feat: crunchy

kubernetes/apps/default/plant-it/app/externalsecret.yaml → .archive/kubernetes/plant-it/app/externalsecret.yaml

@@ -20,7 +20,7 @@ spec:
         MYSQL_ROOT_PASSWORD: &dbPass "{{ .PLANTIT__MARIADB_ROOT_PASS }}"
         MYSQL_USERNAME: "{{ .PLANTIT__MARIADB_USER }}"
         MYSQL_PSW: *dbPass
-        FLORACODEX_KEY: "{{ .PLANTIT__FLORACODEX_KEY }}"
+        FLORACODEX_KEY: "{{ .PLANTIT__TREFLE_KEY }}"
         JWT_SECRET: "{{ .PLANTIT__JWT_SECRET }}"
 
   dataFrom:

kubernetes/apps/database/crunchy-postgres-operator/cluster/cluster.yaml

@@ -0,0 +1,174 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/postgres-operator.crunchydata.com/postgrescluster_v1beta1.json
+apiVersion: postgres-operator.crunchydata.com/v1beta1
+kind: PostgresCluster
+metadata:
+  name: &name postgres
+spec:
+  postgresVersion: 17
+
+  metadata:
+    labels:
+      crunchy-userinit.ramblurr.github.com/enabled: "true"
+      crunchy-userinit.ramblurr.github.com/superuser: "postgres"
+
+  patroni: # turn on sync writes to at least 1 other replica
+    dynamicConfiguration:
+      synchronous_mode: true
+      postgresql:
+        max_wal_size: 5GB
+        synchronous_commit: "on"
+        pg_hba:
+          - hostnossl all all 10.69.0.0/16 md5 # Needed because dbman does not support SSL yet
+          - hostssl all all all md5
+        parameters:
+          max_connections: 500
+  instances:
+    - name: postgres
+      metadata:
+        labels:
+          app.kubernetes.io/name: crunchy-postgres
+      replicas: &replica 3
+      dataVolumeClaimSpec:
+        storageClassName: openebs-hostpath
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 80Gi
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: "kubernetes.io/hostname"
+          whenUnsatisfiable: "DoNotSchedule"
+          labelSelector:
+            matchLabels:
+              postgres-operator.crunchydata.com/cluster: *name
+              postgres-operator.crunchydata.com/data: postgres
+
+  users:
+    # Superuser
+    - name: postgres
+      databases:
+        - postgres
+      options: "SUPERUSER"
+      password: &password
+        type: AlphaNumeric
+    # Applications
+    - name: authelia
+      databases:
+        - authelia
+      password: *password
+    - name: ghostfolio
+      databases:
+        - ghostfolio
+      password: *password
+    - name: joplin
+      databases:
+        - joplin
+      password: *password
+    - name: lychee
+      databases:
+        - lychee
+      password: *password
+    - name: outline
+      databases:
+        - outline
+      password: *password
+    - name: paperless
+      databases:
+        - paperless
+      password: *password
+    - name: pushover-notifier
+      databases:
+        - pushover-notifier
+      password: *password
+    - name: tandoor
+      databases:
+        - tandoor
+      password: *password
+    - name: vaultwarden
+      databases:
+        - vaultwarden
+      password: *password
+    - name: vikunja
+      databases:
+        - vikunja
+      password: *password
+  backups:
+    pgbackrest:
+      configuration: &backupConfig
+        - secret:
+            name: crunchy-postgres-secret
+      global: &backupFlag
+        compress-type: "bz2"
+        compress-level: "9"
+        # Minio
+        repo1-block: "y"
+        repo1-bundle: "y"
+        repo1-path: /crunchy-pgo
+        repo1-retention-full: "30" # days
+        repo1-retention-full-type: "time"
+        repo1-s3-uri-style: path
+      manual:
+        repoName: repo1
+        options:
+          - --type=full
+      metadata:
+        labels:
+          app.kubernetes.io/name: crunchy-postgres-backup
+      repos:
+        - name: repo1 # Minio
+          s3: &minio
+            bucket: crunchy-postgres
+            endpoint: "s3.${SECRET_INTERNAL_DOMAIN}"
+            region: us-east-1
+          schedules:
+            full: "0 1 * * 0" # Sunday at 01:00
+            differential: "0 1 * * 1-6" # Mon-Sat at 01:00
+            incremental: "0 2-23 * * *" # Every hour except 01:00
+
+  # dataSource:
+  #   pgbackrest:
+  #     stanza: "db"
+  #     configuration: *backupConfig
+  #     global: *backupFlag
+  #     repo:
+  #       name: "repo1"
+  #       s3: *minio
+
+  monitoring:
+    pgmonitor:
+      exporter:
+        resources:
+          requests:
+            cpu: 10m
+            memory: 64M
+          limits:
+            memory: 512M
+
+  proxy:
+    pgBouncer:
+      port: 5432
+      service:
+        metadata:
+          annotations:
+            lbipam.cilium.io/ips: ${CLUSTER_LB_POSTGRES}
+        type: LoadBalancer
+      replicas: *replica
+      metadata:
+        labels:
+          app.kubernetes.io/name: crunchy-postgres-pgbouncer
+      config:
+        global:
+          pool_mode: "session" # Grafana requires session https://github.com/grafana/grafana/issues/74260#issuecomment-1702795311. Everything else is happy with transaction
+          client_tls_sslmode: prefer
+          default_pool_size: "100"
+          max_client_conn: "500"
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: "kubernetes.io/hostname"
+          whenUnsatisfiable: "DoNotSchedule"
+          labelSelector:
+            matchLabels:
+              postgres-operator.crunchydata.com/cluster: *name
+              postgres-operator.crunchydata.com/role: pgbouncer

