nelm-ready: public images overlays, nodeSelector fix, secrets

.helm/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: postgres
+description: PostgreSQL for nelm deploy
+type: application
+version: 1.0.0
+appVersion: "16"

.helm/secret-values.yaml

@@ -0,0 +1,5 @@
+postgres:
+  password:
+    _default: 10007b442b12b79b702572fbb868e484b8a050c3350e5528391027805f93650b214f
+    preprod: 100062d90430a2424fea00c7498f65764c4c1c0a4a507782e8187ed32540191f496a
+    prod: 1000f80cdf2e67846d60f88d0167136c273b80da91790c3b32547fb89c22f428e6cc

.helm/templates/03-serviceaccount.yaml

@@ -3,5 +3,3 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ .Chart.Name }}-sa
-  annotations:
-    werf.io/weight: "-31"

.helm/templates/10-postgres.yaml

@@ -1,5 +1,17 @@
-{{- $nodeSelector := dig .Values.werf.env .Values.postgres.nodeSelector._default .Values.postgres.nodeSelector }}
+{{- $nodeSelector := dig .Values.env .Values.postgres.nodeSelector._default .Values.postgres.nodeSelector }}
-{{- $tolerations := dig .Values.werf.env .Values.postgres.tolerations._default .Values.postgres.tolerations }}
+{{- $tolerations := dig .Values.env .Values.postgres.tolerations._default .Values.postgres.tolerations }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Chart.Name }}-env
+  annotations:
+    "helm.sh/resource-policy": keep
+type: Opaque
+stringData:
+  POSTGRES_USER: {{ dig .Values.env .Values.postgres.user._default .Values.postgres.user | quote }}
+  POSTGRES_DB: {{ dig .Values.env .Values.postgres.database._default .Values.postgres.database | quote }}
+  POSTGRES_PASSWORD: {{ dig .Values.env .Values.postgres.password._default .Values.postgres.password | quote }}
 ---
 apiVersion: apps/v1
 kind: StatefulSet
@@ -9,6 +21,7 @@ metadata:
     app: {{ .Chart.Name }}
 spec:
   replicas: 1
+  serviceName: {{ .Chart.Name }}
   selector:
     matchLabels:
       app: {{ .Chart.Name }}
@@ -16,13 +29,17 @@ spec:
     metadata:
       labels:
         app: {{ .Chart.Name }}
+      {{- if .Values.secretsStore.enabled }}
       annotations:
-        secrets-store.deckhouse.io/role: "{{ .Values.werf.env }}-{{ .Chart.Name }}-role"
+        secrets-store.deckhouse.io/role: "{{ .Values.env }}-{{ .Chart.Name }}-role"
-        secrets-store.deckhouse.io/env-from-path: "{{ .Values.werf.env }}/data/{{ .Chart.Name }}"
+        secrets-store.deckhouse.io/env-from-path: "{{ .Values.env }}/data/{{ .Chart.Name }}"
+      {{- end }}
     spec:
       serviceAccountName: {{ .Chart.Name }}-sa
+      {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
-      - name: registrysecret
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- if $nodeSelector }}
       nodeSelector: {{ toYaml $nodeSelector | nindent 8 }}
       {{- end }}
@@ -31,39 +48,33 @@ spec:
       {{- end }}
       containers:
       - name: postgres
-        image: {{ .Values.werf.image.postgresql }}
+        image: {{ .Values.image.postgresql }}
         imagePullPolicy: IfNotPresent
-        args:
+        env:
-          - -c
+        - name: PGDATA
-          - shared_preload_libraries=pg_stat_statements
+          value: /var/lib/postgresql/data/pgdata
+        envFrom:
+        - secretRef:
+            name: {{ .Chart.Name }}-env
         resources:
           requests:
-            cpu: {{ dig .Values.werf.env .Values.postgres.resources.requests.cpu._default .Values.postgres.resources.requests.cpu }}
+            cpu: {{ dig .Values.env .Values.postgres.resources.requests.cpu._default .Values.postgres.resources.requests.cpu }}
-            memory: {{ dig .Values.werf.env .Values.postgres.resources.requests.memory._default .Values.postgres.resources.requests.memory }}
+            memory: {{ dig .Values.env .Values.postgres.resources.requests.memory._default .Values.postgres.resources.requests.memory }}
           limits:
-            memory: {{ dig .Values.werf.env .Values.postgres.resources.limits.memory._default .Values.postgres.resources.limits.memory }}
+            memory: {{ dig .Values.env .Values.postgres.resources.limits.memory._default .Values.postgres.resources.limits.memory }}
         volumeMounts:
         - name: data
           mountPath: /var/lib/postgresql/data
-          subPath: postgresql
-        - name: {{ .Chart.Name }}-config
-          mountPath: /usr/share/postgresql/postgresql.conf.sample
-          subPath: postgresql.conf.sample
         readinessProbe:
           tcpSocket:
-            port: {{ dig .Values.werf.env .Values.postgres.port._default .Values.postgres.port }}
+            port: {{ dig .Values.env .Values.postgres.port._default .Values.postgres.port }}
           initialDelaySeconds: 5
           timeoutSeconds: 1
         livenessProbe:
           tcpSocket:
-            port: {{ dig .Values.werf.env .Values.postgres.port._default .Values.postgres.port }}
+            port: {{ dig .Values.env .Values.postgres.port._default .Values.postgres.port }}
           initialDelaySeconds: 30
           periodSeconds: 5
-      volumes:
-      - name: {{ .Chart.Name }}-config
-        configMap:
-          name: {{ .Chart.Name }}-configmap
-
   volumeClaimTemplates:
     - metadata:
         name: data
@@ -72,8 +83,8 @@ spec:
         - ReadWriteOnce
         resources:
           requests:
-            storage: {{ dig .Values.werf.env .Values.postgres.storage._default .Values.postgres.storage }}
+            storage: {{ dig .Values.env .Values.postgres.storage._default .Values.postgres.storage }}
-        storageClassName: {{ dig .Values.werf.env .Values.postgres.storageClassName._default .Values.postgres.storageClassName }}
+        storageClassName: {{ dig .Values.env .Values.postgres.storageClassName._default .Values.postgres.storageClassName }}
 ---
 apiVersion: v1
 kind: Service
@@ -84,24 +95,4 @@ spec:
     app: {{ .Chart.Name }}
   ports:
   - name: {{ .Chart.Name }}
-    port: {{ dig .Values.werf.env .Values.postgres.port._default .Values.postgres.port }}
+    port: {{ dig .Values.env .Values.postgres.port._default .Values.postgres.port }}
-
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ .Chart.Name }}-configmap
-  annotations:
-    werf.io/weight: "-31"
-data:
-  postgresql.conf.sample: |
-    listen_addresses = '*'
-    log_checkpoints = on
-    log_connections = off
-    log_disconnections = off
-    log_duration = on
-    log_line_prefix = '%m  %p %u@%d from %h [vxid:%v txid:%x] [%i]'
-    log_lock_waits = on
-    log_statement = 'all'
-    log_temp_files = 0
-    log_timezone = 'UTC'

