Initial crunchy setup on PRs

.github/workflows/pr-open.yml

@@ -32,16 +32,28 @@ jobs:
           tag_fallback: latest
           triggers: ('${{ matrix.package }}/')
 
+  # https://github.com/bcgov/quickstart-openshift
+  # TODO: using latest for now, but move to tagged version
+  crunchy:
+    name: Deploy Crunchy
+    needs: [builds]
+    uses: bcgov/quickstart-openshift/.github/workflows/.deployer-db.yml
+    secrets:
+      oc_namespace: ${{ secrets.OC_NAMESPACE }}
+      oc_token: ${{ secrets.OC_TOKEN }}
+    with:
+      triggers: ('backend/' 'frontend/' 'webeoc/' 'migrations/' 'charts/')
+
   # https://github.com/bcgov/quickstart-openshift-helpers
   deploys:
     name: Deploys
-    needs: [builds]
+    needs: [builds, crunchy]
     uses: bcgov/quickstart-openshift-helpers/.github/workflows/[email protected]
     secrets:
       oc_namespace: ${{ secrets.OC_NAMESPACE }}
       oc_token: ${{ secrets.OC_TOKEN }}
     with:
-      triggers: ('backend/' 'frontend/' 'webeoc/' 'migrations/')
+      triggers: ('backend/' 'frontend/' 'webeoc/' 'migrations/' 'charts/')
 
   healthcheck:
     name: Healthcheck Deployment

charts/crunchy/Chart.yaml

@@ -0,0 +1,26 @@
+apiVersion: v2
+name: crunchy
+description: A Helm chart for Kubernetes deployment.
+icon: https://www.nicepng.com/png/detail/521-5211827_bc-icon-british-columbia-government-logo.png
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 5.5.1
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "5.5.1"
+