kubernetes/apps/database/crunchy-postgres-operator/cluster/externalsecret.yaml

@@ -0,0 +1,26 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: crunchy-postgres
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: crunchy-postgres-secret
+    template:
+      engineVersion: v2
+      data:
+        s3.conf: |
+          [global]
+          repo1-s3-key={{ .CRUNCHY_POSTGRES_S3_ACCESS_KEY }}
+          repo1-s3-key-secret={{ .CRUNCHY_POSTGRES_S3_SECRET_KEY }}
+        encryption.conf: |
+          [global]
+          repo1-cipher-pass={{ .CRUNCHY_POSTGRES_BACKUP_ENCRYPTION_CIPHER }}
+  dataFrom:
+    - extract:
+        key: crunchy-postgres

kubernetes/apps/database/crunchy-postgres-operator/cluster/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./externalsecret.yaml
+  - ./cluster.yaml
+  - ./podmonitor.yaml

kubernetes/apps/database/crunchy-postgres-operator/cluster/podmonitor.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: cpgo-postgres
+spec:
+  jobLabel: cpgo-postgres
+  namespaceSelector:
+    matchNames:
+      - database
+  podMetricsEndpoints:
+    - honorLabels: true
+      path: /metrics
+      port: exporter
+      relabelings:
+        - sourceLabels:
+            [
+              "__meta_kubernetes_namespace",
+              "__meta_kubernetes_pod_label_postgres_operator_crunchydata_com_cluster",
+            ]
+          targetLabel: pg_cluster
+          separator: "/"
+          replacement: "$1$2"
+        - sourceLabels:
+            [
+              __meta_kubernetes_pod_label_postgres_operator_crunchydata_com_instance,
+            ]
+          targetLabel: deployment
+        - sourceLabels:
+            [__meta_kubernetes_pod_label_postgres_operator_crunchydata_com_role]
+          targetLabel: role
+        - sourceLabels: [__meta_kubernetes_pod_name]
+          targetLabel: instance
+  selector:
+    matchLabels:
+      postgres-operator.crunchydata.com/cluster: postgres
+      postgres-operator.crunchydata.com/crunchy-postgres-exporter: "true"

kubernetes/apps/database/crunchy-postgres-operator/clustersecretstore/clustersecretstore.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: crunchy-pgo-secrets
+spec:
+  provider:
+    kubernetes:
+      remoteNamespace: database
+      server:
+        caProvider:
+          type: ConfigMap
+          name: kube-root-ca.crt
+          namespace: database
+          key: ca.crt
+      auth:
+        serviceAccount:
+          name: external-secrets-pg
+          namespace: database

kubernetes/apps/database/crunchy-postgres-operator/clustersecretstore/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./rbac.yaml
+  - ./clustersecretstore.yaml

kubernetes/apps/database/crunchy-postgres-operator/clustersecretstore/rbac.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: external-secrets-pg
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["authorization.k8s.io"]
+    resources: ["selfsubjectrulesreviews"]
+    verbs: ["create"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: &name external-secrets-pg
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: *name
+subjects:
+  - kind: ServiceAccount
+    name: *name
+    namespace: database
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: external-secrets-pg
+  namespace: database