fix

2023-08-06 18:48:50 +02:00
parent 216c67f441
commit 10570d29fe
6 changed files with 405 additions and 283 deletions
--- a/apps/gitea/datas.tf
+++ b/apps/gitea/datas.tf
@@ -19,9 +19,9 @@ locals {
 }

 data "kubernetes_secret_v1" "postgresql_password" {
-  depends_on = [kubectl_manifest.gitea_postgresql]
+  depends_on = [kubectl_manifest.prj_pg]
  metadata {
-    name = "${var.component}.${var.instance}-${var.component}.credentials.postgresql.acid.zalan.do"
+    name = "${var.instance}-${var.component}-pg-app"
    namespace = var.namespace
  }
 }
--- a/apps/gitea/index.yaml
+++ b/apps/gitea/index.yaml
@@ -9,61 +9,21 @@ metadata:
    A painless self-hosted Git service.
    Gitea is a community managed lightweight code hosting solution written in Go. It is published under the MIT license.
 options:
-  load-balancer:
-    default:
-      ip: ''
+  timezone:
+    default: Europe/Paris
    examples:
-    - ip: ''
-    properties:
-      ip:
-        default: ''
-        type: string
-    type: object
-  admin:
-    default:
-      email: git-admin@git.your_company.com
-      name: gitea_admin
-    examples:
-    - email: git-admin@git.your_company.com
-      name: gitea_admin
-    properties:
-      email:
-        default: git-admin@git.your_company.com
-        type: string
-      name:
-        default: gitea_admin
-        type: string
-    type: object
-  postgres:
-    default:
-      replicas: 1
-      storage: 10Gi
-      version: '14'
-    examples:
-    - replicas: 1
-      storage: 10Gi
-      version: '14'
-    properties:
-      replicas:
-        default: 1
-        type: integer
-      storage:
-        default: 10Gi
-        type: string
-      version:
-        default: '14'
-        type: string
-    type: object
-  release:
-    default: 8.3.0
-    examples:
-    - 8.3.0
+    - Europe/Paris
    type: string
-  theme:
-    default: gitea-modern
+  sub-domain:
+    default: git
    examples:
-    - gitea-modern
+    - git
    type: string
+  ssh-port:
+    default: 2222
+    examples:
+    - 2222
+    type: integer
  webhook:
    default:
      allowed-hosts: private
@@ -79,46 +39,11 @@ options:
        default: false
        type: boolean
    type: object
-  volume:
-    default:
-      size: 10Gi
+  release:
+    default: 8.3.0
    examples:
-    - size: 10Gi
-    properties:
-      size:
-        default: 10Gi
-        type: string
-    type: object
-  timezone:
-    default: Europe/Paris
-    examples:
-    - Europe/Paris
+    - 8.3.0
    type: string
-  default-branch:
-    default: main
-    examples:
-    - main
-    type: string
-  issuer:
-    default: letsencrypt-prod
-    examples:
-    - letsencrypt-prod
-    type: string
-  ssh-port:
-    default: 2222
-    examples:
-    - 2222
-    type: integer
-  domain-name:
-    default: your_company.com
-    examples:
-    - your_company.com
-    type: string
-  replicas:
-    default: 1
-    examples:
-    - 1
-    type: integer
  images:
    default:
      gitea:
@@ -182,6 +107,66 @@ options:
            type: string
        type: object
    type: object
+  ingress-class:
+    default: traefik
+    examples:
+    - traefik
+    type: string
+  replicas:
+    default: 1
+    examples:
+    - 1
+    type: integer
+  domain:
+    default: your-company
+    examples:
+    - your-company
+    type: string
+  domain-name:
+    default: your_company.com
+    examples:
+    - your_company.com
+    type: string
+  volume:
+    default:
+      size: 10Gi
+    examples:
+    - size: 10Gi
+    properties:
+      size:
+        default: 10Gi
+        type: string
+    type: object
+  load-balancer:
+    default:
+      ip: ''
+    examples:
+    - ip: ''
+    properties:
+      ip:
+        default: ''
+        type: string
+    type: object
+  issuer:
