From d1738b166ec55268f29e6e3b3b35d714e0e3a1a4 Mon Sep 17 00:00:00 2001 From: ci Date: Fri, 11 Sep 2026 14:28:15 +0300 Subject: [PATCH] nelm-ready: public images overlays, nodeSelector fix, secrets --- .helm/Chart.yaml | 6 ++ .helm/secret-values.yaml | 5 ++ .helm/templates/03-serviceaccount.yaml | 2 - .helm/templates/10-postgres.yaml | 83 +++++++++------------ .helm/templates/11-postgresql-exporter.yaml | 16 ++-- .helm/values-public.yaml | 4 + .helm/values.yaml | 24 +++++- Dockerfile | 1 + 8 files changed, 84 insertions(+), 57 deletions(-) create mode 100644 .helm/Chart.yaml create mode 100644 .helm/secret-values.yaml create mode 100644 .helm/values-public.yaml create mode 100644 Dockerfile diff --git a/.helm/Chart.yaml b/.helm/Chart.yaml new file mode 100644 index 0000000..9c251f5 --- /dev/null +++ b/.helm/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: postgres +description: PostgreSQL for nelm deploy +type: application +version: 1.0.0 +appVersion: "16" diff --git a/.helm/secret-values.yaml b/.helm/secret-values.yaml new file mode 100644 index 0000000..a41f145 --- /dev/null +++ b/.helm/secret-values.yaml @@ -0,0 +1,5 @@ +postgres: + password: + _default: 10007b442b12b79b702572fbb868e484b8a050c3350e5528391027805f93650b214f + preprod: 100062d90430a2424fea00c7498f65764c4c1c0a4a507782e8187ed32540191f496a + prod: 1000f80cdf2e67846d60f88d0167136c273b80da91790c3b32547fb89c22f428e6cc diff --git a/.helm/templates/03-serviceaccount.yaml b/.helm/templates/03-serviceaccount.yaml index 8e86467..77dcb8d 100644 --- a/.helm/templates/03-serviceaccount.yaml +++ b/.helm/templates/03-serviceaccount.yaml @@ -3,5 +3,3 @@ apiVersion: v1 kind: ServiceAccount metadata: name: {{ .Chart.Name }}-sa - annotations: - werf.io/weight: "-31" diff --git a/.helm/templates/10-postgres.yaml b/.helm/templates/10-postgres.yaml index 08a9c34..24a2953 100644 --- a/.helm/templates/10-postgres.yaml +++ b/.helm/templates/10-postgres.yaml @@ -1,5 +1,17 @@ -{{- $nodeSelector := dig .Values.werf.env .Values.postgres.nodeSelector._default .Values.postgres.nodeSelector }} -{{- $tolerations := dig .Values.werf.env .Values.postgres.tolerations._default .Values.postgres.tolerations }} +{{- $nodeSelector := dig .Values.env .Values.postgres.nodeSelector._default .Values.postgres.nodeSelector }} +{{- $tolerations := dig .Values.env .Values.postgres.tolerations._default .Values.postgres.tolerations }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ .Chart.Name }}-env + annotations: + "helm.sh/resource-policy": keep +type: Opaque +stringData: + POSTGRES_USER: {{ dig .Values.env .Values.postgres.user._default .Values.postgres.user | quote }} + POSTGRES_DB: {{ dig .Values.env .Values.postgres.database._default .Values.postgres.database | quote }} + POSTGRES_PASSWORD: {{ dig .Values.env .Values.postgres.password._default .Values.postgres.password | quote }} --- apiVersion: apps/v1 kind: StatefulSet @@ -9,6 +21,7 @@ metadata: app: {{ .Chart.Name }} spec: replicas: 1 + serviceName: {{ .Chart.Name }} selector: matchLabels: app: {{ .Chart.Name }} @@ -16,13 +29,17 @@ spec: metadata: labels: app: {{ .Chart.Name }} + {{- if .Values.secretsStore.enabled }} annotations: - secrets-store.deckhouse.io/role: "{{ .Values.werf.env }}-{{ .Chart.Name }}-role" - secrets-store.deckhouse.io/env-from-path: "{{ .Values.werf.env }}/data/{{ .Chart.Name }}" + secrets-store.deckhouse.io/role: "{{ .Values.env }}-{{ .Chart.Name }}-role" + secrets-store.deckhouse.io/env-from-path: "{{ .Values.env }}/data/{{ .Chart.Name }}" + {{- end }} spec: serviceAccountName: {{ .Chart.Name }}-sa + {{- with .Values.imagePullSecrets }} imagePullSecrets: - - name: registrysecret + {{- toYaml . | nindent 8 }} + {{- end }} {{- if $nodeSelector }} nodeSelector: {{ toYaml $nodeSelector | nindent 8 }} {{- end }} @@ -31,39 +48,33 @@ spec: {{- end }} containers: - name: postgres - image: {{ .Values.werf.image.postgresql }} + image: {{ .Values.image.postgresql }} imagePullPolicy: IfNotPresent - args: - - -c - - shared_preload_libraries=pg_stat_statements + env: + - name: PGDATA + value: /var/lib/postgresql/data/pgdata + envFrom: + - secretRef: + name: {{ .Chart.Name }}-env resources: requests: - cpu: {{ dig .Values.werf.env .Values.postgres.resources.requests.cpu._default .Values.postgres.resources.requests.cpu }} - memory: {{ dig .Values.werf.env .Values.postgres.resources.requests.memory._default .Values.postgres.resources.requests.memory }} + cpu: {{ dig .Values.env .Values.postgres.resources.requests.cpu._default .Values.postgres.resources.requests.cpu }} + memory: {{ dig .Values.env .Values.postgres.resources.requests.memory._default .Values.postgres.resources.requests.memory }} limits: - memory: {{ dig .Values.werf.env .Values.postgres.resources.limits.memory._default .Values.postgres.resources.limits.memory }} + memory: {{ dig .Values.env .Values.postgres.resources.limits.memory._default .Values.postgres.resources.limits.memory }} volumeMounts: - name: data mountPath: /var/lib/postgresql/data - subPath: postgresql - - name: {{ .Chart.Name }}-config - mountPath: /usr/share/postgresql/postgresql.conf.sample - subPath: postgresql.conf.sample readinessProbe: tcpSocket: - port: {{ dig .Values.werf.env .Values.postgres.port._default .Values.postgres.port }} + port: {{ dig .Values.env .Values.postgres.port._default .Values.postgres.port }} initialDelaySeconds: 5 timeoutSeconds: 1 livenessProbe: tcpSocket: - port: {{ dig .Values.werf.env .Values.postgres.port._default .Values.postgres.port }} + port: {{ dig .Values.env .Values.postgres.port._default .Values.postgres.port }} initialDelaySeconds: 30 periodSeconds: 5 - volumes: - - name: {{ .Chart.Name }}-config - configMap: - name: {{ .Chart.Name }}-configmap - volumeClaimTemplates: - metadata: name: data @@ -72,8 +83,8 @@ spec: - ReadWriteOnce resources: requests: - storage: {{ dig .Values.werf.env .Values.postgres.storage._default .Values.postgres.storage }} - storageClassName: {{ dig .Values.werf.env .Values.postgres.storageClassName._default .Values.postgres.storageClassName }} + storage: {{ dig .Values.env .Values.postgres.storage._default .Values.postgres.storage }} + storageClassName: {{ dig .Values.env .Values.postgres.storageClassName._default .Values.postgres.storageClassName }} --- apiVersion: v1 kind: Service @@ -84,24 +95,4 @@ spec: app: {{ .Chart.Name }} ports: - name: {{ .Chart.Name }} - port: {{ dig .Values.werf.env .Values.postgres.port._default .Values.postgres.port }} - ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ .Chart.Name }}-configmap - annotations: - werf.io/weight: "-31" -data: - postgresql.conf.sample: | - listen_addresses = '*' - log_checkpoints = on - log_connections = off - log_disconnections = off - log_duration = on - log_line_prefix = '%m %p %u@%d from %h [vxid:%v txid:%x] [%i]' - log_lock_waits = on - log_statement = 