init
This commit is contained in:
112
gitea/charts/postgresql-ha/templates/NOTES.txt
Normal file
112
gitea/charts/postgresql-ha/templates/NOTES.txt
Normal file
@@ -0,0 +1,112 @@
|
||||
CHART NAME: {{ .Chart.Name }}
|
||||
CHART VERSION: {{ .Chart.Version }}
|
||||
APP VERSION: {{ .Chart.AppVersion }}
|
||||
|
||||
Did you know there are enterprise versions of the Bitnami catalog? For enhanced secure software supply chain features, unlimited pulls from Docker, LTS support, or application customization, see Bitnami Premium or Tanzu Application Catalog. See https://www.arrow.com/globalecs/na/vendors/bitnami for more information.
|
||||
|
||||
{{- $clusterDomain:= .Values.clusterDomain }}
|
||||
** Please be patient while the chart is being deployed **
|
||||
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with:
|
||||
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }}
|
||||
|
||||
Get the list of pods by executing:
|
||||
|
||||
kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
|
||||
|
||||
Access the pod you want to debug by executing
|
||||
|
||||
kubectl exec --namespace {{ .Release.Namespace }} -ti <NAME OF THE POD> -- bash
|
||||
|
||||
In order to replicate the container startup scripts, check the /opt/bitnami/scripts folder.
|
||||
|
||||
Default PostgreSQL startup command
|
||||
|
||||
/opt/bitnami/scripts/postgresql-repmgr/entrypoint.sh /opt/bitnami/scripts/postgresql-repmgr/run.sh
|
||||
|
||||
Default PgPool startup command
|
||||
|
||||
/opt/bitnami/scripts/pgpool/entrypoint.sh /opt/bitnami/scripts/pgpool/run.sh
|
||||
|
||||
{{- else }}
|
||||
PostgreSQL can be accessed through Pgpool via port {{ .Values.service.ports.postgresql }} on the following DNS name from within your cluster:
|
||||
|
||||
{{ include "postgresql-ha.pgpool" . }}.{{ .Release.Namespace }}.svc.{{ $clusterDomain }}
|
||||
|
||||
Pgpool acts as a load balancer for PostgreSQL and forward read/write connections to the primary node while read-only connections are forwarded to standby nodes.
|
||||
|
||||
To get the password for {{ (include "postgresql-ha.postgresqlUsername" .) | quote }} run:
|
||||
|
||||
export POSTGRES_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "postgresql-ha.postgresqlSecretName" . }} -o jsonpath="{.data.password}" | base64 -d)
|
||||
|
||||
To get the password for {{ (include "postgresql-ha.postgresqlRepmgrUsername" .) | quote }} run:
|
||||
|
||||
export REPMGR_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "postgresql-ha.postgresqlSecretName" . }} -o jsonpath="{.data.repmgr-password}" | base64 -d)
|
||||
|
||||
To connect to your database run the following command:
|
||||
|
||||
kubectl run {{ include "common.names.fullname" . }}-client --rm --tty -i --restart='Never' --namespace {{ .Release.Namespace }} --image {{ include "postgresql-ha.postgresql.image" . }} --env="PGPASSWORD=$POSTGRES_PASSWORD" {{ if and (.Values.pgpool.networkPolicy.enabled) (not .Values.pgpool.networkPolicy.allowExternal) }}--labels="{{ include "common.names.fullname" . }}-client=true" {{- end }} \
|
||||
--command -- psql -h {{ include "postgresql-ha.pgpool" . }} -p {{ .Values.service.ports.postgresql }} -U {{ include "postgresql-ha.postgresqlUsername" . }}{{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} -d {{ include "postgresql-ha.postgresqlDatabase" . }}{{- end }}
|
||||
|
||||
{{- if and (.Values.postgresql.networkPolicy.enabled) (not .Values.postgresql.networkPolicy.allowExternal) }}
|
||||
|
||||
Note: Since NetworkPolicy is enabled, only pods with label "{{ include "postgresql-ha.postgresql" . }}-client=true" can access postgresql will be able to connect to PostgreSQL.
|
||||
|
||||
{{- end }}
|
||||
|
||||
{{- if and (.Values.pgpool.networkPolicy.enabled) (not .Values.pgpool.networkPolicy.allowExternal) }}
|
||||
|
||||
Note: Since NetworkPolicy is enabled, only pods with label "{{ include "postgresql-ha.pgpool" . }}-client=true" can access postgresql will be able to connect PgPool.
|
||||
|
||||
{{- end }}
|
||||
|
||||
To connect to your database from outside the cluster execute the following commands:
|
||||
|
||||
{{- if contains "NodePort" .Values.service.type }}
|
||||
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "postgresql-ha.pgpool" . }}
|
||||
PGPASSWORD="$POSTGRES_PASSWORD" psql -h $NODE_IP -p $NODE_PORT -U {{ include "postgresql-ha.postgresqlUsername" . }}{{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} -d {{ include "postgresql-ha.postgresqlDatabase" . }}{{- end }}
|
||||
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ include "postgresql-ha.pgpool" . }}
|
||||
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "postgresql-ha.pgpool" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}")
|
||||
PGPASSWORD="$POSTGRES_PASSWORD" psql -h $SERVICE_IP -p {{ .Values.service.ports.postgresql }} -U {{ include "postgresql-ha.postgresqlUsername" . }}{{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} -d {{ include "postgresql-ha.postgresqlDatabase" . }}{{- end }}
|
||||
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
|
||||
kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "postgresql-ha.pgpool" . }} {{ .Values.service.ports.postgresql }}:{{ .Values.service.ports.postgresql }} &
|
||||
psql -h 127.0.0.1 -p {{ .Values.service.ports.postgresql }} -U {{ include "postgresql-ha.postgresqlUsername" . }}{{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} -d {{ include "postgresql-ha.postgresqlDatabase" . }}{{- end }}
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- include "postgresql-ha.validateValues" . }}
|
||||
{{- include "postgresql-ha.checkRollingTags" . }}
|
||||
|
||||
{{- $passwordValidationErrors := list -}}
|
||||
{{- $requiredPasswords := list -}}
|
||||
{{- if not (include "postgresql-ha.postgresql.existingSecretProvided" . ) }}
|
||||
{{- $secretName := include "postgresql-ha.postgresqlSecretName" . -}}
|
||||
{{- $requiredPostgresqlPassword := dict "valueKey" "postgresql.password" "secret" $secretName "field" "password" "context" $ -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlPassword -}}
|
||||
{{- $requiredRepmgrPassword := dict "valueKey" "postgresql.repmgrPassword" "secret" $secretName "field" "repmgr-password" "context" $ -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredRepmgrPassword -}}
|
||||
{{- end }}
|
||||
{{- if not (include "postgresql-ha.pgpool.existingSecretProvided" . ) }}
|
||||
{{- $secretName := include "postgresql-ha.pgpoolSecretName" . -}}
|
||||
{{- $requiredPgpoolPassword := dict "valueKey" "pgpool.adminPassword" "secret" $secretName "field" "admin-password" "context" $ -}}
|
||||
{{- $requiredPasswords = append $requiredPasswords $requiredPgpoolPassword -}}
|
||||
{{- end }}
|
||||
{{- $passwordValidationErrors = include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .) -}}
|
||||
|
||||
{{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $) -}}
|
||||
{{- include "common.warnings.resources" (dict "sections" (list "metrics" "pgpool" "postgresql" "volumePermissions" "witness") "context" $) }}
|
||||
{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.postgresql.image .Values.pgpool.image .Values.metrics.image .Values.volumePermissions.image) "context" $) }}
|
||||
{{- include "common.errors.insecureImages" (dict "images" (list .Values.postgresql.image .Values.pgpool.image .Values.metrics.image .Values.volumePermissions.image) "context" $) }}
|
||||
761
gitea/charts/postgresql-ha/templates/_helpers.tpl
Normal file
761
gitea/charts/postgresql-ha/templates/_helpers.tpl
Normal file
@@ -0,0 +1,761 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Fully qualified app name for PostgreSQL
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresql" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- printf "%s-postgresql" .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- printf "%s-postgresql" .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s-postgresql" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Fully qualified app name for Pgpool
|
||||
*/}}
|
||||
{{- define "postgresql-ha.pgpool" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- printf "%s-pgpool" .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- printf "%s-pgpool" .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s-pgpool" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Fully qualified app name for LDAP
|
||||
*/}}
|
||||
{{- define "postgresql-ha.ldap" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- printf "%s-ldap" .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- printf "%s-ldap" .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s-ldap" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "postgresql-ha.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
{{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper PostgreSQL image name
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresql.image" -}}
|
||||
{{- include "common.images.image" ( dict "imageRoot" .Values.postgresql.image "global" .Values.global ) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Pgpool image name
|
||||
*/}}
|
||||
{{- define "postgresql-ha.pgpool.image" -}}
|
||||
{{- include "common.images.image" ( dict "imageRoot" .Values.pgpool.image "global" .Values.global ) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper PostgreSQL Prometheus exporter image name
|
||||
*/}}
|
||||
{{- define "postgresql-ha.volumePermissions.image" -}}
|
||||
{{- include "common.images.image" ( dict "imageRoot" .Values.volumePermissions.image "global" .Values.global ) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper PostgreSQL Prometheus exporter image name
|
||||
*/}}
|
||||
{{- define "postgresql-ha.metrics.image" -}}
|
||||
{{- include "common.images.image" ( dict "imageRoot" .Values.metrics.image "global" .Values.global ) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names
|
||||
*/}}
|
||||
{{- define "postgresql-ha.image.pullSecrets" -}}
|
||||
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.postgresql.image .Values.pgpool.image .Values.volumePermissions.image .Values.metrics.image) "context" $) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the PostgreSQL username
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresqlUsername" -}}
|
||||
{{- if .Values.global -}}
|
||||
{{- if .Values.global.postgresql -}}
|
||||
{{- if .Values.global.postgresql.username -}}
|
||||
{{- .Values.global.postgresql.username -}}
|
||||
{{- else -}}
|
||||
{{- .Values.postgresql.username -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- .Values.postgresql.username -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- .Values.postgresql.username -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return PostgreSQL postgres user password
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresqlPostgresPassword" -}}
|
||||
{{- if .Values.global -}}
|
||||
{{- if .Values.global.postgresql -}}
|
||||
{{- if .Values.global.postgresql.postgresPassword -}}
|
||||
{{- .Values.global.postgresql.postgresPassword -}}
|
||||
{{- else -}}
|
||||
{{- ternary (randAlphaNum 10) .Values.postgresql.postgresPassword (empty .Values.postgresql.postgresPassword) -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- ternary (randAlphaNum 10) .Values.postgresql.postgresPassword (empty .Values.postgresql.postgresPassword) -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- ternary (randAlphaNum 10) .Values.postgresql.postgresPassword (empty .Values.postgresql.postgresPassword) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if PostgreSQL postgres user password has been provided
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresqlPasswordProvided" -}}
|
||||
{{- if .Values.global -}}
|
||||
{{- if .Values.global.postgresql -}}
|
||||
{{- if .Values.global.postgresql.postgresPassword -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- if .Values.postgresql.postgresPassword -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- if .Values.postgresql.postgresPassword -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- if .Values.postgresql.postgresPassword -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the PostgreSQL password
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresqlPassword" -}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.postgresql }}
|
||||
{{- if .Values.global.postgresql.password }}
|
||||
{{- .Values.global.postgresql.password -}}
|
||||
{{- else -}}
|
||||
{{- ternary (randAlphaNum 10) .Values.postgresql.password (empty .Values.postgresql.password) -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- ternary (randAlphaNum 10) .Values.postgresql.password (empty .Values.postgresql.password) -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- ternary (randAlphaNum 10) .Values.postgresql.password (empty .Values.postgresql.password) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Pgpool Admin username
|
||||
*/}}
|
||||
{{- define "postgresql-ha.pgpoolAdminUsername" -}}
|
||||
{{- if .Values.global -}}
|
||||
{{- if .Values.global.pgpool -}}
|
||||
{{- if .Values.global.pgpool.adminUsername -}}
|
||||
{{- .Values.global.pgpool.adminUsername -}}
|
||||
{{- else -}}
|
||||
{{- .Values.pgpool.adminUsername -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- .Values.pgpool.adminUsername -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- .Values.pgpool.adminUsername -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Pgpool Admin password
|
||||
*/}}
|
||||
{{- define "postgresql-ha.pgpoolAdminPassword" -}}
|
||||
{{- if .Values.global -}}
|
||||
{{- if .Values.global.pgpool -}}
|
||||
{{- if .Values.global.pgpool.adminPassword -}}
|
||||
{{- .Values.global.pgpool.adminPassword -}}
|
||||
{{- else -}}
|
||||
{{- ternary (randAlphaNum 10) .Values.pgpool.adminPassword (empty .Values.pgpool.adminPassword) -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- ternary (randAlphaNum 10) .Values.pgpool.adminPassword (empty .Values.pgpool.adminPassword) -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- ternary (randAlphaNum 10) .Values.pgpool.adminPassword (empty .Values.pgpool.adminPassword) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Get the metrics ConfigMap name.
|
||||
*/}}
|
||||
{{- define "postgresql.metricsCM" -}}
|
||||
{{- printf "%s-metrics" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the PostgreSQL database to create
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresqlDatabase" -}}
|
||||
{{- $postgresqlDatabase := default "postgres" .Values.postgresql.database -}}
|
||||
{{- if .Values.global -}}
|
||||
{{- if .Values.global.postgresql -}}
|
||||
{{- if .Values.global.postgresql.database -}}
|
||||
{{- default "postgres" .Values.global.postgresql.database -}}
|
||||
{{- else -}}
|
||||
{{- $postgresqlDatabase -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- $postgresqlDatabase -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- $postgresqlDatabase -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the PostgreSQL repmgr username
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresqlRepmgrUsername" -}}
|
||||
{{- if .Values.global -}}
|
||||
{{- if .Values.global.postgresql -}}
|
||||
{{- if .Values.global.postgresql.repmgrUsername -}}
|
||||
{{- .Values.global.postgresql.repmgrUsername -}}
|
||||
{{- else -}}
|
||||
{{- .Values.postgresql.repmgrUsername -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- .Values.postgresql.repmgrUsername -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- .Values.postgresql.repmgrUsername -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the PostgreSQL repmgr password
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresqlRepmgrPassword" -}}
|
||||
{{- if .Values.global -}}
|
||||
{{- if .Values.global.postgresql -}}
|
||||
{{- if .Values.global.postgresql.repmgrPassword -}}
|
||||
{{- .Values.global.postgresql.repmgrPassword -}}
|
||||
{{- else -}}
|
||||
{{- ternary (randAlphaNum 10) .Values.postgresql.repmgrPassword (empty .Values.postgresql.repmgrPassword) -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- ternary (randAlphaNum 10) .Values.postgresql.repmgrPassword (empty .Values.postgresql.repmgrPassword) -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- ternary (randAlphaNum 10) .Values.postgresql.repmgrPassword (empty .Values.postgresql.repmgrPassword) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the database to use for repmgr
|
||||
*/}}
|
||||
{{- define "postgresql-ha.repmgrDatabase" -}}
|
||||
{{- if .Values.global -}}
|
||||
{{- if .Values.global.postgresql -}}
|
||||
{{- if .Values.global.postgresql.repmgrDatabase -}}
|
||||
{{- .Values.global.postgresql.repmgrDatabase -}}
|
||||
{{- else -}}
|
||||
{{- .Values.postgresql.repmgrDatabase -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- .Values.postgresql.repmgrDatabase -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- .Values.postgresql.repmgrDatabase -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if the PostgreSQL credential secret has a separate entry for the postgres user
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresqlSeparatePostgresPassword" -}}
|
||||
{{- if (include "postgresql-ha.postgresqlCreateSecret" .) -}}
|
||||
{{- if and (include "postgresql-ha.postgresqlPostgresPassword" .) (not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres")) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- $pgSecret := index (lookup "v1" "Secret" (include "common.names.namespace" .) (include "postgresql-ha.postgresqlSecretName" .)) "data" -}}
|
||||
{{- if and $pgSecret (index $pgSecret "postgres-password") -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a secret object should be created for PostgreSQL
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresqlCreateSecret" -}}
|
||||
{{- if .Values.global -}}
|
||||
{{- if .Values.global.postgresql -}}
|
||||
{{- if .Values.global.postgresql.existingSecret -}}
|
||||
{{- else if (not .Values.postgresql.existingSecret) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- else if (not .Values.postgresql.existingSecret) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- else if (not .Values.postgresql.existingSecret) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the PostgreSQL credentials secret.
