Stand up crunchy-postgres-chonk server
This commit is contained in:
parent
d8c6750ff7
commit
289cffc55a
10 changed files with 331 additions and 0 deletions
|
@ -0,0 +1,38 @@
|
||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/external-secrets.io/externalsecret_v1beta1.json
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ExternalSecret
|
||||||
|
metadata:
|
||||||
|
name: &name crunchy-postgres
|
||||||
|
spec:
|
||||||
|
secretStoreRef:
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
name: onepassword-connect
|
||||||
|
target:
|
||||||
|
name: crunchy-postgres-secret
|
||||||
|
template:
|
||||||
|
engineVersion: v2
|
||||||
|
data:
|
||||||
|
s3.conf: |
|
||||||
|
[global]
|
||||||
|
repo1-s3-key={{ .minio_crunchy_postgres_access_key }}
|
||||||
|
repo1-s3-key-secret={{ .minio_crunchy_postgres_secret_key }}
|
||||||
|
encryption.conf: |
|
||||||
|
[global]
|
||||||
|
repo1-cipher-pass={{ .crunchy_postgres_backup_encryption_cipher }}
|
||||||
|
dataFrom:
|
||||||
|
- extract:
|
||||||
|
key: crunchy-postgres
|
||||||
|
rewrite:
|
||||||
|
- regexp:
|
||||||
|
source: "(.*)"
|
||||||
|
target: "crunchy_postgres_$1"
|
||||||
|
- extract:
|
||||||
|
key: minio
|
||||||
|
rewrite:
|
||||||
|
- regexp:
|
||||||
|
source: "[-]"
|
||||||
|
target: "_"
|
||||||
|
- regexp:
|
||||||
|
source: "(.*)"
|
||||||
|
target: "minio_$1"
|
|
@ -0,0 +1,7 @@
|
||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- ./externalsecret.yaml
|
||||||
|
- ./postgrescluster.yaml
|
|
@ -0,0 +1,130 @@
|
||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://ks.hsn.dev/postgres-operator.crunchydata.com/postgrescluster_v1beta1.json
|
||||||
|
apiVersion: postgres-operator.crunchydata.com/v1beta1
|
||||||
|
kind: PostgresCluster
|
||||||
|
metadata:
|
||||||
|
name: &name postgres
|
||||||
|
spec:
|
||||||
|
postgresVersion: 16
|
||||||
|
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
crunchy-userinit.ramblurr.github.com/enabled: "true"
|
||||||
|
crunchy-userinit.ramblurr.github.com/superuser: "postgres"
|
||||||
|
|
||||||
|
service:
|
||||||
|
type: LoadBalancer
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
external-dns.alpha.kubernetes.io/hostname: postgres.jahanson.tech
|
||||||
|
io.cilium/lb-ipam-ips: 10.45.0.4
|
||||||
|
|
||||||
|
patroni: # turn on sync writes to at least 1 other replica
|
||||||
|
dynamicConfiguration:
|
||||||
|
synchronous_mode: true
|
||||||
|
postgresql:
|
||||||
|
synchronous_commit: "on"
|
||||||
|
pg_hba:
|
||||||
|
- hostnossl all all 10.244.0.0/16 md5 # Needed because dbman does not support SSL yet
|
||||||
|
- hostssl all all all md5
|
||||||
|
|
||||||
|
instances:
|
||||||
|
- name: postgres
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: crunchy-postgres
|
||||||
|
replicas: &replica 3
|
||||||
|
dataVolumeClaimSpec:
|
||||||
|
storageClassName: openebs-hostpath
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 20Gi
|
||||||
|
topologySpreadConstraints:
|
||||||
|
- maxSkew: 1
|
||||||
|
topologyKey: "kubernetes.io/hostname"
|
||||||
|
whenUnsatisfiable: "DoNotSchedule"
|
||||||
|
labelSelector:
|
||||||
|
matchLabels:
|
||||||
|
postgres-operator.crunchydata.com/cluster: *name
|
||||||
|
postgres-operator.crunchydata.com/data: postgres
|
||||||
|
|
||||||
|
users:
|
||||||
|
# Superuser
|
||||||
|
- name: postgres
|
||||||
|
databases:
|
||||||
|
- postgres
|
||||||
|
options: "SUPERUSER"
|
||||||
|
password:
|
||||||
|
type: AlphaNumeric
|
||||||
|
# Applications
|
||||||
|
- name: atuin
|
||||||
|
databases:
|
||||||
|
- atuin
|
||||||
|
password:
|
||||||
|
type: AlphaNumeric
|
||||||
|
|
||||||
|
|
||||||
|
backups:
|
||||||
|
pgbackrest:
|
||||||
|
configuration: &backupConfig
|
||||||
|
- secret:
|
||||||
|
name: crunchy-postgres-secret
|
||||||
|
global: &backupFlag
|
||||||
|
archive-timeout: "60"
|
||||||
|
compress-type: "bz2"
|
||||||
|
compress-level: "9"
|
||||||
|
delta: "y"
|
||||||
|
repo1-retention-full-type: "time"
|
||||||
|
repo1-retention-full: "14"
|
||||||
|
repo1-retention-diff: "30"
|
||||||
|
repo1-path: "/crunchy-pgo"
|
||||||
|
repo1-s3-uri-style: path
|
||||||
|
archive-push-queue-max: 4GiB
|
||||||
|
manual:
|
||||||
|
repoName: repo1
|
||||||
|
options:
|
||||||
|
- --type=full
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: crunchy-postgres-backup
|
||||||
|
repos:
|
||||||
|
- name: repo1 # Minio
|
||||||
|
s3: &minio
|
||||||
|
bucket: "crunchy-main"
|
||||||
|
endpoint: "s3.hsn.dev"
|
||||||
|
region: "us-east-1"
|
||||||
|
schedules:
|
||||||
|
full: "0 1 * * 0" # Sunday at 01:00
|
||||||
|
differential: "0 1 * * 1-6" # Mon-Sat at 01:00
|
||||||
|
incremental: "0 2-23 * * *" # Every hour except 01:00
|
||||||
|
|
||||||
|
dataSource:
|
||||||
|
pgbackrest:
|
||||||
|
stanza: "db"
|
||||||
|
configuration: *backupConfig
|
||||||
|
global: *backupFlag
|
||||||
|
repo:
|
||||||
|
name: "repo1"
|
||||||
|
s3: *minio
|
||||||
|
|
||||||
|
proxy:
|
||||||
|
