mirror of
https://github.com/auricom/home-cluster.git
synced 2025-09-26 20:13:31 +02:00
♻️ flux kustomizations
This commit is contained in:
auricom
30
kubernetes/apps/default/cloudnative-pg/app/helmrelease.yaml
Normal file
30
kubernetes/apps/default/cloudnative-pg/app/helmrelease.yaml
Normal file
@@ -0,0 +1,30 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helmrelease_v2beta1.json
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: cloudnative-pg
|
||||
namespace: default
|
||||
spec:
|
||||
interval: 15m
|
||||
chart:
|
||||
spec:
|
||||
chart: cloudnative-pg
|
||||
version: 0.16.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: cloudnative-pg
|
||||
namespace: flux-system
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
values:
|
||||
crds:
|
||||
create: true
|
||||
config:
|
||||
data:
|
||||
INHERITED_ANNOTATIONS: kyverno.io/ignore
|
||||
@@ -0,0 +1,18 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: default
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
- ./secret.sops.yaml
|
||||
configMapGenerator:
|
||||
- name: cloudnative-pg-dashboard
|
||||
files:
|
||||
- cloudnative-pg-dashboard.json=https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/docs/src/samples/monitoring/grafana-dashboard.json
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
annotations:
|
||||
kustomize.toolkit.fluxcd.io/substitute: disabled
|
||||
labels:
|
||||
grafana_dashboard: "true"
|
||||
29
kubernetes/apps/default/cloudnative-pg/app/secret.sops.yaml
Normal file
29
kubernetes/apps/default/cloudnative-pg/app/secret.sops.yaml
Normal file
@@ -0,0 +1,29 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
type: kubernetes.io/basic-auth
|
||||
metadata:
|
||||
name: postgres-superuser
|
||||
namespace: default
|
||||
stringData:
|
||||
username: ENC[AES256_GCM,data:oMwUm7mTJ3U=,iv:hfa6GmA8uFC1gPs7Z0wAaddOhVeHu8FmANOd9n/fLok=,tag:FIv7VhkHlVLq4Q+k7N2DDw==,type:str]
|
||||
password: ENC[AES256_GCM,data:LCUuhRW3wjkeVQgefTuh9Q==,iv:07R0ZUrLQe8jPZo3wFn/15fXg8yc/pa+a03tWkSrjjM=,tag:0YoG2EZ3JbihlY98ay/5eg==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQand1M1U2SytHclJSN1I3
|
||||
NzdvdjZMQnJPSW9GUXo1SkZ1elRVY1NvK0FJClpiVk9JVWxHSlIwSXZDSWRoOXI4
|
||||
YkxVeDR5V09OTS92YmpMeUl2a1QyRlUKLS0tIG9iNGJlaDQ3UW1uelFla0cySXRC
|
||||
SzhQOGRzNnYzcEVjVG0rOUt1T1ZJQkkKtbXybUgBFr69GvBmo8+7J1xrtxJ7y1wo
|
||||
ZhV6dzuxc2QSd3o9A6f9J/wg9DHtBHviK5nP0K/edHth9darJw/3Eg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2022-10-25T23:37:50Z"
|
||||
mac: ENC[AES256_GCM,data:aU5GLUX3Tml3tRZUzRP451X5oeUSEpB2QFp7ys8pnKlskDidWwwy3gCCTeG0gjsmJbYiZqZFS0qnYe5brT1b9gJgQVLTgVA8xcoXMFJnGQfHm+kmqBxfYR2wPyCzE3T/J4/2e01oITuVS5RKtc3/w1L2en8DwttcBBaezh3vRRM=,iv:a11Hm95soVPiALzZSHMkKx+XEdq7PPmVysfhXHY0+pw=,tag:ITVZQw2WSmD9rmU/cSto4w==,type:str]
|
||||
pgp: []
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
version: 3.7.3
|
||||
51
kubernetes/apps/default/cloudnative-pg/cluster/cluster.yaml
Normal file
51
kubernetes/apps/default/cloudnative-pg/cluster/cluster.yaml
Normal file
@@ -0,0 +1,51 @@
|
||||
---