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresqlSecretName" -}}
|
||||
{{- if .Values.global -}}
|
||||
{{- if .Values.global.postgresql -}}
|
||||
{{- if .Values.global.postgresql.existingSecret -}}
|
||||
{{- printf "%s" (tpl .Values.global.postgresql.existingSecret $) -}}
|
||||
{{- else if .Values.postgresql.existingSecret -}}
|
||||
{{- printf "%s" (tpl .Values.postgresql.existingSecret $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s" (include "postgresql-ha.postgresql" .) -}}
|
||||
{{- end -}}
|
||||
{{- else if .Values.postgresql.existingSecret -}}
|
||||
{{- printf "%s" (tpl .Values.postgresql.existingSecret $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s" (include "postgresql-ha.postgresql" .) -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- if .Values.postgresql.existingSecret -}}
|
||||
{{- printf "%s" (tpl .Values.postgresql.existingSecret $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s" (include "postgresql-ha.postgresql" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a secret object should be created for Pgpool
|
||||
*/}}
|
||||
{{- define "postgresql-ha.pgpoolCreateSecret" -}}
|
||||
{{- if .Values.global -}}
|
||||
{{- if .Values.global.pgpool -}}
|
||||
{{- if .Values.global.pgpool.existingSecret -}}
|
||||
{{- else if (not .Values.pgpool.existingSecret) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- else if (not .Values.pgpool.existingSecret) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- else if (not .Values.pgpool.existingSecret) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Pgpool credentials secret.
|
||||
*/}}
|
||||
{{- define "postgresql-ha.pgpoolSecretName" -}}
|
||||
{{- if .Values.global -}}
|
||||
{{- if .Values.global.pgpool -}}
|
||||
{{- if .Values.global.pgpool.existingSecret -}}
|
||||
{{- printf "%s" (tpl .Values.global.pgpool.existingSecret $) -}}
|
||||
{{- else if .Values.pgpool.existingSecret -}}
|
||||
{{- printf "%s" (tpl .Values.pgpool.existingSecret $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s" (include "postgresql-ha.pgpool" .) -}}
|
||||
{{- end -}}
|
||||
{{- else if .Values.pgpool.existingSecret -}}
|
||||
{{- printf "%s" (tpl .Values.pgpool.existingSecret $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s" (include "postgresql-ha.pgpool" .) -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- if .Values.pgpool.existingSecret -}}
|
||||
{{- printf "%s" (tpl .Values.pgpool.existingSecret $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s" (include "postgresql-ha.pgpool" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the PostgreSQL configuration configmap.
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresqlConfigurationCM" -}}
|
||||
{{- if .Values.postgresql.configurationCM -}}
|
||||
{{- printf "%s" (tpl .Values.postgresql.configurationCM $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-configuration" (include "postgresql-ha.postgresql" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the PostgreSQL extended configuration configmap.
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresqlExtendedConfCM" -}}
|
||||
{{- if .Values.postgresql.extendedConfCM -}}
|
||||
{{- printf "%s" (tpl .Values.postgresql.extendedConfCM $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-extended-configuration" (include "postgresql-ha.postgresql" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Pgpool configuration configmap.
|
||||
*/}}
|
||||
{{- define "postgresql-ha.pgpoolConfigurationCM" -}}
|
||||
{{- if .Values.pgpool.configurationCM -}}
|
||||
{{- printf "%s" (tpl .Values.pgpool.configurationCM $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-configuration" (include "postgresql-ha.pgpool" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the PostgreSQL initdb scripts configmap.
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresqlInitdbScriptsCM" -}}
|
||||
{{- if .Values.postgresql.initdbScriptsCM -}}
|
||||
{{- printf "%s" (tpl .Values.postgresql.initdbScriptsCM $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-initdb-scripts" (include "postgresql-ha.postgresql" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Get the initialization scripts Secret name.
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresqlInitdbScriptsSecret" -}}
|
||||
{{- if .Values.postgresql.initdbScriptsSecret -}}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.postgresql.initdbScriptsSecret "context" $) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Pgpool initdb scripts configmap.
|
||||
*/}}
|
||||
{{- define "postgresql-ha.pgpoolInitdbScriptsCM" -}}
|
||||
{{- if .Values.pgpool.initdbScriptsCM -}}
|
||||
{{- printf "%s" (tpl .Values.pgpool.initdbScriptsCM $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-initdb-scripts" (include "postgresql-ha.pgpool" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Get the pgpool initialization scripts Secret name.
|
||||
*/}}
|
||||
{{- define "postgresql-ha.pgpoolInitdbScriptsSecret" -}}
|
||||
{{- if .Values.pgpool.initdbScriptsSecret -}}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.pgpool.initdbScriptsSecret "context" $) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the LDAP bind password
|
||||
*/}}
|
||||
{{- define "postgresql-ha.ldapPassword" -}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.ldap }}
|
||||
{{- if .Values.global.ldap.bindpw }}
|
||||
{{- .Values.global.ldap.bindpw -}}
|
||||
{{- else -}}
|
||||
{{- ternary (randAlphaNum 10) .Values.ldap.bindpw (empty .Values.ldap.bindpw) -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- ternary (randAlphaNum 10) .Values.ldap.bindpw (empty .Values.ldap.bindpw) -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- ternary (randAlphaNum 10) .Values.ldap.bindpw (empty .Values.ldap.bindpw) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the LDAP credentials secret.
|
||||
*/}}
|
||||
{{- define "postgresql-ha.ldapSecretName" -}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.ldap }}
|
||||
{{- if .Values.global.ldap.existingSecret }}
|
||||
{{- printf "%s" .Values.global.ldap.existingSecret -}}
|
||||
{{- else if .Values.ldap.existingSecret -}}
|
||||
{{- printf "%s" .Values.ldap.existingSecret -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s" (include "postgresql-ha.ldap" .) -}}
|
||||
{{- end -}}
|
||||
{{- else if .Values.ldap.existingSecret -}}
|
||||
{{- printf "%s" .Values.ldap.existingSecret -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s" (include "postgresql-ha.ldap" .) -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- if .Values.ldap.existingSecret -}}
|
||||
{{- printf "%s" .Values.ldap.existingSecret -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s" (include "postgresql-ha.ldap" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Check if there are rolling tags in the images */}}
|
||||
{{- define "postgresql-ha.checkRollingTags" -}}
|
||||
{{- include "common.warnings.rollingTag" .Values.postgresql.image -}}
|
||||
{{- include "common.warnings.rollingTag" .Values.pgpool.image -}}
|
||||
{{- include "common.warnings.rollingTag" .Values.metrics.image -}}
|
||||
{{- include "common.warnings.rollingTag" .Values.volumePermissions.image -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Compile all warnings into a single message, and call fail.
|
||||
*/}}
|
||||
{{- define "postgresql-ha.validateValues" -}}
|
||||
{{- $messages := list -}}
|
||||
{{- $messages := append $messages (include "postgresql-ha.validateValues.nodesHostnames" .) -}}
|
||||
{{- $messages := append $messages (include "postgresql-ha.validateValues.ldap" .) -}}
|
||||
{{- $messages := append $messages (include "postgresql-ha.validateValues.ldapPgHba" .) -}}
|
||||
{{- $messages := append $messages (include "postgresql-ha.validateValues.upgradeRepmgrExtension" .) -}}
|
||||
{{- $messages := without $messages "" -}}
|
||||
{{- $message := join "\n" $messages -}}
|
||||
|
||||
{{- if $message -}}
|
||||
{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of PostgreSQL HA - PostgreSQL nodes hostnames cannot be longer than 128 characters */}}
|
||||
{{- define "postgresql-ha.validateValues.nodesHostnames" -}}
|
||||
{{- $postgresqlFullname := include "postgresql-ha.postgresql" . }}
|
||||
{{- $postgresqlHeadlessServiceName := printf "%s-headless" (include "postgresql-ha.postgresql" .) }}
|
||||
{{- $nodeHostname := printf "%s-00.%s" $postgresqlFullname $postgresqlHeadlessServiceName }}
|
||||
{{- if gt (len $nodeHostname) 128 -}}
|
||||
postgresql-ha: Nodes hostnames
|
||||
PostgreSQL nodes hostnames ({{ $nodeHostname }}) exceeds the characters limit for Pgpool: 128.
|
||||
Consider using a shorter release name or namespace.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of PostgreSQL HA - must provide mandatory LDAP parameters when LDAP is enabled */}}
|
||||
{{- define "postgresql-ha.validateValues.ldap" -}}
|
||||
{{- if and .Values.ldap.enabled (or (empty .Values.ldap.uri) (and (empty .Values.ldap.basedn) (empty .Values.ldap.base)) (empty .Values.ldap.binddn) (and (empty .Values.ldap.bindpw) (empty .Values.ldap.existingSecret))) -}}
|
||||
postgresql-ha: LDAP
|
||||
Invalid LDAP configuration. When enabling LDAP support, the parameters "ldap.uri",
|
||||
"ldap.basedn", "ldap.binddn", and "ldap.bindpw" are mandatory. Please provide them:
|
||||
|
||||
$ helm install {{ .Release.Name }} oci://registry-1.docker.io/bitnamicharts/postgresql-ha \
|
||||
--set ldap.enabled=true \
|
||||
--set ldap.uri="ldap://my_ldap_server" \
|
||||
--set ldap.basedn="dc=example\,dc=org" \
|
||||
--set ldap.binddn="cn=admin\,dc=example\,dc=org" \
|
||||
--set ldap.bindpw="admin"
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of PostgreSQL HA - PostgreSQL HBA configuration must trust every user when LDAP is enabled */}}
|
||||
{{- define "postgresql-ha.validateValues.ldapPgHba" -}}
|
||||
{{- if and .Values.ldap.enabled (not .Values.postgresql.pgHbaTrustAll) }}
|
||||
postgresql-ha: LDAP & pg_hba.conf
|
||||
PostgreSQL HBA configuration must trust every user when LDAP is enabled.
|
||||
Please configure HBA to trust every user (--set postgresql.pgHbaTrustAll=true)
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of PostgreSQL HA - There must be an unique replica when upgrading repmgr extension */}}
|
||||
{{- define "postgresql-ha.validateValues.upgradeRepmgrExtension" -}}
|
||||
{{- $postgresqlReplicaCount := int .Values.postgresql.replicaCount }}
|
||||
{{- if and .Values.postgresql.upgradeRepmgrExtension (gt $postgresqlReplicaCount 1) }}
|
||||
postgresql-ha: Upgrade repmgr extension
|
||||
There must be only one replica when upgrading repmgr extension:
|
||||
|
||||
$ helm upgrade {{ .Release.Name }} oci://registry-1.docker.io/bitnamicharts/postgresql-ha \
|
||||
--set postgresql.replicaCount=1 \
|
||||
--set postgresql.upgradeRepmgrExtension=true
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Set PostgreSQL PGPASSWORD as environment variable depends on configuration */}}
|
||||
{{- define "postgresql-ha.pgpassword" -}}
|
||||
{{- if .Values.postgresql.usePasswordFile -}}
|
||||
PGPASSWORD=$(< $POSTGRES_PASSWORD_FILE)
|
||||
{{- else -}}
|
||||
PGPASSWORD=$POSTGRES_PASSWORD
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Set Pgpool PGPASSWORD as environment variable depends on configuration */}}
|
||||
{{- define "postgresql-ha.pgpoolPostgresPassword" -}}
|
||||
{{- if .Values.postgresql.usePasswordFile -}}
|
||||
PGPASSWORD=$(< $PGPOOL_POSTGRES_PASSWORD_FILE)
|
||||
{{- else -}}
|
||||
PGPASSWORD=$PGPOOL_POSTGRES_PASSWORD
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Pgpool secret containing custom users to be added to
|
||||
pool_passwd file.
|
||||
*/}}
|
||||
{{- define "postgresql-ha.pgpoolCustomUsersSecretName" -}}
|
||||
{{- if .Values.pgpool.customUsersSecret -}}
|
||||
{{- printf "%s" (tpl .Values.pgpool.customUsersSecret $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-custom-users" (include "postgresql-ha.pgpool" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the path to the cert file.
|
||||
*/}}
|
||||
{{- define "postgresql-ha.pgpool.tlsCert" -}}
|
||||
{{- if and .Values.pgpool.tls.enabled .Values.pgpool.tls.autoGenerated }}
|
||||
{{- printf "/opt/bitnami/pgpool/certs/tls.crt" -}}
|
||||
{{- else -}}
|
||||
{{- required "Certificate filename is required when TLS in enabled" .Values.pgpool.tls.certFilename | printf "/opt/bitnami/pgpool/certs/%s" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the path to the cert key file.
|
||||
*/}}
|
||||
{{- define "postgresql-ha.pgpool.tlsCertKey" -}}
|
||||
{{- if and .Values.pgpool.tls.enabled .Values.pgpool.tls.autoGenerated }}
|
||||
{{- printf "/opt/bitnami/pgpool/certs/tls.key" -}}
|
||||
{{- else -}}
|
||||
{{- required "Certificate Key filename is required when TLS in enabled" .Values.pgpool.tls.certKeyFilename | printf "/opt/bitnami/pgpool/certs/%s" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the path to the CA cert file.
|
||||
*/}}
|
||||
{{- define "postgresql-ha.pgpool.tlsCACert" -}}
|
||||
{{- if and .Values.pgpool.tls.enabled .Values.pgpool.tls.autoGenerated }}
|
||||
{{- printf "/opt/bitnami/pgpool/certs/ca.crt" -}}
|
||||
{{- else -}}
|
||||
{{- printf "/opt/bitnami/pgpool/certs/%s" .Values.pgpool.tls.certCAFilename -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a TLS credentials secret object should be created
|
||||
*/}}
|
||||
{{- define "postgresql-ha.createTlsSecret" -}}
|
||||
{{- if and .Values.pgpool.tls.enabled .Values.pgpool.tls.autoGenerated (not .Values.pgpool.tls.certificatesSecret) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the path to the CA cert file.
|
||||
*/}}
|
||||
{{- define "postgresql-ha.tlsSecretName" -}}
|
||||
{{- if .Values.pgpool.tls.enabled }}
|
||||
{{- if .Values.pgpool.tls.autoGenerated }}
|
||||
{{- printf "%s-crt" (include "postgresql-ha.pgpool" .) -}}
|
||||
{{- else -}}
|
||||
{{ required "A secret containing TLS certificates is required when TLS is enabled" (tpl .Values.pgpool.tls.certificatesSecret $) }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if PostgreSQL postgres existingSecret has been provided
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresql.existingSecretProvided" -}}
|
||||
{{- if .Values.global -}}
|
||||
{{- if .Values.global.postgresql -}}
|
||||
{{- if .Values.global.postgresql.existingSecret -}}
|
||||
{{- true -}}
|
||||
{{- else if .Values.postgresql.existingSecret -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- else if .Values.postgresql.existingSecret -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- if .Values.postgresql.existingSecret -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if PostgreSQL pgpool existingSecret has been provided
|
||||
*/}}
|
||||
{{- define "postgresql-ha.pgpool.existingSecretProvided" -}}
|
||||
{{- if .Values.global -}}
|
||||
{{- if .Values.global.pgpool -}}
|
||||
{{- if .Values.global.pgpool.existingSecret -}}
|
||||
{{- true -}}
|
||||
{{- else if .Values.pgpool.existingSecret -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- else if .Values.pgpool.existingSecret -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- if .Values.pgpool.existingSecret -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the path to the cert file.
