{{- define "postgresql-ha.pgpool.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.pgpool.image "global" .Values.global ) -}} +{{- end -}} + +{{/* +Return the proper PostgreSQL Prometheus exporter image name +*/}} +{{- define "postgresql-ha.volumePermissions.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.volumePermissions.image "global" .Values.global ) -}} +{{- end -}} + +{{/* +Return the proper PostgreSQL Prometheus exporter image name +*/}} +{{- define "postgresql-ha.metrics.image" -}} +{{- include "common.images.image" ( dict "imageRoot" .Values.metrics.image "global" .Values.global ) -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names +*/}} +{{- define "postgresql-ha.image.pullSecrets" -}} +{{- include "common.images.pullSecrets" (dict "images" (list .Values.postgresql.image .Values.pgpool.image .Values.volumePermissions.image .Values.metrics.image) "global" .Values.global) -}} +{{- end -}} + +{{/* +Return the PostgreSQL username +*/}} +{{- define "postgresql-ha.postgresqlUsername" -}} +{{- if .Values.global -}} + {{- if .Values.global.postgresql -}} + {{- if .Values.global.postgresql.username -}} + {{- .Values.global.postgresql.username -}} + {{- else -}} + {{- .Values.postgresql.username -}} + {{- end -}} + {{- else -}} + {{- .Values.postgresql.username -}} + {{- end -}} +{{- else -}} + {{- .Values.postgresql.username -}} +{{- end -}} +{{- end -}} + +{{/* +Return PostgreSQL postgres user password +*/}} +{{- define "postgresql-ha.postgresqlPostgresPassword" -}} +{{- if .Values.global -}} + {{- if .Values.global.postgresql -}} + {{- if .Values.global.postgresql.postgresPassword -}} + {{- .Values.global.postgresql.postgresPassword -}} + {{- else -}} + {{- ternary (randAlphaNum 10) .Values.postgresql.postgresPassword (empty .Values.postgresql.postgresPassword) -}} + {{- end -}} + {{- else -}} + {{- ternary (randAlphaNum 10) .Values.postgresql.postgresPassword (empty .Values.postgresql.postgresPassword) -}} + {{- end -}} +{{- else -}} + {{- ternary (randAlphaNum 10) .Values.postgresql.postgresPassword (empty .Values.postgresql.postgresPassword) -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if PostgreSQL postgres user password has been provided +*/}} +{{- define "postgresql-ha.postgresqlPasswordProvided" -}} +{{- if .Values.global -}} + {{- if .Values.global.postgresql -}} + {{- if .Values.global.postgresql.postgresPassword -}} + {{- true -}} + {{- end -}} + {{- if .Values.postgresql.postgresPassword -}} + {{- true -}} + {{- end -}} + {{- else -}} + {{- if .Values.postgresql.postgresPassword -}} + {{- true -}} + {{- end -}} + {{- end -}} +{{- else -}} + {{- if .Values.postgresql.postgresPassword -}} + {{- true -}} + {{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Return the PostgreSQL password +*/}} +{{- define "postgresql-ha.postgresqlPassword" -}} +{{- if .Values.global }} + {{- if .Values.global.postgresql }} + {{- if .Values.global.postgresql.password }} + {{- .Values.global.postgresql.password -}} + {{- else -}} + {{- ternary (randAlphaNum 10) .Values.postgresql.password (empty .Values.postgresql.password) -}} + {{- end -}} + {{- else -}} + {{- ternary (randAlphaNum 10) .Values.postgresql.password (empty .Values.postgresql.password) -}} + {{- end -}} +{{- else -}} + {{- ternary (randAlphaNum 10) .Values.postgresql.password (empty .Values.postgresql.password) -}} +{{- end -}} +{{- end -}} + +{{/* +Return the Pgpool Admin username +*/}} +{{- define "postgresql-ha.pgpoolAdminUsername" -}} +{{- if .Values.global -}} + {{- if .Values.global.pgpool -}} + {{- if .Values.global.pgpool.adminUsername -}} + {{- .Values.global.pgpool.adminUsername -}} + {{- else -}} + {{- .Values.pgpool.adminUsername -}} + {{- end -}} + {{- else -}} + {{- .Values.pgpool.adminUsername -}} + {{- end -}} +{{- else -}} + {{- .Values.pgpool.adminUsername -}} +{{- end -}} +{{- end -}} + +{{/* +Return the Pgpool Admin password +*/}} +{{- define "postgresql-ha.pgpoolAdminPassword" -}} +{{- if .Values.global -}} + {{- if .Values.global.pgpool -}} + {{- if .Values.global.pgpool.adminPassword -}} + {{- .Values.global.pgpool.adminPassword -}} + {{- else -}} + {{- ternary (randAlphaNum 10) .Values.pgpool.adminPassword (empty .Values.pgpool.adminPassword) -}} + {{- end -}} + {{- else -}} + {{- ternary (randAlphaNum 10) .Values.pgpool.adminPassword (empty .Values.pgpool.adminPassword) -}} + {{- end -}} +{{- else -}} + {{- ternary (randAlphaNum 10) .Values.pgpool.adminPassword (empty .Values.pgpool.adminPassword) -}} +{{- end -}} +{{- end -}} + +{{/* +Get the metrics ConfigMap name. +*/}} +{{- define "postgresql.metricsCM" -}} +{{- printf "%s-metrics" (include "common.names.fullname" .) -}} +{{- end -}} + +{{/* +Return the PostgreSQL database to create +*/}} +{{- define "postgresql-ha.postgresqlDatabase" -}} +{{- $postgresqlDatabase := default "postgres" .Values.postgresql.database -}} +{{- if .Values.global -}} + {{- if .Values.global.postgresql -}} + {{- if .Values.global.postgresql.database -}} + {{- default "postgres" .Values.global.postgresql.database -}} + {{- else -}} + {{- $postgresqlDatabase -}} + {{- end -}} + {{- else -}} + {{- $postgresqlDatabase -}} + {{- end -}} +{{- else -}} + {{- $postgresqlDatabase -}} +{{- end -}} +{{- end -}} + +{{/* +Return the PostgreSQL repmgr username +*/}} +{{- define "postgresql-ha.postgresqlRepmgrUsername" -}} +{{- if .Values.global -}} + {{- if .Values.global.postgresql -}} + {{- if .Values.global.postgresql.repmgrUsername -}} + {{- .Values.global.postgresql.repmgrUsername -}} + {{- else -}} + {{- .Values.postgresql.repmgrUsername -}} + {{- end -}} + {{- else -}} + {{- .Values.postgresql.repmgrUsername -}} + {{- end -}} +{{- else -}} + {{- .Values.postgresql.repmgrUsername -}} +{{- end -}} +{{- end -}} + +{{/* +Return the PostgreSQL repmgr password +*/}} +{{- define "postgresql-ha.postgresqlRepmgrPassword" -}} +{{- if .Values.global -}} + {{- if .Values.global.postgresql -}} + {{- if .Values.global.postgresql.repmgrPassword -}} + {{- .Values.global.postgresql.repmgrPassword -}} + {{- else -}} + {{- ternary (randAlphaNum 10) .Values.postgresql.repmgrPassword (empty .Values.postgresql.repmgrPassword) -}} + {{- end -}} + {{- else -}} + {{- ternary (randAlphaNum 10) .Values.postgresql.repmgrPassword (empty .Values.postgresql.repmgrPassword) -}} + {{- end -}} +{{- else -}} + {{- ternary (randAlphaNum 10) .Values.postgresql.repmgrPassword (empty .Values.postgresql.repmgrPassword) -}} +{{- end -}} +{{- end -}} + +{{/* +Return the database to use for repmgr +*/}} +{{- define "postgresql-ha.repmgrDatabase" -}} +{{- if .Values.global -}} + {{- if .Values.global.postgresql -}} + {{- if .Values.global.postgresql.repmgrDatabase -}} + {{- .Values.global.postgresql.repmgrDatabase -}} + {{- else -}} + {{- .Values.postgresql.repmgrDatabase -}} + {{- end -}} + {{- else -}} + {{- .Values.postgresql.repmgrDatabase -}} + {{- end -}} +{{- else -}} + {{- .Values.postgresql.repmgrDatabase -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if a secret object should be created for PostgreSQL +*/}} +{{- define "postgresql-ha.postgresqlCreateSecret" -}} +{{- if .Values.global -}} + {{- if .Values.global.postgresql -}} + {{- if .Values.global.postgresql.existingSecret -}} + {{- else if (not .Values.postgresql.existingSecret) -}} + {{- true -}} + {{- end -}} + {{- else if (not .Values.postgresql.existingSecret) -}} + {{- true -}} + {{- end -}} +{{- else if (not .Values.postgresql.existingSecret) -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Return the PostgreSQL credentials secret. +*/}} +{{- define "postgresql-ha.postgresqlSecretName" -}} +{{- if .Values.global -}} + {{- if .Values.global.postgresql -}} + {{- if .Values.global.postgresql.existingSecret -}} + {{- printf "%s" (tpl .Values.global.postgresql.existingSecret $) -}} + {{- else if .Values.postgresql.existingSecret -}} + {{- printf "%s" (tpl .Values.postgresql.existingSecret $) -}} + {{- else -}} + {{- printf "%s" (include "postgresql-ha.postgresql" .) -}} + {{- end -}} + {{- else if .Values.postgresql.existingSecret -}} + {{- printf "%s" (tpl .Values.postgresql.existingSecret $) -}} + {{- else -}} + {{- printf "%s" (include "postgresql-ha.postgresql" .) -}} + {{- end -}} +{{- else -}} + {{- if .Values.postgresql.existingSecret -}} + {{- printf "%s" (tpl .Values.postgresql.existingSecret $) -}} + {{- else -}} + {{- printf "%s" (include "postgresql-ha.postgresql" .) -}} + {{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if a secret object should be created for Pgpool +*/}} +{{- define "postgresql-ha.pgpoolCreateSecret" -}} +{{- if .Values.global -}} + {{- if .Values.global.pgpool -}} + {{- if .Values.global.pgpool.existingSecret -}} + {{- else if (not .Values.pgpool.existingSecret) -}} + {{- true -}} + {{- end -}} + {{- else if (not .Values.pgpool.existingSecret) -}} + {{- true -}} + {{- end -}} +{{- else if (not .Values.pgpool.existingSecret) -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Return the Pgpool credentials secret. +*/}} +{{- define "postgresql-ha.pgpoolSecretName" -}} +{{- if .Values.global -}} + {{- if .Values.global.pgpool -}} + {{- if .Values.global.pgpool.existingSecret -}} + {{- printf "%s" .Values.global.pgpool.existingSecret -}} + {{- else if .Values.pgpool.existingSecret -}} + {{- printf "%s" .Values.pgpool.existingSecret -}} + {{- else -}} + {{- printf "%s" (include "postgresql-ha.pgpool" .) -}} + {{- end -}} + {{- else if .Values.pgpool.existingSecret -}} + {{- printf "%s" .Values.pgpool.existingSecret -}} + {{- else -}} + {{- printf "%s" (include "postgresql-ha.pgpool" .) -}} + {{- end -}} +{{- else -}} + {{- if .Values.pgpool.existingSecret -}} + {{- printf "%s" .Values.pgpool.existingSecret -}} + {{- else -}} + {{- printf "%s" (include "postgresql-ha.pgpool" .) -}} + {{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Return the PostgreSQL configuration configmap. +*/}} +{{- define "postgresql-ha.postgresqlConfigurationCM" -}} +{{- if .Values.postgresql.configurationCM -}} +{{- printf "%s" (tpl .Values.postgresql.configurationCM $) -}} +{{- else -}} +{{- printf "%s-configuration" (include "postgresql-ha.postgresql" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Return the PostgreSQL extended configuration configmap. +*/}} +{{- define "postgresql-ha.postgresqlExtendedConfCM" -}} +{{- if .Values.postgresql.extendedConfCM -}} +{{- printf "%s" (tpl .Values.postgresql.extendedConfCM $) -}} +{{- else -}} +{{- printf "%s-extended-configuration" (include "postgresql-ha.postgresql" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Return the Pgpool configuration configmap. +*/}} +{{- define "postgresql-ha.pgpoolConfigurationCM" -}} +{{- if .Values.pgpool.configurationCM -}} +{{- printf "%s" (tpl .Values.pgpool.configurationCM $) -}} +{{- else -}} +{{- printf "%s-configuration" (include "postgresql-ha.pgpool" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Return the PostgreSQL initdb scripts configmap. +*/}} +{{- define "postgresql-ha.postgresqlInitdbScriptsCM" -}} +{{- if .Values.postgresql.initdbScriptsCM -}} +{{- printf "%s" (tpl .Values.postgresql.initdbScriptsCM $) -}} +{{- else -}} +{{- printf "%s-initdb-scripts" (include "postgresql-ha.postgresql" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Get the initialization scripts Secret name. +*/}} +{{- define "postgresql-ha.postgresqlInitdbScriptsSecret" -}} +{{- if .Values.postgresql.initdbScriptsSecret -}} +{{- include "common.tplvalues.render" (dict "value" .Values.postgresql.initdbScriptsSecret "context" $) -}} +{{- end -}} +{{- end -}} + +{{/* +Return the Pgpool initdb scripts configmap. +*/}} +{{- define "postgresql-ha.pgpoolInitdbScriptsCM" -}} +{{- if .Values.pgpool.initdbScriptsCM -}} +{{- printf "%s" (tpl .Values.pgpool.initdbScriptsCM $) -}} +{{- else -}} +{{- printf "%s-initdb-scripts" (include "postgresql-ha.pgpool" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Get the pgpool initialization scripts Secret name. +*/}} +{{- define "postgresql-ha.pgpoolInitdbScriptsSecret" -}} +{{- if .Values.pgpool.initdbScriptsSecret -}} +{{- include "common.tplvalues.render" (dict "value" .Values.pgpool.initdbScriptsSecret "context" $) -}} +{{- end -}} +{{- end -}} + +{{/* +Return the LDAP bind password +*/}} +{{- define "postgresql-ha.ldapPassword" -}} +{{- if .Values.global }} + {{- if .Values.global.ldap }} + {{- if .Values.global.ldap.bindpw }} + {{- .Values.global.ldap.bindpw -}} + {{- else -}} + {{- ternary (randAlphaNum 10) .Values.ldap.bindpw (empty .Values.ldap.bindpw) -}} + {{- end -}} + {{- else -}} + {{- ternary (randAlphaNum 10) .Values.ldap.bindpw (empty .Values.ldap.bindpw) -}} + {{- end -}} +{{- else -}} + {{- ternary (randAlphaNum 10) .Values.ldap.bindpw (empty .Values.ldap.bindpw) -}} +{{- end -}} +{{- end -}} + +{{/* +Return the LDAP credentials secret. +*/}} +{{- define "postgresql-ha.ldapSecretName" -}} +{{- if .Values.global }} + {{- if .Values.global.ldap }} + {{- if .Values.global.ldap.existingSecret }} + {{- printf "%s" .Values.global.ldap.existingSecret -}} + {{- else if .Values.ldap.existingSecret -}} + {{- printf "%s" .Values.ldap.existingSecret -}} + {{- else -}} + {{- printf "%s" (include "postgresql-ha.ldap" .) -}} + {{- end -}} + {{- else if .Values.ldap.existingSecret -}} + {{- printf "%s" .Values.ldap.existingSecret -}} + {{- else -}} + {{- printf "%s" (include "postgresql-ha.ldap" .) -}} + {{- end -}} +{{- else -}} + {{- if .Values.ldap.existingSecret -}} + {{- printf "%s" .Values.ldap.existingSecret -}} + {{- else -}} + {{- printf "%s" (include "postgresql-ha.ldap" .) -}} + {{- end -}} +{{- end -}} +{{- end -}} + +{{/* Check if there are rolling tags in the images */}} +{{- define "postgresql-ha.checkRollingTags" -}} +{{- include "common.warnings.rollingTag" .Values.postgresql.image -}} +{{- include "common.warnings.rollingTag" .Values.pgpool.image -}} +{{- include "common.warnings.rollingTag" .Values.metrics.image -}} +{{- include "common.warnings.rollingTag" .Values.volumePermissions.image -}} +{{- end -}} + +{{/* +Compile all warnings into a single message, and call fail. +*/}} +{{- define "postgresql-ha.validateValues" -}} +{{- $messages := list -}} +{{- $messages := append $messages (include "postgresql-ha.validateValues.nodesHostnames" .) -}} +{{- $messages := append $messages (include "postgresql-ha.validateValues.ldap" .) -}} +{{- $messages := append $messages (include "postgresql-ha.validateValues.ldapPgHba" .) -}} +{{- $messages := append $messages (include "postgresql-ha.validateValues.upgradeRepmgrExtension" .) -}} +{{- $messages := without $messages "" -}} +{{- $message := join "\n" $messages -}} + +{{- if $message -}} +{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}} +{{- end -}} +{{- end -}} + +{{/* Validate values of PostgreSQL HA - PostgreSQL nodes hostnames cannot be longer than 128 characters */}} +{{- define "postgresql-ha.validateValues.nodesHostnames" -}} +{{- $postgresqlFullname := include "postgresql-ha.postgresql" . }} +{{- $postgresqlHeadlessServiceName := printf "%s-headless" (include "postgresql-ha.postgresql" .) }} +{{- $nodeHostname := printf "%s-00.%s" $postgresqlFullname $postgresqlHeadlessServiceName }} +{{- if gt (len $nodeHostname) 128 -}} +postgresql-ha: Nodes hostnames + PostgreSQL nodes hostnames ({{ $nodeHostname }}) exceeds the characters limit for Pgpool: 128. + Consider using a shorter release name or namespace. +{{- end -}} +{{- end -}} + +{{/* Validate values of PostgreSQL HA - must provide mandatory LDAP parameters when LDAP is enabled */}} +{{- define "postgresql-ha.validateValues.ldap" -}} +{{- if and .Values.ldap.enabled (or (empty .Values.ldap.uri) (and (empty .Values.ldap.basedn) (empty .Values.ldap.base)) (empty .Values.ldap.binddn) (and (empty .Values.ldap.bindpw) (empty .Values.ldap.existingSecret))) -}} +postgresql-ha: LDAP + Invalid LDAP configuration. When enabling LDAP support, the parameters "ldap.uri", + "ldap.basedn", "ldap.binddn", and "ldap.bindpw" are mandatory. Please provide them: + + $ helm install {{ .Release.Name }} my-repo/postgresql-ha \ + --set ldap.enabled=true \ + --set ldap.uri="ldap://my_ldap_server" \ + --set ldap.basedn="dc=example\,dc=org" \ + --set ldap.binddn="cn=admin\,dc=example\,dc=org" \ + --set ldap.bindpw="admin" +{{- end -}} +{{- end -}} + +{{/* Validate values of PostgreSQL HA - PostgreSQL HBA configuration must trust every user when LDAP is enabled */}} +{{- define "postgresql-ha.validateValues.ldapPgHba" -}} +{{- if and .Values.ldap.enabled (not .Values.postgresql.pgHbaTrustAll) }} +postgresql-ha: LDAP & pg_hba.conf + PostgreSQL HBA configuration must trust every user when LDAP is enabled. + Please configure HBA to trust every user (--set postgresql.pgHbaTrustAll=true) +{{- end -}} +{{- end -}} + +{{/* Validate values of PostgreSQL HA - There must be an unique replica when upgrading repmgr extension */}} +{{- define "postgresql-ha.validateValues.upgradeRepmgrExtension" -}} +{{- $postgresqlReplicaCount := int .Values.postgresql.replicaCount }} +{{- if and .Values.postgresql.upgradeRepmgrExtension (gt $postgresqlReplicaCount 1) }} +postgresql-ha: Upgrade repmgr extension + There must be only one replica when upgrading repmgr extension: + + $ helm upgrade {{ .Release.Name }} my-repo/postgresql-ha \ + --set postgresql.replicaCount=1 \ + --set postgresql.upgradeRepmgrExtension=true +{{- end -}} +{{- end -}} + +{{/* Set PGPASSWORD as environment variable depends on configuration */}} +{{- define "postgresql-ha.pgpassword" -}} +{{- if .Values.postgresql.usePasswordFile -}} +PGPASSWORD=$(< $POSTGRES_PASSWORD_FILE) +{{- else -}} +PGPASSWORD=$POSTGRES_PASSWORD +{{- end -}} +{{- end -}} + +{{/* +Return the Pgpool secret containing custom users to be added to +pool_passwd file. +*/}} +{{- define "postgresql-ha.pgpoolCustomUsersSecretName" -}} +{{- if .Values.pgpool.customUsersSecret -}} +{{- printf "%s" (tpl .Values.pgpool.customUsersSecret $) -}} +{{- else -}} +{{- printf "%s-custom-users" (include "postgresql-ha.pgpool" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Return the path to the cert file. +*/}} +{{- define "postgresql-ha.pgpool.tlsCert" -}} +{{- if and .Values.pgpool.tls.enabled .Values.pgpool.tls.autoGenerated }} + {{- printf "/opt/bitnami/pgpool/certs/tls.crt" -}} +{{- else -}} +{{- required "Certificate filename is required when TLS in enabled" .Values.pgpool.tls.certFilename | printf "/opt/bitnami/pgpool/certs/%s" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the path to the cert key file. +*/}} +{{- define "postgresql-ha.pgpool.tlsCertKey" -}} +{{- if and .Values.pgpool.tls.enabled .Values.pgpool.tls.autoGenerated }} + {{- printf "/opt/bitnami/pgpool/certs/tls.key" -}} +{{- else -}} + {{- required "Certificate Key filename is required when TLS in enabled" .Values.pgpool.tls.certKeyFilename | printf "/opt/bitnami/pgpool/certs/%s" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the path to the CA cert file. +*/}} +{{- define "postgresql-ha.pgpool.tlsCACert" -}} +{{- if and .Values.pgpool.tls.enabled .Values.pgpool.tls.autoGenerated }} + {{- printf "/opt/bitnami/pgpool/certs/ca.crt" -}} +{{- else -}} + {{- printf "/opt/bitnami/pgpool/certs/%s" .Values.pgpool.tls.certCAFilename -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if a TLS credentials secret object should be created +*/}} +{{- define "postgresql-ha.createTlsSecret" -}} +{{- if and .Values.pgpool.tls.enabled .Values.pgpool.tls.autoGenerated (not .Values.pgpool.tls.certificatesSecret) }} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Return the path to the CA cert file. +*/}} +{{- define "postgresql-ha.tlsSecretName" -}} +{{- if .Values.pgpool.tls.enabled }} +{{- if .Values.pgpool.tls.autoGenerated }} + {{- printf "%s-crt" (include "postgresql-ha.pgpool" .) -}} +{{- else -}} + {{ required "A secret containing TLS certificates is required when TLS is enabled" .Values.pgpool.tls.certificatesSecret }} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if PostgreSQL postgres existingSecret has been provided +*/}} +{{- define "postgresql-ha.postgresql.existingSecretProvided" -}} +{{- if .Values.global -}} + {{- if .Values.global.postgresql -}} + {{- if .Values.global.postgresql.existingSecret -}} + {{- true -}} + {{- else if .Values.postgresql.existingSecret -}} + {{- true -}} + {{- end -}} + {{- else if .Values.postgresql.existingSecret -}} + {{- true -}} + {{- end -}} +{{- else -}} + {{- if .Values.postgresql.existingSecret -}} + {{- true -}} + {{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if PostgreSQL pgpool existingSecret has been provided +*/}} +{{- define "postgresql-ha.pgpool.existingSecretProvided" -}} +{{- if .Values.global -}} + {{- if .Values.global.pgpool -}} + {{- if .Values.global.pgpool.existingSecret -}} + {{- true -}} + {{- else if .Values.pgpool.existingSecret -}} + {{- true -}} + {{- end -}} + {{- else if .Values.pgpool.existingSecret -}} + {{- true -}} + {{- end -}} +{{- else -}} + {{- if .Values.pgpool.existingSecret -}} + {{- true -}} + {{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Return the path to the cert file. +*/}} +{{- define "postgresql-ha.postgresql.tlsCert" -}} +{{- required "Certificate filename is required when TLS in enabled" .Values.postgresql.tls.certFilename | printf "/opt/bitnami/postgresql/certs/%s" -}} +{{- end -}} + +{{/* +Return the path to the cert key file. +*/}} +{{- define "postgresql-ha.postgresql.tlsCertKey" -}} +{{- required "Certificate Key filename is required when TLS in enabled" .Values.postgresql.tls.certKeyFilename | printf "/opt/bitnami/postgresql/certs/%s" -}} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/extra-list.