Adding information to stac-fastapi README, adding PVC and secrets (#83)

Element84 · Aug 18, 2023 · 6ecc291 · 6ecc291
1 parent 0d50360
commit 6ecc291
Show file tree

Hide file tree

Showing 10 changed files with 955 additions and 46 deletions.
diff --git a/charts/stac-fastapi/Chart.yaml b/charts/stac-fastapi/Chart.yaml
@@ -7,3 +7,8 @@ keywords:
   - stac-fastapi
 sources:
 home:
+dependencies:
+- name: local-path-provisioner
+  condition: local-path-provisioner.enabled
+  version: "0.0.25"
+  repository: "https://element84.github.io/filmdrop-k8s-helm-charts/"
diff --git a/charts/stac-fastapi/README.md b/charts/stac-fastapi/README.md
diff --git a/charts/stac-fastapi/templates/pgstac-claim0-persistentvolumeclaim.yaml b/charts/stac-fastapi/templates/pgstac-claim0-persistentvolumeclaim.yaml
@@ -0,0 +1,17 @@
+{{- if and .Values.pgStac.enabled .Values.pgStac.storage.retainPersistentVolume -}}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  creationTimestamp: null
+  labels:
+    {{- include "pgstac.labels" . | nindent 6 }}
+  name: pgstac-claim0
+spec:
+  storageClassName: {{ .Values.pgStac.storage.storageClassName }}
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.pgStac.storage.size }}
+status: {}
+{{- end }}
diff --git a/charts/stac-fastapi/templates/pgstac-deployment.yaml b/charts/stac-fastapi/templates/pgstac-deployment.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.pgStac.enabled -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -24,39 +25,42 @@ spec:
             - "500"
           env:
             - name: PGDATABASE
-              valueFrom:
-                secretKeyRef:
-                  name: stac-fastapi-secret
-                  key: pg_dbname
+              value: {{.Values.pgStac.dbName}}
             - name: PGPASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: stac-fastapi-secret
-                  key: pg_password
+                  name: {{ .Values.pgStac.passwordSecret.name }}
+                  key: {{ .Values.pgStac.passwordSecret.key }}
             - name: PGUSER
               valueFrom:
                 secretKeyRef:
-                  name: stac-fastapi-secret
-                  key: pg_username
+                  name: {{ .Values.pgStac.userNameSecret.name }}
+                  key: {{ .Values.pgStac.userNameSecret.key }}
             - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: stac-fastapi-secret
-                  key: img_dbname
+              value: {{.Values.pgStac.dbName}}
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: stac-fastapi-secret
-                  key: img_password
+                  name: {{ .Values.pgStac.passwordSecret.name }}
+                  key: {{ .Values.pgStac.passwordSecret.key }}
             - name: POSTGRES_USER
               valueFrom:
                 secretKeyRef:
-                  name: stac-fastapi-secret
-                  key: img_username
+                  name: {{ .Values.pgStac.userNameSecret.name }}
+                  key: {{ .Values.pgStac.userNameSecret.key }}
           image: "{{ .Values.pgStac.image.repository }}:{{ .Values.pgStac.image.tag }}"
           name: {{ .Values.pgStac.deployment.name }}
           ports:
             - containerPort: {{ .Values.pgStac.container.port }}
           resources: {}
+          volumeMounts:
+            - mountPath: /pgstac
+              name: pgstac-claim0
+          workingDir: /pgstac
       restartPolicy: Always
+      volumes:
+        - name: pgstac-claim0
+          persistentVolumeClaim:
+            claimName: pgstac-claim0
 status: {}
+{{- end }}
diff --git a/charts/stac-fastapi/templates/pgstac-service.yaml b/charts/stac-fastapi/templates/pgstac-service.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.pgStac.enabled -}}
 apiVersion: v1
 kind: Service
 metadata:
@@ -7,10 +8,11 @@ metadata:
   name: {{ .Values.pgStac.service.name }}
 spec:
   ports:
-    - name: "5439"
+    - name: "{{ .Values.pgStac.service.port }}"
       port: {{ .Values.pgStac.service.port }}
       targetPort: {{ .Values.pgStac.service.targetPort }}
   selector:
     {{- include "pgstac.labels" . | nindent 6 }}
 status:
   loadBalancer: {}
+{{- end }}
diff --git a/charts/stac-fastapi/templates/pgstac-storage-class.yaml b/charts/stac-fastapi/templates/pgstac-storage-class.yaml
@@ -0,0 +1,11 @@