+    default: letsencrypt-prod
+    examples:
+    - letsencrypt-prod
+    type: string
+  theme:
+    default: gitea-modern
+    examples:
+    - gitea-modern
+    type: string
+  default-branch:
+    default: main
+    examples:
+    - main
+    type: string
+  disable-registration:
+    default: true
+    examples:
+    - true
+    type: boolean
  push-create:
    default:
      org: 'true'
@@ -202,26 +187,41 @@ options:
        default: 'true'
        type: string
    type: object
-  domain:
-    default: your-company
+  admin:
+    default:
+      email: git-admin@git.your_company.com
+      name: gitea_admin
    examples:
-    - your-company
-    type: string
-  ingress-class:
-    default: traefik
+    - email: git-admin@git.your_company.com
+      name: gitea_admin
+    properties:
+      email:
+        default: git-admin@git.your_company.com
+        type: string
+      name:
+        default: gitea_admin
+        type: string
+    type: object
+  postgres:
+    default:
+      replicas: 1
+      storage: 10Gi
+      version: '14'
    examples:
-    - traefik
-    type: string
-  sub-domain:
-    default: git
-    examples:
-    - git
-    type: string
-  disable-registration:
-    default: true
-    examples:
-    - true
-    type: boolean
+    - replicas: 1
+      storage: 10Gi
+      version: '14'
+    properties:
+      replicas:
+        default: 1
+        type: integer
+      storage:
+        default: 10Gi
+        type: string
+      version:
+        default: '14'
+        type: string
+    type: object
 dependencies:
 - dist: null
  category: share
@@ -231,7 +231,7 @@ dependencies:
  component: secret-generator
 - dist: null
  category: dbo
-  component: postgresql
+  component: pg
 providers:
  kubernetes: true
  authentik: true
--- a/apps/gitea/inline-config.tf
+++ b/apps/gitea/inline-config.tf
@@ -17,11 +17,10 @@ HOST=gitea-memcached.${var.namespace}.svc:11211
    EOF
    database = <<-EOF
 DB_TYPE=postgres
-HOST=${var.instance}-${var.component}.${var.namespace}.svc:5432
+HOST=${var.instance}-${var.component}-pg-rw.${var.namespace}.svc:5432
 NAME=${var.component}
 PASSWD=${data.kubernetes_secret_v1.postgresql_password.data["password"]}
 USER=${data.kubernetes_secret_v1.postgresql_password.data["username"]}
-SSL_MODE=require
    EOF
    repository = <<-EOF
 DEFAULT_BRANCH=${var.default-branch}
--- a/apps/gitea/postgresql.tf
+++ b/apps/gitea/postgresql.tf
@@ -1,5 +1,8 @@
 locals {
  pg-labels = merge(local.common-labels, {
+    "app.kubernetes.io/component" = "pg"
+  })
+  postgres-labels = merge(local.common-labels, {
    "app.kubernetes.io/component" = "postgresql"
  })
 }
@@ -10,7 +13,7 @@ resource "kubectl_manifest" "gitea_postgresql" {
    metadata:
      name: "${var.instance}-${var.component}"
      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.pg-labels)}
+      labels: ${jsonencode(local.postgres-labels)}
    spec:
      databases:
        ${var.component}: "${var.component}"
@@ -29,3 +32,75 @@ resource "kubectl_manifest" "gitea_postgresql" {
        size: "${var.postgres.storage}"
  EOF
 }
+
+resource "kubectl_manifest" "prj_pre_migrate_pg" {
+  yaml_body  = <<-EOF
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "${var.instance}-remove-zalando-extensions"
+  namespace: "${var.namespace}"
+spec:
+  template:
+    spec:
+      restartPolicy: OnFailure
+      containers:
+      - name: clean
+        image: docker.io/postgres:15.3-bookworm
+        imagePullPolicy: IfNotPresent
+        env:
+        - name: USERNAME
+          valueFrom:
+            secretKeyRef:
+              key:  username
+              name: postgres.${var.instance}-${var.component}.credentials.postgresql.acid.zalan.do
+        - name: PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key:  password