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/extra-list.yaml new file mode 100644 index 0000000..9ac65f9 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/extra-list.yaml @@ -0,0 +1,4 @@ +{{- range .Values.extraDeploy }} +--- +{{ include "common.tplvalues.render" (dict "value" . "context" $) }} +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/ldap-secrets.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/ldap-secrets.yaml new file mode 100644 index 0000000..bcf477d --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/ldap-secrets.yaml @@ -0,0 +1,17 @@ +{{- if .Values.ldap.enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "postgresql-ha.ldap" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: Opaque +data: + bind-password: {{ (include "postgresql-ha.ldapPassword" .) | b64enc | quote }} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/metrics-configmap.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/metrics-configmap.yaml new file mode 100644 index 0000000..5efbb35 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/metrics-configmap.yaml @@ -0,0 +1,16 @@ +{{- if and .Values.metrics.enabled .Values.metrics.customMetrics }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "postgresql.metricsCM" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + custom-metrics.yaml: {{ toYaml .Values.metrics.customMetrics | quote }} +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/networkpolicy-egress.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/networkpolicy-egress.yaml new file mode 100644 index 0000000..17170b0 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/networkpolicy-egress.yaml @@ -0,0 +1,64 @@ +{{- if and .Values.networkPolicy.enabled (or .Values.networkPolicy.egressRules.denyConnectionsToExternal .Values.networkPolicy.egressRules.customRules) }} +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ printf "%s-postgresql-egress" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: {{ include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: postgresql + policyTypes: + - Egress + egress: + {{- if .Values.networkPolicy.egressRules.denyConnectionsToExternal }} + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + - to: + - namespaceSelector: {} + {{- end }} + {{- if .Values.networkPolicy.egressRules.customRules }} + {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.egressRules.customRules "context" $) | nindent 4 }} + {{- end }} +--- +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ printf "%s-pgpool-egress" (include "common.names.fullname" .) }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: {{ include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: pgpool + policyTypes: + - Egress + egress: + {{- if .Values.networkPolicy.egressRules.denyConnectionsToExternal }} + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + - to: + - namespaceSelector: {} + {{- end }} + {{- if .Values.networkPolicy.egressRules.customRules }} + {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.egressRules.customRules "context" $) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/networkpolicy-ingress.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/networkpolicy-ingress.yaml new file mode 100644 index 0000000..80e22ad --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/networkpolicy-ingress.yaml @@ -0,0 +1,35 @@ +{{- if .Values.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ printf "%s-ingress" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: {{ include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: postgresql + policyTypes: + - Ingress + ingress: + # Allow inbound connections + - ports: + - port: {{ .Values.service.ports.postgresql }} + {{- if not .Values.networkPolicy.allowExternal }} + from: + - podSelector: + matchLabels: + {{ template "common.names.fullname" . }}-client: "true" + - podSelector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 14 }} + {{- end }} + # Allow prometheus scrapes + - ports: + - port: {{ .Values.metrics.service.ports.metrics }} +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/configmap.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/configmap.yaml new file mode 100644 index 0000000..d3c3294 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/configmap.yaml @@ -0,0 +1,18 @@ +{{- if and .Values.pgpool.configuration (not .Values.pgpool.configurationCM) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-configuration" (include "postgresql-ha.pgpool" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: pgpool + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + pgpool.conf: |- + {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.configuration "context" $) | nindent 4 }} +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/custom-users-secrets.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/custom-users-secrets.yaml new file mode 100644 index 0000000..42c9515 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/custom-users-secrets.yaml @@ -0,0 +1,19 @@ +{{- if and (not .Values.pgpool.customUsersSecret) .Values.pgpool.customUsers }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ printf "%s-custom-users" (include "postgresql-ha.pgpool" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: pgpool + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: Opaque +data: + usernames: {{ .Values.pgpool.customUsers.usernames | b64enc | quote }} + passwords: {{ .Values.pgpool.customUsers.passwords | b64enc | quote }} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/deployment.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/deployment.yaml new file mode 100644 index 0000000..1cf2a78 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/deployment.yaml @@ -0,0 +1,407 @@ +apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} +kind: Deployment +metadata: + name: {{ include "postgresql-ha.pgpool" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{ include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: pgpool + {{- if .Values.pgpool.labels }} + {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.labels "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + replicas: {{ .Values.pgpool.replicaCount }} + selector: + matchLabels: {{ include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: pgpool + {{- if .Values.pgpool.updateStrategy }} + strategy: {{- toYaml .Values.pgpool.updateStrategy | nindent 4 }} + {{- end }} + {{- if .Values.pgpool.minReadySeconds }} + minReadySeconds: {{ .Values.pgpool.minReadySeconds }} + {{- end }} + template: + metadata: + labels: {{ include "common.labels.standard" . | nindent 8 }} + app.kubernetes.io/component: pgpool + {{- if .Values.pgpool.podLabels }} + {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.podLabels "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.pgpool.podAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.podAnnotations "context" $) | nindent 8 }} + {{- end }} + spec: + {{- include "postgresql-ha.image.pullSecrets" . | nindent 6 }} + {{- if .Values.pgpool.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.pgpool.affinity }} + affinity: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.pgpool.podAffinityPreset "component" "pgpool" "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.pgpool.podAntiAffinityPreset "component" "pgpool" "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.pgpool.nodeAffinityPreset.type "key" .Values.pgpool.nodeAffinityPreset.key "values" .Values.pgpool.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.pgpool.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.pgpool.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.tolerations "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.pgpool.priorityClassName }} + priorityClassName: {{ .Values.pgpool.priorityClassName }} + {{- end }} + {{- if .Values.pgpool.schedulerName }} + schedulerName: {{ .Values.pgpool.schedulerName | quote }} + {{- end }} + {{- if .Values.pgpool.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.pgpool.podSecurityContext.enabled }} + securityContext: {{- omit .Values.pgpool.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.pgpool.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.pgpool.terminationGracePeriodSeconds }} + {{- end }} + {{- if .Values.serviceAccount.create }} + serviceAccountName: {{ include "postgresql-ha.serviceAccountName" . }} + {{- end }} + initContainers: + {{- if .Values.pgpool.tls.enabled }} + - name: init-chmod-data + image: {{ template "postgresql-ha.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: + - /bin/sh + - -cx + - | + cp /tmp/certs/* /opt/bitnami/pgpool/certs/ + {{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }} + chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/pgpool/certs/ + {{- else }} + chown -R {{ .Values.pgpool.containerSecurityContext.runAsUser }}:{{ .Values.pgpool.podSecurityContext.fsGroup }} /opt/bitnami/pgpool/certs/ + {{- end }} + chmod 600 {{ template "postgresql-ha.pgpool.tlsCertKey" . }} + {{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }} + securityContext: {{- omit .Values.volumePermissions.podSecurityContext "runAsUser" | toYaml | nindent 12 }} + {{- else }} + securityContext: {{- .Values.volumePermissions.podSecurityContext | toYaml | nindent 12 }} + {{- end }} + volumeMounts: + - name: raw-certificates + mountPath: /tmp/certs + - name: pgpool-certificates + mountPath: /opt/bitnami/pgpool/certs + {{- end }} + {{- if .Values.pgpool.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.initContainers "context" $) | nindent 8 }} + {{- end }} + # Auxiliary vars to populate environment variables + {{- $postgresqlReplicaCount := int .Values.postgresql.replicaCount }} + {{- $postgresqlFullname := include "postgresql-ha.postgresql" . }} + {{- $postgresalContainerPort := int .Values.postgresql.containerPorts.postgresql }} + {{- $postgresqlHeadlessServiceName := printf "%s-headless" (include "postgresql-ha.postgresql" .) }} + containers: + - name: pgpool + image: {{ include "postgresql-ha.pgpool.image" . }} + imagePullPolicy: {{ .Values.pgpool.image.pullPolicy | quote }} + {{- if .Values.pgpool.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.pgpool.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.pgpool.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.pgpool.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.args "context" $) | nindent 12 }} + {{- end }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.pgpool.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" (or .Values.pgpool.image.debug .Values.diagnosticMode.enabled) | quote }} + {{- if or .Values.pgpool.customUsersSecret .Values.pgpool.customUsers }} + - name: PGPOOL_POSTGRES_CUSTOM_USERS + valueFrom: + secretKeyRef: + name: {{ include "postgresql-ha.pgpoolCustomUsersSecretName" . }} + key: usernames + - name: PGPOOL_POSTGRES_CUSTOM_PASSWORDS + valueFrom: + secretKeyRef: + name: {{ include "postgresql-ha.pgpoolCustomUsersSecretName" . }} + key: passwords + {{- end }} + - name: PGPOOL_BACKEND_NODES + value: {{ range $e, $i := until $postgresqlReplicaCount }}{{ $i }}:{{ $postgresqlFullname }}-{{ $i }}.{{ $postgresqlHeadlessServiceName }}:{{ $postgresalContainerPort }},{{ end }} + - name: PGPOOL_SR_CHECK_USER + value: {{ (include "postgresql-ha.postgresqlRepmgrUsername" .) | quote }} + {{- if .Values.postgresql.usePasswordFile }} + - name: PGPOOL_SR_CHECK_PASSWORD_FILE + value: "/opt/bitnami/pgpool/secrets/pgpool-sr-check-password" + {{- else }} + - name: PGPOOL_SR_CHECK_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql-ha.postgresqlSecretName" . }} + key: repmgr-password + {{- end }} + - name: PGPOOL_SR_CHECK_DATABASE + value: {{ .Values.pgpool.srCheckDatabase | quote }} + - name: PGPOOL_ENABLE_LDAP + value: {{ ternary "yes" "no" .Values.ldap.enabled | quote }} + {{- if .Values.ldap.enabled }} + - name: LDAP_URI + value: {{ .Values.ldap.uri | quote }} + - name: LDAP_BASE + value: {{ coalesce .Values.ldap.base .Values.ldap.basedn | quote }} + - name: LDAP_BIND_DN + value: {{ .Values.ldap.binddn | quote }} + - name: LDAP_BIND_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql-ha.ldapSecretName" . }} + key: bind-password + {{- if .Values.ldap.bslookup }} + - name: LDAP_BASE_LOOKUP + value: {{ .Values.ldap.bslookup | quote }} + {{- end }} + {{- if .Values.ldap.scope }} + - name: LDAP_SCOPE + value: {{ .Values.ldap.scope | quote }} + {{- end }} + {{- if .Values.ldap.tlsReqcert }} + - name: LDAP_TLS_REQCERT + value: {{ .Values.ldap.tlsReqcert | quote }} + {{- end }} + - name: LDAP_NSS_INITGROUPS_IGNOREUSERS + value: {{ .Values.ldap.nssInitgroupsIgnoreusers | quote }} + {{- end }} + - name: PGPOOL_POSTGRES_USERNAME + value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }} + {{- if .Values.postgresql.usePasswordFile }} + - name: PGPOOL_POSTGRES_PASSWORD_FILE + value: "/opt/bitnami/pgpool/secrets/pgpool-password" + {{- else }} + - name: PGPOOL_POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql-ha.postgresqlSecretName" . }} + key: password + {{- end }} + - name: PGPOOL_ADMIN_USERNAME + value: {{ (include "postgresql-ha.pgpoolAdminUsername" .) | quote }} + {{- if .Values.pgpool.usePasswordFile }} + - name: PGPOOL_ADMIN_PASSWORD_FILE + value: "/opt/bitnami/pgpool/secrets/admin-password" + {{- else }} + - name: PGPOOL_ADMIN_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql-ha.pgpoolSecretName" . }} + key: admin-password + {{- end }} + - name: PGPOOL_AUTHENTICATION_METHOD + value: {{ .Values.pgpool.authenticationMethod | quote }} + - name: PGPOOL_ENABLE_LOAD_BALANCING + value: {{ ternary "yes" "no" .Values.pgpool.useLoadBalancing | quote }} + {{- if .Values.pgpool.useLoadBalancing }} + - name: PGPOOL_DISABLE_LOAD_BALANCE_ON_WRITE + value: {{ .Values.pgpool.loadBalancingOnWrite }} + {{- end }} + - name: PGPOOL_ENABLE_LOG_CONNECTIONS + value: {{ ternary "yes" "no" .Values.pgpool.logConnections | quote }} + - name: PGPOOL_ENABLE_LOG_HOSTNAME + value: {{ ternary "yes" "no" .Values.pgpool.logHostname | quote }} + - name: PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT + value: {{ ternary "yes" "no" .Values.pgpool.logPerNodeStatement | quote }} + {{- if .Values.pgpool.logLinePrefix }} + - name: PGPOOL_LOG_LINE_PREFIX + value: {{ .Values.pgpool.logLinePrefix | quote }} + {{- end }} + {{- if .Values.pgpool.numInitChildren }} + - name: PGPOOL_NUM_INIT_CHILDREN + value: {{ .Values.pgpool.numInitChildren | quote }} + {{- end }} + {{- if .Values.pgpool.reservedConnections }} + - name: PGPOOL_RESERVED_CONNECTIONS + value: '{{ .Values.pgpool.reservedConnections }}' + {{- end }} + {{- if .Values.pgpool.maxPool }} + - name: PGPOOL_MAX_POOL + value: {{ .Values.pgpool.maxPool | quote }} + {{- end }} + {{- if .Values.pgpool.childMaxConnections }} + - name: PGPOOL_CHILD_MAX_CONNECTIONS + value: {{ .Values.pgpool.childMaxConnections | quote }} + {{- end }} + {{- $childlifetime := .Values.pgpool.childLifeTime | quote }} + {{- if or $childlifetime (eq "0" $childlifetime) }} + - name: PGPOOL_CHILD_LIFE_TIME + value: {{ $childlifetime }} + {{- end }} + {{- if .Values.pgpool.clientIdleLimit }} + - name: PGPOOL_CLIENT_IDLE_LIMIT + value: {{ .Values.pgpool.clientIdleLimit | quote }} + {{- end }} + {{- if .Values.pgpool.connectionLifeTime }} + - name: PGPOOL_CONNECTION_LIFE_TIME + value: {{ .Values.pgpool.connectionLifeTime | quote }} + {{- end }} + {{- if or .Values.pgpool.configuration .Values.pgpool.configurationCM }} + - name: PGPOOL_USER_CONF_FILE + value: "/opt/bitnami/pgpool/user_config/pgpool.conf" + {{- end }} + - name: PGPOOL_ENABLE_TLS + value: {{ ternary "yes" "no" .Values.pgpool.tls.enabled | quote }} + {{- if .Values.pgpool.tls.enabled }} + - name: PGPOOL_TLS_PREFER_SERVER_CIPHERS + value: {{ ternary "yes" "no" .Values.pgpool.tls.preferServerCiphers | quote }} + - name: PGPOOL_TLS_CERT_FILE + value: {{ template "postgresql-ha.pgpool.tlsCert" . }} + - name: PGPOOL_TLS_KEY_FILE + value: {{ template "postgresql-ha.pgpool.tlsCertKey" . }} + {{- if .Values.pgpool.tls.certCAFilename }} + - name: PGPOOL_TLS_CA_FILE + value: {{ template "postgresql-ha.pgpool.tlsCACert" . }} + {{- end }} + {{- end }} + {{- if .Values.pgpool.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + envFrom: + {{- if .Values.pgpool.extraEnvVarsCM }} + - configMapRef: + name: {{ .Values.pgpool.extraEnvVarsCM }} + {{- end }} + {{- if .Values.pgpool.extraEnvVarsSecret }} + - secretRef: + name: {{ .Values.pgpool.extraEnvVarsSecret }} + {{- end }} + ports: + - name: postgresql + containerPort: {{ .Values.pgpool.containerPorts.postgresql }} + protocol: TCP + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.pgpool.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.pgpool.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.pgpool.livenessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /opt/bitnami/scripts/pgpool/healthcheck.sh + {{- end }} + {{- if .Values.pgpool.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.pgpool.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.pgpool.readinessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - bash + - -ec + - PGPASSWORD=${PGPOOL_POSTGRES_PASSWORD} psql -U {{ (include "postgresql-ha.postgresqlUsername" .) | quote }} {{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }}{{- end }} -h /opt/bitnami/pgpool/tmp -tA -c "SELECT 1" >/dev/null + {{- end }} + {{- if .Values.pgpool.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.pgpool.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.pgpool.startupProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /opt/bitnami/scripts/pgpool/healthcheck.sh + {{- end }} + {{- end }} + {{- if .Values.pgpool.resources }} + resources: {{- toYaml .Values.pgpool.resources | nindent 12 }} + {{- end }} + volumeMounts: + {{- if or .Values.pgpool.configuration .Values.pgpool.configurationCM }} + - name: pgpool-config + mountPath: /opt/bitnami/pgpool/user_config/ + {{- end }} + {{- if or .Values.pgpool.initdbScripts .Values.pgpool.initdbScriptsCM }} + - name: custom-init-scripts + mountPath: /docker-entrypoint-initdb.d/ + {{- end }} + {{- if .Values.pgpool.initdbScriptsSecret }} + - name: custom-init-scripts-secret + mountPath: /docker-entrypoint-initdb.d/secret + {{- end }} + {{- if .Values.postgresql.usePasswordFile }} + - name: postgresql-password + subPath: pgpool-password + mountPath: /opt/bitnami/pgpool/secrets/pgpool-password + - name: postgresql-password + subPath: pgpool-sr-check-password + mountPath: /opt/bitnami/pgpool/secrets/pgpool-sr-check-password + {{- end }} + {{- if .Values.pgpool.usePasswordFile }} + - name: pgpool-password + subPath: admin-password + mountPath: /opt/bitnami/pgpool/secrets/admin-password + {{- end }} + {{- if .Values.pgpool.tls.enabled }} + - name: pgpool-certificates + mountPath: /opt/bitnami/pgpool/certs + {{- end }} + {{- if .Values.pgpool.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.pgpool.sidecars }} + {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.sidecars "context" $) | nindent 8 }} + {{- end }} + volumes: + {{- if or .Values.pgpool.configuration .Values.pgpool.configurationCM }} + - name: pgpool-config + configMap: + name: {{ include "postgresql-ha.pgpoolConfigurationCM" . }} + {{- end }} + {{- if or .Values.pgpool.initdbScripts .Values.pgpool.initdbScriptsCM }} + - name: custom-init-scripts + configMap: + name: {{ template "postgresql-ha.pgpoolInitdbScriptsCM" . }} + {{- end }} + {{- if .Values.pgpool.initdbScriptsSecret }} + - name: custom-init-scripts-secret + secret: + secretName: {{ template "postgresql-ha.pgpoolInitdbScriptsSecret" . }} + {{- end }} + {{- if .Values.postgresql.usePasswordFile }} + - name: postgresql-password + secret: + secretName: {{ include "postgresql-ha.postgresqlSecretName" . }} + items: + - key: postgresql-password + path: pgpool-password + - key: repmgr-password + path: pgpool-sr-check-password + {{- end }} + {{- if .Values.pgpool.usePasswordFile }} + - name: pgpool-password + secret: + secretName: {{ include "postgresql-ha.pgpoolSecretName" . }} + items: + - key: admin-password + path: admin-password + {{- end }} + {{- if .Values.pgpool.tls.enabled }} + - name: raw-certificates + secret: + secretName: {{ include "postgresql-ha.tlsSecretName" . }} + - name: pgpool-certificates + emptyDir: {} + {{- end }} + {{- if .Values.pgpool.extraVolumes }} + {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.extraVolumes "context" $) | nindent 8 }} + {{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/initdb-scripts-configmap.