'all' - log_temp_files = 0 - log_timezone = 'UTC' + port: {{ dig .Values.env .Values.postgres.port._default .Values.postgres.port }} diff --git a/.helm/templates/11-postgresql-exporter.yaml b/.helm/templates/11-postgresql-exporter.yaml index b33d885..6084a0b 100644 --- a/.helm/templates/11-postgresql-exporter.yaml +++ b/.helm/templates/11-postgresql-exporter.yaml @@ -1,6 +1,6 @@ {{- $appName := "postgres-exporter" }} -{{- $nodeSelector := dig .Values.werf.env .Values.postgres.nodeSelector._default .Values.postgres.nodeSelector }} -{{- $tolerations := dig .Values.werf.env .Values.postgres.tolerations._default .Values.postgres.tolerations }} +{{- $nodeSelector := dig .Values.env .Values.postgres.nodeSelector._default .Values.postgres.nodeSelector }} +{{- $tolerations := dig .Values.env .Values.postgres.tolerations._default .Values.postgres.tolerations }} --- apiVersion: apps/v1 kind: Deployment @@ -17,9 +17,11 @@ spec: metadata: labels: app: {{ $appName }} + {{- if .Values.secretsStore.enabled }} annotations: - secrets-store.deckhouse.io/role: "{{ .Values.werf.env }}-{{ .Chart.Name }}-role" - secrets-store.deckhouse.io/env-from-path: "{{ .Values.werf.env }}/data/{{ .Chart.Name }}" + secrets-store.deckhouse.io/role: "{{ .Values.env }}-{{ .Chart.Name }}-role" + secrets-store.deckhouse.io/env-from-path: "{{ .Values.env }}/data/{{ .Chart.Name }}" + {{- end }} spec: volumes: - configMap: @@ -27,8 +29,10 @@ spec: name: {{ $appName }}-config name: {{ $appName }}-config serviceAccountName: {{ .Chart.Name }}-sa + {{- with .Values.imagePullSecrets }} imagePullSecrets: - - name: registrysecret + {{- toYaml . | nindent 8 }} + {{- end }} {{- if $nodeSelector }} nodeSelector: {{ toYaml $nodeSelector | nindent 8 }} {{- end }} @@ -41,7 +45,7 @@ spec: - mountPath: /etc/postgres_exporter.yml name: {{ $appName }}-config subPath: postgres_exporter.yml - image: {{ .Values.werf.image.postgresqlExporter }} + image: {{ .Values.image.postgresqlExporter }} args: - --web.listen-address=:9187 - --config.file=/etc/postgres_exporter.yml diff --git a/.helm/values-public.yaml b/.helm/values-public.yaml new file mode 100644 index 0000000..9e0c645 --- /dev/null +++ b/.helm/values-public.yaml @@ -0,0 +1,4 @@ +imagePullSecrets: [] +image: + postgresql: ghcr.io/cloudnative-pg/postgresql:16.4-22 + postgresqlExporter: ghcr.io/cloudnative-pg/postgresql:16.4-22 diff --git a/.helm/values.yaml b/.helm/values.yaml index eaded68..415111d 100644 --- a/.helm/values.yaml +++ b/.helm/values.yaml @@ -1,4 +1,20 @@ +global: + cluster: "" + +env: dev + +imagePullSecrets: + - name: registrysecret + +image: + postgresql: 192.168.10.68:5000/library/postgres:16-alpine + postgresqlExporter: 192.168.10.68:5000/prometheuscommunity/postgres-exporter:v0.19.0 + postgres: + user: + _default: postgres + database: + _default: postgres port: _default: "5432" storage: @@ -6,7 +22,7 @@ postgres: preprod: 20Gi prod: 50Gi storageClassName: - _default: local-storage-class-worker + _default: localpath resources: requests: cpu: @@ -20,12 +36,14 @@ postgres: _default: 512Mi preprod: 1Gi prod: 2Gi - nodeSelector: _default: - node-role.deckhouse.io/worker: "" + node-role.kubernetes.io/worker: "" tolerations: _default: [] postgresqlExporter: user: okagent + +secretsStore: + enabled: false diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..30c15bb --- /dev/null +++ b/Dockerfile @@ -0,0 +1 @@ +FROM docker.io/library/postgres:16-alpine