+{{- if and .Values.pgStac.enabled .Values.pgStac.storage.retainPersistentVolume -}}
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  labels:
+    {{- include "pgstac.labels" . | nindent 6 }}
+  name: pgstac-retain
+provisioner: {{ .Values.pgStac.storage.provisioner }}
+reclaimPolicy: Retain
+volumeBindingMode: {{ .Values.pgStac.storage.volumeBindingMode }}
+{{- end }}
diff --git a/charts/stac-fastapi/templates/stac-fastapi-crds.yaml b/charts/stac-fastapi/templates/stac-fastapi-crds.yaml
@@ -0,0 +1,70 @@
+{{- if .Values.pgStac.enabled -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.stacFastApi.service.serviceAccount }}
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Values.stacFastApi.service.serviceAccount }}-migration-reader
+rules:
+rules:
+- apiGroups:
+  - '*'
+  resources:
+  - statefulsets
+  - services
+  - replicationcontrollers
+  - replicasets
+  - podtemplates
+  - podsecuritypolicies
+  - pods
+  - pods/log
+  - pods/exec
+  - podpreset
+  - poddisruptionbudget
+  - persistentvolumes
+  - persistentvolumeclaims
+  - jobs
+  - endpoints
+  - deployments
+  - deployments/scale
+  - daemonsets
+  - cronjobs
+  - configmaps
+  - namespaces
+  - events
+  - secrets
+  verbs:
+  - create
+  - get
+  - watch
+  - delete
+  - list
+  - patch
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Values.stacFastApi.service.serviceAccount }}-migration-reader
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.stacFastApi.service.serviceAccount }}
+roleRef:
+  kind: Role
+  name: {{ .Values.stacFastApi.service.serviceAccount }}-migration-reader
+  apiGroup: rbac.authorization.k8s.io
+apiVersion: rbac.authorization.k8s.io/v1
+{{- end }}
diff --git a/charts/stac-fastapi/templates/stac-fastapi-pgstac-deployment.yaml b/charts/stac-fastapi/templates/stac-fastapi-pgstac-deployment.yaml
@@ -17,6 +17,16 @@ spec:
       labels:
         app: stac-fastapi-pgstac
     spec:
+    {{ if .Values.pgStac.enabled }}
+      serviceAccountName: {{ .Values.stacFastApi.service.serviceAccount }}
+      initContainers:
+        - name: wait-for-pgstac
+          image: ghcr.io/groundnuty/k8s-wait-for:v2.0
+          imagePullPolicy: Always
+          args:
+            - "service"
+            - "-lapp={{.Values.pgStac.service.name}}"
+    {{ end }}
       containers:
         - env:
             - name: APP_HOST
@@ -32,32 +42,31 @@ spec:
             - name: GDAL_HTTP_MERGE_CONSECUTIVE_RANGES
               value: "YES"
             - name: POSTGRES_DBNAME
-              valueFrom:
-                secretKeyRef:
-                  name: stac-fastapi-secret
-                  key: img_dbname
+              value: {{.Values.pgStac.dbName}}
             - name: POSTGRES_HOST_READER
-              valueFrom:
-                secretKeyRef:
-                  name: stac-fastapi-secret
-                  key: img_hostrw
+              {{ if .Values.pgStac.enabled }}
+              value: "{{.Values.pgStac.service.name}}.{{.Release.Namespace}}"
+              {{ else }}
+              value: {{.Values.pgStac.dbHost}}
+              {{ end}}
             - name: POSTGRES_HOST_WRITER
-              valueFrom:
-                secretKeyRef:
-                  name: stac-fastapi-secret
-                  key: img_hostrw
+              {{ if .Values.pgStac.enabled }}
+              value: "{{.Values.pgStac.service.name}}.{{.Release.Namespace}}"
+              {{ else }}
+              value: {{.Values.pgStac.dbHost}}
+              {{ end}}
             - name: POSTGRES_PASS
               valueFrom:
                 secretKeyRef:
-                  name: stac-fastapi-secret
-                  key: img_password
+                  name: {{ .Values.pgStac.passwordSecret.name }}
+                  key: {{ .Values.pgStac.passwordSecret.key }}
             - name: POSTGRES_PORT
-              value: "5439"
+              value: "{{ .Values.pgStac.service.port }}"
             - name: POSTGRES_USER
               valueFrom:
                 secretKeyRef:
-                  name: stac-fastapi-secret
-                  key: img_username
+                  name: {{ .Values.pgStac.userNameSecret.name }}
+                  key: {{ .Values.pgStac.userNameSecret.key }}
             - name: USE_API_HYDRATE
               value: "FALSE"
             - name: VSI_CACHE