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresql.tlsCert" -}}
|
||||
{{- required "Certificate filename is required when TLS in enabled" .Values.postgresql.tls.certFilename | printf "/opt/bitnami/postgresql/certs/%s" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the path to the cert key file.
|
||||
*/}}
|
||||
{{- define "postgresql-ha.postgresql.tlsCertKey" -}}
|
||||
{{- required "Certificate Key filename is required when TLS in enabled" .Values.postgresql.tls.certKeyFilename | printf "/opt/bitnami/postgresql/certs/%s" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Get the readiness probe command
|
||||
*/}}
|
||||
{{- define "postgresql-ha.readinessProbeCommand" -}}
|
||||
{{- $block := index .context.Values .component }}
|
||||
{{- if eq .component "postgresql" -}}
|
||||
- |
|
||||
exec pg_isready -U "postgres" {{- if $block.tls.enabled }} -d "sslcert={{ include "postgresql-ha.postgresql.tlsCert" .context }} sslkey={{ include "postgresql-ha.postgresql.tlsCertKey" .context }}"{{- end }} -h 127.0.0.1 -p {{ $block.containerPorts.postgresql }}
|
||||
{{- if contains "bitnami/" $block.image.repository }}
|
||||
[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
|
||||
{{- end }}
|
||||
{{- else -}}
|
||||
- exec pg_isready -U "postgres" -h 127.0.0.1 -p {{ $block.containerPorts.postgresql }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
136
gitea/charts/postgresql-ha/templates/backup/cronjob.yaml
Normal file
136
gitea/charts/postgresql-ha/templates/backup/cronjob.yaml
Normal file
@@ -0,0 +1,136 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.backup.enabled }}
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.postgresql" . }}-pgdumpall
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.labels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: pg_dumpall
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
{{- if $annotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
schedule: {{ .Values.backup.cronjob.schedule | quote }}
|
||||
{{- if .Values.backup.cronjob.timezone }}
|
||||
timeZone: {{ .Values.backup.cronjob.timezone | quote }}
|
||||
{{- end }}
|
||||
concurrencyPolicy: {{ .Values.backup.cronjob.concurrencyPolicy }}
|
||||
failedJobsHistoryLimit: {{ .Values.backup.cronjob.failedJobsHistoryLimit }}
|
||||
successfulJobsHistoryLimit: {{ .Values.backup.cronjob.successfulJobsHistoryLimit }}
|
||||
{{- if .Values.backup.cronjob.startingDeadlineSeconds }}
|
||||
startingDeadlineSeconds: {{ .Values.backup.cronjob.startingDeadlineSeconds }}
|
||||
{{- end }}
|
||||
jobTemplate:
|
||||
spec:
|
||||
{{- if .Values.backup.cronjob.ttlSecondsAfterFinished }}
|
||||
ttlSecondsAfterFinished: {{ .Values.backup.cronjob.ttlSecondsAfterFinished }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 12 }}
|
||||
app.kubernetes.io/component: pg_dumpall
|
||||
{{- if $annotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- include "postgresql-ha.image.pullSecrets" . | nindent 10 }}
|
||||
{{- if .Values.backup.cronjob.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.nodeSelector "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.backup.cronjob.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.tolerations "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ include "postgresql-ha.postgresql" . }}-pgdumpall
|
||||
image: {{ include "postgresql-ha.postgresql.image" . }}
|
||||
imagePullPolicy: {{ .Values.postgresql.image.pullPolicy | quote }}
|
||||
env:
|
||||
- name: PGUSER
|
||||
value: "postgres"
|
||||
{{- if .Values.postgresql.usePasswordFile }}
|
||||
- name: PGPASSFILE
|
||||
value: "/opt/bitnami/postgresql/secrets/postgres-password"
|
||||
{{- else }}
|
||||
- name: PGPASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
{{- if (include "postgresql-ha.postgresqlSeparatePostgresPassword" .) }}
|
||||
key: postgres-password
|
||||
{{- else }}
|
||||
key: password
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: PGHOST
|
||||
value: {{ include "postgresql-ha.postgresql" . }}
|
||||
- name: PGPORT
|
||||
value: {{ .Values.service.ports.postgresql | quote }}
|
||||
- name: PGDUMP_DIR
|
||||
value: {{ .Values.backup.cronjob.storage.mountPath }}
|
||||
{{- if .Values.postgresql.tls.enabled }}
|
||||
- name: PGSSLROOTCERT
|
||||
values: {{ include "postgresql-ha.pgpool.tlsCACert" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.backup.cronjob.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.extraEnvVars "context" $) | nindent 14 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
{{- if .Values.backup.cronjob.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ .Values.backup.cronjob.extraEnvVarsCM }}
|
||||
{{- end }}
|
||||
{{- if .Values.backup.cronjob.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ .Values.backup.cronjob.extraEnvVarsSecret }}
|
||||
{{- end }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.command "context" $) | nindent 14 }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- if .Values.postgresql.tls.enabled }}
|
||||
- name: certs
|
||||
mountPath: /certs
|
||||
{{- end }}
|
||||
- name: datadir
|
||||
mountPath: {{ .Values.backup.cronjob.storage.mountPath }}
|
||||
subPath: {{ .Values.backup.cronjob.storage.subPath }}
|
||||
{{- if .Values.backup.cronjob.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.extraVolumeMounts "context" $) | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- if .Values.backup.cronjob.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.backup.cronjob.containerSecurityContext "context" $) | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- if .Values.backup.cronjob.resources }}
|
||||
resources: {{- toYaml .Values.backup.cronjob.resources | nindent 14 }}
|
||||
{{- else if ne .Values.backup.cronjob.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.backup.cronjob.resourcesPreset) | nindent 14 }}
|
||||
{{- end }}
|
||||
restartPolicy: {{ .Values.backup.cronjob.restartPolicy }}
|
||||
{{- if .Values.backup.cronjob.podSecurityContext.enabled }}
|
||||
securityContext:
|
||||
fsGroup: {{ .Values.backup.cronjob.podSecurityContext.fsGroup }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
{{- if .Values.backup.cronjob.storage.existingClaim }}
|
||||
- name: datadir
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ printf "%s" (tpl .Values.backup.cronjob.storage.existingClaim .) }}
|
||||
{{- else }}
|
||||
- name: datadir
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ include "postgresql-ha.postgresql" . }}-pgdumpall
|
||||
{{- end }}
|
||||
{{- if .Values.backup.cronjob.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.extraVolumes "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
34
gitea/charts/postgresql-ha/templates/backup/pvc.yaml
Normal file
34
gitea/charts/postgresql-ha/templates/backup/pvc.yaml
Normal file
@@ -0,0 +1,34 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.backup.enabled (not .Values.backup.cronjob.storage.existingClaim) -}}
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.postgresql" . }}-pgdumpall
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.labels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: pg_dumpall
|
||||
{{- if or .Values.backup.cronjob.annotations .Values.commonAnnotations .Values.backup.cronjob.storage.resourcePolicy }}
|
||||
annotations:
|
||||
{{- if or .Values.backup.cronjob.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.backup.cronjob.storage.resourcePolicy }}
|
||||
helm.sh/resource-policy: {{ .Values.backup.cronjob.storage.resourcePolicy | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- range .Values.backup.cronjob.storage.accessModes }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.backup.cronjob.storage.size | quote }}
|
||||
{{ include "common.storage.class" (dict "persistence" .Values.backup.cronjob.storage "global" .Values.global) }}
|
||||
{{- end }}
|
||||
9
gitea/charts/postgresql-ha/templates/extra-list.yaml
Normal file
9
gitea/charts/postgresql-ha/templates/extra-list.yaml
Normal file
@@ -0,0 +1,9 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- range .Values.extraDeploy }}
|
||||
---
|
||||
{{ include "common.tplvalues.render" (dict "value" . "context" $) }}
|
||||
{{- end }}
|
||||
19
gitea/charts/postgresql-ha/templates/ldap-secrets.yaml
Normal file
19
gitea/charts/postgresql-ha/templates/ldap-secrets.yaml
Normal file
@@ -0,0 +1,19 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.ldap.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.ldap" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
bind-password: {{ (include "postgresql-ha.ldapPassword" .) | b64enc | quote }}
|
||||
{{- end -}}
|
||||
18
gitea/charts/postgresql-ha/templates/metrics-configmap.yaml
Normal file
18
gitea/charts/postgresql-ha/templates/metrics-configmap.yaml
Normal file
@@ -0,0 +1,18 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.customMetrics }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "postgresql.metricsCM" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
custom-metrics.yaml: {{ toYaml .Values.metrics.customMetrics | quote }}
|
||||
{{- end }}
|
||||
22
gitea/charts/postgresql-ha/templates/pgpool/configmap.yaml
Normal file
22
gitea/charts/postgresql-ha/templates/pgpool/configmap.yaml
Normal file
@@ -0,0 +1,22 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.pgpool.configuration (not .Values.pgpool.configurationCM) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-configuration" (include "postgresql-ha.pgpool" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: pgpool
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
pgpool.conf: |-
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.pgpool.configuration "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,23 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and (not .Values.pgpool.customUsersSecret) .Values.pgpool.customUsers.usernames }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ printf "%s-custom-users" (include "postgresql-ha.pgpool" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: pgpool
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
usernames: {{ .Values.pgpool.customUsers.usernames | b64enc | quote }}
|
||||
passwords: {{ .Values.pgpool.customUsers.passwords | b64enc | quote }}
|
||||
{{- end -}}
|
||||
447
gitea/charts/postgresql-ha/templates/pgpool/deployment.yaml
Normal file
447
gitea/charts/postgresql-ha/templates/pgpool/deployment.yaml
Normal file
@@ -0,0 +1,447 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.pgpool" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.labels .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: pgpool
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- if and (not .Values.pgpool.customUsersSecret) .Values.pgpool.customUsers.usernames }}
|
||||
checksum/custom-users-secrets: {{ include (print $.Template.BasePath "/pgpool/custom-users-secrets.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.pgpool.replicaCount }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.podLabels .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: pgpool
|
||||
{{- if .Values.pgpool.updateStrategy }}
|
||||
strategy: {{- toYaml .Values.pgpool.updateStrategy | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.minReadySeconds }}
|
||||
minReadySeconds: {{ .Values.pgpool.minReadySeconds }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
app.kubernetes.io/component: pgpool
|
||||
{{- if .Values.pgpool.podAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- include "postgresql-ha.image.pullSecrets" . | nindent 6 }}
|
||||
automountServiceAccountToken: {{ .Values.pgpool.automountServiceAccountToken }}
|
||||
{{- if .Values.pgpool.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.pgpool.podAffinityPreset "component" "pgpool" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.pgpool.podAntiAffinityPreset "component" "pgpool" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.pgpool.nodeAffinityPreset.type "key" .Values.pgpool.nodeAffinityPreset.key "values" .Values.pgpool.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.tolerations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.priorityClassName }}
|
||||
priorityClassName: {{ .Values.pgpool.priorityClassName }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.schedulerName }}
|
||||
schedulerName: {{ .Values.pgpool.schedulerName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.topologySpreadConstraints "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.pgpool.podSecurityContext "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.pgpool.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "postgresql-ha.serviceAccountName" . }}
|
||||
{{- if or .Values.pgpool.tls.enabled .Values.pgpool.initContainers }}
|
||||
initContainers:
|
||||
{{- if .Values.pgpool.tls.enabled }}
|
||||
- name: init-chmod-data
|
||||
image: {{ template "postgresql-ha.volumePermissions.image" . }}
|
||||
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
|
||||
command:
|
||||
- /bin/sh
|
||||
- -cx
|
||||
- |
|
||||
cp /tmp/certs/* /opt/bitnami/pgpool/certs/
|
||||
{{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }}
|
||||
chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/pgpool/certs/
|
||||
{{- else }}
|
||||
chown -R {{ .Values.pgpool.containerSecurityContext.runAsUser }}:{{ .Values.pgpool.podSecurityContext.fsGroup }} /opt/bitnami/pgpool/certs/
|
||||
{{- end }}
|
||||
chmod 600 {{ template "postgresql-ha.pgpool.tlsCertKey" . }}
|
||||
{{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" (omit .Values.volumePermissions.podSecurityContext "runAsUser") "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.podSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.volumePermissions.resources }}
|
||||
resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
|
||||
{{- else if ne .Values.volumePermissions.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: raw-certificates
|
||||
mountPath: /tmp/certs
|
||||
- name: pgpool-certificates
|
||||
mountPath: /opt/bitnami/pgpool/certs
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.initContainers }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.pgpool.initContainers "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
# Auxiliary vars to populate environment variables
|
||||
{{- $postgresqlReplicaCount := int .Values.postgresql.replicaCount }}
|
||||
{{- $postgresqlFullname := include "postgresql-ha.postgresql" . }}
|
||||
{{- $postgresalContainerPort := int .Values.postgresql.containerPorts.postgresql }}
|
||||
{{- $postgresqlHeadlessServiceName := printf "%s-headless" (include "postgresql-ha.postgresql" .) }}
|
||||
containers:
|
||||
- name: pgpool
|
||||
image: {{ include "postgresql-ha.pgpool.image" . }}
|
||||
imagePullPolicy: {{ .Values.pgpool.image.pullPolicy | quote }}
|
||||
{{- if .Values.pgpool.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.pgpool.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.pgpool.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.pgpool.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.pgpool.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" (or .Values.pgpool.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||
{{- if or .Values.pgpool.customUsersSecret .Values.pgpool.customUsers.usernames }}
|
||||
- name: PGPOOL_POSTGRES_CUSTOM_USERS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.pgpoolCustomUsersSecretName" . }}
|
||||
key: usernames
|
||||
- name: PGPOOL_POSTGRES_CUSTOM_PASSWORDS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.pgpoolCustomUsersSecretName" . }}
|
||||
key: passwords
|
||||
{{- end }}
|
||||
- name: PGPOOL_BACKEND_NODES
|
||||
value: {{ range $e, $i := until $postgresqlReplicaCount }}{{ $i }}:{{ $postgresqlFullname }}-{{ $i }}.{{ $postgresqlHeadlessServiceName }}:{{ $postgresalContainerPort }},{{ end }}
|
||||
- name: PGPOOL_SR_CHECK_USER
|
||||
value: {{ (include "postgresql-ha.postgresqlRepmgrUsername" .) | quote }}
|
||||
{{- if .Values.postgresql.usePasswordFile }}
|
||||
- name: PGPOOL_SR_CHECK_PASSWORD_FILE
|
||||
value: "/opt/bitnami/pgpool/secrets/pgpool-sr-check-password"
|
||||
{{- else }}
|
||||
- name: PGPOOL_SR_CHECK_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
key: repmgr-password
|
||||
{{- end }}
|
||||
- name: PGPOOL_SR_CHECK_DATABASE
|
||||
value: {{ .Values.pgpool.srCheckDatabase | quote }}
|
||||
- name: PGPOOL_ENABLE_LDAP
|
||||
value: {{ ternary "yes" "no" .Values.ldap.enabled | quote }}
|
||||
{{- if .Values.ldap.enabled }}
|
||||
- name: LDAP_URI
|
||||
value: {{ .Values.ldap.uri | quote }}
|
||||
- name: LDAP_BASE
|
||||
value: {{ coalesce .Values.ldap.base .Values.ldap.basedn | quote }}
|
||||
- name: LDAP_BIND_DN
|
||||
value: {{ .Values.ldap.binddn | quote }}
|
||||
- name: LDAP_BIND_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.ldapSecretName" . }}
|
||||
key: bind-password
|
||||
{{- if .Values.ldap.bslookup }}
|
||||
- name: LDAP_BASE_LOOKUP
|
||||
value: {{ .Values.ldap.bslookup | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.ldap.scope }}
|
||||
- name: LDAP_SCOPE
|
||||
value: {{ .Values.ldap.scope | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.ldap.tlsReqcert }}
|
||||
- name: LDAP_TLS_REQCERT
|
||||
value: {{ .Values.ldap.tlsReqcert | quote }}
|
||||
{{- end }}
|
||||
- name: LDAP_NSS_INITGROUPS_IGNOREUSERS
|
||||
value: {{ .Values.ldap.nssInitgroupsIgnoreusers | quote }}
|
||||
{{- end }}
|
||||
- name: PGPOOL_POSTGRES_USERNAME
|
||||
value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }}
|
||||
{{- if .Values.postgresql.usePasswordFile }}
|
||||
- name: PGPOOL_POSTGRES_PASSWORD_FILE
|
||||
value: "/opt/bitnami/pgpool/secrets/pgpool-password"
|
||||
{{- else }}
|
||||
- name: PGPOOL_POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
key: password
|
||||
{{- end }}
|
||||
- name: PGPOOL_ADMIN_USERNAME
|
||||
value: {{ (include "postgresql-ha.pgpoolAdminUsername" .) | quote }}
|
||||
{{- if .Values.pgpool.usePasswordFile }}