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/initdb-scripts-configmap.yaml new file mode 100644 index 0000000..d8e03ea --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/initdb-scripts-configmap.yaml @@ -0,0 +1,17 @@ +{{- if and .Values.pgpool.initdbScripts (not .Values.pgpool.initdbScriptsCM) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-initdb-scripts" (include "postgresql-ha.pgpool" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: pgpool + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.initdbScripts "context" $) | nindent 4 }} +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/pdb.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/pdb.yaml new file mode 100644 index 0000000..662052a --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/pdb.yaml @@ -0,0 +1,25 @@ +{{- if .Values.pgpool.pdb.create }} +apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} +kind: PodDisruptionBudget +metadata: + name: {{ include "postgresql-ha.pgpool" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: pgpool + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.pgpool.pdb.minAvailable }} + minAvailable: {{ .Values.pgpool.pdb.minAvailable }} + {{- end }} + {{- if .Values.pgpool.pdb.maxUnavailable }} + maxUnavailable: {{ .Values.pgpool.pdb.maxUnavailable }} + {{- end }} + selector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: pgpool +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/secrets.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/secrets.yaml new file mode 100644 index 0000000..db3d52e --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/secrets.yaml @@ -0,0 +1,18 @@ +{{- if (include "postgresql-ha.pgpoolCreateSecret" .) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "postgresql-ha.pgpool" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: pgpool + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: Opaque +data: + admin-password: {{ (include "postgresql-ha.pgpoolAdminPassword" .) | b64enc | quote }} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/service.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/service.yaml new file mode 100644 index 0000000..8bf91a2 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/pgpool/service.yaml @@ -0,0 +1,57 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "postgresql-ha.pgpool" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: pgpool + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.pgpool.serviceLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.pgpool.serviceLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if or .Values.service.annotations .Values.commonAnnotations }} + annotations: + {{- if .Values.service.annotations }} + {{- include "common.tplvalues.render" (dict "value" .Values.service.annotations "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} +spec: + type: {{ .Values.service.type }} + {{- if .Values.service.sessionAffinity }} + sessionAffinity: {{ .Values.service.sessionAffinity }} + {{- end }} + {{- if .Values.service.sessionAffinityConfig }} + sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.service.sessionAffinityConfig "context" $) | nindent 4 }} + {{- end }} + {{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort") }} + externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }} + {{- end }} + {{- if and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: {{- toYaml .Values.service.loadBalancerSourceRanges | nindent 4 }} + {{- end }} + {{- if and (not (empty .Values.service.loadBalancerIP)) (eq .Values.service.type "LoadBalancer") }} + loadBalancerIP: {{ .Values.service.loadBalancerIP }} + {{- end }} + {{- if and (eq .Values.service.type "ClusterIP") .Values.service.clusterIP }} + clusterIP: {{ .Values.service.clusterIP }} + {{- end }} + ports: + - name: {{ .Values.service.portName | quote }} + port: {{ .Values.service.ports.postgresql }} + targetPort: postgresql + protocol: TCP + {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.postgresql)) }} + nodePort: {{ .Values.service.nodePorts.postgresql }} + {{- else if eq .Values.service.type "ClusterIP" }} + nodePort: null + {{- end }} + {{- if .Values.service.extraPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }} + {{- end }} + selector: {{- include "common.labels.matchLabels" . | nindent 4 }} + app.kubernetes.io/component: pgpool diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/podsecuritypolicy.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/podsecuritypolicy.yaml new file mode 100644 index 0000000..1e5326e --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/podsecuritypolicy.yaml @@ -0,0 +1,43 @@ +{{- $pspAvailable := (semverCompare "<1.25-0" (include "common.capabilities.kubeVersion" .)) -}} +{{- if and $pspAvailable .Values.psp.create }} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ template "common.names.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + privileged: false + allowedCapabilities: + - CHOWN + volumes: + - 'configMap' + - 'secret' + - 'persistentVolumeClaim' + - 'emptyDir' + - 'projected' + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + rule: 'RunAsAny' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + readOnlyRootFilesystem: false +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/configmap.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/configmap.yaml new file mode 100644 index 0000000..17a581b --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/configmap.yaml @@ -0,0 +1,28 @@ +{{- if and (or .Values.postgresql.repmgrConfiguration .Values.postgresql.configuration .Values.postgresql.pgHbaConfiguration) (not .Values.postgresql.configurationCM) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-configuration" (include "postgresql-ha.postgresql" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: postgresql + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + {{- if .Values.postgresql.repmgrConfiguration }} + repmgr.conf: |- + {{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.repmgrConfiguration "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.postgresql.configuration }} + postgresql.conf: |- + {{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.configuration "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.postgresql.pgHbaConfiguration }} + pg_hba.conf: |- + {{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.pgHbaConfiguration "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/extended-configmap.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/extended-configmap.yaml new file mode 100644 index 0000000..bc7c818 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/extended-configmap.yaml @@ -0,0 +1,18 @@ +{{- if and .Values.postgresql.extendedConf (not .Values.postgresql.extendedConfCM) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-extended-configuration" (include "postgresql-ha.postgresql" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: postgresql + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + override.conf: |- + {{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.extendedConf "context" $ ) | nindent 4 }} +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/hooks-scripts-configmap.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/hooks-scripts-configmap.yaml new file mode 100644 index 0000000..61b3464 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/hooks-scripts-configmap.yaml @@ -0,0 +1,73 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-hooks-scripts" (include "postgresql-ha.postgresql" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: postgresql + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + pre-stop.sh: |- + #!/bin/bash + set -o errexit + set -o pipefail + set -o nounset + + # Debug section + exec 3>&1 + exec 4>&2 + + # Load Libraries + . /opt/bitnami/scripts/liblog.sh + . /opt/bitnami/scripts/libpostgresql.sh + . /opt/bitnami/scripts/librepmgr.sh + + # Load PostgreSQL & repmgr environment variables + . /opt/bitnami/scripts/postgresql-env.sh + + # Auxiliary functions + is_new_primary_ready() { + return_value=1 + currenty_primary_node="$(repmgr_get_primary_node)" + currenty_primary_host="$(echo $currenty_primary_node | awk '{print $1}')" + + info "$currenty_primary_host != $REPMGR_NODE_NETWORK_NAME" + if [[ $(echo $currenty_primary_node | wc -w) -eq 2 ]] && [[ "$currenty_primary_host" != "$REPMGR_NODE_NETWORK_NAME" ]]; then + info "New primary detected, leaving the cluster..." + return_value=0 + else + info "Waiting for a new primary to be available..." + fi + return $return_value + } + + export MODULE="pre-stop-hook" + + if [[ "${BITNAMI_DEBUG}" == "true" ]]; then + info "Bash debug is on" + else + info "Bash debug is off" + exec 1>/dev/null + exec 2>/dev/null + fi + + postgresql_enable_nss_wrapper + + # Prepare env vars for managing roles + readarray -t primary_node < <(repmgr_get_upstream_node) + primary_host="${primary_node[0]}" + + # Stop postgresql for graceful exit. + postgresql_stop + + if [[ -z "$primary_host" ]] || [[ "$primary_host" == "$REPMGR_NODE_NETWORK_NAME" ]]; then + info "Primary node need to wait for a new primary node before leaving the cluster" + retry_while is_new_primary_ready 10 5 + else + info "Standby node doesn't need to wait, leaving the cluster." + fi diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/initdb-scripts-configmap.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/initdb-scripts-configmap.yaml new file mode 100644 index 0000000..e916778 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/initdb-scripts-configmap.yaml @@ -0,0 +1,17 @@ +{{- if and .Values.postgresql.initdbScripts (not .Values.postgresql.initdbScriptsCM) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-initdb-scripts" (include "postgresql-ha.postgresql" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: postgresql + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.initdbScripts "context" $) | nindent 4 }} +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/metrics-service.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/metrics-service.yaml new file mode 100644 index 0000000..7b03e90 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/metrics-service.yaml @@ -0,0 +1,49 @@ +{{- if .Values.metrics.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ printf "%s-metrics" (include "postgresql-ha.postgresql" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: postgresql + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.selector }} + {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 4 }} + {{- end }} + {{- if or .Values.metrics.annotations .Values.commonAnnotations }} + annotations: + {{- if .Values.metrics.annotations }} + {{- include "common.tplvalues.render" (dict "value" .Values.metrics.annotations "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} +spec: + type: {{ .Values.metrics.service.type }} + {{- if (or (eq .Values.metrics.service.type "LoadBalancer") (eq .Values.metrics.service.type "NodePort")) }} + externalTrafficPolicy: {{ .Values.metrics.service.externalTrafficPolicy | quote }} + {{- end }} + {{ if .Values.metrics.service.clusterIP }} + clusterIP: {{ .Values.metrics.service.clusterIP }} + {{ end }} + {{ if eq .Values.metrics.service.type "LoadBalancer" }} + loadBalancerSourceRanges: {{ .Values.metrics.service.loadBalancerSourceRanges }} + {{ end }} + {{- if (and (eq .Values.metrics.service.type "LoadBalancer") (not (empty .Values.metrics.service.loadBalancerIP))) }} + loadBalancerIP: {{ .Values.metrics.service.loadBalancerIP }} + {{- end }} + ports: + - name: metrics + port: {{ .Values.metrics.service.ports.metrics }} + targetPort: metrics + {{- if (and (or (eq .Values.metrics.service.type "NodePort") (eq .Values.metrics.service.type "LoadBalancer")) (not (empty .Values.metrics.service.nodePorts.metrics))) }} + nodePort: {{ .Values.metrics.service.nodePorts.metrics }} + {{- else if eq .Values.metrics.service.type "ClusterIP" }} + nodePort: null + {{- end }} + selector: {{- include "common.labels.matchLabels" . | nindent 4 }} + app.kubernetes.io/component: postgresql +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/pdb.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/pdb.yaml new file mode 100644 index 0000000..1eafae7 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/pdb.yaml @@ -0,0 +1,25 @@ +{{- if .Values.postgresql.pdb.create }} +apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} +kind: PodDisruptionBudget +metadata: + name: {{ include "postgresql-ha.postgresql" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: postgresql + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.postgresql.pdb.minAvailable }} + minAvailable: {{ .Values.postgresql.pdb.minAvailable }} + {{- end }} + {{- if .Values.postgresql.pdb.maxUnavailable }} + maxUnavailable: {{ .Values.postgresql.pdb.maxUnavailable }} + {{- end }} + selector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: postgresql +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/secrets.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/secrets.yaml new file mode 100644 index 0000000..961c806 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/secrets.yaml @@ -0,0 +1,22 @@ +{{- if (include "postgresql-ha.postgresqlCreateSecret" .) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "postgresql-ha.postgresql" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: postgresql + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: Opaque +data: + {{- if and (include "postgresql-ha.postgresqlPostgresPassword" .) (not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres")) }} + postgres-password: {{ include "postgresql-ha.postgresqlPostgresPassword" . | b64enc | quote }} + {{- end }} + password: {{ (include "postgresql-ha.postgresqlPassword" .) | b64enc | quote }} + repmgr-password: {{ (include "postgresql-ha.postgresqlRepmgrPassword" .) | b64enc | quote }} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/service-headless.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/service-headless.yaml new file mode 100644 index 0000000..6369edf --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/service-headless.yaml @@ -0,0 +1,22 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ printf "%s-headless" (include "postgresql-ha.postgresql" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + clusterIP: None + ports: + - name: {{ .Values.service.portName | quote }} + port: {{ .Values.postgresql.containerPorts.postgresql }} + targetPort: postgresql + protocol: TCP + selector: {{- include "common.labels.matchLabels" . | nindent 4 }} + app.kubernetes.io/component: postgresql diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/service.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/service.yaml new file mode 100644 index 0000000..d8318e8 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/service.yaml @@ -0,0 +1,34 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "postgresql-ha.postgresql" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: postgresql + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.service.serviceLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.service.serviceLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if or .Values.service.annotations .Values.commonAnnotations }} + annotations: + {{- if .Values.service.annotations }} + {{- include "common.tplvalues.render" (dict "value" .Values.service.annotations "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} +spec: + type: ClusterIP + ports: + - name: {{ .Values.service.portName | quote }} + port: {{ .Values.service.ports.postgresql }} + targetPort: postgresql + protocol: TCP + {{- if .Values.service.extraPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }} + {{- end }} + selector: {{- include "common.labels.matchLabels" . | nindent 4 }} + app.kubernetes.io/component: postgresql diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/servicemonitor.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/servicemonitor.yaml new file mode 100644 index 0000000..ea1242a --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/servicemonitor.yaml @@ -0,0 +1,54 @@ +{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "postgresql-ha.postgresql" . }} + namespace: {{ coalesce .Values.metrics.serviceMonitor.namespace (include "common.names.namespace" .) | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: postgresql + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.labels }} + {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.labels "context" $) | nindent 4 }} + {{- end }} + {{- if or .Values.commonAnnotations .Values.metrics.serviceMonitor.annotations }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.annotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.annotations "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} +spec: + {{- if .Values.metrics.serviceMonitor.jobLabel }} + jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }} + {{- end }} + selector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} + {{- if .Values.metrics.serviceMonitor.selector }} + {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }} + {{- end }} + app.kubernetes.io/component: postgresql + endpoints: + - port: metrics + {{- if .Values.metrics.serviceMonitor.interval }} + interval: {{ .Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.honorLabels }} + honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.metricRelabelings }} + metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.relabelings }} + relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 8 }} + {{- end }} + namespaceSelector: + matchNames: + - {{ include "common.names.namespace" . | quote }} +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/statefulset.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/statefulset.yaml new file mode 100644 index 0000000..f61c03c --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/postgresql/statefulset.yaml @@ -0,0 +1,606 @@ +apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} +kind: StatefulSet +metadata: + name: {{ include "postgresql-ha.postgresql" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: postgresql + {{- if .Values.postgresql.labels }} + {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.labels "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + replicas: {{ .Values.postgresql.replicaCount }} + podManagementPolicy: Parallel + serviceName: {{ printf "%s-headless" (include "postgresql-ha.postgresql" .) }} + updateStrategy: {{- toYaml .Values.postgresql.updateStrategy | nindent 4 }} + selector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: postgresql + template: + metadata: + labels: {{- include "common.labels.standard" . | nindent 8 }} + app.kubernetes.io/component: postgresql + {{- if .Values.postgresql.podLabels }} + {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.podLabels "context" $) | nindent 8 }} + {{- end }} + {{- if or .Values.postgresql.podAnnotations (and .Values.metrics.enabled .Values.metrics.annotations) }} + annotations: + {{- if .Values.postgresql.podAnnotations }} + {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.podAnnotations "context" $) | nindent 8 }} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.annotations }} + {{- include "common.tplvalues.render" (dict "value" .Values.metrics.annotations "context" $) | nindent 8 }} + {{- end }} + {{- end }} + spec: + {{- include "postgresql-ha.image.pullSecrets" . | nindent 6 }} + {{- if .Values.postgresql.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.postgresql.affinity }} + affinity: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.postgresql.podAffinityPreset "component" "postgresql" "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.postgresql.podAntiAffinityPreset "component" "postgresql" "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.postgresql.nodeAffinityPreset.type "key" .Values.postgresql.nodeAffinityPreset.key "values" .Values.postgresql.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.postgresql.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.postgresql.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.tolerations "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.postgresql.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.postgresql.priorityClassName }} + priorityClassName: {{ .Values.postgresql.priorityClassName | quote }} + {{- end }} + {{- if .Values.postgresql.schedulerName }} + schedulerName: {{ .Values.postgresql.schedulerName }} + {{- end }} + {{- if .Values.postgresql.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.postgresql.terminationGracePeriodSeconds }} + {{- end }} + {{- if .Values.postgresql.podSecurityContext.enabled }} + securityContext: {{- omit .Values.postgresql.