fix

share/authentik/postgresql.tf

@@ -24,3 +24,67 @@ resource "kubectl_manifest" "authentik_postgresql" {
         size: "${var.postgres.storage}"
   EOF
 }
+
+// Since each authentik worker create a new connection to the DB
+// lots of logs are created mesuring in GBs of junk
+// So a dayly cleanup make sense
+resource "kubectl_manifest" "authentik_cleanup_logs_script" {
+  yaml_body  = <<-EOF
+    apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: "${var.instance}-${var.component}-cleanlogs"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.common-labels)}
+    data:
+      "clean.sh": |-
+        #!/bin/ash
+        grep log /pgdata/pgroot/data/postgresql.conf|grep conn
+        echo "$(date '+%T') - Enforcing configuration"
+        sed -i "s/^log_connections.*/log_connections = 'off'/;s/^log_disconnections.*/log_disconnections = 'off'/" /pgdata/pgroot/data/postgresql.conf
+        grep log /pgdata/pgroot/data/postgresql.conf|grep conn
+        for i in /pgdata/pgroot/pg_log/*csv;do echo "$(date '+%T') - Cleaning $i";sed -i '/connection/d' "$i";done
+        df -h /pgdata/pgroot
+  EOF
+}
+resource "kubectl_manifest" "authentik_cleanup_logs_job" {
+  yaml_body  = <<-EOF
+    apiVersion: batch/v1
+    kind: CronJob
+    metadata:
+      name: "${var.instance}-${var.component}-cleanlogs"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.common-labels)}
+    spec:
+      concurrencyPolicy: Forbid
+      failedJobsHistoryLimit: 1
+      jobTemplate:
+        spec:
+          template:
+            spec:
+              containers:
+              - image: "${var.postgres.cleanlogs.image}"
+                imagePullPolicy: IfNotPresent
+                name: cleanlogs
+                command: ["/bin/ash"]
+                args: ["/script/clean.sh"]
+                volumeMounts:
+                - mountPath: /pgdata
+                  name: pgdata
+                - mountPath: /script
+                  name: script
+              securityContext:
+                fsGroup: 100
+                runAsGroup: 100
+                runAsUser: 405
+              volumes:
+              - name: script
+                configMap:
+                  name: ${kubectl_manifest.authentik_cleanup_logs_script.name}
+              - name: pgdata
+                persistentVolumeClaim:
+                  claimName: pgdata-${var.instance}-${var.component}-0
+      schedule: "${var.postgres.cleanlogs.image}"
+      successfulJobsHistoryLimit: 3
+  EOF
+}