|
||||
- name: PGPOOL_ADMIN_PASSWORD_FILE
|
||||
value: "/opt/bitnami/pgpool/secrets/admin-password"
|
||||
{{- else }}
|
||||
- name: PGPOOL_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.pgpoolSecretName" . }}
|
||||
key: admin-password
|
||||
{{- end }}
|
||||
- name: PGPOOL_AUTHENTICATION_METHOD
|
||||
value: {{ .Values.pgpool.authenticationMethod | quote }}
|
||||
- name: PGPOOL_ENABLE_LOAD_BALANCING
|
||||
value: {{ ternary "yes" "no" .Values.pgpool.useLoadBalancing | quote }}
|
||||
{{- if .Values.pgpool.useLoadBalancing }}
|
||||
- name: PGPOOL_DISABLE_LOAD_BALANCE_ON_WRITE
|
||||
value: {{ .Values.pgpool.disableLoadBalancingOnWrite | quote }}
|
||||
{{- end }}
|
||||
- name: PGPOOL_ENABLE_LOG_CONNECTIONS
|
||||
value: {{ ternary "yes" "no" .Values.pgpool.logConnections | quote }}
|
||||
- name: PGPOOL_ENABLE_LOG_HOSTNAME
|
||||
value: {{ ternary "yes" "no" .Values.pgpool.logHostname | quote }}
|
||||
- name: PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT
|
||||
value: {{ ternary "yes" "no" .Values.pgpool.logPerNodeStatement | quote }}
|
||||
{{- if .Values.pgpool.logLinePrefix }}
|
||||
- name: PGPOOL_LOG_LINE_PREFIX
|
||||
value: {{ .Values.pgpool.logLinePrefix | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.numInitChildren }}
|
||||
- name: PGPOOL_NUM_INIT_CHILDREN
|
||||
value: {{ .Values.pgpool.numInitChildren | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.reservedConnections }}
|
||||
- name: PGPOOL_RESERVED_CONNECTIONS
|
||||
value: '{{ .Values.pgpool.reservedConnections }}'
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.maxPool }}
|
||||
- name: PGPOOL_MAX_POOL
|
||||
value: {{ .Values.pgpool.maxPool | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.childMaxConnections }}
|
||||
- name: PGPOOL_CHILD_MAX_CONNECTIONS
|
||||
value: {{ .Values.pgpool.childMaxConnections | quote }}
|
||||
{{- end }}
|
||||
{{- $childlifetime := .Values.pgpool.childLifeTime | quote }}
|
||||
{{- if or $childlifetime (eq "0" $childlifetime) }}
|
||||
- name: PGPOOL_CHILD_LIFE_TIME
|
||||
value: {{ $childlifetime }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.clientIdleLimit }}
|
||||
- name: PGPOOL_CLIENT_IDLE_LIMIT
|
||||
value: {{ .Values.pgpool.clientIdleLimit | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.connectionLifeTime }}
|
||||
- name: PGPOOL_CONNECTION_LIFE_TIME
|
||||
value: {{ .Values.pgpool.connectionLifeTime | quote }}
|
||||
{{- end }}
|
||||
{{- if or .Values.pgpool.configuration .Values.pgpool.configurationCM }}
|
||||
- name: PGPOOL_USER_CONF_FILE
|
||||
value: "/opt/bitnami/pgpool/user_config/pgpool.conf"
|
||||
{{- end }}
|
||||
- name: PGPOOL_ENABLE_TLS
|
||||
value: {{ ternary "yes" "no" .Values.pgpool.tls.enabled | quote }}
|
||||
{{- if .Values.pgpool.tls.enabled }}
|
||||
- name: PGPOOL_TLS_PREFER_SERVER_CIPHERS
|
||||
value: {{ ternary "yes" "no" .Values.pgpool.tls.preferServerCiphers | quote }}
|
||||
- name: PGPOOL_TLS_CERT_FILE
|
||||
value: {{ template "postgresql-ha.pgpool.tlsCert" . }}
|
||||
- name: PGPOOL_TLS_KEY_FILE
|
||||
value: {{ template "postgresql-ha.pgpool.tlsCertKey" . }}
|
||||
{{- if .Values.pgpool.tls.certCAFilename }}
|
||||
- name: PGPOOL_TLS_CA_FILE
|
||||
value: {{ template "postgresql-ha.pgpool.tlsCACert" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: PGPOOL_HEALTH_CHECK_PSQL_TIMEOUT
|
||||
{{- if .Values.pgpool.customLivenessProbe }}
|
||||
value: {{ add 1 (default 1 .Values.pgpool.customLivenessProbe.timeoutSeconds) | quote }}
|
||||
{{- else }}
|
||||
value: {{ add 1 (default 1 .Values.pgpool.livenessProbe.timeoutSeconds) | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.pgpool.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
{{- if .Values.pgpool.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ .Values.pgpool.extraEnvVarsCM }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ .Values.pgpool.extraEnvVarsSecret }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: postgresql
|
||||
containerPort: {{ .Values.pgpool.containerPorts.postgresql }}
|
||||
protocol: TCP
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.pgpool.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.pgpool.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.pgpool.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
command:
|
||||
- /opt/bitnami/scripts/pgpool/healthcheck.sh
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.pgpool.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.pgpool.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- '{{ include "postgresql-ha.pgpoolPostgresPassword" . }} psql -U {{ (include "postgresql-ha.postgresqlUsername" .) | quote }} {{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }}{{- end }} -h /opt/bitnami/pgpool/tmp -tA -c "SELECT 1" >/dev/null'
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.pgpool.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.pgpool.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
command:
|
||||
- /opt/bitnami/scripts/pgpool/healthcheck.sh
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.resources }}
|
||||
resources: {{- toYaml .Values.pgpool.resources | nindent 12 }}
|
||||
{{- else if ne .Values.pgpool.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.pgpool.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/pgpool/etc
|
||||
subPath: app-etc-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/pgpool/conf
|
||||
subPath: app-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/pgpool/tmp
|
||||
subPath: app-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/pgpool/logs
|
||||
subPath: app-logs-dir
|
||||
{{- if or .Values.pgpool.configuration .Values.pgpool.configurationCM .Values.pgpool.initdbScripts .Values.pgpool.initdbScriptsCM .Values.pgpool.initdbScriptsSecret .Values.postgresql.usePasswordFile .Values.pgpool.usePasswordFile .Values.pgpool.tls.enabled .Values.pgpool.extraVolumeMounts }}
|
||||
{{- if or .Values.pgpool.configuration .Values.pgpool.configurationCM }}
|
||||
- name: pgpool-config
|
||||
mountPath: /opt/bitnami/pgpool/user_config/
|
||||
{{- end }}
|
||||
{{- if or .Values.pgpool.initdbScripts .Values.pgpool.initdbScriptsCM }}
|
||||
- name: custom-init-scripts
|
||||
mountPath: /docker-entrypoint-initdb.d/
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.initdbScriptsSecret }}
|
||||
- name: custom-init-scripts-secret
|
||||
mountPath: /docker-entrypoint-initdb.d/secret
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.usePasswordFile }}
|
||||
- name: postgresql-password
|
||||
subPath: pgpool-password
|
||||
mountPath: /opt/bitnami/pgpool/secrets/pgpool-password
|
||||
- name: postgresql-password
|
||||
subPath: pgpool-sr-check-password
|
||||
mountPath: /opt/bitnami/pgpool/secrets/pgpool-sr-check-password
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.usePasswordFile }}
|
||||
- name: pgpool-password
|
||||
subPath: admin-password
|
||||
mountPath: /opt/bitnami/pgpool/secrets/admin-password
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.tls.enabled }}
|
||||
- name: pgpool-certificates
|
||||
mountPath: /opt/bitnami/pgpool/certs
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.pgpool.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.sidecars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.pgpool.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
{{- if or .Values.pgpool.configuration .Values.pgpool.configurationCM .Values.pgpool.initdbScripts .Values.pgpool.initdbScriptsCM .Values.pgpool.initdbScriptsSecret .Values.pgpool.usePasswordFile .Values.postgresql.usePasswordFile .Values.pgpool.tls.enabled .Values.pgpool.extraVolumes }}
|
||||
{{- if or .Values.pgpool.configuration .Values.pgpool.configurationCM }}
|
||||
- name: pgpool-config
|
||||
configMap:
|
||||
name: {{ include "postgresql-ha.pgpoolConfigurationCM" . }}
|
||||
{{- end }}
|
||||
{{- if or .Values.pgpool.initdbScripts .Values.pgpool.initdbScriptsCM }}
|
||||
- name: custom-init-scripts
|
||||
configMap:
|
||||
name: {{ template "postgresql-ha.pgpoolInitdbScriptsCM" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.initdbScriptsSecret }}
|
||||
- name: custom-init-scripts-secret
|
||||
secret:
|
||||
secretName: {{ template "postgresql-ha.pgpoolInitdbScriptsSecret" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.usePasswordFile }}
|
||||
- name: postgresql-password
|
||||
secret:
|
||||
secretName: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
items:
|
||||
- key: password
|
||||
path: pgpool-password
|
||||
- key: repmgr-password
|
||||
path: pgpool-sr-check-password
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.usePasswordFile }}
|
||||
- name: pgpool-password
|
||||
secret:
|
||||
secretName: {{ include "postgresql-ha.pgpoolSecretName" . }}
|
||||
items:
|
||||
- key: admin-password
|
||||
path: admin-password
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.tls.enabled }}
|
||||
- name: raw-certificates
|
||||
secret:
|
||||
secretName: {{ include "postgresql-ha.tlsSecretName" . }}
|
||||
- name: pgpool-certificates
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.pgpool.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,21 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.pgpool.initdbScripts (not .Values.pgpool.initdbScriptsCM) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-initdb-scripts" (include "postgresql-ha.pgpool" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: pgpool
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.pgpool.initdbScripts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,88 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.pgpool.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.pgpool" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: pgpool
|
||||
role: data
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: pgpool
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.pgpool.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
# Allow outbound connections to other cluster pods
|
||||
- ports:
|
||||
- port: {{ .Values.service.ports.postgresql }}
|
||||
- port: {{ .Values.pgpool.containerPorts.postgresql }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/component: pgpool
|
||||
# Allow outbound connections to other postgresql pods
|
||||
- ports:
|
||||
- port: {{ .Values.service.ports.postgresql }}
|
||||
- port: {{ .Values.postgresql.containerPorts.postgresql }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if .Values.pgpool.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.pgpool.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.pgpool.containerPorts.postgresql }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- port: {{ .Values.metrics.containerPorts.http }}
|
||||
{{- end }}
|
||||
{{- if not .Values.pgpool.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "postgresql-ha.pgpool" . }}-client: "true"
|
||||
{{- if .Values.pgpool.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.pgpool.networkPolicy.ingressNSMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.networkPolicy.ingressNSPodMatchLabels }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.pgpool.networkPolicy.ingressNSPodMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.pgpool.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.pgpool.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
30
gitea/charts/postgresql-ha/templates/pgpool/pdb.yaml
Normal file
30
gitea/charts/postgresql-ha/templates/pgpool/pdb.yaml
Normal file
@@ -0,0 +1,30 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.pgpool.pdb.create }}
|
||||
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.pgpool" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: pgpool
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.pgpool.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.pgpool.pdb.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if or .Values.pgpool.pdb.maxUnavailable (not .Values.pgpool.pdb.minAvailable) }}
|
||||
maxUnavailable: {{ .Values.pgpool.pdb.maxUnavailable | default 1 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: pgpool
|
||||
{{- end }}
|
||||
22
gitea/charts/postgresql-ha/templates/pgpool/secrets.yaml
Normal file
22
gitea/charts/postgresql-ha/templates/pgpool/secrets.yaml
Normal file
@@ -0,0 +1,22 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if (include "postgresql-ha.pgpoolCreateSecret" .) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.pgpool" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: pgpool
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
admin-password: {{ (include "postgresql-ha.pgpoolAdminPassword" .) | b64enc | quote }}
|
||||
{{- end -}}
|
||||
54
gitea/charts/postgresql-ha/templates/pgpool/service.yaml
Normal file
54
gitea/charts/postgresql-ha/templates/pgpool/service.yaml
Normal file
@@ -0,0 +1,54 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.pgpool" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.serviceLabels .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: pgpool
|
||||
{{- if or .Values.pgpool.serviceAnnotations .Values.service.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.serviceAnnotations .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
{{- if .Values.service.sessionAffinity }}
|
||||
sessionAffinity: {{ .Values.service.sessionAffinity }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.sessionAffinityConfig }}
|
||||
sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.service.sessionAffinityConfig "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort") }}
|
||||
externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges: {{- toYaml .Values.service.loadBalancerSourceRanges | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if and (not (empty .Values.service.loadBalancerIP)) (eq .Values.service.type "LoadBalancer") }}
|
||||
loadBalancerIP: {{ .Values.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.service.type "ClusterIP") .Values.service.clusterIP }}
|
||||
clusterIP: {{ .Values.service.clusterIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: {{ .Values.service.portName | quote }}
|
||||
port: {{ .Values.service.ports.postgresql }}
|
||||
targetPort: postgresql
|
||||
protocol: TCP
|
||||
{{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.postgresql)) }}
|
||||
nodePort: {{ .Values.service.nodePorts.postgresql }}
|
||||
{{- else if eq .Values.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
{{- if .Values.service.extraPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: pgpool
|
||||
44
gitea/charts/postgresql-ha/templates/podsecuritypolicy.yaml
Normal file
44
gitea/charts/postgresql-ha/templates/podsecuritypolicy.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and (include "common.capabilities.psp.supported" .) .Values.psp.create }}
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
privileged: false
|
||||
allowedCapabilities:
|
||||
- CHOWN
|
||||
volumes:
|
||||
- 'configMap'
|
||||
- 'secret'
|
||||
- 'persistentVolumeClaim'
|
||||
- 'emptyDir'
|
||||
- 'projected'
|
||||
hostNetwork: false
|
||||
hostIPC: false
|
||||
hostPID: false
|
||||
runAsUser:
|
||||
rule: 'RunAsAny'
|
||||
seLinux:
|
||||
rule: 'RunAsAny'
|
||||
supplementalGroups:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1
|
||||
max: 65535
|
||||
fsGroup:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1
|
||||
max: 65535
|
||||
readOnlyRootFilesystem: false
|
||||
{{- end }}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and (or .Values.postgresql.repmgrConfiguration .Values.postgresql.configuration .Values.postgresql.pgHbaConfiguration) (not .Values.postgresql.configurationCM) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-configuration" (include "postgresql-ha.postgresql" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{- if .Values.postgresql.repmgrConfiguration }}
|
||||
repmgr.conf: |-
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.repmgrConfiguration "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.configuration }}
|
||||
postgresql.conf: |-
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.configuration "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.pgHbaConfiguration }}
|
||||
pg_hba.conf: |-
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.pgHbaConfiguration "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,20 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.postgresql.extendedConf (not .Values.postgresql.extendedConfCM) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-extended-configuration" (include "postgresql-ha.postgresql" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
override.conf: |-
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.extendedConf "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,136 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-hooks-scripts" (include "postgresql-ha.postgresql" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
pre-stop.sh: |-
|
||||
#!/bin/bash
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
set -o nounset
|
||||
|
||||
# Debug section
|
||||
exec 3>&1
|
||||
exec 4>&2
|
||||
|
||||
# Process input parameters
|
||||
MIN_DELAY_AFTER_PG_STOP_SECONDS=$1
|
||||
|
||||
# Load Libraries
|
||||
. /opt/bitnami/scripts/liblog.sh
|
||||
. /opt/bitnami/scripts/libpostgresql.sh
|
||||
. /opt/bitnami/scripts/librepmgr.sh
|
||||
|
||||
# Load PostgreSQL & repmgr environment variables
|
||||
. /opt/bitnami/scripts/postgresql-env.sh
|
||||
|
||||
# Auxiliary functions
|
||||
is_new_primary_ready() {
|
||||
return_value=1
|
||||
currenty_primary_node="$(repmgr_get_primary_node)"
|
||||
currenty_primary_host="$(echo $currenty_primary_node | awk '{print $1}')"
|
||||
|
||||
info "$currenty_primary_host != $REPMGR_NODE_NETWORK_NAME"
|
||||
if [[ $(echo $currenty_primary_node | wc -w) -eq 2 ]] && [[ "$currenty_primary_host" != "$REPMGR_NODE_NETWORK_NAME" ]]; then
|
||||
info "New primary detected, leaving the cluster..."