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.serviceAccount.create }} + serviceAccountName: {{ include "postgresql-ha.serviceAccountName" . }} + {{- end }} + hostNetwork: {{ .Values.postgresql.hostNetwork }} + hostIPC: {{ .Values.postgresql.hostIPC }} + initContainers: + {{- if .Values.postgresql.tls.enabled }} + - name: init-chmod-tls + image: {{ template "postgresql-ha.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: + - /bin/sh + - -cx + - | + cp /tmp/certs/* /opt/bitnami/postgresql/certs/ + {{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }} + chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/postgresql/certs/ + {{- else }} + chown -R {{ .Values.postgresql.containerSecurityContext.runAsUser }}:{{ .Values.postgresql.podSecurityContext.fsGroup }} /opt/bitnami/postgresql/certs/ + {{- end }} + chmod 600 {{ template "postgresql-ha.postgresql.tlsCertKey" . }} + {{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }} + securityContext: {{- omit .Values.volumePermissions.podSecurityContext "runAsUser" | toYaml | nindent 12 }} + {{- else }} + securityContext: {{- .Values.volumePermissions.podSecurityContext | toYaml | nindent 12 }} + {{- end }} + volumeMounts: + - name: raw-certificates + mountPath: /tmp/certs + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + {{- end }} + {{- if and .Values.volumePermissions.enabled (or (or (not (empty .Values.postgresql.extendedConf)) (not (empty .Values.postgresql.extendedConfCM))) .Values.persistence.enabled) }} + - name: init-chmod-data + image: {{ include "postgresql-ha.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: + - sh + - -c + - | + mkdir -p {{ .Values.persistence.mountPath }}/conf {{ .Values.persistence.mountPath }}/data {{ .Values.persistence.mountPath }}/lock + chmod 700 {{ .Values.persistence.mountPath }}/conf {{ .Values.persistence.mountPath }}/data {{ .Values.persistence.mountPath }}/lock + chown {{ .Values.postgresql.containerSecurityContext.runAsUser }}:{{ .Values.postgresql.podSecurityContext.fsGroup }} {{ .Values.persistence.mountPath }} + find {{ .Values.persistence.mountPath }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | \ + xargs -r chown -R {{ .Values.postgresql.containerSecurityContext.runAsUser }}:{{ .Values.postgresql.podSecurityContext.fsGroup }} + securityContext: {{- .Values.volumePermissions.podSecurityContext | toYaml | nindent 12 }} + {{- if .Values.volumePermissions.resources }} + resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} + {{- end }} + volumeMounts: + - name: data + mountPath: {{ .Values.persistence.mountPath }} + {{- end }} + {{- if or .Values.postgresql.initContainers .Values.postgresql.extraInitContainers }} + {{- include "common.tplvalues.render" ( dict "value" (coalesce .Values.postgresql.initContainers .Values.postgresql.extraInitContainers) "context" $ ) | nindent 8 }} + {{- end }} + containers: + - name: postgresql + image: {{ include "postgresql-ha.postgresql.image" . }} + imagePullPolicy: {{ .Values.postgresql.image.pullPolicy | quote }} + {{- if .Values.postgresql.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.postgresql.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.postgresql.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.lifecycleHooks "context" $) | nindent 12 }} + {{- else }} + lifecycle: + preStop: + exec: + command: + - /pre-stop.sh + {{- end }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.postgresql.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.postgresql.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.args "context" $) | nindent 12 }} + {{- end }} + # Auxiliary vars to populate environment variables + {{- $postgresqlReplicaCount := int .Values.postgresql.replicaCount }} + {{- $postgresqlFullname := include "postgresql-ha.postgresql" . }} + {{- $postgresqlHeadlessServiceName := printf "%s-headless" (include "postgresql-ha.postgresql" .) }} + {{- $clusterDomain:= .Values.clusterDomain }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" (or .Values.postgresql.image.debug .Values.diagnosticMode.enabled) | quote }} + # PostgreSQL configuration + - name: POSTGRESQL_VOLUME_DIR + value: {{ .Values.persistence.mountPath | quote }} + - name: PGDATA + value: {{ printf "%s/%s" .Values.persistence.mountPath "data" | quote }} + {{- if and (or (not (include "postgresql-ha.postgresqlCreateSecret" .)) (include "postgresql-ha.postgresqlPasswordProvided" .)) (not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres")) }} + {{- if .Values.postgresql.usePasswordFile }} + - name: POSTGRES_POSTGRES_PASSWORD_FILE + value: "/opt/bitnami/postgresql/secrets/postgres-password" + {{- else }} + - name: POSTGRES_POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "postgresql-ha.postgresqlSecretName" . }} + key: postgres-password + {{- end }} + {{- end }} + - name: POSTGRES_USER + value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }} + {{- if .Values.postgresql.usePasswordFile }} + - name: POSTGRES_PASSWORD_FILE + value: "/opt/bitnami/postgresql/secrets/password" + {{- else }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql-ha.postgresqlSecretName" . }} + {{- if (include "postgresql-ha.postgresqlCreateSecret" .) }} + key: password + {{- else }} + {{- if ( index ( lookup "v1" "Secret" (include "common.names.namespace" .) (include "postgresql-ha.postgresqlSecretName" .) ) ".data.postgres-password" ) }} + key: postgres-password + {{- else }} + key: password + {{- end }} + {{- end }} + {{- end }} + {{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} + - name: POSTGRES_DB + value: {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} + {{- end }} + - name: POSTGRESQL_LOG_HOSTNAME + value: {{ .Values.postgresql.audit.logHostname | quote }} + - name: POSTGRESQL_LOG_CONNECTIONS + value: {{ .Values.postgresql.audit.logConnections | quote }} + - name: POSTGRESQL_LOG_DISCONNECTIONS + value: {{ .Values.postgresql.audit.logDisconnections | quote }} + {{- if .Values.postgresql.audit.logLinePrefix }} + - name: POSTGRESQL_LOG_LINE_PREFIX + value: {{ .Values.postgresql.audit.logLinePrefix | quote }} + {{- end }} + {{- if .Values.postgresql.audit.logTimezone }} + - name: POSTGRESQL_LOG_TIMEZONE + value: {{ .Values.postgresql.audit.logTimezone | quote }} + {{- end }} + {{- if .Values.postgresql.audit.pgAuditLog }} + - name: POSTGRESQL_PGAUDIT_LOG + value: {{ .Values.postgresql.audit.pgAuditLog | quote }} + {{- end }} + - name: POSTGRESQL_PGAUDIT_LOG_CATALOG + value: {{ .Values.postgresql.audit.pgAuditLogCatalog | quote }} + - name: POSTGRESQL_CLIENT_MIN_MESSAGES + value: {{ .Values.postgresql.audit.clientMinMessages | quote }} + - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES + value: {{ .Values.postgresql.sharedPreloadLibraries | quote }} + {{- if .Values.postgresql.maxConnections }} + - name: POSTGRESQL_MAX_CONNECTIONS + value: {{ .Values.postgresql.maxConnections | quote }} + {{- end }} + {{- if .Values.postgresql.usePgRewind }} + - name: REPMGR_USE_PGREWIND + value: {{ .Values.postgresql.usePgRewind | quote }} + {{- end }} + {{- if .Values.postgresql.postgresConnectionLimit }} + - name: POSTGRESQL_POSTGRES_CONNECTION_LIMIT + value: {{ .Values.postgresql.postgresConnectionLimit | quote }} + {{- end }} + {{- if .Values.postgresql.dbUserConnectionLimit }} + - name: POSTGRESQL_USERNAME_CONNECTION_LIMIT + value: {{ .Values.postgresql.dbUserConnectionLimit | quote }} + {{- end }} + {{- if .Values.postgresql.tcpKeepalivesInterval }} + - name: POSTGRESQL_TCP_KEEPALIVES_INTERVAL + value: {{ .Values.postgresql.tcpKeepalivesInterval | quote }} + {{- end }} + {{- if .Values.postgresql.tcpKeepalivesIdle }} + - name: POSTGRESQL_TCP_KEEPALIVES_IDLE + value: {{ .Values.postgresql.tcpKeepalivesIdle | quote }} + {{- end }} + {{- if .Values.postgresql.tcpKeepalivesCount }} + - name: POSTGRESQL_TCP_KEEPALIVES_COUNT + value: {{ .Values.postgresql.tcpKeepalivesCount | quote }} + {{- end }} + {{- if .Values.postgresql.statementTimeout }} + - name: POSTGRESQL_STATEMENT_TIMEOUT + value: {{ .Values.postgresql.statementTimeout | quote }} + {{- end }} + {{- if .Values.postgresql.pghbaRemoveFilters }} + - name: POSTGRESQL_PGHBA_REMOVE_FILTERS + value: {{ .Values.postgresql.pghbaRemoveFilters | quote }} + {{- end }} + - name: POSTGRESQL_ENABLE_TLS + value: {{ ternary "yes" "no" .Values.postgresql.tls.enabled | quote }} + {{- if .Values.postgresql.tls.enabled }} + - name: POSTGRESQL_TLS_PREFER_SERVER_CIPHERS + value: {{ ternary "yes" "no" .Values.postgresql.tls.preferServerCiphers | quote }} + - name: POSTGRESQL_TLS_CERT_FILE + value: {{ template "postgresql-ha.postgresql.tlsCert" . }} + - name: POSTGRESQL_TLS_KEY_FILE + value: {{ template "postgresql-ha.postgresql.tlsCertKey" . }} + {{- end }} + - name: POSTGRESQL_PORT_NUMBER + value: {{ .Values.postgresql.containerPorts.postgresql | quote }} + # Repmgr configuration + - name: REPMGR_PORT_NUMBER + value: {{ .Values.postgresql.containerPorts.postgresql | quote }} + - name: REPMGR_PRIMARY_PORT + value: {{ .Values.postgresql.containerPorts.postgresql | quote }} + - name: MY_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: REPMGR_UPGRADE_EXTENSION + value: {{ ternary "yes" "no" .Values.postgresql.upgradeRepmgrExtension | quote }} + - name: REPMGR_PGHBA_TRUST_ALL + value: {{ ternary "yes" "no" .Values.postgresql.pgHbaTrustAll | quote }} + - name: REPMGR_MOUNTED_CONF_DIR + value: "/bitnami/repmgr/conf" + - name: REPMGR_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: REPMGR_PARTNER_NODES + value: {{ range $e, $i := until $postgresqlReplicaCount }}{{ $postgresqlFullname }}-{{ $i }}.{{ $postgresqlHeadlessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }},{{ end }} + - name: REPMGR_PRIMARY_HOST + value: {{ printf "%s-0.%s.$(REPMGR_NAMESPACE).svc.%s" $postgresqlFullname $postgresqlHeadlessServiceName $clusterDomain | quote }} + - name: REPMGR_NODE_NAME + value: "$(MY_POD_NAME)" + - name: REPMGR_NODE_NETWORK_NAME + value: "$(MY_POD_NAME).{{ $postgresqlHeadlessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }}" + - name: REPMGR_LOG_LEVEL + value: {{ .Values.postgresql.repmgrLogLevel | quote }} + - name: REPMGR_CONNECT_TIMEOUT + value: {{ .Values.postgresql.repmgrConnectTimeout | quote }} + - name: REPMGR_RECONNECT_ATTEMPTS + value: {{ .Values.postgresql.repmgrReconnectAttempts | quote }} + - name: REPMGR_RECONNECT_INTERVAL + value: {{ .Values.postgresql.repmgrReconnectInterval | quote }} + - name: REPMGR_USERNAME + value: {{ (include "postgresql-ha.postgresqlRepmgrUsername" .) | quote }} + {{- if .Values.postgresql.usePasswordFile }} + - name: REPMGR_PASSWORD_FILE + value: "/opt/bitnami/postgresql/secrets/repmgr-password" + {{- else }} + - name: REPMGR_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql-ha.postgresqlSecretName" . }} + key: repmgr-password + {{- end }} + {{- if .Values.postgresql.repmgrUsePassfile }} + - name: REPMGR_USE_PASSFILE + value: {{ ternary "true" "false" .Values.postgresql.repmgrUsePassfile | quote }} + - name: REPMGR_PASSFILE_PATH + value: {{ default "/opt/bitnami/repmgr/conf/.pgpass" .Values.postgresql.repmgrPassfilePath }} + {{- end }} + {{- if (include "postgresql-ha.repmgrDatabase" .) }} + - name: REPMGR_DATABASE + value: {{ (include "postgresql-ha.repmgrDatabase" .) | quote }} + {{- end }} + - name: REPMGR_FENCE_OLD_PRIMARY + value: {{ ternary "yes" "no" .Values.postgresql.repmgrFenceOldPrimary | quote }} + {{- if .Values.postgresql.repmgrChildNodesCheckInterval }} + - name: REPMGR_CHILD_NODES_CHECK_INTERVAL + value: {{ .Values.postgresql.repmgrChildNodesCheckInterval | quote }} + {{- end }} + {{- if .Values.postgresql.repmgrChildNodesConnectedMinCount }} + - name: REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT + value: {{ .Values.postgresql.repmgrChildNodesConnectedMinCount | quote }} + {{- end }} + {{- if .Values.postgresql.repmgrChildNodesDisconnectTimeout }} + - name: REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT + value: {{ .Values.postgresql.repmgrChildNodesDisconnectTimeout | quote }} + {{- end }} + {{- if .Values.postgresql.syncReplication }} + - name: POSTGRESQL_NUM_SYNCHRONOUS_REPLICAS + value: {{ sub (int .Values.postgresql.replicaCount) 1 | quote }} + {{- end }} + {{- if .Values.postgresql.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + envFrom: + {{- if .Values.postgresql.extraEnvVarsCM }} + - configMapRef: + name: {{ .Values.postgresql.extraEnvVarsCM }} + {{- end }} + {{- if .Values.postgresql.extraEnvVarsSecret }} + - secretRef: + name: {{ .Values.postgresql.extraEnvVarsSecret }} + {{- end }} + ports: + - name: postgresql + containerPort: {{ .Values.postgresql.containerPorts.postgresql }} + protocol: TCP + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.postgresql.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.postgresql.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.postgresql.livenessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - bash + - -ec + - '{{ include "postgresql-ha.pgpassword" . }} psql -w -U {{ include "postgresql-ha.postgresqlUsername" . | quote }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} -h 127.0.0.1 -p {{ .Values.postgresql.containerPorts.postgresql }} -c "SELECT 1"' + {{- end }} + {{- if .Values.postgresql.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.postgresql.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.postgresql.readinessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - bash + - -ec + - '{{ include "postgresql-ha.pgpassword" . }} psql -w -U {{ include "postgresql-ha.postgresqlUsername" . | quote }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} -h 127.0.0.1 -p {{ .Values.postgresql.containerPorts.postgresql }} -c "SELECT 1"' + {{- end }} + {{- if .Values.postgresql.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.postgresql.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.postgresql.startupProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - bash + - -ec + - '{{ include "postgresql-ha.pgpassword" . }} psql -w -U {{ include "postgresql-ha.postgresqlUsername" . | quote }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} -h 127.0.0.1 -p {{ .Values.postgresql.containerPorts.postgresql }} -c "SELECT 1"' + {{- end }} + {{- end }} + {{- if .Values.postgresql.resources }} + resources: {{- toYaml .Values.postgresql.resources | nindent 12 }} + {{- end }} + volumeMounts: + {{- if or .Values.postgresql.repmgrConfiguration .Values.postgresql.configuration .Values.postgresql.pgHbaConfiguration .Values.postgresql.configurationCM }} + - name: postgresql-config + mountPath: /bitnami/repmgr/conf + {{- end }} + {{- if or .Values.postgresql.extendedConf .Values.postgresql.extendedConfCM }} + - name: postgresql-extended-config + mountPath: /bitnami/postgresql/conf/conf.d/ + {{- end }} + {{- if or .Values.postgresql.initdbScriptsCM .Values.postgresql.initdbScripts }} + - name: custom-init-scripts + mountPath: /docker-entrypoint-initdb.d/ + {{- end }} + {{- if .Values.postgresql.initdbScriptsSecret }} + - name: custom-init-scripts-secret + mountPath: /docker-entrypoint-initdb.d/secret + {{- end }} + {{- if .Values.postgresql.usePasswordFile }} + - name: password + mountPath: /opt/bitnami/postgresql/secrets/ + {{- end }} + {{- if .Values.postgresql.tls.enabled }} + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + {{- end }} + - name: data + mountPath: {{ .Values.persistence.mountPath }} + - name: hooks-scripts + mountPath: /pre-stop.sh + subPath: pre-stop.sh + {{- if .Values.postgresql.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.metrics.enabled }} + - name: metrics + image: {{ include "postgresql-ha.metrics.image" . }} + imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} + {{- if .Values.metrics.podSecurityContext.enabled }} + securityContext: {{- omit .Values.metrics.podSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + env: + - name: PG_EXPORTER_WEB_LISTEN_ADDRESS + value: :{{ .Values.metrics.containerPorts.http }} + - name: DATA_SOURCE_URI + value: {{ printf "127.0.0.1:%d/%s?sslmode=disable" (.Values.postgresql.containerPorts.postgresql | int64) (include "postgresql-ha.postgresqlDatabase" .) | quote }} + {{- if .Values.postgresql.usePasswordFile }} + - name: DATA_SOURCE_PASS_FILE + value: "/opt/bitnami/postgresql/secrets/password" + {{- else }} + - name: DATA_SOURCE_PASS + valueFrom: + secretKeyRef: + name: {{ include "postgresql-ha.postgresqlSecretName" . }} + key: password + {{- end }} + - name: DATA_SOURCE_USER + value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }} + {{- if .Values.metrics.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + envFrom: + {{- if .Values.metrics.extraEnvVarsCM }} + - configMapRef: + name: {{ .Values.metrics.extraEnvVarsCM }} + {{- end }} + {{- if .Values.metrics.extraEnvVarsSecret }} + - secretRef: + name: {{ .Values.metrics.extraEnvVarsSecret }} + {{- end }} + ports: + - name: metrics + containerPort: {{ .Values.metrics.containerPorts.http }} + protocol: TCP + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.metrics.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: metrics + {{- end }} + {{- if .Values.metrics.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: metrics + {{- end }} + {{- if .Values.metrics.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: metrics + {{- end }} + {{- end }} + {{- if .Values.metrics.resources }} + resources: {{- toYaml .Values.metrics.resources | nindent 12 }} + {{- end }} + volumeMounts: + {{- if .Values.postgresql.usePasswordFile }} + - name: password + mountPath: /opt/bitnami/postgresql/secrets/ + {{- end }} + {{- if .Values.metrics.customMetrics }} + - name: custom-metrics + mountPath: /conf + readOnly: true + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else }} + args: ["--extend.query-path", "/conf/custom-metrics.yaml"] + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.postgresql.sidecars }} + {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.sidecars "context" $) | nindent 8 }} + {{- end }} + volumes: + {{- if .Values.postgresql.extraVolumes }} + {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.extraVolumes "context" $) | nindent 8 }} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.customMetrics }} + - name: custom-metrics + configMap: + name: {{ include "postgresql.metricsCM" . }} + {{- end }} + - name: hooks-scripts + configMap: + name: {{ printf "%s-hooks-scripts" (include "postgresql-ha.postgresql" .) }} + defaultMode: 0755 + {{- if or .Values.postgresql.repmgrConfiguration .Values.postgresql.configuration .Values.postgresql.pgHbaConfiguration .Values.postgresql.configurationCM }} + - name: postgresql-config + configMap: + name: {{ include "postgresql-ha.postgresqlConfigurationCM" . }} + {{- end }} + {{- if or .Values.postgresql.extendedConf .Values.postgresql.extendedConfCM }} + - name: postgresql-extended-config + configMap: + name: {{ template "postgresql-ha.postgresqlExtendedConfCM" . }} + {{- end }} + {{- if .Values.postgresql.initdbScriptsSecret }} + - name: custom-init-scripts-secret + secret: + secretName: {{ template "postgresql-ha.postgresqlInitdbScriptsSecret" . }} + {{- end }} + {{- if .Values.postgresql.usePasswordFile }} + - name: password + secret: + secretName: {{ include "postgresql-ha.postgresqlSecretName" . }} + {{- end }} + {{- if or .Values.postgresql.initdbScriptsCM .Values.postgresql.initdbScripts }} + - name: custom-init-scripts + configMap: + name: {{ template "postgresql-ha.postgresqlInitdbScriptsCM" . }} + {{- end }} + {{- if .Values.postgresql.tls.enabled }} + - name: raw-certificates + secret: + secretName: {{ required "A secret containing TLS certificates is required when TLS is enabled" .Values.postgresql.tls.certificatesSecret }} + - name: postgresql-certificates + emptyDir: {} + {{- end }} + {{- if and .Values.persistence.enabled .Values.persistence.existingClaim }} + - name: data + persistentVolumeClaim: + {{- with .Values.persistence.existingClaim }} + claimName: {{ tpl . $ }} + {{- end }} + {{- else if not .Values.persistence.enabled }} + - name: data + emptyDir: {} + {{- else if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} + volumeClaimTemplates: + - metadata: + name: data + {{- if .Values.persistence.annotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.annotations "context" $) | nindent 10 }} + {{- end }} + {{- if .Values.persistence.labels }} + labels: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.labels "context" $) | nindent 10 }} + {{- end }} + spec: + accessModes: + {{- range .Values.persistence.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.persistence.size | quote }} + {{- if .Values.persistence.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.selector "context" $) | nindent 10 }} + {{- end -}} + {{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 8 }} + {{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/role.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/role.yaml new file mode 100644 index 0000000..93117a1 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/role.yaml @@ -0,0 +1,26 @@ +{{- if .Values.rbac.create }} +kind: Role +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ template "common.names.