fix

2023-08-06 21:07:18 +02:00
parent 10570d29fe
commit b464ef24d7
12 changed files with 694 additions and 503 deletions
--- a/share/authentik/datas.tf
+++ b/share/authentik/datas.tf
@@ -40,7 +40,6 @@ data "kustomization_overlay" "data" {
      "AUTHENTIK_GEOIP=${var.geoip}",
      "AUTHENTIK_LOG_LEVEL=${var.loglevel}",
      "AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=${var.image.registry}/${var.image.project}/%(type)s:%(version)s",
-      "AUTHENTIK_POSTGRESQL__HOST=${var.instance}-${var.component}.${var.namespace}.svc",
      "AUTHENTIK_POSTGRESQL__NAME=${var.component}",
      "AUTHENTIK_POSTGRESQL__PORT=5432",
      "AUTHENTIK_POSTGRESQL__USER=${var.component}",
@@ -66,10 +65,12 @@ data "kustomization_overlay" "data" {
                image: "${var.image.registry}/${var.image.repository}:${var.image.tag}"
                imagePullPolicy: "${var.image.pullPolicy}"
                env:
+                - name: "AUTHENTIK_POSTGRESQL__HOST"
+                  value: "${var.instance}-${var.component}-pg-rw.${var.namespace}.svc"
                - name: AUTHENTIK_POSTGRESQL__PASSWORD
                  valueFrom:
                    secretKeyRef:
-                      name: ${var.component}.${var.instance}-${var.component}.credentials.postgresql.acid.zalan.do
+                      name: "${var.instance}-${var.component}-pg-app"
                      key: password
                envFrom:
                - secretRef:
@@ -96,10 +97,12 @@ data "kustomization_overlay" "data" {
                image: "${var.image.registry}/${var.image.repository}:${var.image.tag}"
                imagePullPolicy: "${var.image.pullPolicy}"
                env:
+                - name: "AUTHENTIK_POSTGRESQL__HOST"
+                  value: "${var.instance}-${var.component}-pg-rw.${var.namespace}.svc"
                - name: AUTHENTIK_POSTGRESQL__PASSWORD
                  valueFrom:
                    secretKeyRef:
-                      name: ${var.component}.${var.name}-${var.component}.credentials.postgresql.acid.zalan.do
+                      name: "${var.instance}-${var.component}-pg-app"
                      key: password
                envFrom:
                - secretRef:
--- a/share/authentik/index.yaml
+++ b/share/authentik/index.yaml
@@ -6,46 +6,16 @@ metadata:
  name: authentik
  description: authentik is an open-source Identity Provider focused on flexibility and versatility
 options:
-  issuer:
-    default: letsencrypt-prod
-    examples:
-    - letsencrypt-prod
-    type: string
-  error_reporting:
+  admin:
    default:
-      enabled: false
-      environment: k8s
-      send_pii: false
+      email: auth-admin
    examples:
-    - enabled: false
-      environment: k8s
-      send_pii: false
+    - email: auth-admin
    properties:
-      enabled:
-        default: false
-        type: boolean
-      environment:
-        default: k8s
+      email:
+        default: auth-admin
        type: string
-      send_pii:
-        default: false
-        type: boolean
    type: object
-  loglevel:
-    default: info
-    examples:
-    - info
-    type: string
-  domain-name:
-    default: your_company.com
-    examples:
-    - your_company.com
-    type: string
-  ingress-class:
-    default: traefik
-    examples:
-    - traefik
-    type: string
  email:
    default:
      port: 587
@@ -71,26 +41,6 @@ options:
        default: false
        type: boolean
    type: object
-  geoip:
-    default: /geoip/GeoLite2-City.mmdb
-    examples:
-    - /geoip/GeoLite2-City.mmdb
-    type: string
-  sub-domain:
-    default: auth
-    examples:
-    - auth
-    type: string
-  admin:
-    default:
-      email: auth-admin