charts/crunchy/templates/PostgresCluster.yaml

@@ -0,0 +1,258 @@
+{{- if .Values.crunchy.enabled}}
+apiVersion: postgres-operator.crunchydata.com/v1beta1
+kind: PostgresCluster
+metadata:
+  name: {{ template "crunchy-postgres.fullname" . }}
+  labels: {{ include "crunchy-postgres.labels" . | nindent 4 }}
+spec:
+  metadata:
+    labels: {{ include "crunchy-postgres.labels" . | nindent 6 }}
+  {{ if .Values.crunchy.crunchyImage }}
+  image: {{ .Values.crunchy.crunchyImage }}
+  {{ end }}
+  imagePullPolicy: {{.Values.crunchy.imagePullPolicy}}
+  postgresVersion: {{ .Values.crunchy.postgresVersion }}
+  {{ if .Values.crunchy.postGISVersion }}
+  postGISVersion: {{ .Values.crunchy.postGISVersion | quote }}
+  {{ end }}
+  postgresVersion: {{ .Values.crunchy.postgresVersion }}
+  {{- if and .Values.crunchy.clone .Values.crunchy.clone.enabled }} # enabled in disaster recovery scenario
+  dataSource:
+    {{- if .Values.crunchy.clone.s3.enabled}}
+    pgbackrest:
+      stanza: {{ .Values.crunchy.instances.name }}
+      configuration:
+        - secret:
+            name: {{ .Release.Name }}-s3-secret
+      global:
+        repo2-s3-uri-style: path # This is mandatory since the backups are path based.
+        repo2-path: {{ .Values.crunchy.clone.path }} # path to the backup where cluster will bootstrap from
+      repo:
+        name: repo2 # hardcoded since repo 2, it is always backed up to object storage.
+        s3:
+          bucket: {{ .Values.crunchy.pgBackRest.s3.bucket }}
+          endpoint: {{ .Values.crunchy.pgBackRest.s3.endpoint }}
+          region: "ca-central-1"
+    {{- end}}
+    {{- if .Values.crunchy.clone.pvc.enabled}}
+    postgresCluster:
+      clusterName: {{ template "crunchy-postgres.fullname" . }}
+      repoName: repo1
+    {{- end}}
+  {{- end}}
+  {{- if .Values.crunchy.pgmonitor.enabled }}
+  monitoring:
+    pgmonitor:
+      # this stuff is for the "exporter" container in the "postgres-cluster-ha" set of pods
+      exporter:
+        {{ if .Values.crunchy.pgmonitor.exporter.image}}
+        image: {{ .Values.crunchy.pgmonitor.exporter.image}}
+        {{ end }}
+        resources:
+          requests:
+            cpu: {{ .Values.crunchy.pgmonitor.exporter.requests.cpu }}
+            memory: {{ .Values.crunchy.pgmonitor.exporter.requests.memory }}
+          limits:
+            cpu: {{ .Values.crunchy.pgmonitor.exporter.limits.cpu }}
+            memory: {{ .Values.crunchy.pgmonitor.exporter.limits.memory }}
+
+  {{ end }}
+
+  instances:
+    - name: {{ .Values.crunchy.instances.name }}
+      {{- if .Values.crunchy.instances.metadata }}
+      metadata:
+        {{- toYaml .Values.crunchy.instances.metadata | nindent 8 }}
+      {{- end }}
+      replicas: {{ .Values.crunchy.instances.replicas }}
+      resources:
+        requests:
+          cpu: {{ .Values.crunchy.instances.requests.cpu }}
+          memory: {{ .Values.crunchy.instances.requests.memory }}
+        limits:
+          cpu: {{ .Values.crunchy.instances.limits.cpu }}
+          memory: {{ .Values.crunchy.instances.limits.memory }}
+
+      sidecars:
+        replicaCertCopy:
+          resources:
+            requests:
+              cpu: {{ .Values.crunchy.instances.replicaCertCopy.requests.cpu }}
+              memory: {{ .Values.crunchy.instances.replicaCertCopy.requests.memory }}
+            limits:
+              cpu: {{ .Values.crunchy.instances.replicaCertCopy.limits.cpu }}
+              memory: {{ .Values.crunchy.instances.replicaCertCopy.limits.memory }}
+      dataVolumeClaimSpec:
+        accessModes:
+          - "ReadWriteOnce"
+        resources:
+          requests:
+            storage: {{ .Values.crunchy.instances.dataVolumeClaimSpec.storage }}
+        storageClassName: {{ .Values.crunchy.instances.dataVolumeClaimSpec.storageClassName }}
+      walVolumeClaimSpec:
+        accessModes:
+          - "ReadWriteOnce"
+        resources:
+          requests:
+            storage: {{ .Values.crunchy.instances.dataVolumeClaimSpec.walStorage }}
+        storageClassName: {{ .Values.crunchy.instances.dataVolumeClaimSpec.storageClassName }}
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 1
+              podAffinityTerm:
+                topologyKey: kubernetes.io/hostname
+                labelSelector:
+                  matchLabels:
+                    postgres-operator.crunchydata.com/cluster:
+                      {{ template "crunchy-postgres.fullname" . }}
+                    postgres-operator.crunchydata.com/instance-set: {{ .Values.crunchy.instances.name }}
+
+  users:
+    - name: {{ .Values.global.config.dbName }}
+      databases:
+        - {{ .Values.global.config.dbName }}
+      options: "SUPERUSER CREATEDB CREATEROLE"
+    - name: postgres
+      databases:
+        - postgres
+        - {{ .Values.global.config.dbName }}
+    - name: {{ .Values.global.config.dbName }}proxy # this user lets dev connect to postgres via pgbouncer from local system
+      databases:
+        - {{ .Values.global.config.dbName }}
+        - postgres
+    {{- if .Values.crunchy.pgBackRest.enabled }}
+  backups:
+    pgbackrest:
+      {{ if .Values.crunchy.pgBackRest.image }}
+      image: {{ .Values.crunchy.pgBackRest.image }}
+      {{ end }}
+      {{- if .Values.crunchy.pgBackRest.s3.enabled}}
+      configuration:
+        - secret:
+            name: {{ .Release.Name }}-s3-secret
+      {{- end }}
+      global:
+        repo1-retention-full: {{ .Values.crunchy.pgBackRest.pvc.retention | quote }}
+        repo1-retention-full-type: {{ .Values.crunchy.pgBackRest.pvc.retentionFullType }}
+        {{- if .Values.crunchy.pgBackRest.s3.enabled}}
+        repo2-retention-full: {{ .Values.crunchy.pgBackRest.s3.retention | quote }}
+        repo2-retention-full-type: {{ .Values.crunchy.pgBackRest.retentionFullType }}
+        repo2-path: '{{ .Values.crunchy.pgBackRest.backupPath }}/{{ .Values.crunchy.pgBackRest.clusterCounter}}'
+        repo2-s3-uri-style: path
+        {{- end }}
+      repos:
+
+        - name: repo1
+          schedules:
+            full: {{ .Values.crunchy.pgBackRest.pvc.fullBackupSchedule }}
+            incremental: {{ .Values.crunchy.pgBackRest.pvc.incrementalBackupSchedule }}
+          volume:
+            volumeClaimSpec:
+              accessModes:
+                - {{ .Values.crunchy.pgBackRest.pvc.volume.accessModes }}
+              resources:
+                requests:
+                  storage: {{ .Values.crunchy.pgBackRest.pvc.volume.storage }}
+              storageClassName: {{ .Values.crunchy.pgBackRest.pvc.volume.storageClassName }}
+      {{- if .Values.crunchy.pgBackRest.s3.enabled}}
+        - name: repo2
+          schedules:
+            full: {{ .Values.crunchy.pgBackRest.s3.fullBackupSchedule }}
+            incremental: {{ .Values.crunchy.pgBackRest.s3.incrementalBackupSchedule }}
+          s3:
+            bucket: {{ .Values.crunchy.pgBackRest.s3.bucket | quote }}
+            endpoint: {{ .Values.crunchy.pgBackRest.s3.endpoint | quote }}
+            region: "ca-central-1"
+        {{- end }}
+      {{- if and .Values.crunchy.restore .Values.crunchy.restore.enabled }}
+      restore:
+        enabled: {{ .Values.crunchy.restore.enabled }}
+        repoName: {{ .Values.crunchy.restore.repoName }}
+        options:
+          - --type=time
+          - --target="{{ .Values.crunchy.restore.target }}"
+      {{- end }}
+      # this stuff is for the "pgbackrest" container (the only non-init container) in the "postgres-crunchy-repo-host" pod
+      repoHost:
+        resources:
+          requests:
+            cpu: {{ .Values.crunchy.pgBackRest.repoHost.requests.cpu }}
+            memory: {{ .Values.crunchy.pgBackRest.repoHost.requests.memory }}
+          limits:
+            cpu: {{ .Values.crunchy.pgBackRest.repoHost.limits.cpu }}
+            memory: {{ .Values.crunchy.pgBackRest.repoHost.limits.memory }}
+      sidecars:
+        # this stuff is for the "pgbackrest" container in the "postgres-crunchy-ha" set of pods
+        pgbackrest:
+          resources:
+            requests:
+              cpu: {{ .Values.crunchy.pgBackRest.sidecars.requests.cpu }}
+              memory: {{ .Values.crunchy.pgBackRest.sidecars.requests.memory }}
+            limits:
+              cpu: {{ .Values.crunchy.pgBackRest.sidecars.limits.cpu }}
+              memory: {{ .Values.crunchy.pgBackRest.sidecars.limits.memory }}
+        pgbackrestConfig:
+          resources:
+            requests:
+              cpu: {{ .Values.crunchy.pgBackRest.sidecars.requests.cpu }}
+              memory: {{ .Values.crunchy.pgBackRest.sidecars.requests.memory }}
+            limits:
