[flant] init repo

.gitignore

@@ -0,0 +1,3 @@
+*.swp
+.werf_secret_key
+.idea

.helm/templates/03-serviceaccount.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Chart.Name }}-sa
+  annotations:
+    werf.io/weight: "-31"

.helm/templates/10-postgres.yaml

@@ -0,0 +1,107 @@
+{{- $nodeSelector := dig .Values.werf.env .Values.postgres.nodeSelector._default .Values.postgres.nodeSelector }}
+{{- $tolerations := dig .Values.werf.env .Values.postgres.tolerations._default .Values.postgres.tolerations }}
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ .Chart.Name }}
+  labels:
+    app: {{ .Chart.Name }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ .Chart.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Chart.Name }}
+      annotations:
+        secrets-store.deckhouse.io/role: "{{ .Values.werf.env }}-{{ .Chart.Name }}-role"
+        secrets-store.deckhouse.io/env-from-path: "{{ .Values.werf.env }}/data/{{ .Chart.Name }}"
+    spec:
+      serviceAccountName: {{ .Chart.Name }}-sa
+      imagePullSecrets:
+      - name: registrysecret
+      {{- if $nodeSelector }}
+      nodeSelector: {{ toYaml $nodeSelector | nindent 8 }}
+      {{- end }}
+      {{- if $tolerations }}
+      tolerations: {{ toYaml $tolerations | nindent 6 }}
+      {{- end }}
+      containers:
+      - name: postgres
+        image: {{ .Values.werf.image.postgresql }}
+        imagePullPolicy: IfNotPresent
+        args:
+          - -c
+          - shared_preload_libraries=pg_stat_statements
+        resources:
+          requests:
+            cpu: {{ dig .Values.werf.env .Values.postgres.resources.requests.cpu._default .Values.postgres.resources.requests.cpu }}
+            memory: {{ dig .Values.werf.env .Values.postgres.resources.requests.memory._default .Values.postgres.resources.requests.memory }}
+          limits:
+            memory: {{ dig .Values.werf.env .Values.postgres.resources.limits.memory._default .Values.postgres.resources.limits.memory }}
+        volumeMounts:
+        - name: data
+          mountPath: /var/lib/postgresql/data
+          subPath: postgresql
+        - name: {{ .Chart.Name }}-config
+          mountPath: /usr/share/postgresql/postgresql.conf.sample
+          subPath: postgresql.conf.sample
+        readinessProbe:
+          tcpSocket:
+            port: {{ dig .Values.werf.env .Values.postgres.port._default .Values.postgres.port }}
+          initialDelaySeconds: 5
+          timeoutSeconds: 1
+        livenessProbe:
+          tcpSocket:
+            port: {{ dig .Values.werf.env .Values.postgres.port._default .Values.postgres.port }}
+          initialDelaySeconds: 30
+          periodSeconds: 5
+      volumes:
+      - name: {{ .Chart.Name }}-config
+        configMap:
+          name: {{ .Chart.Name }}-configmap
+
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes:
+        - ReadWriteOnce
+        resources:
+          requests:
+            storage: {{ dig .Values.werf.env .Values.postgres.storage._default .Values.postgres.storage }}
+        storageClassName: {{ dig .Values.werf.env .Values.postgres.storageClassName._default .Values.postgres.storageClassName }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Chart.Name }}
+spec:
+  selector:
+    app: {{ .Chart.Name }}
+  ports:
+  - name: {{ .Chart.Name }}
+    port: {{ dig .Values.werf.env .Values.postgres.port._default .Values.postgres.port }}
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Chart.Name }}-configmap
+  annotations:
+    werf.io/weight: "-31"
+data:
+  postgresql.conf.sample: |
+    listen_addresses = '*'
+    log_checkpoints = on
+    log_connections = off
+    log_disconnections = off
+    log_duration = on
+    log_line_prefix = '%m  %p %u@%d from %h [vxid:%v txid:%x] [%i]'
+    log_lock_waits = on
+    log_statement = 'all'
+    log_temp_files = 0
+    log_timezone = 'UTC'