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +rules: + {{- $pspAvailable := (semverCompare "<1.25-0" (include "common.capabilities.kubeVersion" .)) -}} + {{- if and $pspAvailable .Values.psp.create }} + - apiGroups: ["extensions"] + resources: ["podsecuritypolicies"] + verbs: ["use"] + resourceNames: + - {{ template "common.names.fullname" . }} + {{- end }} + {{- if .Values.rbac.rules }} + {{- include "common.tplvalues.render" ( dict "value" .Values.rbac.rules "context" $ ) | nindent 2 }} + {{- end }} +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/rolebinding.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/rolebinding.yaml new file mode 100644 index 0000000..d8eb568 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/rolebinding.yaml @@ -0,0 +1,22 @@ +{{- if .Values.rbac.create }} +kind: RoleBinding +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ template "common.names.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +roleRef: + kind: Role + name: {{ template "common.names.fullname" . }} + apiGroup: rbac.authorization.k8s.io +subjects: + - kind: ServiceAccount + name: {{ default (include "common.names.fullname" . ) .Values.serviceAccount.name }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/serviceaccount.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/serviceaccount.yaml new file mode 100644 index 0000000..0ed017a --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/serviceaccount.yaml @@ -0,0 +1,21 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "postgresql-ha.serviceAccountName" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.serviceAccount.annotations }} + {{- include "common.tplvalues.render" (dict "value" .Values.serviceAccount.annotations "context" $) | nindent 4 }} + {{- end }} + {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} +{{- end -}} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/templates/tls-secrets.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/tls-secrets.yaml new file mode 100644 index 0000000..24a9d78 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/templates/tls-secrets.yaml @@ -0,0 +1,26 @@ +{{- if (include "postgresql-ha.createTlsSecret" . ) }} +{{- $ca := genCA "postgresql-ha-internal-ca" 365 }} +{{- $fullname := include "postgresql-ha.pgpool" . }} +{{- $releaseNamespace := .Release.Namespace }} +{{- $clusterDomain := .Values.clusterDomain }} +{{- $serviceName := include "postgresql-ha.pgpool" . }} +{{- $altNames := list (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) $fullname }} +{{- $crt := genSignedCert $fullname nil $altNames 365 $ca }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ printf "%s-crt" (include "postgresql-ha.pgpool" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + ca.crt: {{ $ca.Cert | b64enc | quote }} + tls.crt: {{ $crt.Cert | b64enc | quote }} + tls.key: {{ $crt.Key | b64enc | quote }} +{{- end }} diff --git a/espresso-shop/charts/S4/espresso/postgresql-ha/values.yaml b/espresso-shop/charts/S4/espresso/postgresql-ha/values.yaml new file mode 100644 index 0000000..96d48fa --- /dev/null +++ b/espresso-shop/charts/S4/espresso/postgresql-ha/values.yaml @@ -0,0 +1,1530 @@ +## @section Global parameters +## Global Docker image parameters +## Please, note that this will override the image parameters, including dependencies, configured to use the global value +## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass + +## @param global.imageRegistry Global Docker image registry +## @param global.imagePullSecrets Global Docker registry secret names as an array +## @param global.storageClass Global StorageClass for Persistent Volume(s) +## @param global.postgresql.username PostgreSQL username (overrides `postgresql.username`) +## @param global.postgresql.password PostgreSQL password (overrides `postgresql.password`) +## @param global.postgresql.database PostgreSQL database (overrides `postgresql.database`) +## @param global.postgresql.repmgrUsername PostgreSQL repmgr username (overrides `postgresql.repmgrUsername`) +## @param global.postgresql.repmgrPassword PostgreSQL repmgr password (overrides `postgresql.repmgrpassword`) +## @param global.postgresql.repmgrDatabase PostgreSQL repmgr database (overrides `postgresql.repmgrDatabase`) +## @param global.postgresql.existingSecret Name of existing secret to use for PostgreSQL passwords (overrides `postgresql.existingSecret`) +## @param global.ldap.bindpw LDAP bind password (overrides `ldap.bindpw`) +## @param global.ldap.existingSecret Name of existing secret to use for LDAP passwords (overrides `ldap.existingSecret`) +## @param global.pgpool.adminUsername Pgpool Admin username (overrides `pgpool.adminUsername`) +## @param global.pgpool.adminPassword Pgpool Admin password (overrides `pgpool.adminPassword`) +## @param global.pgpool.existingSecret Pgpool existing secret +## +global: + imageRegistry: "" + ## E.g. + ## imagePullSecrets: + ## - myRegistryKeySecretName + ## + imagePullSecrets: [] + storageClass: "" + postgresql: + username: "" + password: "" + database: "" + repmgrUsername: "" + repmgrPassword: "" + repmgrDatabase: "" + existingSecret: "" + ldap: + bindpw: "" + existingSecret: "" + pgpool: + adminUsername: "" + adminPassword: "" + existingSecret: "" + +## @section Common parameters + +## @param kubeVersion Override Kubernetes version +## +kubeVersion: "" +## @param nameOverride String to partially override common.names.fullname template (will maintain the release name) +## +nameOverride: "" +## @param fullnameOverride String to fully override common.names.fullname template +## +fullnameOverride: "" +## @param namespaceOverride String to fully override common.names.namespace +## +namespaceOverride: "" +## @param commonLabels Common labels to add to all resources (sub-charts are not considered). Evaluated as a template +## +commonLabels: {} +## @param commonAnnotations Common annotations to add to all resources (sub-charts are not considered). Evaluated as a template +## +commonAnnotations: {} +## @param clusterDomain Kubernetes Cluster Domain +## +clusterDomain: cluster.local +## @param extraDeploy Array of extra objects to deploy with the release (evaluated as a template) +## +extraDeploy: [] +## Diagnostic mode in the deployment +## +diagnosticMode: + ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) + ## + enabled: false + ## @param diagnosticMode.command [array] Command to override all containers in the deployment + ## + command: + - sleep + ## @param diagnosticMode.args [array] Args to override all containers in the deployment + ## + args: + - infinity + +## @section PostgreSQL with Repmgr parameters + +## PostgreSQL parameters +## +postgresql: + ## ref: https://hub.docker.com/r/bitnami/postgresql/tags/ + ## @param postgresql.image.registry PostgreSQL with Repmgr image registry + ## @param postgresql.image.repository PostgreSQL with Repmgr image repository + ## @param postgresql.image.tag PostgreSQL with Repmgr image tag + ## @param postgresql.image.digest PostgreSQL image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag + ## @param postgresql.image.pullPolicy PostgreSQL with Repmgr image pull policy + ## @param postgresql.image.pullSecrets Specify docker-registry secret names as an array + ## @param postgresql.image.debug Specify if debug logs should be enabled + ## + image: + registry: docker.io + repository: bitnami/postgresql-repmgr + tag: 15.1.0-debian-11-r0 + digest: "" + ## Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## Example: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Set to true if you would like to see extra information on logs + ## + debug: false + ## @param postgresql.labels Labels to add to the StatefulSet. Evaluated as template + ## + labels: {} + ## @param postgresql.podLabels Labels to add to the StatefulSet pods. Evaluated as template + ## + podLabels: {} + ## @param postgresql.replicaCount Number of replicas to deploy. Use an odd number. Having 3 replicas is the minimum to get quorum when promoting a new primary. + ## + replicaCount: 3 + ## @param postgresql.updateStrategy.type Postgresql statefulset strategy type + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## e.g: + ## updateStrategy: + ## type: RollingUpdate + ## rollingUpdate: + ## maxSurge: 25% + ## maxUnavailable: 25% + ## + updateStrategy: + type: RollingUpdate + ## @param postgresql.containerPorts.postgresql PostgreSQL port + ## + containerPorts: + postgresql: 5432 + ## @param postgresql.hostAliases Deployment pod host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param postgresql.hostNetwork Specify if host network should be enabled for PostgreSQL pod + ## + hostNetwork: false + ## @param postgresql.hostIPC Specify if host IPC should be enabled for PostgreSQL pod + ## + hostIPC: false + ## @param postgresql.podAnnotations Additional pod annotations + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param postgresql.podAffinityPreset PostgreSQL pod affinity preset. Ignored if `postgresql.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param postgresql.podAntiAffinityPreset PostgreSQL pod anti-affinity preset. Ignored if `postgresql.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## PostgreSQL node affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param postgresql.nodeAffinityPreset.type PostgreSQL node affinity preset type. Ignored if `postgresql.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param postgresql.nodeAffinityPreset.key PostgreSQL node label key to match Ignored if `postgresql.affinity` is set. + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## @param postgresql.nodeAffinityPreset.values PostgreSQL node label values to match. Ignored if `postgresql.affinity` is set. + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param postgresql.affinity Affinity for PostgreSQL pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## Note: postgresql.podAffinityPreset, postgresql.podAntiAffinityPreset, and postgresql.nodeAffinityPreset will be ignored when it's set + ## + affinity: {} + ## @param postgresql.nodeSelector Node labels for PostgreSQL pods assignment + ## ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + ## @param postgresql.tolerations Tolerations for PostgreSQL pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param postgresql.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: [] + ## @param postgresql.priorityClassName Pod priority class + ## Ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ + ## + priorityClassName: "" + ## @param postgresql.schedulerName Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param postgresql.terminationGracePeriodSeconds Seconds PostgreSQL pod needs to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## K8s Security Context + ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## @param postgresql.podSecurityContext.enabled Enable security context for PostgreSQL with Repmgr + ## @param postgresql.podSecurityContext.fsGroup Group ID for the PostgreSQL with Repmgr filesystem + ## + podSecurityContext: + enabled: true + fsGroup: 1001 + ## Container Security Context + ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## @param postgresql.containerSecurityContext.enabled Enable container security context + ## @param postgresql.containerSecurityContext.runAsUser User ID for the PostgreSQL with Repmgr container + ## @param postgresql.containerSecurityContext.runAsNonRoot Set PostgreSQL with Repmgr containers' Security Context runAsNonRoot + ## @param postgresql.containerSecurityContext.readOnlyRootFilesystem Set PostgreSQL with Repmgr containers' Security Context runAsNonRoot + ## e.g: + ## containerSecurityContext: + ## enabled: true + ## capabilities: + ## drop: ["NET_RAW"] + ## readOnlyRootFilesystem: true + ## + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true + readOnlyRootFilesystem: false + ## @param postgresql.command Override default container command (useful when using custom images) + ## + command: [] + ## @param postgresql.args Override default container args (useful when using custom images) + ## + args: [] + ## @param postgresql.lifecycleHooks LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template + ## + lifecycleHooks: {} + ## @param postgresql.extraEnvVars Array containing extra environment variables + ## For example: + ## - name: PG_EXPORTER_DISABLE_DEFAULT_METRICS + ## value: "true" + ## + extraEnvVars: [] + ## @param postgresql.extraEnvVarsCM ConfigMap with extra environment variables + ## + extraEnvVarsCM: "" + ## @param postgresql.extraEnvVarsSecret Secret with extra environment variables + ## + extraEnvVarsSecret: "" + ## @param postgresql.extraVolumes Extra volumes to add to the deployment + ## + extraVolumes: [] + ## @param postgresql.extraVolumeMounts Extra volume mounts to add to the container. Normally used with `extraVolumes`. + ## + extraVolumeMounts: [] + ## @param postgresql.initContainers Extra init containers to add to the deployment + ## + initContainers: [] + ## @param postgresql.sidecars Extra sidecar containers to add to the deployment + ## + sidecars: [] + ## PostgreSQL containers' resource requests and limits + ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ + ## We usually recommend not to specify default resources and to leave this as a conscious + ## choice for the user. This also increases chances charts run on environments with little + ## resources, such as Minikube. If you do want to specify resources, uncomment the following + ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. + ## @param postgresql.resources.limits The resources limits for the container + ## @param postgresql.resources.requests The requested resources for the container + ## + resources: + ## Example: + ## limits: + ## cpu: 250m + ## memory: 256Mi + ## + limits: {} + ## Examples: + ## requests: + ## cpu: 250m + ## memory: 256Mi + ## + requests: {} + ## PostgreSQL container's liveness probe + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## @param postgresql.livenessProbe.enabled Enable livenessProbe + ## @param postgresql.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param postgresql.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param postgresql.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param postgresql.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param postgresql.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 6 + ## PostgreSQL container's readiness probe + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## @param postgresql.readinessProbe.enabled Enable readinessProbe + ## @param postgresql.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param postgresql.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param postgresql.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param postgresql.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param postgresql.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 6 + ## PostgreSQL container's startup probe + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## @param postgresql.startupProbe.enabled Enable startupProbe + ## @param postgresql.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param postgresql.startupProbe.periodSeconds Period seconds for startupProbe + ## @param postgresql.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param postgresql.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param postgresql.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 10 + ## @param postgresql.customLivenessProbe Override default liveness probe + ## + customLivenessProbe: {} + ## @param postgresql.customReadinessProbe Override default readiness probe + ## + customReadinessProbe: {} + ## @param postgresql.customStartupProbe Override default startup probe + ## + customStartupProbe: {} + ## Pod disruption budget configuration + ## @param postgresql.pdb.create Specifies whether to create a Pod disruption budget for PostgreSQL with Repmgr + ## @param postgresql.pdb.minAvailable Minimum number / percentage of pods that should remain scheduled + ## @param postgresql.pdb.maxUnavailable Maximum number / percentage of pods that may be made unavailable + ## + pdb: + create: false + minAvailable: 1 + maxUnavailable: "" + ## PostgreSQL configuration parameters + ## @param postgresql.username PostgreSQL username + ## @param postgresql.password PostgreSQL password + ## @param postgresql.database PostgreSQL database + ## + username: postgres + password: "NXY&gep#SXn*6ruVJLvWdzDr!VaWxM*BE" + database: "postgres" + ## @param postgresql.existingSecret PostgreSQL password using existing secret + ## + existingSecret: "" + ## @param postgresql.postgresPassword PostgreSQL password for the `postgres` user when `username` is not `postgres` + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#creating-a-database-user-on-first-run (see note!) + ## + postgresPassword: "" + ## @param postgresql.usePasswordFile Set to `true` to mount PostgreSQL secret as a file instead of passing environment variable + ## + usePasswordFile: "" + ## @param postgresql.repmgrUsePassfile Set to `true` to configure repmgrl to use `passfile` instead of `password` vars*:*:*:username:password" and use it to configure Repmgr instead of using password (Requires Postgresql 10+, otherwise ignored) + ## ref: https://repmgr.org/docs/current/configuration-password-management.html + ## https://www.postgresql.org/docs/current/libpq-pgpass.html + ## + repmgrUsePassfile: "" + ## @param postgresql.repmgrPassfilePath Custom path where `passfile` will be stored + ## + repmgrPassfilePath: "" + ## @param postgresql.upgradeRepmgrExtension Upgrade repmgr extension in the database + ## + upgradeRepmgrExtension: false + ## @param postgresql.pgHbaTrustAll Configures PostgreSQL HBA to trust every user + ## + pgHbaTrustAll: false + ## @param postgresql.syncReplication Make the replication synchronous. This will wait until the data is synchronized in all the replicas before other query can be run. This ensures the data availability at the expenses of speed. + ## + syncReplication: false + ## Repmgr configuration parameters + ## @param postgresql.repmgrUsername PostgreSQL Repmgr username + ## @param postgresql.repmgrPassword PostgreSQL Repmgr password + ## @param postgresql.repmgrDatabase PostgreSQL Repmgr database + ## @param postgresql.repmgrLogLevel Repmgr log level (DEBUG, INFO, NOTICE, WARNING, ERROR, ALERT, CRIT or EMERG) + ## @param postgresql.repmgrConnectTimeout Repmgr backend connection timeout (in seconds) + ## @param postgresql.repmgrReconnectAttempts Repmgr backend reconnection attempts + ## @param postgresql.repmgrReconnectInterval Repmgr backend reconnection interval (in seconds) + ## @param postgresql.repmgrFenceOldPrimary Set if fencing of old primary in multiple primary situation is desired + ## @param postgresql.repmgrChildNodesCheckInterval Repmgr child nodes check interval (in seconds) + ## @param postgresql.repmgrChildNodesConnectedMinCount Repmgr minimum number of connected child nodes before being considered as failed primary for fencing + ## @param postgresql.repmgrChildNodesDisconnectTimeout Repmgr time before node will be fenced when insufficient child nodes are detected (in seconds) + ## + repmgrUsername: repmgr + repmgrPassword: "" + repmgrDatabase: repmgr + repmgrLogLevel: NOTICE + repmgrConnectTimeout: 5 + repmgrReconnectAttempts: 2 + repmgrReconnectInterval: 3 + repmgrFenceOldPrimary: false + repmgrChildNodesCheckInterval: 5 + repmgrChildNodesConnectedMinCount: 1 + repmgrChildNodesDisconnectTimeout: 30 + ## EXPERMENTAL: Use pg_rewind for standby failover + ## @param postgresql.usePgRewind Use pg_rewind for standby failover (experimental) + ## + usePgRewind: false + ## Audit settings + ## https://github.com/bitnami/containers/tree/main/bitnami/postgresql#auditing + ## + audit: + ## @param postgresql.audit.logHostname Add client hostnames to the log file + ## + logHostname: true + ## @param postgresql.audit.logConnections Add client log-in operations to the log file + ## + logConnections: false + ## @param postgresql.audit.logDisconnections Add client log-outs operations to the log file + ## + logDisconnections: false + ## @param postgresql.audit.pgAuditLog Add operations to log using the pgAudit extension + ## + pgAuditLog: "" + ## @param postgresql.audit.pgAuditLogCatalog Log catalog using pgAudit + ## + pgAuditLogCatalog: "off" + ## @param postgresql.audit.clientMinMessages Message log level to share with the user + ## + clientMinMessages: error + ## @param postgresql.audit.logLinePrefix Template string for the log line prefix + ## + logLinePrefix: "" + ## @param postgresql.audit.logTimezone Timezone for the log timestamps + ## + logTimezone: "" + ## @param postgresql.sharedPreloadLibraries Shared preload libraries (comma-separated list) + ## + sharedPreloadLibraries: "pgaudit, repmgr" + ## @param postgresql.maxConnections Maximum total connections + ## + maxConnections: "" + ## @param postgresql.postgresConnectionLimit Maximum connections for the postgres user + ## + postgresConnectionLimit: "" + ## @param postgresql.dbUserConnectionLimit Maximum connections for the created user + ## + dbUserConnectionLimit: "" + ## @param postgresql.tcpKeepalivesInterval TCP keepalives interval + ## + tcpKeepalivesInterval: "" + ## @param postgresql.tcpKeepalivesIdle TCP keepalives idle + ## + tcpKeepalivesIdle: "" + ## @param postgresql.tcpKeepalivesCount TCP keepalives count + ## + tcpKeepalivesCount: "" + ## @param postgresql.statementTimeout Statement timeout + ## + statementTimeout: "" + ## @param postgresql.pghbaRemoveFilters Comma-separated list of patterns to remove from the pg_hba.conf file + ## (cannot be used with custom pg_hba.conf) + ## + pghbaRemoveFilters: "" + ## @param postgresql.extraInitContainers Extra init containers + ## Example: + ## extraInitContainers: + ## - name: do-something + ## image: busybox + ## command: ['do', 'something'] + ## + extraInitContainers: [] + ## @param postgresql.repmgrConfiguration Repmgr configuration + ## You can use this parameter to specify the content for repmgr.conf + ## Otherwise, a repmgr.conf will be generated based on the environment variables + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#configuration + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#configuration-file + ## Example: + ## repmgrConfiguration: |- + ## ssh_options='-o "StrictHostKeyChecking no" -v' + ## use_replication_slots='1' + ## ... + ## + repmgrConfiguration: "" + ## @param postgresql.configuration PostgreSQL configuration + ## You can use this parameter to specify the content for postgresql.conf + ## Otherwise, a repmgr.conf will be generated based on the environment variables + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#configuration + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#configuration-file + ## Example: + ## configuration: |- + ## listen_addresses = '*' + ## port = '5432' + ## ... + ## + configuration: "" + ## @param postgresql.pgHbaConfiguration PostgreSQL client authentication configuration + ## You can use this parameter to specify the content for pg_hba.conf + ## Otherwise, a repmgr.conf will be generated based on the environment variables + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#configuration + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#configuration-file + ## Example: + ## pgHbaConfiguration: |- + ## host all repmgr 0.0.0.0/0 md5 + ## host repmgr repmgr 0.0.0.0/0 md + ## ... + ## + pgHbaConfiguration: "" + ## @param postgresql.configurationCM Name of existing ConfigMap with configuration files + ## NOTE: This will override postgresql.repmgrConfiguration, postgresql.configuration and postgresql.pgHbaConfiguration + ## + configurationCM: "" + ## @param postgresql.extendedConf Extended PostgreSQL configuration (appended to main or default configuration). Implies `volumePermissions.enabled`. + ## Similar to postgresql.configuration, but _appended_ to the main configuration + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#allow-settings-to-be-loaded-from-files-other-than-the-default-postgresqlconf + ## Example: + ## extendedConf: |- + ## deadlock_timeout = 1s + ## max_locks_per_transaction = 64 + ## ... + ## + extendedConf: "" + ## @param postgresql.extendedConfCM ConfigMap with PostgreSQL extended configuration + ## NOTE: This will override postgresql.extendedConf and implies `volumePermissions.enabled` + ## + extendedConfCM: "" + ## @param postgresql.initdbScripts Dictionary of initdb scripts + ## Specify dictionary of scripts to be run at first boot + ## The allowed extensions are `.sh`, `.sql` and `.sql.gz` + ## ref: https://github.com/bitnami/charts/tree/main/bitnami/postgresql-ha#initialize-a-fresh-instance + ## e.g: + ## initdbScripts: + ## my_init_script.sh: | + ## #!/bin/sh + ## echo "Do something." + ## + initdbScripts: {} + ## @param postgresql.initdbScriptsCM ConfigMap with scripts to be run at first boot + ## NOTE: This will override initdbScripts + ## + initdbScriptsCM: "" + ## @param postgresql.initdbScriptsSecret Secret with scripts to be run at first boot + ## Note: can be used with initdbScriptsCM or initdbScripts + ## + initdbScriptsSecret: "" + ## TLS configuration + ## + tls: + ## @param postgresql.tls.enabled Enable TLS traffic support for end-client connections + ## + enabled: false + ## @param postgresql.tls.preferServerCiphers Whether to use the server's TLS cipher preferences rather than the client's + ## + preferServerCiphers: true + ## @param postgresql.tls.certificatesSecret Name of an existing secret that contains the certificates + ## + certificatesSecret: "" + ## @param postgresql.tls.certFilename Certificate filename + ## + certFilename: "" + ## @param postgresql.tls.certKeyFilename Certificate key filename + ## + certKeyFilename: "" + +## @section Pgpool parameters + +## Pgpool parameters +## +pgpool: + ## Bitnami Pgpool image + ## ref: https://hub.docker.com/r/bitnami/pgpool/tags/ + ## @param pgpool.image.registry Pgpool image registry + ## @param pgpool.image.repository Pgpool image repository + ## @param pgpool.image.tag Pgpool image tag + ## @param pgpool.image.digest Pgpool image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag + ## @param pgpool.image.pullPolicy Pgpool image pull policy + ## @param pgpool.image.pullSecrets Specify docker-registry secret names as an array + ## @param pgpool.image.debug Specify if debug logs should be enabled + ## + image: + registry: docker.io + repository: bitnami/pgpool + tag: 4.3.3-debian-11-r28 + digest: "" + ## Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## Example: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Set to true if you would like to see extra information on logs + ## + debug: false + ## @param pgpool.customUsers Additional users that will be performing connections to the database using + ## pgpool. Use this property in order to create new user/password entries that + ## will be appended to the "pgpool_passwd" file + ## + customUsers: {} + ## @param pgpool.usernames Comma or semicolon separated list of postgres usernames + ## e.g: + ## usernames: 'user01;user02' + ## + usernames: "" + ## @param pgpool.passwords Comma or semicolon separated list of the associated passwords for the users above + ## e.g: + ## passwords: 'pass01;pass02' + ## + passwords: "" + ## @param pgpool.hostAliases Deployment pod host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param pgpool.customUsersSecret Name of a secret containing the usernames and passwords of accounts that will be added to pgpool_passwd + ## The secret must contain the keys "usernames" and "passwords" respectively. + ## + customUsersSecret: "" + ## @param pgpool.existingSecret Pgpool admin password using existing secret + ## + existingSecret: "" + ## @param pgpool.srCheckDatabase Name of the database to perform streaming replication checks + ## + srCheckDatabase: postgres + ## @param pgpool.labels Labels to add to the Deployment. Evaluated as template + ## + labels: {} + ## @param pgpool.podLabels Labels to add to the pods. Evaluated as template + ## + podLabels: {} + ## @param pgpool.serviceLabels Labels to add to the service. Evaluated as template + ## + serviceLabels: {} + ## @param pgpool.customLivenessProbe Override default liveness probe + ## + customLivenessProbe: {} + ## @param pgpool.customReadinessProbe Override default readiness probe + ## + customReadinessProbe: {} + ## @param pgpool.customStartupProbe Override default startup probe + ## + customStartupProbe: {} + ## @param pgpool.command Override default container command (useful when using custom images) + ## + command: [] + ## @param pgpool.args Override default container args (useful when using custom images) + ## + args: [] + ## @param pgpool.lifecycleHooks LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template + ## + lifecycleHooks: {} + ## @param pgpool.extraEnvVars Array containing extra environment variables + ## For example: + ## - name: BEARER_AUTH + ## value: true + ## + extraEnvVars: [] + ## @param pgpool.extraEnvVarsCM ConfigMap with extra environment variables + ## + extraEnvVarsCM: "" + ## @param pgpool.extraEnvVarsSecret Secret with extra environment variables + ## + extraEnvVarsSecret: "" + ## @param pgpool.extraVolumes Extra volumes to add to the deployment + ## + extraVolumes: [] + ## @param pgpool.extraVolumeMounts Extra volume mounts to add to the container. Normally used with `extraVolumes` + ## + extraVolumeMounts: [] + ## @param pgpool.initContainers Extra init containers to add to the deployment + ## + initContainers: [] + ## @param pgpool.sidecars Extra sidecar containers to add to the deployment + ## + sidecars: [] + ## @param pgpool.replicaCount The number of replicas to deploy + ## + replicaCount: 1 + ## @param pgpool.podAnnotations Additional pod annotations + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param pgpool.priorityClassName Pod priority class + ## Ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ + ## + priorityClassName: "" + ## @param pgpool.schedulerName Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param pgpool.terminationGracePeriodSeconds Seconds pgpool pod needs to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## @param pgpool.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: [] + ## @param pgpool.podAffinityPreset Pgpool pod affinity preset. Ignored if `pgpool.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param pgpool.podAntiAffinityPreset Pgpool pod anti-affinity preset. Ignored if `pgpool.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## Pgpool node affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param pgpool.nodeAffinityPreset.type Pgpool node affinity preset type. Ignored if `pgpool.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param pgpool.nodeAffinityPreset.key Pgpool node label key to match Ignored if `pgpool.affinity` is set. + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## @param pgpool.nodeAffinityPreset.values Pgpool node label values to match. Ignored if `pgpool.affinity` is set. + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param pgpool.affinity Affinity for Pgpool pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## Note: pgpool.podAffinityPreset, pgpool.podAntiAffinityPreset, and pgpool.nodeAffinityPreset will be ignored when it's set + ## + affinity: {} + ## @param pgpool.nodeSelector Node labels for Pgpool pods assignment + ## ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + ## @param pgpool.tolerations Tolerations for Pgpool pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## K8s Security Context + ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## @param pgpool.podSecurityContext.enabled Enable security context for Pgpool + ## @param pgpool.podSecurityContext.fsGroup Group ID for the Pgpool filesystem + ## + podSecurityContext: + enabled: true + fsGroup: 1001 + ## Container Security Context + ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## @param pgpool.containerSecurityContext.enabled Enable container security context + ## @param pgpool.containerSecurityContext.runAsUser User ID for the Pgpool container + ## @param pgpool.containerSecurityContext.runAsNonRoot Set Pgpool containers' Security Context runAsNonRoot + ## @param pgpool.containerSecurityContext.readOnlyRootFilesystem Set Pgpool containers' Security Context runAsNonRoot + ## e.g: + ## containerSecurityContext: + ## enabled: true + ## capabilities: + ## drop: ["NET_RAW"] + ## readOnlyRootFilesystem: true + ## + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true + readOnlyRootFilesystem: false + ## Pgpool containers' resource requests and limits + ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ + ## We usually recommend not to specify default resources and to leave this as a conscious + ## choice for the user. This also increases chances charts run on environments with little + ## resources, such as Minikube. If you do want to specify resources, uncomment the following + ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. + ## @param pgpool.resources.limits The resources limits for the container + ## @param pgpool.resources.requests The requested resources for the container + ## + resources: + ## Example: + ## limits: + ## cpu: 250m + ## memory: 256Mi + ## + limits: {} + ## Examples: + ## requests: + ## cpu: 250m + ## memory: 256Mi + ## + requests: {} + ## Pgpool container's liveness probe + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## @param pgpool.livenessProbe.enabled Enable livenessProbe + ## @param pgpool.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param pgpool.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param pgpool.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param pgpool.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param pgpool.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + ## Pgpool container's readiness probe + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## @param pgpool.readinessProbe.enabled Enable readinessProbe + ## @param pgpool.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param pgpool.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param pgpool.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param pgpool.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param pgpool.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + ## Pgpool container's startup probe + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## @param pgpool.startupProbe.enabled Enable startupProbe + ## @param pgpool.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param pgpool.startupProbe.periodSeconds Period seconds for startupProbe + ## @param pgpool.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param pgpool.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param pgpool.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 10 + ## Pod disruption budget configuration + ## @param pgpool.pdb.create Specifies whether a Pod disruption budget should be created for Pgpool pods + ## @param pgpool.pdb.minAvailable Minimum number / percentage of pods that should remain scheduled + ## @param pgpool.pdb.maxUnavailable Maximum number / percentage of pods that may be made unavailable + ## + pdb: + create: false + minAvailable: 1 + maxUnavailable: "" + ## @param pgpool.updateStrategy Strategy used to replace old Pods by new ones + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + ## + updateStrategy: {} + ## @param pgpool.containerPorts.postgresql Pgpool port + ## + containerPorts: + postgresql: 5432 + ## @param pgpool.minReadySeconds How many seconds a pod needs to be ready before killing the next, during update + ## + minReadySeconds: "" + ## Credentials for the pgpool administrator + ## @param pgpool.adminUsername Pgpool Admin username + ## @param pgpool.adminPassword Pgpool Admin password + ## + adminUsername: admin + adminPassword: "" + ## @param pgpool.usePasswordFile Set to `true` to mount pgpool secret as a file instead of passing environment variable + ## + usePasswordFile: "" + ## Authentication method for pgpool container (PGPOOL_AUTHENTICATION_METHOD) + ## @param pgpool.authenticationMethod Pgpool authentication method. Use 'md5' for PSQL < 14. + ## + authenticationMethod: scram-sha-256 + ## @param pgpool.logConnections Log all client connections (PGPOOL_ENABLE_LOG_CONNECTIONS) + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration + ## + logConnections: false + ## @param pgpool.logHostname Log the client hostname instead of IP address (PGPOOL_ENABLE_LOG_HOSTNAME) + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration + ## + logHostname: true + ## @param pgpool.logPerNodeStatement Log every SQL statement for each DB node separately (PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT) + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration + ## + logPerNodeStatement: false + ## @param pgpool.logLinePrefix Format of the log entry lines (PGPOOL_LOG_LINE_PREFIX) + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration + ## ref: https://www.pgpool.net/docs/latest/en/html/runtime-config-logging.html + ## + logLinePrefix: "" + ## @param pgpool.clientMinMessages Log level for clients + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration + ## + clientMinMessages: error + ## @param pgpool.numInitChildren The number of preforked Pgpool-II server processes. It is also the concurrent + ## connections limit to Pgpool-II from clients. Must be a positive integer. (PGPOOL_NUM_INIT_CHILDREN) + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration + ## + numInitChildren: "" + ## @param pgpool.reservedConnections Number of reserved connections. When zero, excess connection block. When non-zero, excess connections are refused with an error message. + ## When this parameter is set to 1 or greater, incoming connections from clients are not accepted with error message + ## "Sorry, too many clients already", rather than blocked if the number of current connections from clients is more than + ## (num_init_children - reserved_connections). + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration + ## + reservedConnections: 1 + + ## @param pgpool.maxPool The maximum number of cached connections in each child process (PGPOOL_MAX_POOL) + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration + ## + maxPool: "" + ## @param pgpool.childMaxConnections The maximum number of client connections in each child process (PGPOOL_CHILD_MAX_CONNECTIONS) + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration + ## + childMaxConnections: "" + ## @param pgpool.childLifeTime The time in seconds to terminate a Pgpool-II child process if it remains idle (PGPOOL_CHILD_LIFE_TIME) + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration + ## + childLifeTime: "" + ## @param pgpool.clientIdleLimit The time in seconds to disconnect a client if it remains idle since the last query (PGPOOL_CLIENT_IDLE_LIMIT) + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration + ## + clientIdleLimit: "" + ## @param pgpool.connectionLifeTime The time in seconds to terminate the cached connections to the PostgreSQL backend (PGPOOL_CONNECTION_LIFE_TIME) + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration + ## + connectionLifeTime: "" + ## @param pgpool.useLoadBalancing Use Pgpool Load-Balancing + ## + useLoadBalancing: true + ## @param pgpool.loadBalancingOnWrite LoadBalancer on write actions behavior + ## one of: [off, transaction, trans_transaction, always] + ## + loadBalancingOnWrite: transaction + ## @param pgpool.configuration Pgpool configuration + ## You can use this parameter to specify the content for pgpool.conf + ## Otherwise, a repmgr.conf will be generated based on the environment variables + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration-file + ## Example: + ## configuration: |- + ## listen_addresses = '*' + ## port = '5432' + ## ... + ## + configuration: "" + ## @param pgpool.configurationCM ConfigMap with Pgpool configuration + ## NOTE: This will override pgpool.configuration parameter + ## The file used must be named `pgpool.conf` + ## + configurationCM: "" + ## @param pgpool.initdbScripts Dictionary of initdb scripts + ## Specify dictionary of scripts to be run every time Pgpool container is initialized + ## The allowed extension is `.sh` + ## ref: https://github.com/bitnami/charts/tree/main/bitnami/postgresql-ha#initialize-a-fresh-instance + ## e.g: + ## initdbScripts: + ## my_init_script.sh: | + ## #!