+              cpu: {{ .Values.crunchy.pgBackRest.sidecars.limits.cpu }}
+              memory: {{ .Values.crunchy.pgBackRest.sidecars.limits.memory }}
+      jobs:
+        resources:
+          requests:
+            cpu: {{ .Values.crunchy.pgBackRest.jobs.requests.cpu }}
+            memory: {{ .Values.crunchy.pgBackRest.jobs.requests.memory }}
+          limits:
+            cpu: {{ .Values.crunchy.pgBackRest.jobs.limits.cpu }}
+            memory: {{ .Values.crunchy.pgBackRest.jobs.limits.memory }}
+  {{- end }}
+  patroni:
+    dynamicConfiguration:
+      postgresql:
+        pg_hba: {{ toYaml .Values.crunchy.patroni.postgresql.pg_hba | nindent 10 }}
+        parameters:
+          log_min_duration_statement: {{ .Values.crunchy.patroni.postgresql.parameters.log_min_duration_statement }}
+          shared_buffers: {{ .Values.crunchy.patroni.postgresql.parameters.shared_buffers }}
+          wal_buffers: {{ .Values.crunchy.patroni.postgresql.parameters.wal_buffers }}
+          work_mem: {{ .Values.crunchy.patroni.postgresql.parameters.work_mem }}
+          min_wal_size: {{ .Values.crunchy.patroni.postgresql.parameters.min_wal_size }}
+          max_wal_size: {{ .Values.crunchy.patroni.postgresql.parameters.max_wal_size }}
+          max_slot_wal_keep_size:  {{ .Values.crunchy.patroni.postgresql.parameters.max_slot_wal_keep_size }}
+          effective_io_concurrency: {{ .Values.crunchy.patroni.postgresql.parameters.effective_io_concurrency }}
+  {{- if and .Values.crunchy.proxy .Values.crunchy.proxy.enabled }}
+  proxy:
+    pgBouncer:
+      config:
+        global:
+          client_tls_sslmode: disable
+          pool_mode: session
+          max_db_connections: {{ .Values.crunchy.proxy.pgBouncer.maxConnections | quote }}
+      {{ if .Values.crunchy.proxy.pgBouncer.image }}
+      image: {{ .Values.crunchy.proxy.pgBouncer.image }}
+      {{ end }}
+      replicas: {{ .Values.crunchy.proxy.pgBouncer.replicas }}
+      # these resources are for the "pgbouncer" container in the "postgres-crunchy-ha-pgbouncer" set of pods
+      # there is a sidecar in these pods which are not mentioned here, but the requests/limits are teeny weeny by default so no worries there.
+      resources:
+        requests:
+          cpu: {{ .Values.crunchy.proxy.pgBouncer.requests.cpu }}
+          memory: {{ .Values.crunchy.proxy.pgBouncer.requests.memory }}
+        limits:
+          cpu: {{ .Values.crunchy.proxy.pgBouncer.limits.cpu }}
+          memory: {{ .Values.crunchy.proxy.pgBouncer.limits.memory }}
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 1
+              podAffinityTerm:
+                topologyKey: kubernetes.io/hostname
+                labelSelector:
+                  matchLabels:
+                    postgres-operator.crunchydata.com/cluster:
+                      {{ template "crunchy-postgres.fullname" . }}
+                    postgres-operator.crunchydata.com/role: pgbouncer
+  {{- end }}
+  {{- end }}

charts/crunchy/templates/_helpers.tpl

@@ -0,0 +1,70 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "crunchy-postgres.name" -}}
+{{- default "crunchy" .Values.crunchy.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "crunchy-postgres.fullname" -}}
+{{- if .Values.crunchy.fullnameOverride }}
+{{- .Values.crunchy.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default "crunchy" .Values.crunchy.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "crunchy-postgres.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "crunchy-postgres.labels" -}}
+helm.sh/chart: {{ include "crunchy-postgres.chart" . }}
+{{ include "crunchy-postgres.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "crunchy-postgres.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "crunchy-postgres.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "crunchy-postgres.serviceAccountName" -}}
+{{- if .Values.crunchy.serviceAccount.create }}
+{{- default (include "crunchy-postgres.fullname" .) .Values.crunchy.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.crunchy.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{- define "crunchy.s3" }}
+{{- if .Values.crunchy.pgBackRest.s3.enabled}}
+[global]
+repo2-s3-key={{ .Values.crunchy.pgBackRest.s3.accessKey }}
+repo2-s3-key-secret={{ .Values.crunchy.pgBackRest.s3.secretKey }}
+{{ end }}
+{{ end }}