|
||||
return_value=0
|
||||
else
|
||||
info "Waiting for a new primary to be available..."
|
||||
fi
|
||||
return $return_value
|
||||
}
|
||||
|
||||
export MODULE="pre-stop-hook"
|
||||
|
||||
if [[ "${BITNAMI_DEBUG}" == "true" ]]; then
|
||||
info "Bash debug is on"
|
||||
else
|
||||
info "Bash debug is off"
|
||||
exec 1>/dev/null
|
||||
exec 2>/dev/null
|
||||
fi
|
||||
|
||||
postgresql_enable_nss_wrapper
|
||||
|
||||
# Prepare env vars for managing roles
|
||||
readarray -t primary_node < <(repmgr_get_upstream_node)
|
||||
primary_host="${primary_node[0]}"
|
||||
|
||||
# Stop postgresql for graceful exit.
|
||||
PG_STOP_TIME=$EPOCHSECONDS
|
||||
postgresql_stop
|
||||
|
||||
if [[ -z "$primary_host" ]] || [[ "$primary_host" == "$REPMGR_NODE_NETWORK_NAME" ]]; then
|
||||
info "Primary node need to wait for a new primary node before leaving the cluster"
|
||||
retry_while is_new_primary_ready 10 5
|
||||
else
|
||||
info "Standby node doesn't need to wait for a new primary switchover. Leaving the cluster"
|
||||
fi
|
||||
|
||||
# Make sure pre-stop hook waits at least 25 seconds after stop of PG to make sure PGPOOL detects node is down.
|
||||
# default terminationGracePeriodSeconds=30 seconds
|
||||
PG_STOP_DURATION=$(($EPOCHSECONDS - $PG_STOP_TIME))
|
||||
if (( $PG_STOP_DURATION < $MIN_DELAY_AFTER_PG_STOP_SECONDS )); then
|
||||
WAIT_TO_PG_POOL_TIME=$(($MIN_DELAY_AFTER_PG_STOP_SECONDS - $PG_STOP_DURATION))
|
||||
info "PG stopped including primary switchover in $PG_STOP_DURATION. Waiting additional $WAIT_TO_PG_POOL_TIME seconds for PG pool"
|
||||
sleep $WAIT_TO_PG_POOL_TIME
|
||||
fi
|
||||
|
||||
readiness-probe.sh: |-
|
||||
#!/bin/bash
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
set -o nounset
|
||||
|
||||
# Debug section
|
||||
exec 3>&1
|
||||
exec 4>&2
|
||||
|
||||
# Load Libraries
|
||||
. /opt/bitnami/scripts/liblog.sh
|
||||
. /opt/bitnami/scripts/libpostgresql.sh
|
||||
|
||||
# Load PostgreSQL & repmgr environment variables
|
||||
. /opt/bitnami/scripts/postgresql-env.sh
|
||||
|
||||
# Process input parameters
|
||||
MIN_DELAY_AFTER_POD_READY_FIRST_TIME=$1
|
||||
TMP_FIRST_READY_FILE_TS="/tmp/ts-first-ready.mark"
|
||||
TMP_DELAY_APPLIED_FILE="/tmp/delay-applied.mark"
|
||||
|
||||
DB_CHECK_RESULT=$(echo "SELECT 1" | postgresql_execute_print_output "$POSTGRESQL_DATABASE" "$POSTGRESQL_USERNAME" "$POSTGRESQL_PASSWORD" "-h 127.0.0.1 -tA" || echo "command failed")
|
||||
if [[ "$DB_CHECK_RESULT" == "1" ]]; then
|
||||
if [[ ! -f "$TMP_DELAY_APPLIED_FILE" ]]; then
|
||||
# DB up, but initial readiness delay not applied
|
||||
if [[ -f "$TMP_FIRST_READY_FILE_TS" ]]; then
|
||||
# calculate delay from the first readiness success
|
||||
FIRST_READY_TS=$(cat $TMP_FIRST_READY_FILE_TS)
|
||||
CURRENT_DELAY_SECONDS=$(($EPOCHSECONDS - $FIRST_READY_TS))
|
||||
if (( $CURRENT_DELAY_SECONDS > $MIN_DELAY_AFTER_POD_READY_FIRST_TIME )); then
|
||||
# minimal delay of the first readiness state passed - report success and mark delay as applied
|
||||
touch "$TMP_DELAY_APPLIED_FILE"
|
||||
else
|
||||
# minimal delay of the first readiness state not reached yet - report failure
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
# first ever readiness test success - store timestamp and report failure
|
||||
echo $EPOCHSECONDS > $TMP_FIRST_READY_FILE_TS
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
else
|
||||
# DB test failed - report failure
|
||||
exit 1
|
||||
fi
|
||||
@@ -0,0 +1,19 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.postgresql.initdbScripts (not .Values.postgresql.initdbScriptsCM) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-initdb-scripts" (include "postgresql-ha.postgresql" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.postgresql.initdbScripts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,47 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.service.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-metrics" (include "postgresql-ha.postgresql" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if .Values.metrics.serviceMonitor.selector }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.metrics.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.metrics.service.type }}
|
||||
{{- if (or (eq .Values.metrics.service.type "LoadBalancer") (eq .Values.metrics.service.type "NodePort")) }}
|
||||
externalTrafficPolicy: {{ .Values.metrics.service.externalTrafficPolicy | quote }}
|
||||
{{- end }}
|
||||
{{ if .Values.metrics.service.clusterIP }}
|
||||
clusterIP: {{ .Values.metrics.service.clusterIP }}
|
||||
{{ end }}
|
||||
{{ if eq .Values.metrics.service.type "LoadBalancer" }}
|
||||
loadBalancerSourceRanges: {{ .Values.metrics.service.loadBalancerSourceRanges }}
|
||||
{{ end }}
|
||||
{{- if (and (eq .Values.metrics.service.type "LoadBalancer") (not (empty .Values.metrics.service.loadBalancerIP))) }}
|
||||
loadBalancerIP: {{ .Values.metrics.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: metrics
|
||||
port: {{ .Values.metrics.service.ports.metrics }}
|
||||
targetPort: metrics
|
||||
{{- if (and (or (eq .Values.metrics.service.type "NodePort") (eq .Values.metrics.service.type "LoadBalancer")) (not (empty .Values.metrics.service.nodePorts.metrics))) }}
|
||||
nodePort: {{ .Values.metrics.service.nodePorts.metrics }}
|
||||
{{- else if eq .Values.metrics.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- end }}
|
||||
@@ -0,0 +1,80 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.postgresql.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.postgresql" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.postgresql.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
# Allow outbound connections to other cluster pods
|
||||
- ports:
|
||||
- port: {{ .Values.service.ports.postgresql }}
|
||||
- port: {{ .Values.postgresql.containerPorts.postgresql }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if .Values.postgresql.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.postgresql.containerPorts.postgresql }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- port: {{ .Values.metrics.containerPorts.http }}
|
||||
{{- end }}
|
||||
{{- if not .Values.postgresql.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "postgresql-ha.postgresql" . }}-client: "true"
|
||||
{{- if .Values.postgresql.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.postgresql.networkPolicy.ingressNSMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.networkPolicy.ingressNSPodMatchLabels }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.postgresql.networkPolicy.ingressNSPodMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
28
gitea/charts/postgresql-ha/templates/postgresql/pdb.yaml
Normal file
28
gitea/charts/postgresql-ha/templates/postgresql/pdb.yaml
Normal file
@@ -0,0 +1,28 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.postgresql.pdb.create }}
|
||||
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.postgresql" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.postgresql.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.postgresql.pdb.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if or .Values.postgresql.pdb.maxUnavailable (not .Values.postgresql.pdb.minAvailable) }}
|
||||
maxUnavailable: {{ .Values.postgresql.pdb.maxUnavailable | default 1 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- end }}
|
||||
24
gitea/charts/postgresql-ha/templates/postgresql/secrets.yaml
Normal file
24
gitea/charts/postgresql-ha/templates/postgresql/secrets.yaml
Normal file
@@ -0,0 +1,24 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if (include "postgresql-ha.postgresqlCreateSecret" .) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.postgresql" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- if and (include "postgresql-ha.postgresqlPostgresPassword" .) (not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres")) }}
|
||||
postgres-password: {{ include "postgresql-ha.postgresqlPostgresPassword" . | b64enc | quote }}
|
||||
{{- end }}
|
||||
password: {{ (include "postgresql-ha.postgresqlPassword" .) | b64enc | quote }}
|
||||
repmgr-password: {{ (include "postgresql-ha.postgresqlRepmgrPassword" .) | b64enc | quote }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,28 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-headless" (include "postgresql-ha.postgresql" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.commonAnnotations .Values.service.headless.annotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonAnnotations .Values.service.headless.annotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
publishNotReadyAddresses: {{ .Values.postgresql.headlessWithNotReadyAddresses }}
|
||||
ports:
|
||||
- name: {{ .Values.service.portName | quote }}
|
||||
port: {{ .Values.postgresql.containerPorts.postgresql }}
|
||||
targetPort: postgresql
|
||||
protocol: TCP
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
@@ -0,0 +1,29 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.witness.create }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-witness" (include "postgresql-ha.postgresql" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.commonAnnotations .Values.service.headless.annotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.serviceAnnotations .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
ports:
|
||||
- name: {{ .Values.service.portName | quote }}
|
||||
port: {{ .Values.postgresql.containerPorts.postgresql }}
|
||||
targetPort: postgresql
|
||||
protocol: TCP
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.witness.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: witness
|
||||
{{- end }}
|
||||
31
gitea/charts/postgresql-ha/templates/postgresql/service.yaml
Normal file
31
gitea/charts/postgresql-ha/templates/postgresql/service.yaml
Normal file
@@ -0,0 +1,31 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.postgresql" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.serviceLabels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if or .Values.postgresql.serviceAnnotations .Values.service.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.serviceAnnotations .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: {{ .Values.service.portName | quote }}
|
||||
port: {{ .Values.service.ports.postgresql }}
|
||||
targetPort: postgresql
|
||||
protocol: TCP
|
||||
{{- if .Values.service.extraPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
@@ -0,0 +1,49 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.postgresql" . }}
|
||||
namespace: {{ coalesce .Values.metrics.serviceMonitor.namespace (include "common.names.namespace" .) | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if or .Values.commonAnnotations .Values.metrics.serviceMonitor.annotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.metrics.serviceMonitor.jobLabel }}
|
||||
jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }}
|
||||
{{- if .Values.metrics.serviceMonitor.selector }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
endpoints:
|
||||
- port: metrics
|
||||
{{- if .Values.metrics.serviceMonitor.interval }}
|
||||
interval: {{ .Values.metrics.serviceMonitor.interval }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.honorLabels }}
|
||||
honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.relabelings }}
|
||||
relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ include "common.names.namespace" . | quote }}
|
||||
{{- end }}
|
||||
679
gitea/charts/postgresql-ha/templates/postgresql/statefulset.yaml
Normal file
679
gitea/charts/postgresql-ha/templates/postgresql/statefulset.yaml
Normal file
@@ -0,0 +1,679 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.postgresql" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.labels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.postgresql.replicaCount }}
|
||||
podManagementPolicy: {{ .Values.postgresql.podManagementPolicy | quote }}
|
||||
serviceName: {{ printf "%s-headless" (include "postgresql-ha.postgresql" .) }}
|
||||
updateStrategy: {{- toYaml .Values.postgresql.updateStrategy | nindent 4 }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
template:
|
||||
metadata:
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
{{- if or .Values.postgresql.podAnnotations (and .Values.metrics.enabled .Values.metrics.annotations) }}
|
||||
annotations:
|
||||
{{- if .Values.postgresql.podAnnotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.postgresql.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.annotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.annotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- include "postgresql-ha.image.pullSecrets" . | nindent 6 }}
|
||||
automountServiceAccountToken: {{ .Values.postgresql.automountServiceAccountToken }}
|
||||
{{- if .Values.postgresql.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.postgresql.podAffinityPreset "component" "postgresql" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.postgresql.podAntiAffinityPreset "component" "postgresql" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.postgresql.nodeAffinityPreset.type "key" .Values.postgresql.nodeAffinityPreset.key "values" .Values.postgresql.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.tolerations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.topologySpreadConstraints "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.priorityClassName }}
|
||||
priorityClassName: {{ .Values.postgresql.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.schedulerName }}
|
||||
schedulerName: {{ .Values.postgresql.schedulerName }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.postgresql.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.postgresql.podSecurityContext "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "postgresql-ha.serviceAccountName" . }}
|
||||
hostNetwork: {{ .Values.postgresql.hostNetwork }}
|
||||
hostIPC: {{ .Values.postgresql.hostIPC }}
|
||||
{{- if or .Values.postgresql.tls.enabled .Values.postgresql.initContainers .Values.postgresql.extraInitContainers (and .Values.volumePermissions.enabled (or (or (not (empty .Values.postgresql.extendedConf)) (not (empty .Values.postgresql.extendedConfCM))) .Values.persistence.enabled)) }}
|
||||
initContainers:
|
||||
{{- if .Values.postgresql.tls.enabled }}
|
||||
- name: init-chmod-tls
|
||||
image: {{ template "postgresql-ha.volumePermissions.image" . }}
|
||||
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
|
||||
command:
|
||||
- /bin/sh
|
||||
- -cx
|
||||
- |
|
||||
cp /tmp/certs/* /opt/bitnami/postgresql/certs/
|
||||
{{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }}
|
||||
chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/postgresql/certs/
|
||||
{{- else }}
|
||||
chown -R {{ .Values.postgresql.containerSecurityContext.runAsUser }}:{{ .Values.postgresql.podSecurityContext.fsGroup }} /opt/bitnami/postgresql/certs/
|
||||
{{- end }}
|
||||
chmod 600 {{ template "postgresql-ha.postgresql.tlsCertKey" . }}
|
||||
{{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" (omit .Values.volumePermissions.podSecurityContext "runAsUser") "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.podSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.volumePermissions.resources }}
|
||||
resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
|
||||
{{- else if ne .Values.volumePermissions.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: raw-certificates
|
||||
mountPath: /tmp/certs
|
||||
- name: postgresql-certificates
|
||||
mountPath: /opt/bitnami/postgresql/certs
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- end }}
|
||||
{{- if and .Values.volumePermissions.enabled (or (or (not (empty .Values.postgresql.extendedConf)) (not (empty .Values.postgresql.extendedConfCM))) .Values.persistence.enabled) }}
|
||||
- name: init-chmod-data
|
||||
image: {{ include "postgresql-ha.volumePermissions.image" . }}
|
||||
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
mkdir -p {{ .Values.persistence.mountPath }}/conf {{ .Values.persistence.mountPath }}/data {{ .Values.persistence.mountPath }}/lock
|
||||
chmod 700 {{ .Values.persistence.mountPath }}/conf {{ .Values.persistence.mountPath }}/data {{ .Values.persistence.mountPath }}/lock
|
||||