diff --git a/charts/stac-fastapi/templates/stac-fastapi-secret.yaml b/charts/stac-fastapi/templates/stac-fastapi-secret.yaml
@@ -1,13 +1,10 @@
+{{- if .Values.pgStac.createPgStacSecret -}}
 apiVersion: v1
 kind: Secret
 metadata:
   name: stac-fastapi-secret
 type: Opaque
 data:
-  img_dbname: cG9zdGdpcw==
-  img_hostrw: cGdzdGFj
-  img_password: cGFzc3dvcmQ=
-  img_username: dXNlcm5hbWU=
-  pg_dbname: cG9zdGdpcw==
-  pg_password: cGFzc3dvcmQ=
-  pg_username: dXNlcm5hbWU=
+  username: {{ .Values.pgStac.dbUser }}
+  password: {{ .Values.pgStac.dbPassword }}
+{{- end }}
diff --git a/charts/stac-fastapi/values.yaml b/charts/stac-fastapi/values.yaml
@@ -5,10 +5,17 @@
 nameOverride: ""
 fullnameOverride: ""
 
+local-path-provisioner:
+  enabled: true
+  storageClass:
+    provisionerName: filmdrop.io/local-pgstac-path-provisioner
+    name: local-path-class
+
 pgStac:
+  enabled: true
   image:
     repository: ghcr.io/stac-utils/pgstac
-    tag: v0.7.1
+    tag: v0.7.10
   container:
     port: 5432
   service:
@@ -17,18 +24,37 @@ pgStac:
     name: pgstac
   deployment:
     name: pgstac
+  createPgStacSecret: true
+  userNameSecret:
+    name: stac-fastapi-secret
+    key: username
+  passwordSecret:
+    name: stac-fastapi-secret
+    key: password
+  dbUser: dXNlcm5hbWU=
+  dbPassword: cGFzc3dvcmQ=
+  dbName: postgis
+  dbHost: pgstac.default
+  serviceAccount:
+  storage:
+    size: 1Gi
+    volumeBindingMode: WaitForFirstConsumer
+    provisioner: filmdrop.io/local-pgstac-path-provisioner
+    retainPersistentVolume: true
+    storageClassName: pgstac-retain
   replicaCount: 1
 
 stacFastApi:
   image:
-    repository: ghcr.io/stac-utils/stac-fastapi
-    tag: main-pgstac
+    repository: ghcr.io/stac-utils/stac-fastapi-pgstac
+    tag: main
   container:
     port: 8080
   service:
     port: 8080
     targetPort: 8080
     name: stac-fastapi-pgstac
+    serviceAccount: stac-fastapi-pgstac
   deployment:
     name: stac-fastapi-pgstac
-  replicaCount: 1
+  replicaCount: 1