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Cluster
|
||||
metadata:
|
||||
name: postgres
|
||||
namespace: default
|
||||
annotations:
|
||||
kyverno.io/ignore: "true"
|
||||
spec:
|
||||
instances: 3
|
||||
primaryUpdateStrategy: unsupervised
|
||||
storage:
|
||||
size: 20Gi
|
||||
storageClass: rook-ceph-block
|
||||
superuserSecret:
|
||||
name: postgres-superuser
|
||||
monitoring:
|
||||
enablePodMonitor: true
|
||||
backup:
|
||||
retentionPolicy: 30d
|
||||
barmanObjectStore:
|
||||
wal:
|
||||
compression: bzip2
|
||||
maxParallel: 8
|
||||
destinationPath: s3://postgresql/
|
||||
endpointURL: https://truenas.${SECRET_DOMAIN}:51515
|
||||
serverName: postgres-v4
|
||||
s3Credentials:
|
||||
accessKeyId:
|
||||
name: postgres-minio
|
||||
key: MINIO_ACCESS_KEY
|
||||
secretAccessKey:
|
||||
name: postgres-minio
|
||||
key: MINIO_SECRET_KEY
|
||||
# bootstrap:
|
||||
# recovery:
|
||||
# source: postgres
|
||||
# externalClusters:
|
||||
# - name: postgres
|
||||
# barmanObjectStore:
|
||||
# destinationPath: s3://postgresql/
|
||||
# endpointURL: https://truenas.${SECRET_DOMAIN}:51515
|
||||
# s3Credentials:
|
||||
# accessKeyId:
|
||||
# name: postgres-minio
|
||||
# key: MINIO_ACCESS_KEY
|
||||
# secretAccessKey:
|
||||
# name: postgres-minio
|
||||
# key: MINIO_SECRET_KEY
|
||||
# wal:
|
||||
# maxParallel: 8
|
||||
@@ -0,0 +1,30 @@
|
||||
#!/bin/sh
|
||||
|
||||
set -e
|
||||
|
||||
# Possible actions: error, pre-backup, post-backup
|
||||
ACTION="$1"
|
||||
|
||||
if [ "$WEBHOOK_URL" != "**None**" ]; then
|
||||
case "$ACTION" in
|
||||
"error")
|
||||
echo "Execute error webhook call to $WEBHOOK_URL"
|
||||
curl --url "$WEBHOOK_URL" \
|
||||
--header 'Content-Type: application/json' \
|
||||
--max-time 10 \
|
||||
--retry 5 \
|
||||
$WEBHOOK_EXTRA_ARGS
|
||||
;;
|
||||
# "pre-backup")
|
||||
# echo "Nothing to do"
|
||||
# ;;
|
||||
"post-backup")
|
||||
echo "Execute post-backup webhook call to $WEBHOOK_URL"
|
||||
curl --url "$WEBHOOK_URL" \
|
||||
--header 'Content-Type: application/json' \
|
||||
--max-time 10 \
|
||||
--retry 5 \
|
||||
$WEBHOOK_EXTRA_ARGS
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
@@ -0,0 +1,62 @@
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: &app cloudnative-pg-external-backup
|
||||
namespace: default
|
||||
spec:
|
||||
schedule: "@daily"
|
||||
jobTemplate:
|
||||
spec:
|
||||
ttlSecondsAfterFinished: 86400
|
||||
template:
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
restartPolicy: OnFailure
|
||||
containers:
|
||||
- name: *app
|
||||
image: prodrigestivill/postgres-backup-local:15-alpine@sha256:1209779d7b39a9f73d498091452051fedfe140252bff59ea1c42e0a9a8a9b8e0
|
||||
env:
|
||||
- name: POSTGRES_HOST
|
||||
value: ${POSTGRES_HOST}
|
||||
- name: POSTGRES_DB
|
||||
value: "authelia,drone,freshrss,gitea,invidious,joplin,lychee,paperless,recipes,sharry,outline,vaultwarden,vikunja,wallabag"
|
||||
- name: POSTGRES_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: postgres-superuser
|
||||
key: username