chown {{ .Values.postgresql.containerSecurityContext.runAsUser }}:{{ .Values.postgresql.podSecurityContext.fsGroup }} {{ .Values.persistence.mountPath }}
|
||||
find {{ .Values.persistence.mountPath }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | \
|
||||
xargs -r chown -R {{ .Values.postgresql.containerSecurityContext.runAsUser }}:{{ .Values.postgresql.podSecurityContext.fsGroup }}
|
||||
{{- if .Values.volumePermissions.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.podSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.volumePermissions.resources }}
|
||||
resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
|
||||
{{- else if ne .Values.volumePermissions.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: {{ .Values.persistence.mountPath }}
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- end }}
|
||||
{{- if or .Values.postgresql.initContainers .Values.postgresql.extraInitContainers }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" (coalesce .Values.postgresql.initContainers .Values.postgresql.extraInitContainers) "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: postgresql
|
||||
image: {{ include "postgresql-ha.postgresql.image" . }}
|
||||
imagePullPolicy: {{ .Values.postgresql.image.pullPolicy | quote }}
|
||||
{{- if .Values.postgresql.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.postgresql.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.postgresql.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /pre-stop.sh
|
||||
- {{ .Values.postgresql.preStopDelayAfterPgStopSeconds | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.postgresql.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.postgresql.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
# Auxiliary vars to populate environment variables
|
||||
{{- $postgresqlReplicaCount := int .Values.postgresql.replicaCount }}
|
||||
{{- $postgresqlFullname := include "postgresql-ha.postgresql" . }}
|
||||
{{- $postgresqlHeadlessServiceName := printf "%s-headless" (include "postgresql-ha.postgresql" .) }}
|
||||
{{- $clusterDomain:= .Values.clusterDomain }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" (or .Values.postgresql.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||
# PostgreSQL configuration
|
||||
- name: POSTGRESQL_VOLUME_DIR
|
||||
value: {{ .Values.persistence.mountPath | quote }}
|
||||
- name: PGDATA
|
||||
value: {{ printf "%s/%s" .Values.persistence.mountPath "data" | quote }}
|
||||
{{- if and (not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres")) (or (not (include "postgresql-ha.postgresqlCreateSecret" .)) (include "postgresql-ha.postgresqlPasswordProvided" .)) }}
|
||||
{{- if .Values.postgresql.usePasswordFile }}
|
||||
- name: POSTGRES_POSTGRES_PASSWORD_FILE
|
||||
value: "/opt/bitnami/postgresql/secrets/postgres-password"
|
||||
{{- else }}
|
||||
- name: POSTGRES_POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "postgresql-ha.postgresqlSecretName" . }}
|
||||
key: postgres-password
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: POSTGRES_USER
|
||||
value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }}
|
||||
{{- if .Values.postgresql.usePasswordFile }}
|
||||
- name: POSTGRES_PASSWORD_FILE
|
||||
value: "/opt/bitnami/postgresql/secrets/password"
|
||||
{{- else }}
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
{{- if (include "postgresql-ha.postgresqlCreateSecret" .) }}
|
||||
key: password
|
||||
{{- else }}
|
||||
{{- if ( index ( lookup "v1" "Secret" (include "common.names.namespace" .) (include "postgresql-ha.postgresqlSecretName" .) ) ".data.postgres-password" ) }}
|
||||
key: postgres-password
|
||||
{{- else }}
|
||||
key: password
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }}
|
||||
- name: POSTGRES_DB
|
||||
value: {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }}
|
||||
{{- end }}
|
||||
- name: POSTGRESQL_LOG_HOSTNAME
|
||||
value: {{ .Values.postgresql.audit.logHostname | quote }}
|
||||
- name: POSTGRESQL_LOG_CONNECTIONS
|
||||
value: {{ .Values.postgresql.audit.logConnections | quote }}
|
||||
- name: POSTGRESQL_LOG_DISCONNECTIONS
|
||||
value: {{ .Values.postgresql.audit.logDisconnections | quote }}
|
||||
{{- if .Values.postgresql.audit.logLinePrefix }}
|
||||
- name: POSTGRESQL_LOG_LINE_PREFIX
|
||||
value: {{ .Values.postgresql.audit.logLinePrefix | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.audit.logTimezone }}
|
||||
- name: POSTGRESQL_LOG_TIMEZONE
|
||||
value: {{ .Values.postgresql.audit.logTimezone | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.audit.pgAuditLog }}
|
||||
- name: POSTGRESQL_PGAUDIT_LOG
|
||||
value: {{ .Values.postgresql.audit.pgAuditLog | quote }}
|
||||
{{- end }}
|
||||
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
|
||||
value: {{ .Values.postgresql.audit.pgAuditLogCatalog | quote }}
|
||||
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
|
||||
value: {{ .Values.postgresql.audit.clientMinMessages | quote }}
|
||||
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
|
||||
value: {{ .Values.postgresql.sharedPreloadLibraries | quote }}
|
||||
{{- if .Values.postgresql.maxConnections }}
|
||||
- name: POSTGRESQL_MAX_CONNECTIONS
|
||||
value: {{ .Values.postgresql.maxConnections | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.usePgRewind }}
|
||||
- name: REPMGR_USE_PGREWIND
|
||||
value: {{ .Values.postgresql.usePgRewind | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.postgresConnectionLimit }}
|
||||
- name: POSTGRESQL_POSTGRES_CONNECTION_LIMIT
|
||||
value: {{ .Values.postgresql.postgresConnectionLimit | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.dbUserConnectionLimit }}
|
||||
- name: POSTGRESQL_USERNAME_CONNECTION_LIMIT
|
||||
value: {{ .Values.postgresql.dbUserConnectionLimit | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.tcpKeepalivesInterval }}
|
||||
- name: POSTGRESQL_TCP_KEEPALIVES_INTERVAL
|
||||
value: {{ .Values.postgresql.tcpKeepalivesInterval | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.tcpKeepalivesIdle }}
|
||||
- name: POSTGRESQL_TCP_KEEPALIVES_IDLE
|
||||
value: {{ .Values.postgresql.tcpKeepalivesIdle | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.tcpKeepalivesCount }}
|
||||
- name: POSTGRESQL_TCP_KEEPALIVES_COUNT
|
||||
value: {{ .Values.postgresql.tcpKeepalivesCount | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.statementTimeout }}
|
||||
- name: POSTGRESQL_STATEMENT_TIMEOUT
|
||||
value: {{ .Values.postgresql.statementTimeout | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.pghbaRemoveFilters }}
|
||||
- name: POSTGRESQL_PGHBA_REMOVE_FILTERS
|
||||
value: {{ .Values.postgresql.pghbaRemoveFilters | quote }}
|
||||
{{- end }}
|
||||
- name: POSTGRESQL_ENABLE_TLS
|
||||
value: {{ ternary "yes" "no" .Values.postgresql.tls.enabled | quote }}
|
||||
{{- if .Values.postgresql.tls.enabled }}
|
||||
- name: POSTGRESQL_TLS_PREFER_SERVER_CIPHERS
|
||||
value: {{ ternary "yes" "no" .Values.postgresql.tls.preferServerCiphers | quote }}
|
||||
- name: POSTGRESQL_TLS_CERT_FILE
|
||||
value: {{ template "postgresql-ha.postgresql.tlsCert" . }}
|
||||
- name: POSTGRESQL_TLS_KEY_FILE
|
||||
value: {{ template "postgresql-ha.postgresql.tlsCertKey" . }}
|
||||
{{- end }}
|
||||
- name: POSTGRESQL_PORT_NUMBER
|
||||
value: {{ .Values.postgresql.containerPorts.postgresql | quote }}
|
||||
# Repmgr configuration
|
||||
- name: REPMGR_PORT_NUMBER
|
||||
value: {{ .Values.postgresql.containerPorts.postgresql | quote }}
|
||||
- name: REPMGR_PRIMARY_PORT
|
||||
value: {{ .Values.postgresql.containerPorts.postgresql | quote }}
|
||||
- name: MY_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: REPMGR_UPGRADE_EXTENSION
|
||||
value: {{ ternary "yes" "no" .Values.postgresql.upgradeRepmgrExtension | quote }}
|
||||
- name: REPMGR_PGHBA_TRUST_ALL
|
||||
value: {{ ternary "yes" "no" .Values.postgresql.pgHbaTrustAll | quote }}
|
||||
- name: REPMGR_MOUNTED_CONF_DIR
|
||||
value: "/bitnami/repmgr/conf"
|
||||
- name: REPMGR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: REPMGR_PARTNER_NODES
|
||||
value: {{ range $e, $i := until $postgresqlReplicaCount }}{{ $postgresqlFullname }}-{{ $i }}.{{ $postgresqlHeadlessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }},{{ end }}
|
||||
- name: REPMGR_PRIMARY_HOST
|
||||
value: {{ printf "%s-0.%s.$(REPMGR_NAMESPACE).svc.%s" $postgresqlFullname $postgresqlHeadlessServiceName $clusterDomain | quote }}
|
||||
- name: REPMGR_NODE_NAME
|
||||
value: "$(MY_POD_NAME)"
|
||||
- name: REPMGR_NODE_NETWORK_NAME
|
||||
value: "$(MY_POD_NAME).{{ $postgresqlHeadlessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }}"
|
||||
- name: REPMGR_NODE_TYPE
|
||||
value: "data"
|
||||
- name: REPMGR_LOG_LEVEL
|
||||
value: {{ .Values.postgresql.repmgrLogLevel | quote }}
|
||||
- name: REPMGR_CONNECT_TIMEOUT
|
||||
value: {{ .Values.postgresql.repmgrConnectTimeout | quote }}
|
||||
- name: REPMGR_RECONNECT_ATTEMPTS
|
||||
value: {{ .Values.postgresql.repmgrReconnectAttempts | quote }}
|
||||
- name: REPMGR_RECONNECT_INTERVAL
|
||||
value: {{ .Values.postgresql.repmgrReconnectInterval | quote }}
|
||||
- name: REPMGR_USERNAME
|
||||
value: {{ (include "postgresql-ha.postgresqlRepmgrUsername" .) | quote }}
|
||||
{{- if .Values.postgresql.usePasswordFile }}
|
||||
- name: REPMGR_PASSWORD_FILE
|
||||
value: "/opt/bitnami/postgresql/secrets/repmgr-password"
|
||||
{{- else }}
|
||||
- name: REPMGR_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
key: repmgr-password
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.repmgrUsePassfile }}
|
||||
- name: REPMGR_USE_PASSFILE
|
||||
value: {{ ternary "true" "false" .Values.postgresql.repmgrUsePassfile | quote }}
|
||||
- name: REPMGR_PASSFILE_PATH
|
||||
value: {{ default "/opt/bitnami/repmgr/conf/.pgpass" .Values.postgresql.repmgrPassfilePath }}
|
||||
{{- end }}
|
||||
{{- if (include "postgresql-ha.repmgrDatabase" .) }}
|
||||
- name: REPMGR_DATABASE
|
||||
value: {{ (include "postgresql-ha.repmgrDatabase" .) | quote }}
|
||||
{{- end }}
|
||||
- name: REPMGR_FENCE_OLD_PRIMARY
|
||||
value: {{ ternary "yes" "no" .Values.postgresql.repmgrFenceOldPrimary | quote }}
|
||||
{{- if .Values.postgresql.repmgrChildNodesCheckInterval }}
|
||||
- name: REPMGR_CHILD_NODES_CHECK_INTERVAL
|
||||
value: {{ .Values.postgresql.repmgrChildNodesCheckInterval | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.repmgrChildNodesConnectedMinCount }}
|
||||
- name: REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT
|
||||
value: {{ .Values.postgresql.repmgrChildNodesConnectedMinCount | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.repmgrChildNodesDisconnectTimeout }}
|
||||
- name: REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT
|
||||
value: {{ .Values.postgresql.repmgrChildNodesDisconnectTimeout | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.syncReplication }}
|
||||
- name: POSTGRESQL_NUM_SYNCHRONOUS_REPLICAS
|
||||
value: {{ sub (int .Values.postgresql.replicaCount) 1 | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.syncReplicationMode }}
|
||||
- name: POSTGRESQL_SYNCHRONOUS_REPLICAS_MODE
|
||||
value: {{ .Values.postgresql.syncReplicationMode | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.postgresql.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
{{- if .Values.postgresql.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ .Values.postgresql.extraEnvVarsCM }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ .Values.postgresql.extraEnvVarsSecret }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: postgresql
|
||||
containerPort: {{ .Values.postgresql.containerPorts.postgresql }}
|
||||
protocol: TCP
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.postgresql.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.postgresql.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.postgresql.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- 'ps waux | grep "data standby clone" | grep -v grep || {{ include "postgresql-ha.pgpassword" . }} psql -w -U {{ include "postgresql-ha.postgresqlUsername" . | quote }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} -h 127.0.0.1 -p {{ .Values.postgresql.containerPorts.postgresql }} -c "SELECT 1"'
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.postgresql.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.postgresql.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
{{- if .Values.postgresql.headlessWithNotReadyAddresses }}
|
||||
command:
|
||||
- /readiness-probe.sh
|
||||
- {{ add .Values.pgpool.livenessProbe.periodSeconds .Values.pgpool.livenessProbe.timeoutSeconds | quote }}
|
||||
{{- else }}
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
{{- include "postgresql-ha.readinessProbeCommand" (dict "component" "postgresql" "context" $) | nindent 16 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.postgresql.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.postgresql.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- '{{ include "postgresql-ha.pgpassword" . }} psql -w -U {{ include "postgresql-ha.postgresqlUsername" . | quote }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} -h 127.0.0.1 -p {{ .Values.postgresql.containerPorts.postgresql }} -c "SELECT 1"'
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.resources }}
|
||||
resources: {{- toYaml .Values.postgresql.resources | nindent 12 }}
|
||||
{{- else if ne .Values.postgresql.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.postgresql.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/postgresql/conf
|
||||
subPath: app-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/postgresql/tmp
|
||||
subPath: app-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/conf
|
||||
subPath: repmgr-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/tmp
|
||||
subPath: repmgr-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/logs
|
||||
subPath: repmgr-logs-dir
|
||||
{{- if or .Values.postgresql.repmgrConfiguration .Values.postgresql.configuration .Values.postgresql.pgHbaConfiguration .Values.postgresql.configurationCM }}
|
||||
- name: postgresql-config
|
||||
mountPath: /bitnami/repmgr/conf
|
||||
{{- end }}
|
||||
{{- if or .Values.postgresql.extendedConf .Values.postgresql.extendedConfCM }}
|
||||
- name: postgresql-extended-config
|
||||
mountPath: /bitnami/postgresql/conf/conf.d/
|
||||
{{- end }}
|
||||
{{- if or .Values.postgresql.initdbScriptsCM .Values.postgresql.initdbScripts }}
|
||||
- name: custom-init-scripts
|
||||
mountPath: /docker-entrypoint-initdb.d/
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.initdbScriptsSecret }}
|
||||
- name: custom-init-scripts-secret
|
||||
mountPath: /docker-entrypoint-initdb.d/secret
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.usePasswordFile }}
|
||||
- name: password
|
||||
mountPath: /opt/bitnami/postgresql/secrets/
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.tls.enabled }}
|
||||
- name: postgresql-certificates
|
||||
mountPath: /opt/bitnami/postgresql/certs
|
||||
{{- end }}
|
||||
- name: data
|
||||
mountPath: {{ .Values.persistence.mountPath }}
|
||||
- name: hooks-scripts
|
||||
mountPath: /pre-stop.sh
|
||||
subPath: pre-stop.sh
|
||||
- name: hooks-scripts
|
||||
mountPath: /readiness-probe.sh
|
||||
subPath: readiness-probe.sh
|
||||
{{- if .Values.postgresql.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.postgresql.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- name: metrics
|
||||
image: {{ include "postgresql-ha.metrics.image" . }}
|
||||
imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }}
|
||||
{{- if .Values.metrics.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.metrics.podSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: PG_EXPORTER_WEB_LISTEN_ADDRESS
|
||||
value: :{{ .Values.metrics.containerPorts.http }}
|
||||
- name: DATA_SOURCE_URI
|
||||
value: {{ printf "127.0.0.1:%d/%s?sslmode=disable" (.Values.postgresql.containerPorts.postgresql | int64) (include "postgresql-ha.postgresqlDatabase" .) | quote }}
|
||||
{{- if .Values.postgresql.usePasswordFile }}
|
||||
- name: DATA_SOURCE_PASS_FILE
|
||||
value: "/opt/bitnami/postgresql/secrets/password"
|
||||
{{- else }}
|
||||
- name: DATA_SOURCE_PASS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
key: password
|
||||
{{- end }}
|
||||
- name: DATA_SOURCE_USER
|
||||