+              name: postgres.${var.instance}-${var.component}.credentials.postgresql.acid.zalan.do
+        - name: DBURL
+          value: "${var.instance}-${var.component}"
+        - name: DBNAME
+          value: "${var.component}"
+        command:
+        - /bin/bash
+        - "-c"
+        - "echo -ne 'drop view if exists metric_helpers.pg_stat_statements;\ndrop function if exists metric_helpers.pg_stat_statements;\nDROP EXTENSION IF EXISTS pg_stat_statements;\nDROP EXTENSION IF EXISTS pg_stat_kcache;\nDROP EXTENSION IF EXISTS set_user;\n'| PGPASSWORD=\"$PASSWORD\" psql -U $USERNAME -d $DBNAME -h $DBURL"
+  EOF
+}
+
+resource "kubectl_manifest" "prj_pg" {
+  depends_on = [kubectl_manifest.prj_pre_migrate_pg]
+  yaml_body  = <<-EOF
+    apiVersion: postgresql.cnpg.io/v1
+    kind: Cluster
+    metadata:
+      name: "${var.instance}-${var.component}-pg"
+      namespace: "${var.namespace}"
+    spec:
+      instances: ${var.postgres.replicas}
+      storage:
+        size: "${var.postgres.storage}"
+      bootstrap:
+        initdb:
+          database: ${var.component}
+          owner: ${var.component}
+          import:
+            type: microservice
+            databases:
+            - ${var.component}
+            source:
+              externalCluster: "${var.instance}-${var.component}"
+      externalClusters:
+        - name: "${var.instance}-${var.component}"
+          connectionParameters:
+            host: "${var.instance}-${var.component}"
+            user: postgres
+            dbname: postgres
+            sslmode: require
+          password:
+            name: "postgres.${var.instance}-${var.component}.credentials.postgresql.acid.zalan.do"
+            key: password
+  EOF
+}
--- a/apps/nextcloud/index.yaml
+++ b/apps/nextcloud/index.yaml
@@ -6,111 +6,100 @@ metadata:
  name: nextcloud
  description: null
 options:
+  admin:
+    default:
+      name: nextcloud_admin
+    examples:
+    - name: nextcloud_admin
+    properties:
+      name:
+        default: nextcloud_admin
+        type: string
+    type: object
  domain:
    default: your-company
    examples:
    - your-company
    type: string
+  hpa:
+    default:
+      avg-cpu: 50
+      max-replicas: 5
+      min-replicas: 1
+    examples:
+    - avg-cpu: 50
+      max-replicas: 5
+      min-replicas: 1
+    properties:
+      avg-cpu:
+        default: 50
+        type: integer
+      max-replicas:
+        default: 5
+        type: integer
+      min-replicas:
+        default: 1
+        type: integer
+    type: object
  ingress-class:
    default: traefik
    examples:
    - traefik
    type: string
-  sub-domain:
-    default: files
+  openid-name:
+    default: vynil
    examples:
-    - files
+    - vynil
    type: string
-  apps:
+  postgres:
    default:
-      audioplayer: false
-      bookmarks: false
-      bpm: false
-      calendar: false
-      collabora: false
-      contacts: false
-      deck: false
-      groupfolders: true
-      mindmap: false
-      music: false
-      notes: false
-      onlyoffice: false
-      passman: false
-      spreed: false
-      tables: false
-      tasks: false
-      texteditor: true
+      replicas: 1
+      storage: 5Gi
+      version: '14'
    examples:
-    - audioplayer: false
-      bookmarks: false
-      bpm: false
-      calendar: false
-      collabora: false
-      contacts: false
-      deck: false
-      groupfolders: true
-      mindmap: false
-      music: false
-      notes: false
-      onlyoffice: false
-      passman: false
-      spreed: false
-      tables: false
-      tasks: false
-      texteditor: true
+    - replicas: 1
+      storage: 5Gi
+      version: '14'
    properties:
-      audioplayer:
-        default: false
-        type: boolean
-      bookmarks:
-        default: false
-        type: boolean
-      bpm:
-        default: false
-        type: boolean
-      calendar:
-        default: false
-        type: boolean
-      collabora:
-        default: false
-        type: boolean
-      contacts:
-        default: false
-        type: boolean
-      deck:
-        default: false
-        type: boolean
-      groupfolders:
-        default: true
-        type: boolean
-      mindmap:
-        default: false
-        type: boolean
-      music:
-        default: false
-        type: boolean
-      notes:
-        default: false
-        type: boolean
-      onlyoffice:
-        default: false
-        type: boolean
-      passman:
-        default: false
-        type: boolean
-      spreed:
-        default: false
-        type: boolean
-      tables:
-        default: false
-        type: boolean
-      tasks:
-        default: false
-        type: boolean
-      texteditor:
-        default: true
-        type: boolean
+      replicas:
+        default: 1
+        type: integer
+      storage:
+        default: 5Gi
+        type: string
+      version:
+        default: '14'
+        type: string
    type: object
+  storage:
+    default:
+      accessMode: ReadWriteOnce
+      size: 10Gi
+    examples:
+    - accessMode: ReadWriteOnce
+      size: 10Gi
+    properties:
+      accessMode:
+        default: ReadWriteOnce
+        enum:
+        - ReadWriteOnce
+        - ReadOnlyMany
+        - ReadWriteMany
+        type: string
+      size:
+        default: 10Gi
+        type: string
+    type: object
+  domain-name:
+    default: your_company.com
+    examples:
+    - your_company.com
+    type: string
+  issuer:
+    default: letsencrypt-prod
+    examples:
+    - letsencrypt-prod
+    type: string
  images:
    default:
      collabora:
@@ -274,26 +263,101 @@ options:
            type: string
        type: object
    type: object
-  postgres:
+  apps:
    default:
-      replicas: 1
-      storage: 5Gi
-      version: '14'
+      audioplayer: false
+      bookmarks: false
+      bpm: false
+      calendar: false
+      collabora: false
+      contacts: false
+      deck: false
+      groupfolders: true
+      mindmap: false
+      music: false
+      notes: false
+      onlyoffice: false
+      passman: false
+      spreed: false
+      tables: false
+      tasks: false
+      texteditor: true
    examples:
-    - replicas: 1
-      storage: 5Gi
-      version: '14'
+    - audioplayer: false
+      bookmarks: false
+      bpm: false
+      calendar: false
+      collabora: false
+      contacts: false
+      deck: false
+      groupfolders: true
+      mindmap: false
+      music: false
+      notes: false
+      onlyoffice: false
+      passman: false
+      spreed: false
+      tables: false
+      tasks: false
+      texteditor: true
    properties:
-      replicas:
-        default: 1
-        type: integer
-      storage:
-        default: 5Gi
-        type: string
-      version:
-        default: '14'
-        type: string
+      audioplayer:
+        default: false
+        type: boolean
+      bookmarks:
+        default: false
+        type: boolean
+      bpm:
+        default: false
+        type: boolean
+      calendar:
+        default: false
+        type: boolean
+      collabora:
+        default: false
+        type: boolean
+      contacts:
+        default: false
+        type: boolean
+      deck:
+        default: false
+        type: boolean
+      groupfolders:
+        default: true
+        type: boolean
+      mindmap:
+        default: false
+        type: boolean
+      music:
+        default: false
+        type: boolean
+      notes:
+        default: false
+        type: boolean
+      onlyoffice:
+        default: false
