forust
003b1e5dca
Move the shared postgres service from 15.19 to 17.6 as the postgres17 StatefulSet with its own PVC, extend the initdb and ingress policy with the statuspage database, and drop the now-unused per-app postgres manifests for authentik, gitea and netronome.
126 lines
3.7 KiB
YAML
126 lines
3.7 KiB
YAML
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: postgres
|
|
namespace: database
|
|
labels:
|
|
app.kubernetes.io/name: postgres17
|
|
app.kubernetes.io/part-of: homelab-database
|
|
spec:
|
|
selector:
|
|
app.kubernetes.io/name: postgres17
|
|
ports:
|
|
- name: postgres
|
|
port: 5432
|
|
targetPort: postgres
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: postgres17
|
|
namespace: database
|
|
spec:
|
|
serviceName: postgres17
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: postgres17
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: postgres17
|
|
spec:
|
|
containers:
|
|
- name: postgres
|
|
image: postgres:17.6-alpine
|
|
ports:
|
|
- name: postgres
|
|
containerPort: 5432
|
|
env:
|
|
- name: POSTGRES_DB
|
|
value: postgres
|
|
- name: POSTGRES_USER
|
|
value: postgres
|
|
- name: POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: postgres-shared-secrets
|
|
key: POSTGRES_ADMIN_PASSWORD
|
|
envFrom:
|
|
- secretRef:
|
|
name: postgres-shared-secrets
|
|
volumeMounts:
|
|
- name: postgres-data
|
|
mountPath: /var/lib/postgresql/data
|
|
- name: initdb
|
|
mountPath: /docker-entrypoint-initdb.d/01-create-databases.sh
|
|
subPath: 01-create-databases.sh
|
|
readinessProbe:
|
|
exec:
|
|
command: ["pg_isready", "-U", "postgres", "-d", "postgres"]
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
exec:
|
|
command: ["pg_isready", "-U", "postgres", "-d", "postgres"]
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 20
|
|
volumes:
|
|
- name: postgres-data
|
|
persistentVolumeClaim:
|
|
claimName: postgres17-data
|
|
- name: initdb
|
|
configMap:
|
|
name: postgres-initdb
|
|
defaultMode: 0755
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: postgres17-data
|
|
namespace: database
|
|
labels:
|
|
app.kubernetes.io/name: postgres17
|
|
app.kubernetes.io/part-of: homelab-database
|
|
spec:
|
|
accessModes: ["ReadWriteOnce"]
|
|
storageClassName: local-path-retain
|
|
resources:
|
|
requests:
|
|
storage: 20Gi
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: postgres-initdb
|
|
namespace: database
|
|
data:
|
|
01-create-databases.sh: |
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
: "${AUTHENTIK_DB_PASSWORD:?AUTHENTIK_DB_PASSWORD is required}"
|
|
: "${GITEA_DB_PASSWORD:?GITEA_DB_PASSWORD is required}"
|
|
: "${NETRONOME_DB_PASSWORD:?NETRONOME_DB_PASSWORD is required}"
|
|
: "${PENPOT_DB_PASSWORD:?PENPOT_DB_PASSWORD is required}"
|
|
: "${STATUSPAGE_DB_PASSWORD:?STATUSPAGE_DB_PASSWORD is required}"
|
|
|
|
create_role_and_database() {
|
|
local role="$1"
|
|
local database="$2"
|
|
local password="$3"
|
|
psql --username "$POSTGRES_USER" --dbname postgres \
|
|
-v role="$role" -v database="$database" -v password="$password" \
|
|
<<'SQL'
|
|
SELECT format('CREATE ROLE %I LOGIN PASSWORD %L', :'role', :'password')
|
|
WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = :'role')\gexec
|
|
SELECT format('CREATE DATABASE %I OWNER %I', :'database', :'role')
|
|
WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = :'database')\gexec
|
|
SQL
|
|
}
|
|
|
|
create_role_and_database authentik authentik "$AUTHENTIK_DB_PASSWORD"
|
|
create_role_and_database gitea gitea "$GITEA_DB_PASSWORD"
|
|
create_role_and_database netronome netronome "$NETRONOME_DB_PASSWORD"
|
|
create_role_and_database penpot penpot "$PENPOT_DB_PASSWORD"
|
|
create_role_and_database statuspage statuspage "$STATUSPAGE_DB_PASSWORD" |