.helm/templates/11-postgresql-exporter.yaml

@@ -0,0 +1,128 @@
+{{- $appName := "postgres-exporter" }}
+{{- $nodeSelector := dig .Values.werf.env .Values.postgres.nodeSelector._default .Values.postgres.nodeSelector }}
+{{- $tolerations := dig .Values.werf.env .Values.postgres.tolerations._default .Values.postgres.tolerations }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ $appName }}
+  labels:
+    app: {{ $appName }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ $appName }}
+  template:
+    metadata:
+      labels:
+        app: {{ $appName }}
+      annotations:
+        secrets-store.deckhouse.io/role: "{{ .Values.werf.env }}-{{ .Chart.Name }}-role"
+        secrets-store.deckhouse.io/env-from-path: "{{ .Values.werf.env }}/data/{{ .Chart.Name }}"
+    spec:
+      volumes:
+      - configMap:
+          defaultMode: 420
+          name: {{ $appName }}-config
+        name: {{ $appName }}-config
+      serviceAccountName: {{ .Chart.Name }}-sa
+      imagePullSecrets:
+      - name: registrysecret
+      {{- if $nodeSelector }}
+      nodeSelector: {{ toYaml $nodeSelector | nindent 8 }}
+      {{- end }}
+      {{- if $tolerations }}
+      tolerations: {{ toYaml $tolerations | nindent 6 }}
+      {{- end }}
+      containers:
+        - name: postgres-exporter
+          volumeMounts:
+          - mountPath: /etc/postgres_exporter.yml
+            name: {{ $appName }}-config
+            subPath: postgres_exporter.yml
+          image: {{ .Values.werf.image.postgresqlExporter }}
+          args:
+          - --web.listen-address=:9187
+          - --config.file=/etc/postgres_exporter.yml
+          - --collector.stat_statements
+          - --collector.stat_activity_autovacuum
+          - --collector.statio_user_indexes
+          - --collector.postmaster
+          - --collector.database_wraparound
+          - --collector.long_running_transactions
+          - --collector.process_idle
+          - --collector.stat_wal_receiver
+          - --collector.stat_statements.exclude_databases=postgres,template0,template1
+          - --collector.stat_statements.include_query
+          - --collector.stat_statements.limit=100
+          - --collector.stat_statements.query_length=2048
+          ports:
+            - name: http-metrics
+              containerPort: 9187
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http-metrics
+            initialDelaySeconds: 15
+            periodSeconds: 9
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http-metrics
+            initialDelaySeconds: 20
+            periodSeconds: 11
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              memory: 64Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 65534
+      restartPolicy: Always
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $appName }}
+  labels:
+    app: {{ $appName }}
+    prometheus.deckhouse.io/custom-target: postgresql
+spec:
+  type: ClusterIP
+  ports:
+    - name: http-metrics
+      port: 9187
+      targetPort: http-metrics
+      protocol: TCP
+  selector:
+    app: {{ $appName }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ $appName }}-config
+data:
+  postgres_exporter.yml: |
+    auth_modules:
+      postgres:
+        type: userpass
+        userpass:
+          username: {{ .Values.postgresqlExporter.user | quote }}
+        options:
+          sslmode: disable
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    app: {{ $appName }}
+  name: {{ $appName }}-env
+type: Opaque
+data:
+  PG_EXPORTER_CONSTANT_LABELS: {{ printf "cluster=%s" .Chart.Name | b64enc | quote }}

.helm/values.yaml

@@ -0,0 +1,31 @@
+postgres:
+  port:
+    _default: "5432"
+  storage:
+    _default: 10Gi
+    preprod: 20Gi
+    prod: 50Gi
+  storageClassName:
+    _default: local-storage-class-worker
+  resources:
+    requests:
+      cpu:
+        _default: 200m
+      memory:
+        _default: 256Mi
+        preprod: 512Mi
+        prod: 1Gi
+    limits:
+      memory:
+        _default: 512Mi
+        preprod: 1Gi
+        prod: 2Gi
+
+  nodeSelector:
+    _default:
+      node-role.deckhouse.io/worker: ""
+  tolerations:
+    _default: []
+
+postgresqlExporter:
+  user: okagent

werf.yaml

@@ -0,0 +1,12 @@
+---
+configVersion: 1
+project: postgres
+deploy:
+  namespace: '[[ env ]]'
+  helmRelease: '[[ project ]]-[[ env ]]'
+---
+image: postgresql
+from: registry.lukoil.ru:8123/external-pub/library/postgres:16.10-alpine3.22
+---
+image: postgresqlExporter
+from: registry.lukoil.ru:8123/external-pub/prometheuscommunity/postgres-exporter:v0.19.0