-    examples:
-    - email: auth-admin
-    properties:
-      email:
-        default: auth-admin
-        type: string
-    type: object
  postgres:
    default:
      cleanlogs:
@@ -129,11 +79,61 @@ options:
        default: '14'
        type: string
    type: object
+  image:
+    default:
+      project: goauthentik
+      pullPolicy: IfNotPresent
+      registry: ghcr.io
+      repository: goauthentik/server
+      tag: 2023.5.4
+    examples:
+    - project: goauthentik
+      pullPolicy: IfNotPresent
+      registry: ghcr.io
+      repository: goauthentik/server
+      tag: 2023.5.4
+    properties:
+      project:
+        default: goauthentik
+        type: string
+      pullPolicy:
+        default: IfNotPresent
+        type: string
+      registry:
+        default: ghcr.io
+        type: string
+      repository:
+        default: goauthentik/server
+        type: string
+      tag:
+        default: 2023.5.4
+        type: string
+    type: object
  domain:
    default: your-company
    examples:
    - your-company
    type: string
+  domain-name:
+    default: your_company.com
+    examples:
+    - your_company.com
+    type: string
+  issuer:
+    default: letsencrypt-prod
+    examples:
+    - letsencrypt-prod
+    type: string
+  sub-domain:
+    default: auth
+    examples:
+    - auth
+    type: string
+  loglevel:
+    default: info
+    examples:
+    - info
+    type: string
  redis:
    default:
      exporter:
@@ -167,36 +167,36 @@ options:
        default: 8Gi
        type: string
    type: object
-  image:
+  error_reporting:
    default:
-      project: goauthentik
-      pullPolicy: IfNotPresent
-      registry: ghcr.io
-      repository: goauthentik/server
-      tag: 2023.5.4
+      enabled: false
+      environment: k8s
+      send_pii: false
    examples:
-    - project: goauthentik
-      pullPolicy: IfNotPresent
-      registry: ghcr.io
-      repository: goauthentik/server
-      tag: 2023.5.4
+    - enabled: false
+      environment: k8s
+      send_pii: false
    properties:
-      project:
-        default: goauthentik
-        type: string
-      pullPolicy:
-        default: IfNotPresent
-        type: string
-      registry:
-        default: ghcr.io
-        type: string
-      repository:
-        default: goauthentik/server
-        type: string
-      tag:
-        default: 2023.5.4
+      enabled:
+        default: false
+        type: boolean
+      environment:
+        default: k8s
        type: string
+      send_pii:
+        default: false
+        type: boolean
    type: object
+  ingress-class:
+    default: traefik
+    examples:
+    - traefik
+    type: string
+  geoip:
+    default: /geoip/GeoLite2-City.mmdb
+    examples:
+    - /geoip/GeoLite2-City.mmdb
+    type: string
 dependencies:
 - dist: null
  category: core
@@ -212,7 +212,7 @@ dependencies:
  component: traefik
 - dist: null
  category: dbo
-  component: postgresql
+  component: pg
 - dist: null
  category: dbo
  component: redis
@@ -223,3 +223,4 @@ providers:
  postgresql: null
  restapi: null
  http: null
+tfaddtype: null
--- a/share/authentik/postgresql.tf
+++ b/share/authentik/postgresql.tf
@@ -1,3 +1,14 @@
+locals {
+  pg-labels = merge(local.common-labels, {
+    "app.kubernetes.io/component" = "pg"
+  })
+  pool-labels = merge(local.common-labels, {
+    "app.kubernetes.io/component" = "pg-pool"
+  })
+  postgres-labels = merge(local.common-labels, {
+    "app.kubernetes.io/component" = "postgresql"
+  })
+}
 resource "kubectl_manifest" "authentik_postgresql" {
  yaml_body  = <<-EOF
    apiVersion: "acid.zalan.do/v1"
@@ -5,7 +16,7 @@ resource "kubectl_manifest" "authentik_postgresql" {