+        type: boolean
+      passman:
+        default: false
+        type: boolean
+      spreed:
+        default: false
+        type: boolean
+      tables:
+        default: false
+        type: boolean
+      tasks:
+        default: false
+        type: boolean
+      texteditor:
+        default: true
+        type: boolean
    type: object
+  sub-domain:
+    default: files
+    examples:
+    - files
+    type: string
  redis:
    default:
      exporter:
@@ -327,71 +391,16 @@ options:
        default: 2Gi
        type: string
    type: object
-  hpa:
-    default:
-      avg-cpu: 50
-      max-replicas: 5
-      min-replicas: 1
-    examples:
-    - avg-cpu: 50
-      max-replicas: 5
-      min-replicas: 1
-    properties:
-      avg-cpu:
-        default: 50
-        type: integer
-      max-replicas:
-        default: 5
-        type: integer
-      min-replicas:
-        default: 1
-        type: integer
-    type: object
-  domain-name:
-    default: your_company.com
-    examples:
-    - your_company.com
-    type: string
-  admin:
-    default:
-      name: nextcloud_admin
-    examples:
-    - name: nextcloud_admin
-    properties:
-      name:
-        default: nextcloud_admin
-        type: string
-    type: object
-  issuer:
-    default: letsencrypt-prod
-    examples:
-    - letsencrypt-prod
-    type: string
-  storage:
-    default:
-      accessMode: ReadWriteOnce
-      size: 10Gi
-    examples:
-    - accessMode: ReadWriteOnce
-      size: 10Gi
-    properties:
-      accessMode:
-        default: ReadWriteOnce
-        enum:
-        - ReadWriteOnce
-        - ReadOnlyMany
-        - ReadWriteMany
-        type: string
-      size:
-        default: 10Gi
-        type: string
-    type: object
-  openid-name:
-    default: vynil
-    examples:
-    - vynil
-    type: string
-dependencies: []
+dependencies:
+- dist: null
+  category: share
+  component: authentik-ldap
+- dist: null
+  category: core
+  component: secret-generator
+- dist: null
+  category: dbo
+  component: pg
 providers:
  kubernetes: true
  authentik: true
--- a/apps/nextcloud/postgresql.tf
+++ b/apps/nextcloud/postgresql.tf
@@ -32,7 +32,46 @@ resource "kubectl_manifest" "prj_postgresql" {
        size: "${var.postgres.storage}"
  EOF
 }
+
+resource "kubectl_manifest" "prj_pre_migrate_pg" {
+  yaml_body  = <<-EOF
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "${var.instance}-remove-zalando-extensions"
+  namespace: "${var.namespace}"
+spec:
+  template:
+    spec:
+      restartPolicy: OnFailure
+      containers:
+      - name: clean
+        image: docker.io/postgres:15.3-bookworm
+        imagePullPolicy: IfNotPresent
+        env:
+        - name: USERNAME
+          valueFrom:
+            secretKeyRef:
+              key:  username
+              name: postgres.${var.instance}-${var.component}.credentials.postgresql.acid.zalan.do
+        - name: PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key:  password
+              name: postgres.${var.instance}-${var.component}.credentials.postgresql.acid.zalan.do
+        - name: DBURL
+          value: "${var.instance}-${var.component}"
+        - name: DBNAME
+          value: "${var.component}"
+        command:
+        - /bin/bash
+        - "-c"
+        - "echo -ne 'drop view if exists metric_helpers.pg_stat_statements;\ndrop function if exists metric_helpers.pg_stat_statements;\nDROP EXTENSION IF EXISTS pg_stat_statements;\nDROP EXTENSION IF EXISTS pg_stat_kcache;\nDROP EXTENSION IF EXISTS set_user;\n'| PGPASSWORD=\"$PASSWORD\" psql -U $USERNAME -d $DBNAME -h $DBURL"
+  EOF
+}
+
 resource "kubectl_manifest" "prj_pg" {
+  depends_on = [kubectl_manifest.prj_pre_migrate_pg]
  yaml_body  = <<-EOF
    apiVersion: postgresql.cnpg.io/v1
    kind: Cluster