value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }}
|
||||
{{- if .Values.metrics.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
{{- if .Values.metrics.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ .Values.metrics.extraEnvVarsCM }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ .Values.metrics.extraEnvVarsSecret }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: {{ .Values.metrics.containerPorts.http }}
|
||||
protocol: TCP
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.metrics.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.metrics.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
tcpSocket:
|
||||
port: metrics
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.metrics.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: metrics
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.metrics.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: metrics
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.resources }}
|
||||
resources: {{- toYaml .Values.metrics.resources | nindent 12 }}
|
||||
{{- else if ne .Values.metrics.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- if or .Values.postgresql.usePasswordFile .Values.metrics.customMetrics }}
|
||||
{{- if .Values.postgresql.usePasswordFile }}
|
||||
- name: password
|
||||
mountPath: /opt/bitnami/postgresql/secrets/
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.customMetrics }}
|
||||
- name: custom-metrics
|
||||
mountPath: /conf
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.customMetrics }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
args: ["--extend.query-path", "/conf/custom-metrics.yaml"]
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.sidecars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.postgresql.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if .Values.postgresql.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.postgresql.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.customMetrics }}
|
||||
- name: custom-metrics
|
||||
configMap:
|
||||
name: {{ include "postgresql.metricsCM" . }}
|
||||
{{- end }}
|
||||
- name: hooks-scripts
|
||||
configMap:
|
||||
name: {{ printf "%s-hooks-scripts" (include "postgresql-ha.postgresql" .) }}
|
||||
defaultMode: 0755
|
||||
{{- if or .Values.postgresql.repmgrConfiguration .Values.postgresql.configuration .Values.postgresql.pgHbaConfiguration .Values.postgresql.configurationCM }}
|
||||
- name: postgresql-config
|
||||
configMap:
|
||||
name: {{ include "postgresql-ha.postgresqlConfigurationCM" . }}
|
||||
{{- end }}
|
||||
{{- if or .Values.postgresql.extendedConf .Values.postgresql.extendedConfCM }}
|
||||
- name: postgresql-extended-config
|
||||
configMap:
|
||||
name: {{ template "postgresql-ha.postgresqlExtendedConfCM" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.initdbScriptsSecret }}
|
||||
- name: custom-init-scripts-secret
|
||||
secret:
|
||||
secretName: {{ template "postgresql-ha.postgresqlInitdbScriptsSecret" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.usePasswordFile }}
|
||||
- name: password
|
||||
secret:
|
||||
secretName: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
{{- end }}
|
||||
{{- if or .Values.postgresql.initdbScriptsCM .Values.postgresql.initdbScripts }}
|
||||
- name: custom-init-scripts
|
||||
configMap:
|
||||
name: {{ template "postgresql-ha.postgresqlInitdbScriptsCM" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.tls.enabled }}
|
||||
- name: raw-certificates
|
||||
secret:
|
||||
secretName: {{ required "A secret containing TLS certificates is required when TLS is enabled" (tpl .Values.postgresql.tls.certificatesSecret .) }}
|
||||
- name: postgresql-certificates
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if and .Values.persistence.enabled .Values.persistence.existingClaim }}
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
{{- with .Values.persistence.existingClaim }}
|
||||
claimName: {{ tpl . $ }}
|
||||
{{- end }}
|
||||
{{- else if not .Values.persistence.enabled }}
|
||||
- name: data
|
||||
emptyDir: {}
|
||||
{{- else if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
|
||||
{{- if .Values.persistentVolumeClaimRetentionPolicy.enabled }}
|
||||
persistentVolumeClaimRetentionPolicy:
|
||||
whenDeleted: {{ .Values.persistentVolumeClaimRetentionPolicy.whenDeleted }}
|
||||
whenScaled: {{ .Values.persistentVolumeClaimRetentionPolicy.whenScaled }}
|
||||
{{- end }}
|
||||
volumeClaimTemplates:
|
||||
- apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: data
|
||||
{{- if .Values.persistence.annotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.annotations "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.persistence.labels }}
|
||||
labels: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.labels "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- range .Values.persistence.accessModes }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.persistence.storageClass }}
|
||||
storageClassName: {{ .Values.persistence.storageClass }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size | quote }}
|
||||
{{- if .Values.persistence.selector }}
|
||||
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.selector "context" $) | nindent 10 }}
|
||||
{{- end -}}
|
||||
{{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.witness.pdb.create }}
|
||||
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ printf "%s-witness" (include "postgresql-ha.postgresql" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: witness
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.witness.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.witness.pdb.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if or .Values.witness.pdb.maxUnavailable (not .Values.witness.pdb.minAvailable) }}
|
||||
maxUnavailable: {{ .Values.witness.pdb.maxUnavailable | default 1 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: witness
|
||||
{{- end }}
|
||||
@@ -0,0 +1,630 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.witness.create }}
|
||||
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ printf "%s-witness" (include "postgresql-ha.postgresql" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.witness.labels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: witness
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.witness.replicaCount }}
|
||||
podManagementPolicy: Parallel
|
||||
serviceName: {{ printf "%s-witness" (include "postgresql-ha.postgresql" .) }}
|
||||
updateStrategy: {{- toYaml .Values.witness.updateStrategy | nindent 4 }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.witness.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: witness
|
||||
template:
|
||||
metadata:
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: witness
|
||||
{{- if or .Values.witness.podAnnotations (and .Values.metrics.enabled .Values.metrics.annotations) }}
|
||||
annotations:
|
||||
{{- if .Values.witness.podAnnotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.witness.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.annotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.annotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- include "postgresql-ha.image.pullSecrets" . | nindent 6 }}
|
||||
automountServiceAccountToken: {{ .Values.witness.automountServiceAccountToken }}
|
||||
{{- if .Values.witness.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.witness.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.witness.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.witness.podAffinityPreset "component" "postgresql" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.witness.podAntiAffinityPreset "component" "postgresql" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.witness.nodeAffinityPreset.type "key" .Values.witness.nodeAffinityPreset.key "values" .Values.witness.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.witness.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.witness.tolerations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.witness.topologySpreadConstraints "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.priorityClassName }}
|
||||
priorityClassName: {{ .Values.witness.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.schedulerName }}
|
||||
schedulerName: {{ .Values.witness.schedulerName }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.witness.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.witness.podSecurityContext "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "postgresql-ha.serviceAccountName" . }}
|
||||
hostNetwork: {{ .Values.witness.hostNetwork }}
|
||||
hostIPC: {{ .Values.witness.hostIPC }}
|
||||
initContainers:
|
||||
{{- if .Values.postgresql.tls.enabled }}
|
||||
- name: init-chmod-tls
|
||||
image: {{ template "postgresql-ha.volumePermissions.image" . }}
|
||||
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
|
||||
command:
|
||||
- /bin/sh
|
||||
- -cx
|
||||
- |
|
||||
cp /tmp/certs/* /opt/bitnami/postgresql/certs/
|
||||
{{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }}
|
||||
chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/postgresql/certs/
|
||||
{{- else }}
|
||||
chown -R {{ .Values.witness.containerSecurityContext.runAsUser }}:{{ .Values.witness.podSecurityContext.fsGroup }} /opt/bitnami/postgresql/certs/
|
||||
{{- end }}
|
||||
chmod 600 {{ template "postgresql-ha.postgresql.tlsCertKey" . }}
|
||||
{{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" (omit .Values.volumePermissions.podSecurityContext "runAsUser") "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.podSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: raw-certificates
|
||||
mountPath: /tmp/certs
|
||||
- name: postgresql-certificates
|
||||
mountPath: /opt/bitnami/postgresql/certs
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- end }}
|
||||
{{- if and .Values.volumePermissions.enabled (or (or (not (empty .Values.witness.extendedConf)) (not (empty .Values.witness.extendedConfCM))) .Values.persistence.enabled) }}
|
||||
- name: init-chmod-data
|
||||
image: {{ include "postgresql-ha.volumePermissions.image" . }}
|
||||
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
mkdir -p {{ .Values.persistence.mountPath }}/conf {{ .Values.persistence.mountPath }}/data {{ .Values.persistence.mountPath }}/lock
|
||||
chmod 700 {{ .Values.persistence.mountPath }}/conf {{ .Values.persistence.mountPath }}/data {{ .Values.persistence.mountPath }}/lock
|
||||
chown {{ .Values.witness.containerSecurityContext.runAsUser }}:{{ .Values.witness.podSecurityContext.fsGroup }} {{ .Values.persistence.mountPath }}
|
||||
find {{ .Values.persistence.mountPath }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | \
|
||||
xargs -r chown -R {{ .Values.witness.containerSecurityContext.runAsUser }}:{{ .Values.witness.podSecurityContext.fsGroup }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.podSecurityContext "context" $) | nindent 12 }}
|
||||
{{- if .Values.volumePermissions.resources }}
|
||||
resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
|
||||
{{- else if ne .Values.volumePermissions.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: {{ .Values.persistence.mountPath }}
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- end }}
|
||||
{{- if or .Values.witness.initContainers .Values.witness.extraInitContainers }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" (coalesce .Values.witness.initContainers .Values.witness.extraInitContainers) "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: postgresql
|
||||
image: {{ include "postgresql-ha.postgresql.image" . }}
|
||||
imagePullPolicy: {{ .Values.postgresql.image.pullPolicy | quote }}
|
||||
{{- if .Values.witness.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.witness.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.witness.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.witness.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /pre-stop.sh
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.witness.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.witness.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.witness.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.witness.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
# Auxiliary vars to populate environment variables
|
||||
{{- $postgresqlReplicaCount := int .Values.witness.replicaCount }}
|
||||
{{- $postgresqlFullname := include "postgresql-ha.postgresql" . }}
|
||||
{{- $postgresqlHeadlessServiceName := printf "%s-headless" (include "postgresql-ha.postgresql" .) }}
|
||||
{{- $postgresqlWitnessServiceName := printf "%s-witness" (include "postgresql-ha.postgresql" .) }}
|
||||
{{- $clusterDomain:= .Values.clusterDomain }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" (or .Values.postgresql.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||
# PostgreSQL configuration
|
||||
- name: POSTGRESQL_VOLUME_DIR
|
||||
value: {{ .Values.persistence.mountPath | quote }}
|
||||
- name: PGDATA
|
||||
value: {{ printf "%s/%s" .Values.persistence.mountPath "data" | quote }}
|
||||
{{- if and (not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres")) (or (not (include "postgresql-ha.postgresqlCreateSecret" .)) (include "postgresql-ha.postgresqlPasswordProvided" .)) }}
|
||||
{{- if .Values.witness.usePasswordFile }}
|
||||
- name: POSTGRES_POSTGRES_PASSWORD_FILE
|
||||
value: "/opt/bitnami/postgresql/secrets/postgres-password"
|
||||
{{- else }}
|
||||
- name: POSTGRES_POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "postgresql-ha.postgresqlSecretName" . }}
|
||||
key: postgres-password
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: POSTGRES_USER
|
||||
value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }}
|
||||
{{- if .Values.witness.usePasswordFile }}
|
||||
- name: POSTGRES_PASSWORD_FILE
|
||||
value: "/opt/bitnami/postgresql/secrets/password"
|
||||
{{- else }}
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
{{- if (include "postgresql-ha.postgresqlCreateSecret" .) }}
|
||||
key: password
|
||||
{{- else }}
|
||||
{{- if ( index ( lookup "v1" "Secret" (include "common.names.namespace" .) (include "postgresql-ha.postgresqlSecretName" .) ) ".data.postgres-password" ) }}
|
||||
key: postgres-password
|
||||
{{- else }}
|
||||
key: password
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }}
|
||||
- name: POSTGRES_DB
|
||||
value: {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }}
|
||||
{{- end }}
|
||||
- name: POSTGRESQL_LOG_HOSTNAME
|
||||
value: {{ .Values.witness.audit.logHostname | quote }}
|
||||
- name: POSTGRESQL_LOG_CONNECTIONS
|
||||
value: {{ .Values.witness.audit.logConnections | quote }}
|
||||
- name: POSTGRESQL_LOG_DISCONNECTIONS
|
||||
value: {{ .Values.witness.audit.logDisconnections | quote }}
|
||||
{{- if .Values.witness.audit.logLinePrefix }}
|
||||
- name: POSTGRESQL_LOG_LINE_PREFIX
|
||||
value: {{ .Values.witness.audit.logLinePrefix | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.audit.logTimezone }}
|
||||
- name: POSTGRESQL_LOG_TIMEZONE
|
||||
value: {{ .Values.witness.audit.logTimezone | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.audit.pgAuditLog }}
|
||||
- name: POSTGRESQL_PGAUDIT_LOG
|
||||
value: {{ .Values.witness.audit.pgAuditLog | quote }}
|
||||
{{- end }}
|
||||
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
|
||||
value: {{ .Values.witness.audit.pgAuditLogCatalog | quote }}
|
||||
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
|
||||
value: {{ .Values.witness.audit.clientMinMessages | quote }}
|
||||
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
|
||||
value: {{ .Values.postgresql.sharedPreloadLibraries | quote }}
|
||||
{{- if .Values.witness.maxConnections }}
|
||||
- name: POSTGRESQL_MAX_CONNECTIONS
|
||||
value: {{ .Values.witness.maxConnections | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.postgresConnectionLimit }}
|
||||
- name: POSTGRESQL_POSTGRES_CONNECTION_LIMIT
|
||||
value: {{ .Values.witness.postgresConnectionLimit | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.dbUserConnectionLimit }}
|
||||
- name: POSTGRESQL_USERNAME_CONNECTION_LIMIT
|
||||
value: {{ .Values.witness.dbUserConnectionLimit | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.tcpKeepalivesInterval }}
|
||||