pgBouncer:
|
||||||
|
port: 5432
|
||||||
|
replicas: *replica
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: crunchy-postgres-pgbouncer
|
||||||
|
config:
|
||||||
|
global:
|
||||||
|
pool_mode: "transaction" # pgBouncer is set to transaction for Authentik. Grafana requires session https://github.com/grafana/grafana/issues/74260#issuecomment-1702795311. Everything else is happy with transaction
|
||||||
|
client_tls_sslmode: prefer
|
||||||
|
topologySpreadConstraints:
|
||||||
|
- maxSkew: 1
|
||||||
|
topologyKey: "kubernetes.io/hostname"
|
||||||
|
whenUnsatisfiable: "DoNotSchedule"
|
||||||
|
labelSelector:
|
||||||
|
matchLabels:
|
||||||
|
postgres-operator.crunchydata.com/cluster: *name
|
||||||
|
postgres-operator.crunchydata.com/role: "pgbouncer"
|
|
@ -0,0 +1,20 @@
|
||||||
|
# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/clustersecretstore_v1beta1.json
|
||||||
|
---
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
metadata:
|
||||||
|
name: crunchy-pgo-secrets
|
||||||
|
spec:
|
||||||
|
provider:
|
||||||
|
kubernetes:
|
||||||
|
remoteNamespace: database
|
||||||
|
server:
|
||||||
|
caProvider:
|
||||||
|
type: "ConfigMap"
|
||||||
|
name: "kube-root-ca.crt"
|
||||||
|
namespace: database
|
||||||
|
key: "ca.crt"
|
||||||
|
auth:
|
||||||
|
serviceAccount:
|
||||||
|
name: external-secrets-pg
|
||||||
|
namespace: database
|
|
@ -0,0 +1,7 @@
|
||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- ./rbac.yaml
|
||||||
|
- ./clustersecretstore.yaml
|
|
@ -0,0 +1,31 @@
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: external-secrets-pg
|
||||||
|
rules:
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: ["authorization.k8s.io"]
|
||||||
|
resources: ["selfsubjectrulesreviews"]
|
||||||
|
verbs: ["create"]
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: &name external-secrets-pg
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: *name
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: *name
|
||||||
|
namespace: database
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: external-secrets-pg
|
||||||
|
namespace: database
|
|
@ -17,3 +17,67 @@ spec:
|
||||||
kind: GitRepository
|
kind: GitRepository
|
||||||
name: homelab
|
name: homelab
|
||||||
wait: true
|
wait: true
|
||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: &appname crunchy-postgres-operator-cluster
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
targetNamespace: database
|
||||||
|
commonMetadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: *appname
|
||||||
|
interval: 10m
|
||||||
|
path: ./kubernetes/apps/database/crunchy-postgres-operator/cluster
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: homelab
|
||||||
|
wait: true
|
||||||
|
dependsOn:
|
||||||
|
- name: crunchy-postgres-operator
|
||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: &appname crunchy-postgres-operator-secretstore
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
targetNamespace: database
|
||||||
|
commonMetadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: *appname
|
||||||
|
interval: 10m
|
||||||
|
path: ./kubernetes/apps/database/crunchy-postgres-operator/clustersecretstore
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: homelab
|
||||||
|
wait: true
|
||||||
|
dependsOn:
|
||||||
|
- name: crunchy-postgres-operator-cluster
|
||||||
|
- name: external-secrets
|
||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: &appname crunchy-postgres-userinit-controller
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
targetNamespace: database
|
||||||
|
commonMetadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: *appname
|
||||||
|
interval: 10m
|
||||||
|
path: ./kubernetes/apps/database/crunchy-postgres-operator/userinit-controller
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: homelab
|
||||||
|
wait: true
|
||||||
|
dependsOn:
|
||||||
|
- name: crunchy-postgres-operator-cluster
|
|
@ -0,0 +1,17 @@
|
||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2beta2.json
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: userinit-controller
|
||||||
|
spec:
|
||||||
|
interval: 30m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
chart: crunchy-userinit-controller
|
||||||
|
version: 0.0.4
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: crunchy-userinit
|
||||||
|
values:
|
||||||
|
fullnameOverride: crunchy-userinit-controller
|
|
@ -0,0 +1,10 @@
|
||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrepository-source-v1beta2.json
|
||||||
|
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||||
|
kind: HelmRepository
|
||||||
|
metadata:
|
||||||
|
name: crunchy-userinit
|
||||||
|
spec:
|
||||||
|
interval: 30m
|
||||||
|
url: https://ramblurr.github.io/crunchy-userinit-controller
|
||||||
|
timeout: 3m
|
|
@ -0,0 +1,7 @@
|
||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- ./helmrepository.yaml
|
||||||
|
- ./helmrelease.yaml
|
Loading…
Reference in a new issue