.helm/templates/11-postgresql-exporter.yaml

@@ -1,6 +1,6 @@
 {{- $appName := "postgres-exporter" }}
-{{- $nodeSelector := dig .Values.werf.env .Values.postgres.nodeSelector._default .Values.postgres.nodeSelector }}
+{{- $nodeSelector := dig .Values.env .Values.postgres.nodeSelector._default .Values.postgres.nodeSelector }}
-{{- $tolerations := dig .Values.werf.env .Values.postgres.tolerations._default .Values.postgres.tolerations }}
+{{- $tolerations := dig .Values.env .Values.postgres.tolerations._default .Values.postgres.tolerations }}
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -17,9 +17,11 @@ spec:
     metadata:
       labels:
         app: {{ $appName }}
+      {{- if .Values.secretsStore.enabled }}
       annotations:
-        secrets-store.deckhouse.io/role: "{{ .Values.werf.env }}-{{ .Chart.Name }}-role"
+        secrets-store.deckhouse.io/role: "{{ .Values.env }}-{{ .Chart.Name }}-role"
-        secrets-store.deckhouse.io/env-from-path: "{{ .Values.werf.env }}/data/{{ .Chart.Name }}"
+        secrets-store.deckhouse.io/env-from-path: "{{ .Values.env }}/data/{{ .Chart.Name }}"
+      {{- end }}
     spec:
       volumes:
       - configMap:
@@ -27,8 +29,10 @@ spec:
           name: {{ $appName }}-config
         name: {{ $appName }}-config
       serviceAccountName: {{ .Chart.Name }}-sa
+      {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
-      - name: registrysecret
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- if $nodeSelector }}
       nodeSelector: {{ toYaml $nodeSelector | nindent 8 }}
       {{- end }}
@@ -41,7 +45,7 @@ spec:
           - mountPath: /etc/postgres_exporter.yml
             name: {{ $appName }}-config
             subPath: postgres_exporter.yml
-          image: {{ .Values.werf.image.postgresqlExporter }}
+          image: {{ .Values.image.postgresqlExporter }}
           args:
           - --web.listen-address=:9187
           - --config.file=/etc/postgres_exporter.yml

.helm/values-public.yaml

@@ -0,0 +1,4 @@
+imagePullSecrets: []
+image:
+  postgresql: ghcr.io/cloudnative-pg/postgresql:16.4-22
+  postgresqlExporter: ghcr.io/cloudnative-pg/postgresql:16.4-22

.helm/values.yaml

@@ -1,4 +1,20 @@
+global:
+  cluster: ""
+
+env: dev
+
+imagePullSecrets:
+  - name: registrysecret
+
+image:
+  postgresql: 192.168.10.68:5000/library/postgres:16-alpine
+  postgresqlExporter: 192.168.10.68:5000/prometheuscommunity/postgres-exporter:v0.19.0
+
 postgres:
+  user:
+    _default: postgres
+  database:
+    _default: postgres
   port:
     _default: "5432"
   storage:
@@ -6,7 +22,7 @@ postgres:
     preprod: 20Gi
     prod: 50Gi
   storageClassName:
-    _default: local-storage-class-worker
+    _default: localpath
   resources:
     requests:
       cpu:
@@ -20,12 +36,14 @@ postgres:
         _default: 512Mi
         preprod: 1Gi
         prod: 2Gi
-
   nodeSelector:
     _default:
-      node-role.deckhouse.io/worker: ""
+      node-role.kubernetes.io/worker: ""
   tolerations:
     _default: []
 
 postgresqlExporter:
   user: okagent
+
+secretsStore:
+  enabled: false

Dockerfile

@@ -0,0 +1 @@
+FROM docker.io/library/postgres:16-alpine