    metadata:
      name: "${var.instance}-${var.component}"
      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.common-labels)}
+      labels: ${jsonencode(local.postgres-labels)}
    spec:
      databases:
        ${var.component}: "${var.component}"
@@ -89,3 +100,99 @@ resource "kubectl_manifest" "authentik_cleanup_logs_job" {
      successfulJobsHistoryLimit: 3
  EOF
 }
+
+resource "kubectl_manifest" "prj_pre_migrate_pg" {
+  yaml_body  = <<-EOF
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "${var.instance}-remove-zalando-extensions"
+  namespace: "${var.namespace}"
+spec:
+  template:
+    spec:
+      restartPolicy: OnFailure
+      containers:
+      - name: clean
+        image: docker.io/postgres:15.3-bookworm
+        imagePullPolicy: IfNotPresent
+        env:
+        - name: USERNAME
+          valueFrom:
+            secretKeyRef:
+              key:  username
+              name: postgres.${var.instance}-${var.component}.credentials.postgresql.acid.zalan.do
+        - name: PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key:  password
+              name: postgres.${var.instance}-${var.component}.credentials.postgresql.acid.zalan.do
+        - name: DBURL
+          value: "${var.instance}-${var.component}"
+        - name: DBNAME
+          value: "${var.component}"
+        command:
+        - /bin/bash
+        - "-c"
+        - "echo -ne 'drop view if exists metric_helpers.pg_stat_statements;\ndrop function if exists metric_helpers.pg_stat_statements;\nDROP EXTENSION IF EXISTS pg_stat_statements;\nDROP EXTENSION IF EXISTS pg_stat_kcache;\nDROP EXTENSION IF EXISTS set_user;\n'| PGPASSWORD=\"$PASSWORD\" psql -U $USERNAME -d $DBNAME -h $DBURL"
+  EOF
+}
+
+resource "kubectl_manifest" "prj_pg" {
+  depends_on = [kubectl_manifest.prj_pre_migrate_pg]
+  yaml_body  = <<-EOF
+    apiVersion: postgresql.cnpg.io/v1
+    kind: Cluster
+    metadata:
+      name: "${var.instance}-${var.component}-pg"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.pg-labels)}
+    spec:
+      instances: ${var.postgres.replicas}
+      storage:
+        size: "${var.postgres.storage}"
+      bootstrap:
+        initdb:
+          database: ${var.component}
+          owner: ${var.component}
+          import:
+            type: microservice
+            databases:
+            - ${var.component}
+            source:
+              externalCluster: "${var.instance}-${var.component}"
+      externalClusters:
+        - name: "${var.instance}-${var.component}"
+          connectionParameters:
+            host: "${var.instance}-${var.component}"
+            user: postgres
+            dbname: postgres
+            sslmode: require
+          password:
+            name: "postgres.${var.instance}-${var.component}.credentials.postgresql.acid.zalan.do"
+            key: password
+  EOF
+}
+
+
+resource "kubectl_manifest" "prj_pg_pool" {
+  depends_on = [kubectl_manifest.prj_pg]
+  yaml_body  = <<-EOF
+    apiVersion: postgresql.cnpg.io/v1
+    kind: Pooler
+    metadata:
+      name: "${var.instance}-${var.component}-pool"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.pool-labels)}
+    spec:
+      cluster:
+        name: "${var.instance}-${var.component}-pg"
+      instances: 1
+      type: rw
+      pgbouncer:
+        poolMode: session
+        parameters:
+          max_client_conn: "1000"
+          default_pool_size: "10"
+  EOF
+}
--- a/share/authentik/v1_ServiceAccount_authentik.yaml
+++ b/share/authentik/v1_ServiceAccount_authentik.yaml
@@ -1,3 +1,4 @@
+---
 # Source: authentik/charts/serviceAccount/templates/service-account.yaml
 apiVersion: v1
 kind: ServiceAccount