/bin/sh + ## echo "Do something." + ## + initdbScripts: {} + ## @param pgpool.initdbScriptsCM ConfigMap with scripts to be run every time Pgpool container is initialized + ## NOTE: This will override pgpool.initdbScripts + ## + initdbScriptsCM: "" + ## @param pgpool.initdbScriptsSecret Secret with scripts to be run every time Pgpool container is initialized + ## Note: can be used with initdbScriptsCM or initdbScripts + ## + initdbScriptsSecret: "" + ## + ## TLS configuration + ## + tls: + ## @param pgpool.tls.enabled Enable TLS traffic support for end-client connections + ## + enabled: false + ## @param pgpool.tls.autoGenerated Create self-signed TLS certificates. Currently only supports PEM certificates + ## + autoGenerated: false + ## @param pgpool.tls.preferServerCiphers Whether to use the server's TLS cipher preferences rather than the client's + ## + preferServerCiphers: true + ## @param pgpool.tls.certificatesSecret Name of an existing secret that contains the certificates + ## + certificatesSecret: "" + ## @param pgpool.tls.certFilename Certificate filename + ## + certFilename: "" + ## @param pgpool.tls.certKeyFilename Certificate key filename + ## + certKeyFilename: "" + ## @param pgpool.tls.certCAFilename CA Certificate filename + ## If provided, PgPool will authenticate TLS/SSL clients by requesting them a certificate + ## ref: https://www.pgpool.net/docs/latest/en/html/runtime-ssl.html + ## + certCAFilename: "" + +## @section LDAP parameters + +## LDAP parameters +## @param ldap.enabled Enable LDAP support +## @param ldap.existingSecret Name of existing secret to use for LDAP passwords +## @param ldap.uri LDAP URL beginning in the form `ldap[s]://:` +## DEPRECATED ldap.base will be removed in a future, please use 'ldap.basedn' instead +## @param ldap.basedn LDAP base DN +## @param ldap.binddn LDAP bind DN +## @param ldap.bindpw LDAP bind password +## @param ldap.bslookup LDAP base lookup +## @param ldap.scope LDAP search scope +## @param ldap.tlsReqcert LDAP TLS check on server certificates +## @param ldap.nssInitgroupsIgnoreusers LDAP ignored users +## +ldap: + enabled: false + existingSecret: "" + uri: "" + basedn: "" + binddn: "" + bindpw: "" + bslookup: "" + scope: "" + tlsReqcert: "" + nssInitgroupsIgnoreusers: root,nslcd + +## @section Other Parameters + +## RBAC configuration +## Required for PSP +## +rbac: + ## @param rbac.create Create Role and RoleBinding (required for PSP to work) + ## + create: false + ## @param rbac.rules Custom RBAC rules to set + ## e.g: + ## rules: + ## - apiGroups: + ## - "" + ## resources: + ## - pods + ## verbs: + ## - get + ## - list + ## + rules: [] + +## ServiceAccount configuration +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ +## +serviceAccount: + ## @param serviceAccount.create Enable creation of ServiceAccount for Airflow pods + ## + create: false + ## @param serviceAccount.name The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the common.names.fullname template + ## + name: "" + ## @param serviceAccount.annotations Additional custom annotations for the ServiceAccount + ## + annotations: {} + ## @param serviceAccount.automountServiceAccountToken Allows auto mount of ServiceAccountToken on the serviceAccount created + ## Can be set to false if pods using this serviceAccount do not need to use K8s API + ## + automountServiceAccountToken: true + +## Pod Security Policy configuration +## ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/ +## @param psp.create Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later +## +psp: + create: false + +## @section Metrics parameters + +## PostgreSQL Prometheus exporter parameters +## +metrics: + ## Bitnami PostgreSQL Prometheus exporter image + ## @param metrics.enabled Enable PostgreSQL Prometheus exporter + ## + enabled: false + ## ref: https://hub.docker.com/r/bitnami/pgpool/tags/ + ## @param metrics.image.registry PostgreSQL Prometheus exporter image registry + ## @param metrics.image.repository PostgreSQL Prometheus exporter image repository + ## @param metrics.image.tag PostgreSQL Prometheus exporter image tag + ## @param metrics.image.digest PostgreSQL Prometheus exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag + ## @param metrics.image.pullPolicy PostgreSQL Prometheus exporter image pull policy + ## @param metrics.image.pullSecrets Specify docker-registry secret names as an array + ## @param metrics.image.debug Specify if debug logs should be enabled + ## + image: + registry: docker.io + repository: bitnami/postgres-exporter + tag: 0.11.1-debian-11-r27 + digest: "" + ## Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## Example: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Set to true if you would like to see extra information on logs + ## + debug: false + ## K8s Security Context + ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## @param metrics.podSecurityContext.enabled Enable security context for PostgreSQL Prometheus exporter + ## @param metrics.podSecurityContext.runAsUser User ID for the PostgreSQL Prometheus exporter container + ## + podSecurityContext: + enabled: true + runAsUser: 1001 + ## Prometheus exporter containers' resource requests and limits + ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ + ## We usually recommend not to specify default resources and to leave this as a conscious + ## choice for the user. This also increases chances charts run on environments with little + ## resources, such as Minikube. If you do want to specify resources, uncomment the following + ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. + ## @param metrics.resources.limits The resources limits for the container + ## @param metrics.resources.requests The requested resources for the container + ## + resources: + ## Example: + ## limits: + ## cpu: 250m + ## memory: 256Mi + ## + limits: {} + ## Examples: + ## requests: + ## cpu: 250m + ## memory: 256Mi + ## + requests: {} + ## @param metrics.containerPorts.http Prometheus metrics exporter port + ## + containerPorts: + http: 9187 + ## Prometheus exporter container's liveness probe + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## @param metrics.livenessProbe.enabled Enable livenessProbe + ## @param metrics.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param metrics.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param metrics.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param metrics.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param metrics.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 6 + ## Prometheus exporter container's readiness probe + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## @param metrics.readinessProbe.enabled Enable readinessProbe + ## @param metrics.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param metrics.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param metrics.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param metrics.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param metrics.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 6 + ## Prometheus exporter container's startup probes + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## @param metrics.startupProbe.enabled Enable startupProbe + ## @param metrics.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param metrics.startupProbe.periodSeconds Period seconds for startupProbe + ## @param metrics.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param metrics.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param metrics.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 10 + ## @param metrics.customLivenessProbe Override default liveness probe + ## + customLivenessProbe: {} + ## @param metrics.customReadinessProbe Override default readiness probe + ## + customReadinessProbe: {} + ## @param metrics.customStartupProbe Override default startup probe + ## + customStartupProbe: {} + + ## Metrics service parameters + ## + service: + ## @param metrics.service.type PostgreSQL Prometheus exporter metrics service type + ## + type: ClusterIP + ## @param metrics.service.ports.metrics PostgreSQL Prometheus exporter metrics service port + ## + ports: + metrics: 9187 + ## @param metrics.service.nodePorts.metrics PostgreSQL Prometheus exporter Node Port + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## + nodePorts: + metrics: "" + ## @param metrics.service.clusterIP PostgreSQL Prometheus exporter metrics service Cluster IP + ## e.g.: + ## clusterIP: None + ## + clusterIP: "" + ## @param metrics.service.loadBalancerIP PostgreSQL Prometheus exporter service Load Balancer IP + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer + ## + loadBalancerIP: "" + ## @param metrics.service.loadBalancerSourceRanges PostgreSQL Prometheus exporter service Load Balancer sources + ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## e.g: + ## loadBalancerSourceRanges: + ## - 10.10.10.0/24 + ## + loadBalancerSourceRanges: [] + ## @param metrics.service.externalTrafficPolicy PostgreSQL Prometheus exporter service external traffic policy + ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + ## @param metrics.annotations [object] Annotations for PostgreSQL Prometheus exporter service + ## + annotations: + prometheus.io/scrape: "true" + prometheus.io/port: "9187" + ## @param metrics.customMetrics Additional custom metrics + ## ref: https://github.com/wrouesnel/postgres_exporter#adding-new-metrics-via-a-config-file + ## customMetrics: + ## pg_database: + ## query: "SELECT d.datname AS name, CASE WHEN pg_catalog.has_database_privilege(d.datname, 'CONNECT') THEN pg_catalog.pg_database_size(d.datname) ELSE 0 END AS size_bytes FROM pg_catalog.pg_database d where datname not in ('template0', 'template1', 'postgres')" + ## metrics: + ## - name: + ## usage: "LABEL" + ## description: "Name of the database" + ## - size_bytes: + ## usage: "GAUGE" + ## description: "Size of the database in bytes" + ## + customMetrics: {} + ## @param metrics.extraEnvVars Array containing extra environment variables + ## For example: + ## - name: BEARER_AUTH + ## value: true + ## + extraEnvVars: [] + ## @param metrics.extraEnvVarsCM ConfigMap with extra environment variables + ## + extraEnvVarsCM: "" + ## @param metrics.extraEnvVarsSecret Secret with extra environment variables + ## + extraEnvVarsSecret: "" + ## Metrics serviceMonitor parameters + ## Enable this if you're using Prometheus Operator + ## + serviceMonitor: + ## @param metrics.serviceMonitor.enabled if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`) + ## + enabled: false + ## @param metrics.serviceMonitor.namespace Optional namespace which Prometheus is running in + ## Fallback to the prometheus default unless specified + ## + namespace: "" + ## @param metrics.serviceMonitor.interval How frequently to scrape metrics (use by default, falling back to Prometheus' default) + ## e.g: + ## interval: 10s + ## + interval: "" + ## @param metrics.serviceMonitor.scrapeTimeout Service monitor scrape timeout + ## e.g: + ## scrapeTimeout: 10s + ## + scrapeTimeout: "" + ## @param metrics.serviceMonitor.annotations Additional annotations for the ServiceMonitor + ## + annotations: {} + ## @param metrics.serviceMonitor.labels Additional labels that can be used so ServiceMonitor will be discovered by Prometheus + ## + labels: {} + ## @param metrics.serviceMonitor.selector [object] Defaults to what's used if you follow CoreOS Prometheus Install Instructions (https://github.com/bitnami/charts/tree/main/bitnami/kube-prometheus#tldr) + ## Prometheus Selector Label (https://github.com/bitnami/charts/tree/main/bitnami/kube-prometheus#prometheus-operator-parameters) + ## Kube Prometheus Selector Label (https://github.com/bitnami/charts/tree/main/bitnami/kube-prometheus#exporters) + ## + selector: + prometheus: kube-prometheus + ## @param metrics.serviceMonitor.relabelings ServiceMonitor relabelings. Value is evaluated as a template + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig + ## + relabelings: [] + ## @param metrics.serviceMonitor.metricRelabelings ServiceMonitor metricRelabelings. Value is evaluated as a template + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig + ## + metricRelabelings: [] + ## @param metrics.serviceMonitor.honorLabels Specify honorLabels parameter to add the scrape endpoint + ## + honorLabels: false + ## @param metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in prometheus. + ## + jobLabel: "" + +## @section Volume permissions parameters + +## Init Container parameters +## volumePermissions: Change the owner and group of the persistent volume mountpoint +## +volumePermissions: + ## @param volumePermissions.enabled Enable init container to adapt volume permissions + ## + enabled: false + ## @param volumePermissions.image.registry Init container volume-permissions image registry + ## @param volumePermissions.image.repository Init container volume-permissions image repository + ## @param volumePermissions.image.tag Init container volume-permissions image tag + ## @param volumePermissions.image.digest Init container volume-permissions image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag + ## @param volumePermissions.image.pullPolicy Init container volume-permissions image pull policy + ## @param volumePermissions.image.pullSecrets Specify docker-registry secret names as an array + ## + image: + registry: docker.io + repository: bitnami/bitnami-shell + tag: 11-debian-11-r50 + digest: "" + ## Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## Example: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## K8s Security Context + ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## @param volumePermissions.podSecurityContext.runAsUser Init container volume-permissions User ID + ## + podSecurityContext: + runAsUser: 0 + ## Init container' resource requests and limits + ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ + ## We usually recommend not to specify default resources and to leave this as a conscious + ## choice for the user. This also increases chances charts run on environments with little + ## resources, such as Minikube. If you do want to specify resources, uncomment the following + ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. + ## @param volumePermissions.resources.limits The resources limits for the container + ## @param volumePermissions.resources.requests The requested resources for the container + ## + resources: + ## Example: + ## limits: + ## cpu: 100m + ## memory: 128Mi + ## + limits: {} + ## Examples: + ## requests: + ## cpu: 100m + ## memory: 128Mi + ## + requests: {} + +## @section Persistence parameters + +## Enable persistence using Persistent Volume Claims +## ref: https://kubernetes.io/docs/user-guide/persistent-volumes/ +## +persistence: + ## @param persistence.enabled Enable data persistence + ## + enabled: true + ## @param persistence.existingClaim A manually managed Persistent Volume and Claim + ## If defined, PVC must be created manually before volume will be bound. + ## All replicas will share this PVC, using existingClaim with replicas > 1 is only useful in very special use cases. + ## The value is evaluated as a template. + ## + existingClaim: "" + ## @param persistence.storageClass Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. + ## + storageClass: "" + ## @param persistence.mountPath The path the volume will be mounted at, useful when using different PostgreSQL images. + ## + mountPath: /bitnami/postgresql + ## @param persistence.accessModes List of access modes of data volume + ## + accessModes: + - ReadWriteOnce + ## @param persistence.size Persistent Volume Claim size + ## + size: 8Gi + ## @param persistence.annotations Persistent Volume Claim annotations + ## + annotations: {} + ## @param persistence.labels Persistent Volume Claim labels + ## + labels: {} + ## @param persistence.selector Selector to match an existing Persistent Volume (this value is evaluated as a template) + ## selector: + ## matchLabels: + ## app: my-app + ## + selector: {} + +## @section Traffic Exposure parameters + +## PostgreSQL service parameters +## +service: + ## @param service.type Kubernetes service type (`ClusterIP`, `NodePort` or `LoadBalancer`) + ## + type: ClusterIP + ## @param service.ports.postgresql PostgreSQL port + ## + ports: + postgresql: 5432 + ## @param service.portName PostgreSQL service port name + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#multi-port-services + ## + portName: postgresql + ## @param service.nodePorts.postgresql Kubernetes service nodePort + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## + nodePorts: + postgresql: "" + ## @param service.loadBalancerIP Load balancer IP if service type is `LoadBalancer` + ## Set the LoadBalancer service type to internal only + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + loadBalancerIP: "" + ## @param service.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer + ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## + ## loadBalancerSourceRanges: + ## - 10.10.10.0/24 + ## + loadBalancerSourceRanges: [] + ## @param service.clusterIP Set the Cluster IP to use + ## Static clusterIP or None for headless services + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address + ## e.g: + ## clusterIP: None + ## + clusterIP: "" + ## @param service.externalTrafficPolicy Enable client source IP preservation + ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + ## @param service.extraPorts Extra ports to expose (normally used with the `sidecar` value) + ## + extraPorts: [] + ## @param service.sessionAffinity Control where client requests go, to the same pod or round-robin + ## Values: ClientIP or None + ## ref: https://kubernetes.io/docs/user-guide/services/ + ## + sessionAffinity: "None" + ## @param service.sessionAffinityConfig Additional settings for the sessionAffinity + ## sessionAffinityConfig: + ## clientIP: + ## timeoutSeconds: 300 + sessionAffinityConfig: {} + ## @param service.annotations Provide any additional annotations for PostgreSQL service + ## + annotations: {} + ## @param service.serviceLabels Labels for PostgreSQL service + ## + serviceLabels: {} + +## NetworkPolicy parameters +## +networkPolicy: + ## @param networkPolicy.enabled Enable NetworkPolicy + ## + enabled: false + ## @param networkPolicy.allowExternal Don't require client label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## client labels will have network access to the port PostgreSQL is listening + ## on. When true, PostgreSQL will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param networkPolicy.egressRules.denyConnectionsToExternal Enable egress rule that denies outgoing traffic outside the cluster, except for DNS (port 53) + ## @param networkPolicy.egressRules.customRules [object] Custom network policy rule + ## + egressRules: + # Deny connections to external. This is not compatible with an external database. + denyConnectionsToExternal: false + ## Additional custom egress rules + ## e.g: + ## customRules: + ## - to: + ## - namespaceSelector: + ## matchLabels: + ## label: example + ## + customRules: [] diff --git a/espresso-shop/charts/S4/espresso/redis-ha/Chart.yaml b/espresso-shop/charts/S4/espresso/redis-ha/Chart.yaml new file mode 100644 index 0000000..e67b9e7 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/redis-ha/Chart.yaml @@ -0,0 +1,21 @@ +apiVersion: v2 +appVersion: 7.0.4 +description: This Helm chart provides a highly available Redis implementation with + a master/slave configuration and uses Sentinel sidecars for failover management +home: http://redis.io/ +icon: https://upload.wikimedia.org/wikipedia/en/thumb/6/6b/Redis_Logo.svg/1200px-Redis_Logo.svg.png +keywords: +- redis +- keyvalue +- database +maintainers: +- email: salimsalaues@gmail.com + name: ssalaues +- email: aaron.layfield@gmail.com + name: dandydeveloper +name: redis-ha +sources: +- https://redis.io/download +- https://github.com/DandyDeveloper/charts/blob/master/charts/redis-ha +- https://github.com/oliver006/redis_exporter +version: 4.22.4 diff --git a/espresso-shop/charts/S4/espresso/redis-ha/README.md b/espresso-shop/charts/S4/espresso/redis-ha/README.md new file mode 100644 index 0000000..4d26352 --- /dev/null +++ b/espresso-shop/charts/S4/espresso/redis-ha/README.md @@ -0,0 +1,396 @@ +# Redis + +[Redis](http://redis.io/) is an advanced key-value cache and store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets, sorted sets, bitmaps and hyperloglogs. + +## TL;DR + +```bash +helm repo add dandydev https://dandydeveloper.github.io/charts +helm install dandydev/redis-ha +``` + +By default this chart install 3 pods total: + +* one pod containing a redis master and sentinel container (optional prometheus metrics exporter sidecar available) +* two pods each containing a redis slave and sentinel containers (optional prometheus metrics exporter sidecars available) + +## Introduction + +This chart bootstraps a [Redis](https://redis.io) highly available master/slave statefulset in a [Kubernetes](http://kubernetes.io) cluster using the Helm package manager. + +## Prerequisites + +* Kubernetes 1.8+ with Beta APIs enabled +* PV provisioner support in the underlying infrastructure + +## Upgrading the Chart + +Please note that there have been a number of changes simplifying the redis management strategy (for better failover and elections) in the 3.x version of this chart. These changes allow the use of official [redis](https://hub.docker.com/_/redis/) images that do not require special RBAC or ServiceAccount roles. As a result when upgrading from version >=2.0.1 to >=3.0.0 of this chart, `Role`, `RoleBinding`, and `ServiceAccount` resources should be deleted manually. + +### Upgrading the chart from 3.x to 4.x + +Starting from version `4.x` HAProxy sidecar prometheus-exporter removed and replaced by the embedded [HAProxy metrics endpoint](https://github.com/haproxy/haproxy/tree/master/contrib/prometheus-exporter), as a result when upgrading from version 3.x to 4.x section `haproxy.exporter` should be removed and the `haproxy.metrics` need to be configured for fit your needs. + +## Installing the Chart + +To install the chart + +```bash +helm repo add dandydev https://dandydeveloper.github.io/charts +helm install dandydev/redis-ha +``` + +The command deploys Redis on the Kubernetes cluster in the default configuration. By default this chart install one master pod containing redis master container and sentinel container along with 2 redis slave pods each containing