- name: POSTGRESQL_TCP_KEEPALIVES_INTERVAL
|
||||
value: {{ .Values.witness.tcpKeepalivesInterval | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.tcpKeepalivesIdle }}
|
||||
- name: POSTGRESQL_TCP_KEEPALIVES_IDLE
|
||||
value: {{ .Values.witness.tcpKeepalivesIdle | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.tcpKeepalivesCount }}
|
||||
- name: POSTGRESQL_TCP_KEEPALIVES_COUNT
|
||||
value: {{ .Values.witness.tcpKeepalivesCount | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.statementTimeout }}
|
||||
- name: POSTGRESQL_STATEMENT_TIMEOUT
|
||||
value: {{ .Values.witness.statementTimeout | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.pghbaRemoveFilters }}
|
||||
- name: POSTGRESQL_PGHBA_REMOVE_FILTERS
|
||||
value: {{ .Values.witness.pghbaRemoveFilters | quote }}
|
||||
{{- end }}
|
||||
- name: POSTGRESQL_ENABLE_TLS
|
||||
value: {{ ternary "yes" "no" .Values.postgresql.tls.enabled | quote }}
|
||||
{{- if .Values.postgresql.tls.enabled }}
|
||||
- name: POSTGRESQL_TLS_PREFER_SERVER_CIPHERS
|
||||
value: {{ ternary "yes" "no" .Values.postgresql.tls.preferServerCiphers | quote }}
|
||||
- name: POSTGRESQL_TLS_CERT_FILE
|
||||
value: {{ template "postgresql-ha.postgresql.tlsCert" . }}
|
||||
- name: POSTGRESQL_TLS_KEY_FILE
|
||||
value: {{ template "postgresql-ha.postgresql.tlsCertKey" . }}
|
||||
{{- end }}
|
||||
- name: POSTGRESQL_PORT_NUMBER
|
||||
value: {{ .Values.witness.containerPorts.postgresql | quote }}
|
||||
# Repmgr configuration
|
||||
- name: REPMGR_PORT_NUMBER
|
||||
value: {{ .Values.witness.containerPorts.postgresql | quote }}
|
||||
- name: REPMGR_PRIMARY_PORT
|
||||
value: {{ .Values.witness.containerPorts.postgresql | quote }}
|
||||
- name: MY_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: REPMGR_UPGRADE_EXTENSION
|
||||
value: {{ ternary "yes" "no" .Values.witness.upgradeRepmgrExtension | quote }}
|
||||
- name: REPMGR_PGHBA_TRUST_ALL
|
||||
value: {{ ternary "yes" "no" .Values.witness.pgHbaTrustAll | quote }}
|
||||
- name: REPMGR_MOUNTED_CONF_DIR
|
||||
value: "/bitnami/repmgr/conf"
|
||||
- name: REPMGR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: REPMGR_PARTNER_NODES
|
||||
value: {{ range $e, $i := until $postgresqlReplicaCount }}{{ $postgresqlFullname }}-{{ $i }}.{{ $postgresqlHeadlessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }},{{ end }}
|
||||
- name: REPMGR_PRIMARY_HOST
|
||||
value: {{ printf "%s-0.%s.$(REPMGR_NAMESPACE).svc.%s" $postgresqlFullname $postgresqlHeadlessServiceName $clusterDomain | quote }}
|
||||
- name: REPMGR_NODE_NAME
|
||||
value: "$(MY_POD_NAME)"
|
||||
- name: REPMGR_NODE_NETWORK_NAME
|
||||
value: "$(MY_POD_NAME).{{ $postgresqlWitnessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }}"
|
||||
- name: REPMGR_NODE_TYPE
|
||||
value: "witness"
|
||||
- name: REPMGR_NODE_ID_START_SEED
|
||||
value: "2000"
|
||||
- name: REPMGR_LOG_LEVEL
|
||||
value: {{ .Values.witness.repmgrLogLevel | quote }}
|
||||
- name: REPMGR_CONNECT_TIMEOUT
|
||||
value: {{ .Values.witness.repmgrConnectTimeout | quote }}
|
||||
- name: REPMGR_RECONNECT_ATTEMPTS
|
||||
value: {{ .Values.witness.repmgrReconnectAttempts | quote }}
|
||||
- name: REPMGR_RECONNECT_INTERVAL
|
||||
value: {{ .Values.witness.repmgrReconnectInterval | quote }}
|
||||
- name: REPMGR_USERNAME
|
||||
value: {{ (include "postgresql-ha.postgresqlRepmgrUsername" .) | quote }}
|
||||
{{- if .Values.witness.usePasswordFile }}
|
||||
- name: REPMGR_PASSWORD_FILE
|
||||
value: "/opt/bitnami/postgresql/secrets/repmgr-password"
|
||||
{{- else }}
|
||||
- name: REPMGR_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
key: repmgr-password
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.repmgrUsePassfile }}
|
||||
- name: REPMGR_USE_PASSFILE
|
||||
value: {{ ternary "true" "false" .Values.postgresql.repmgrUsePassfile | quote }}
|
||||
- name: REPMGR_PASSFILE_PATH
|
||||
value: {{ default "/opt/bitnami/repmgr/conf/.pgpass" .Values.postgresql.repmgrPassfilePath }}
|
||||
{{- end }}
|
||||
{{- if (include "postgresql-ha.repmgrDatabase" .) }}
|
||||
- name: REPMGR_DATABASE
|
||||
value: {{ (include "postgresql-ha.repmgrDatabase" .) | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.witness.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
{{- if .Values.witness.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ .Values.witness.extraEnvVarsCM }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ .Values.witness.extraEnvVarsSecret }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: postgresql
|
||||
containerPort: {{ .Values.witness.containerPorts.postgresql }}
|
||||
protocol: TCP
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.witness.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.witness.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.witness.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.witness.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- '{{ include "postgresql-ha.pgpassword" . }} psql -w -U {{ include "postgresql-ha.postgresqlUsername" . | quote }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} -h 127.0.0.1 -p {{ .Values.witness.containerPorts.postgresql }} -c "SELECT 1"'
|
||||
{{- end }}
|
||||
{{- if .Values.witness.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.witness.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.witness.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.witness.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
{{- include "postgresql-ha.readinessProbeCommand" (dict "component" "witness" "context" $) | nindent 16 }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.witness.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.witness.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.witness.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- '{{ include "postgresql-ha.pgpassword" . }} psql -w -U {{ include "postgresql-ha.postgresqlUsername" . | quote }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} -h 127.0.0.1 -p {{ .Values.witness.containerPorts.postgresql }} -c "SELECT 1"'
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.resources }}
|
||||
resources: {{- toYaml .Values.witness.resources | nindent 12 }}
|
||||
{{- else if ne .Values.witness.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.witness.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/postgresql/conf
|
||||
subPath: app-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/postgresql/tmp
|
||||
subPath: app-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/conf
|
||||
subPath: repmgr-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/tmp
|
||||
subPath: repmgr-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/logs
|
||||
subPath: repmgr-logs-dir
|
||||
{{- if or .Values.witness.repmgrConfiguration .Values.witness.configuration .Values.witness.pgHbaConfiguration .Values.witness.configurationCM }}
|
||||
- name: postgresql-config
|
||||
mountPath: /bitnami/repmgr/conf
|
||||
{{- end }}
|
||||
{{- if or .Values.witness.extendedConf .Values.witness.extendedConfCM }}
|
||||
- name: postgresql-extended-config
|
||||
mountPath: /bitnami/postgresql/conf/conf.d/
|
||||
{{- end }}
|
||||
{{- if or .Values.witness.initdbScriptsCM .Values.witness.initdbScripts }}
|
||||
- name: custom-init-scripts
|
||||
mountPath: /docker-entrypoint-initdb.d/
|
||||
{{- end }}
|
||||
{{- if .Values.witness.initdbScriptsSecret }}
|
||||
- name: custom-init-scripts-secret
|
||||
mountPath: /docker-entrypoint-initdb.d/secret
|
||||
{{- end }}
|
||||
{{- if .Values.witness.usePasswordFile }}
|
||||
- name: password
|
||||
mountPath: /opt/bitnami/postgresql/secrets/
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.tls.enabled }}
|
||||
- name: postgresql-certificates
|
||||
mountPath: /opt/bitnami/postgresql/certs
|
||||
{{- end }}
|
||||
- name: data
|
||||
mountPath: {{ .Values.persistence.mountPath }}
|
||||
- name: hooks-scripts
|
||||
mountPath: /pre-stop.sh
|
||||
subPath: pre-stop.sh
|
||||
{{- if .Values.witness.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.witness.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- name: metrics
|
||||
image: {{ include "postgresql-ha.metrics.image" . }}
|
||||
imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }}
|
||||
{{- if .Values.metrics.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.metrics.podSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: PG_EXPORTER_WEB_LISTEN_ADDRESS
|
||||
value: :{{ .Values.metrics.containerPorts.http }}
|
||||
- name: DATA_SOURCE_URI
|
||||
value: {{ printf "127.0.0.1:%d/%s?sslmode=disable" (.Values.witness.containerPorts.postgresql | int64) (include "postgresql-ha.postgresqlDatabase" .) | quote }}
|
||||
{{- if .Values.witness.usePasswordFile }}
|
||||
- name: DATA_SOURCE_PASS_FILE
|
||||
value: "/opt/bitnami/postgresql/secrets/password"
|
||||
{{- else }}
|
||||
- name: DATA_SOURCE_PASS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
key: password
|
||||
{{- end }}
|
||||
- name: DATA_SOURCE_USER
|
||||
value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }}
|
||||
{{- if .Values.metrics.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
{{- if .Values.metrics.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ .Values.metrics.extraEnvVarsCM }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ .Values.metrics.extraEnvVarsSecret }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: {{ .Values.metrics.containerPorts.http }}
|
||||
protocol: TCP
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.metrics.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.metrics.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
tcpSocket:
|
||||
port: metrics
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.metrics.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: metrics
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.metrics.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: metrics
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.resources }}
|
||||
resources: {{- toYaml .Values.metrics.resources | nindent 12 }}
|
||||
{{- else if ne .Values.metrics.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- if .Values.postgresql.usePasswordFile }}
|
||||
- name: password
|
||||
mountPath: /opt/bitnami/postgresql/secrets/
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.customMetrics }}
|
||||
- name: custom-metrics
|
||||
mountPath: /conf
|
||||
readOnly: true
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
args: ["--extend.query-path", "/conf/custom-metrics.yaml"]
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.sidecars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.witness.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if .Values.witness.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.witness.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.customMetrics }}
|
||||
- name: custom-metrics
|
||||
configMap:
|
||||
name: {{ include "postgresql.metricsCM" . }}
|
||||
{{- end }}
|
||||
- name: hooks-scripts
|
||||
configMap:
|
||||
name: {{ printf "%s-hooks-scripts" (include "postgresql-ha.postgresql" .) }}
|
||||
defaultMode: 0755
|
||||
{{- if or .Values.witness.repmgrConfiguration .Values.witness.configuration .Values.witness.pgHbaConfiguration .Values.witness.configurationCM }}
|
||||
- name: postgresql-config
|
||||
configMap:
|
||||
name: {{ include "postgresql-ha.postgresqlConfigurationCM" . }}
|
||||
{{- end }}
|
||||
{{- if or .Values.witness.extendedConf .Values.witness.extendedConfCM }}
|
||||
- name: postgresql-extended-config
|
||||
configMap:
|
||||
name: {{ template "postgresql-ha.postgresqlExtendedConfCM" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.initdbScriptsSecret }}
|
||||
- name: custom-init-scripts-secret
|
||||
secret:
|
||||
secretName: {{ template "postgresql-ha.postgresqlInitdbScriptsSecret" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.usePasswordFile }}
|
||||
- name: password
|
||||
secret:
|
||||
secretName: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
{{- end }}
|
||||
{{- if or .Values.witness.initdbScriptsCM .Values.witness.initdbScripts }}
|
||||
- name: custom-init-scripts
|
||||
configMap:
|
||||
name: {{ template "postgresql-ha.postgresqlInitdbScriptsCM" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.tls.enabled }}
|
||||
- name: raw-certificates
|
||||
secret:
|
||||
secretName: {{ required "A secret containing TLS certificates is required when TLS is enabled" (tpl .Values.postgresql.tls.certificatesSecret .) }}
|
||||
- name: postgresql-certificates
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if and .Values.persistence.enabled .Values.persistence.existingClaim }}
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
{{- with .Values.persistence.existingClaim }}
|
||||
claimName: {{ tpl . $ }}
|
||||
{{- end }}
|
||||
{{- else if not .Values.persistence.enabled }}
|
||||
- name: data
|
||||
emptyDir: {}
|
||||
{{- else if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
|
||||
volumeClaimTemplates:
|
||||
- apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: data
|
||||
{{- if .Values.persistence.annotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.annotations "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.persistence.labels }}
|
||||
labels: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.labels "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- range .Values.persistence.accessModes }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.persistence.storageClass }}
|
||||
storageClassName: {{ .Values.persistence.storageClass }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size | quote }}
|
||||
{{- if .Values.persistence.selector }}
|
||||
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.selector "context" $) | nindent 10 }}
|
||||
{{- end -}}
|
||||
{{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
27
gitea/charts/postgresql-ha/templates/role.yaml
Normal file
27
gitea/charts/postgresql-ha/templates/role.yaml
Normal file
@@ -0,0 +1,27 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.rbac.create }}
|
||||
kind: Role
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- if and (include "common.capabilities.psp.supported" .) .Values.psp.create }}
|
||||
- apiGroups: ["extensions"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames:
|
||||
- {{ template "common.names.fullname" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.rbac.rules }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.rbac.rules "context" $ ) | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
24
gitea/charts/postgresql-ha/templates/rolebinding.yaml
Normal file
24
gitea/charts/postgresql-ha/templates/rolebinding.yaml
Normal file
@@ -0,0 +1,24 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.rbac.create }}
|
||||
kind: RoleBinding
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ default (include "common.names.fullname" . ) .Values.serviceAccount.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
18
gitea/charts/postgresql-ha/templates/serviceaccount.yaml
Normal file
18
gitea/charts/postgresql-ha/templates/serviceaccount.yaml
Normal file
@@ -0,0 +1,18 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.serviceAccountName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end -}}
|
||||
29
gitea/charts/postgresql-ha/templates/tls-secrets.yaml
Normal file
29
gitea/charts/postgresql-ha/templates/tls-secrets.yaml
Normal file
@@ -0,0 +1,29 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if (include "postgresql-ha.createTlsSecret" . ) }}
|
||||
{{- $secretName := printf "%s-crt" (include "postgresql-ha.pgpool" .) }}
|
||||
{{- $ca := genCA "postgresql-ha-internal-ca" 365 }}
|
||||
{{- $fullname := include "postgresql-ha.pgpool" . }}
|
||||
{{- $releaseNamespace := .Release.Namespace }}
|
||||
{{- $clusterDomain := .Values.clusterDomain }}
|
||||
{{- $serviceName := include "postgresql-ha.pgpool" . }}
|
||||
{{- $altNames := list (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) $fullname }}
|
||||
{{- $cert := genSignedCert $fullname nil $altNames 365 $ca }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ $secretName }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
|
||||
tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
|
||||
ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user