their own sentinel sidecars. The [configuration](#configuration) section lists the parameters that can be configured during installation. + +> **Tip**: List all releases using `helm list` + +## Uninstalling the Chart + +To uninstall/delete the deployment: + +```bash +helm delete +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +## Configuration + +The following table lists the configurable parameters of the Redis chart and their default values. + +| Parameter | Description | Default | +|:--------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-------------------------------------------------------------------------------------------| +| `image.repository` | Redis image repository | `redis` | +| `image.tag` | Redis image tag | `6.2.5-alpine` | +| `image.pullPolicy` | Redis image pull policy | `IfNotPresent` | +| `imagePullSecrets` | Reference to one or more secrets to be used when pulling redis images | [] | +| `tag` | Redis tag | `6.2.5-alpine` | +| `replicas` | Number of redis master/slave pods | `3` | +| `podManagementPolicy` | The statefulset pod management policy | `OrderedReady` | +| `ro_replicas` | Comma separated list of slaves which never get promoted to be master. Count starts with 0. Allowed values 1-9. i.e. 3,4 - 3th and 4th redis slave never make it to be master, where master is index 0. | ``| +| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `serviceAccount.name` | The name of the ServiceAccount to create | Generated using the redis-ha.fullname template | +| `serviceAccount.automountToken` | Opt in/out of automounting API credentials into container | `false` | +| `serviceAnnotations` | Annotations to set on Redis HA service | `null` | +| `serviceLabels` | Labels to set on Redis HA service | `{}` | +| `rbac.create` | Create and use RBAC resources | `true` | +| `redis.port` | Port to access the redis service | `6379` | +| `redis.tlsPort` | TLS Port to access the redis service |``| +| `redis.tlsReplication` | Configures redis with tls-replication parameter, if true sets "tls-replication yes" in redis.conf |``| +| `redis.authClients` | It is possible to disable client side certificates authentication when "authClients" is set to "no" |``| +| `redis.livenessProbe.initialDelaySeconds` | Initial delay in seconds for liveness probe | `30` | +| `redis.livenessProbe.periodSeconds` | Period in seconds after which liveness probe will be repeated | `15` | +| `redis.livenessProbe.timeoutSeconds` | Timeout seconds for liveness probe | `15` | +| `redis.livenessProbe.successThreshold` | Success threshold for liveness probe | `1` | +| `redis.livenessProbe.failureThreshold` | Failure threshold for liveness probe | `5` | +| `redis.readinessProbe.initialDelaySeconds` | Initial delay in seconds for readiness probe | `30` | +| `redis.readinessProbe.periodSeconds` | Period in seconds after which readiness probe will be repeated | `15` | +| `redis.readinessProbe.timeoutSeconds` | Timeout seconds for readiness probe | `15` | +| `redis.readinessProbe.successThreshold` | Success threshold for readiness probe | `1` | +| `redis.readinessProbe.failureThreshold` | Failure threshold for readiness probe | `5` | +| `redis.masterGroupName` | Redis convention for naming the cluster group: must match `^[\\w-\\.]+$` and can be templated | `mymaster` | +| `redis.disableCommands` | Array with commands to disable | `["FLUSHDB","FLUSHALL"]` | +| `redis.config` | Any valid redis config options in this section will be applied to each server (see below) | see values.yaml | +| `redis.customConfig` | Allows for custom redis.conf files to be applied. If this is used then `redis.config` is ignored |``| +| `redis.resources` | CPU/Memory for master/slave nodes resource requests/limits | `{}` | +| `redis.lifecycle` | Container Lifecycle Hooks for redis container | see values.yaml | +| `redis.annotations` | Annotations for the redis statefulset | `{}` | +| `redis.updateStategy.type`| Update strategy for redis statefulSet | `RollingUpdate` | +| `redis.extraVolumeMounts` | Extra volume mounts for Redis container | `[]` | +| `sentinel.port` | Port to access the sentinel service | `26379` | +| `sentinel.bind` | Configure the 'bind' directive to bind to a list of network interfaces | `` | +| `sentinel.tlsPort` | TLS Port to access the sentinel service |``| +| `sentinel.tlsReplication` | Configures sentinel with tls-replication parameter, if true sets "tls-replication yes" in sentinel.conf |``| +| `sentinel.authClients` | It is possible to disable client side certificates authentication when "authClients" is set to "no" |``| +| `sentinel.livenessProbe.initialDelaySeconds` | Initial delay in seconds for liveness probe | `30` | +| `sentinel.livenessProbe.periodSeconds` | Period in seconds after which liveness probe will be repeated | `15` | +| `sentinel.livenessProbe.timeoutSeconds` | Timeout seconds for liveness probe | `15` | +| `sentinel.livenessProbe.successThreshold` | Success threshold for liveness probe | `1` | +| `sentinel.livenessProbe.failureThreshold` | Failure threshold for liveness probe | `5` | +| `sentinel.readinessProbe.initialDelaySeconds` | Initial delay in seconds for readiness probe | `30` | +| `sentinel.readinessProbe.periodSeconds` | Period in seconds after which readiness probe will be repeated | `15` | +| `sentinel.readinessProbe.timeoutSeconds` | Timeout seconds for readiness probe | `15` | +| `sentinel.readinessProbe.successThreshold` | Success threshold for readiness probe | `3` | +| `sentinel.readinessProbe.failureThreshold` | Failure threshold for readiness probe | `5` | +| `sentinel.auth` | Enables or disables sentinel AUTH (Requires `sentinel.password` to be set) | `false` | +| `sentinel.password` | A password that configures a `requirepass` in the conf parameters (Requires `sentinel.auth: enabled`) |``| +| `sentinel.existingSecret` | An existing secret containing a key defined by `sentinel.authKey` that configures `requirepass` in the conf parameters (Requires `sentinel.auth: enabled`, cannot be used in conjunction with `.Values.sentinel.password`) |``| +| `sentinel.authKey` | The key holding the sentinel password in an existing secret. | `sentinel-password` | +| `sentinel.quorum` | Minimum number of servers necessary to maintain quorum | `2` | +| `sentinel.config` | Valid sentinel config options in this section will be applied as config options to each sentinel (see below) | see values.yaml | +| `sentinel.customConfig` | Allows for custom sentinel.conf files to be applied. If this is used then `sentinel.config` is ignored |``| +| `sentinel.resources` | CPU/Memory for sentinel node resource requests/limits | `{}` | +| `sentinel.lifecycle` | Container Lifecycle Hooks for sentinel container | `{}` | +| `sentinel.extraVolumeMounts` | Extra volume mounts for Sentinel container | `[]` | +| `init.resources` | CPU/Memory for init Container node resource requests/limits | `{}` | +| `auth` | Enables or disables redis AUTH (Requires `redisPassword` to be set) | `false` | +| `redisPassword` | A password that configures a `requirepass` and `masterauth` in the conf parameters (Requires `auth: enabled`) |``| +| `authKey` | The key holding the redis password in an existing secret. | `auth` | +| `existingSecret` | An existing secret containing a key defined by `authKey` that configures `requirepass` and `masterauth` in the conf parameters (Requires `auth: enabled`, cannot be used in conjunction with `.Values.redisPassword`) |``| +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `tolerations` | Toleration labels for pod assignment | `[]` | +| `hardAntiAffinity` | Whether the Redis server pods should be forced to run on separate nodes. | `true` | +| `additionalAffinities` | Additional affinities to add to the Redis server pods. | `{}` | +| `securityContext` | Security context to be added to the Redis StatefulSet. | `{runAsUser: 1000, fsGroup: 1000, runAsNonRoot: true}` | +| `containerSecurityContext` | Security context to be added to the Redis containers. | `{ runAsNonRoot: true, allowPrivilegeEscalation: false, seccompProfile: { type: RuntimeDefault }, capabilities: { drop: [ "ALL" ] }` | +| `affinity` | Override all other affinity settings with a string. | `""` | +| `labels` | Labels for the Redis pod. | `{}` | +| `configmap.labels` | Labels for the Redis configmap. | `{}` | +| `configmapTest.image.repository` | Repository of the configmap shellcheck test image. | `koalaman/shellcheck` | +| `configmapTest.image.tag` | Tag of the configmap shellcheck test image. | `v0.5.0` | +| `configmapTest.resources` | Resources for the ConfigMap tests. | `{}` | +| `persistentVolume.size` | Size for the volume | 10Gi | +| `persistentVolume.annotations` | Annotations for the volume | `{}` | +| `persistentVolume.labels` | Labels for the volume | `{}` | +| `emptyDir` | Configuration of `emptyDir`, used only if persistentVolume is disabled and no hostPath specified | `{}` | +| `exporter.enabled` | If `true`, the prometheus exporter sidecar is enabled | `false` | +| `exporter.image` | Exporter image | `oliver006/redis_exporter` | +| `exporter.tag` | Exporter tag | `v1.27.0` | +| `exporter.port` | Exporter port | `9121` | +| `exporter.portName` | Exporter port name | `exporter-port` | +| `exporter.address` | Redis instance Hostname/Address Exists to circumvent some issues with issues in IPv6 hostname resolution | `localhost` | +| `exporter.annotations` | Prometheus scrape annotations | `{prometheus.io/path: /metrics, prometheus.io/port: "9121", prometheus.io/scrape: "true"}` | +| `exporter.extraArgs` | Additional args for the exporter | `{}` | +| `exporter.script` | A custom custom Lua script that will be mounted to exporter for collection of custom metrics. Creates a ConfigMap and sets env var `REDIS_EXPORTER_SCRIPT`. | | +| `exporter.serviceMonitor.enabled` | Use servicemonitor from prometheus operator | `false` | +| `exporter.serviceMonitor.namespace` | Namespace the service monitor is created in | `default` | +| `exporter.serviceMonitor.interval` | Scrape interval, If not set, the Prometheus default scrape interval is used | `nil` | +| `exporter.serviceMonitor.telemetryPath` | Path to redis-exporter telemetry-path | `/metrics` | +| `exporter.serviceMonitor.labels` | Labels for the servicemonitor passed to Prometheus Operator | `{}` | +| `exporter.serviceMonitor.timeout` | How long until a scrape request times out. If not set, the Prometheus default scape timeout is used | `nil` | +| `haproxy.enabled` | Enabled HAProxy LoadBalancing/Proxy | `false` | +| `haproxy.replicas` | Number of HAProxy instances | `3` | +| `haproxy.servicePort` | Modify HAProxy service port | `6379` | +| `haproxy.containerPort` | Modify HAProxy deployment container port | `6379` +| `haproxy.image.repository`| HAProxy Image Repository | `haproxy` | +| `haproxy.image.tag` | HAProxy Image Tag | `2.4.2` | +| `haproxy.image.pullPolicy`| HAProxy Image PullPolicy | `IfNotPresent` | +| `haproxy.imagePullSecrets`| Reference to one or more secrets to be used when pulling haproxy images | [] | +| `haproxy.tls.enabled` | If "true" this will enable TLS termination on haproxy | `false` +| `haproxy.tls.secretName` | Secret containing the .pem file | `""` +| `haproxy.tls.certMountPath` | Path to mount the secret that contains the certificates. haproxy | `false` +| `haproxy.tls.secretName` | Secret containing the .pem file | `""` +| `haproxy.annotations` | HAProxy template annotations | `{}` | +| `haproxy.customConfig` | Allows for custom config-haproxy.cfg file to be applied. If this is used then default config will be overwriten |``| +| `haproxy.extraConfig` | Allows to place any additional configuration section to add to the default config-haproxy.cfg |``| +| `haproxy.resources` | HAProxy resources | `{}` | +| `haproxy.emptyDir` | Configuration of `emptyDir` | `{}` | +| `haproxy.labels` | Labels for the HAProxy pod | `{}` | +| `haproxy.service.type` | HAProxy service type "ClusterIP", "LoadBalancer" or "NodePort" | `ClusterIP` | +| `haproxy.service.nodePort` | HAProxy service nodePort value (haproxy.service.type must be NodePort) | not set | +| `haproxy.image.serviceAccountName`| HAProxy serviceAccountName | `default` +| `haproxy.service.externalTrafficPolicy`| HAProxy service externalTrafficPolicy value (haproxy.service.type must be LoadBalancer) | not set | +| `haproxy.service.annotations` | HAProxy service annotations | `{}` | +| `haproxy.service.labels` | HAProxy service labels | `{}` | +| `haproxy.stickyBalancing` | HAProxy sticky load balancing to Redis nodes. Helps with connections shutdown. | `false` | +| `haproxy.hapreadport.enable` | Enable a read only port for redis slaves | `false` | +| `haproxy.hapreadport.port` | Haproxy port for read only redis slaves | `6380` | +| `haproxy.metrics.enabled` | HAProxy enable prometheus metric scraping | `false` | +| `haproxy.metrics.port` | HAProxy prometheus metrics scraping port | `9101` | +| `haproxy.metrics.portName` | HAProxy metrics scraping port name | `http-exporter-port` | +| `haproxy.metrics.scrapePath` | HAProxy prometheus metrics scraping port | `/metrics` | +| `haproxy.metrics.serviceMonitor.enabled` | Use servicemonitor from prometheus operator for HAProxy metrics | `false` | +| `haproxy.metrics.serviceMonitor.namespace` | Namespace the service monitor for HAProxy metrics is created in | `default` | +| `haproxy.metrics.serviceMonitor.interval` | Scrape interval, If not set, the Prometheus default scrape interval is used | `nil` | +| `haproxy.metrics.serviceMonitor.telemetryPath` | Path to HAProxy metrics telemetry-path | `/metrics` | +| `haproxy.metrics.serviceMonitor.labels` | Labels for the HAProxy metrics servicemonitor passed to Prometheus Operator | `{}` | +| `haproxy.metrics.serviceMonitor.timeout` | How long until a scrape request times out. If not set, the Prometheus default scape timeout is used | `nil` | +| `haproxy.init.resources` | Extra init resources | `{}` | +| `haproxy.timeout.connect` | haproxy.cfg `timeout connect` setting | `4s` | +| `haproxy.timeout.server` | haproxy.cfg `timeout server` setting | `30s` | +| `haproxy.timeout.client` | haproxy.cfg `timeout client` setting | `30s` | +| `haproxy.timeout.check` | haproxy.cfg `timeout check` setting | `2s` | +| `haproxy.checkInterval` | haproxy.cfg `check inter` setting | `1s` | +| `haproxy.checkFall` | haproxy.cfg `check fall` setting | `1` | +| `haproxy.priorityClassName` | priorityClassName for `haproxy` deployment | not set | +| `haproxy.securityContext` | Security context to be added to the HAProxy deployment. | `{runAsUser: 99, fsGroup: 99, runAsNonRoot: true}` | +| `haproxy.containerSecurityContext` | Security context to be added to the HAProxy containers. | `{ runAsNonRoot: true, allowPrivilegeEscalation: false, seccompProfile: { type: RuntimeDefault }, capabilities: { drop: [ "ALL" ] }` | +| `haproxy.hardAntiAffinity` | Whether the haproxy pods should be forced to run on separate nodes. | `true` | +| `haproxy.affinity` | Override all other haproxy affinity settings with a string. | `""` | +| `haproxy.additionalAffinities` | Additional affinities to add to the haproxy server pods. | `{}` | +| `haproxy.tests.resources` | Pod resources for the tests against HAProxy. | `{}` | +| `haproxy.IPv6.enabled` | Disables certain binding options to support non-IPv6 environments. | `true` | +| `podDisruptionBudget` | Pod Disruption Budget rules | `{}` | +| `nameOverride` | Override the chart name | `""` | +| `fullnameOverride` | Fully override the release name and chart name | `""` | +| `priorityClassName` | priorityClassName for `redis-ha-statefulset` | not set | +| `hostPath.path` | Use this path on the host for data storage | not set | +| `hostPath.chown` | Run an init-container as root to set ownership on the hostPath | `true` | +| `sysctlImage.enabled` | Enable an init container to modify Kernel settings | `false` | +| `sysctlImage.command` | sysctlImage command to execute | [] | +| `sysctlImage.registry` | sysctlImage Init container registry | `docker.io` | +| `sysctlImage.repository` | sysctlImage Init container name | `busybox` | +| `sysctlImage.tag` | sysctlImage Init container tag | `1.31.1` | +| `sysctlImage.pullPolicy` | sysctlImage Init container pull policy | `Always` | +| `sysctlImage.mountHostSys`| Mount the host `/sys` folder to `/host-sys` | `false` | +| `sysctlImage.resources` | sysctlImage resources | `{}` | +| `schedulerName` | Alternate scheduler name | `nil` | +| `tls.secretName` | The name of secret if you want to use your own TLS certificates. The secret should contains keys named by "tls.certFile" - the certificate, "tls.keyFile" - the private key, "tls.caCertFile" - the certificate of CA and "tls.dhParamsFile" - the dh parameter file | ``| +| `tls.certFile` | Name of certificate file | `redis.crt` | +| `tls.keyFile` | Name of key file | `redis.key` | +| `tls.dhParamsFile` | Name of Diffie-Hellman (DH) key exchange parameters file |`` | +| `tls.caCertFile` | Name of CA certificate file | `ca.crt` | +| `restore.s3.source` | Restore init container - AWS S3 location of dump - i.e. s3://bucket/dump.rdb | `false` | +| `restore.existingSecret` | Set to true to use existingSecret for the AWS S3 or SSH credentials | `false` | +| `topologySpreadConstraints.enabled` | Enable topology spread constraints |`false`| +| `topologySpreadConstraints.maxSkew` | Max skew of pods tolerated |`1`| +| `topologySpreadConstraints.topologyKey` | Topology key for spread |`topology.kubernetes.io/zone`| +| `topologySpreadConstraints.whenUnsatisfiable` | Enforcement policy, hard or soft |`ScheduleAnyway`| +| `restore.s3.access_key` | Restore init container - AWS AWS_ACCESS_KEY_ID to access restore.s3.source |``| +| `restore.s3.secret_key` | Restore init container - AWS AWS_SECRET_ACCESS_KEY to access restore.s3.source |``| +| `restore.s3.region` | Restore init container - AWS AWS_REGION to access restore.s3.source |``| +| `restore.ssh.source` | Restore init container - SSH scp location of dump - i.e. user@server:/path/dump.rdb | `false` | +| `restore.ssh.key` | Restore init container - SSH private key to scp restore.ssh.source to init container. Key should be in one line separated with \n. i.e. -----BEGIN RSA PRIVATE KEY-----\n...\n...\n-----END RSA PRIVATE KEY----- |`` | +| `extraContainers` | Extra containers to include in StatefulSet |`[]`| +| `extraInitContainers` | Extra init containers to include in StatefulSet |`[]`| +| `extraVolumes` | Extra volumes to include in StatefulSet |`[]`| +| `extraLabels` | Labels that should be applied to all created resources |`{}`| +| `networkPolicy.enabled` | Create NetworkPolicy for Redis StatefulSet pods |`false`| +| `networkPolicy.labels` | Labels for NetworkPolicy |`{}`| +| `networkPolicy.annotations` | Annotations for NetworkPolicy |`{}`| +| `networkPolicy.ingressRules[].selectors` | Label selector query to define resources for this ingress rule |`[]`| +| `networkPolicy.ingressRules[].ports` | The destination ports for the ingress rule |`[{port: redis.port, protocol: TCP}, {port: sentinel.port, protocol: TCP}]`| +| `networkPolicy.egressRules[].selectors` | Label selector query to define resources for this egress rule |`[]`| +| `networkPolicy.egressRules[].ports` | The destination ports for the egress rule |``| +| `splitBrainDetection.interval` | Interval between redis sentinel and server split brain checks (in seconds) |`60`| +| `splitBrainDetection.resources` | splitBrainDetection resources |`{}`| + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```bash +$ helm repo add dandydev https://dandydeveloper.github.io/charts +$ helm install \ + --set image=redis \ + --set tag=5.0.5-alpine \ + dandydev/redis-ha +``` + +The above command sets the Redis server within `default` namespace. + +Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, + +```bash +helm install -f values.yaml dandydev/redis-ha +``` + +> **Tip**: You can use the default [values.yaml](values.yaml) + +## Custom Redis and Sentinel config options + +This chart allows for most redis or sentinel config options to be passed as a key value pair through the `values.yaml` under `redis.config` and `sentinel.config`. See links below for all available options. + +[Example redis.conf](http://download.redis.io/redis-stable/redis.conf) +[Example sentinel.conf](http://download.redis.io/redis-stable/sentinel.conf) + +For example `repl-timeout 60` would be added to the `redis.config` section of the `values.yaml` as: + +```yml + repl-timeout: "60" +``` + +Note: + +1. Some config options should be renamed by redis version，e.g.: + + ```yml + # In redis 5.x，see https://raw.githubusercontent.com/antirez/redis/5.0/redis.conf + min-replicas-to-write: 1 + min-replicas-max-lag: 5 + + # In redis 4.x and redis 3.x，see https://raw.githubusercontent.com/antirez/redis/4.0/redis.conf and https://raw.githubusercontent.com/antirez/redis/3.0/redis.conf + min-slaves-to-write 1 + min-slaves-max-lag 5 + ``` + +Sentinel options supported must be in the the `sentinel