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: postgres-superuser
|
||||
key: password
|
||||
- name: POSTGRES_EXTRA_OPTS
|
||||
value: "-Z9 --schema=public --blobs"
|
||||
- name: BACKUP_KEEP_DAYS
|
||||
value: "7"
|
||||
- name: BACKUP_KEEP_WEEKS
|
||||
value: "4"
|
||||
- name: BACKUP_KEEP_MONTHS
|
||||
value: "3"
|
||||
- name: HEALTHCHECK_PORT
|
||||
value: "8080"
|
||||
- name: WEBHOOK_URL
|
||||
value: https://uptime-kuma.${SECRET_CLUSTER_DOMAIN}/api/push/45cHKtahUg?status=up&msg=OK&ping=
|
||||
command:
|
||||
- "/backup.sh"
|
||||
volumeMounts:
|
||||
- name: backups
|
||||
mountPath: /backups
|
||||
- name: files
|
||||
subPath: 00-webhook
|
||||
mountPath: /hooks/00-webhook
|
||||
volumes:
|
||||
- name: backups
|
||||
nfs:
|
||||
server: "${LOCAL_LAN_TRUENAS}"
|
||||
path: /mnt/storage/backups/postgresql
|
||||
- name: files
|
||||
configMap:
|
||||
name: postgres-external-backup
|
||||
defaultMode: 0555
|
||||
@@ -0,0 +1,13 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: default
|
||||
resources:
|
||||
- ./cronjob.yaml
|
||||
configMapGenerator:
|
||||
- name: postgres-external-backup
|
||||
files:
|
||||
- ./00-webhook
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: default
|
||||
resources:
|
||||
- ./cluster.yaml
|
||||
- ./external-backup
|
||||
- ./secret.sops.yaml
|
||||
- ./scheduledbackup.yaml
|
||||
@@ -0,0 +1,12 @@
|
||||
---
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: ScheduledBackup
|
||||
metadata:
|
||||
name: postgres
|
||||
namespace: default
|
||||
spec:
|
||||
schedule: "@daily"
|
||||
immediate: true
|
||||
backupOwnerReference: self
|
||||
cluster:
|
||||
name: postgres
|
||||
@@ -0,0 +1,31 @@
|
||||
kind: Secret
|
||||
apiVersion: v1
|
||||
type: Opaque
|
||||
metadata:
|
||||
name: postgres-minio
|
||||
namespace: default
|
||||
labels:
|
||||
k8s.enterprisedb.io/reload: "true"
|
||||
stringData:
|
||||
MINIO_ACCESS_KEY: ENC[AES256_GCM,data:lEOKspQaoN5FxOGSnpQuTAzzHrI=,iv:VJQAWK8Sia/wL4iAdpir5fJxBLP1fDQWqj5pBDO6x/g=,tag:5Jf612CStm7NcW1YdrOq1A==,type:str]
|
||||
MINIO_SECRET_KEY: ENC[AES256_GCM,data:Saad8zdhNfJdCDM/3cwVAtp/Cx8F0R4AFERJA3xT7ZC7M0GptDVaGg==,iv:DnmbB6VCRa2itDLAYwGL3LkTBQlf4sVwu1O5+ZmuukQ=,tag:fG6XMj/rC3moGKVZJn9PBA==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQand1M1U2SytHclJSN1I3
|
||||
NzdvdjZMQnJPSW9GUXo1SkZ1elRVY1NvK0FJClpiVk9JVWxHSlIwSXZDSWRoOXI4
|
||||
YkxVeDR5V09OTS92YmpMeUl2a1QyRlUKLS0tIG9iNGJlaDQ3UW1uelFla0cySXRC
|
||||
SzhQOGRzNnYzcEVjVG0rOUt1T1ZJQkkKtbXybUgBFr69GvBmo8+7J1xrtxJ7y1wo
|
||||
ZhV6dzuxc2QSd3o9A6f9J/wg9DHtBHviK5nP0K/edHth9darJw/3Eg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2022-10-25T23:37:42Z"
|
||||
mac: ENC[AES256_GCM,data:VZ5+kUZsCJxiWV7JS+Enhi0yNJ6m+Oi5IurYNxI0gb2+CqENqn4uvOSNMgKTZAc3d/stuI5OGdBbRJo0aBu0hZ950cgbGV6gfEbzzTO9HRstgAwqnEZHj6DPRLcXkCs0jP1p2p0WICe2HZ113C2aN3MjP47J1Jau3yaJlGOsOuU=,iv:EaxUx+ivqYgBm1wUXsCscoJt7x6+3pSM0QZY8h9eI6U=,tag:Q5ix3VW7C2rgm2R3AMDuDA==,type:str]
|
||||
pgp: []
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
version: 3.7.3
|
||||
45
kubernetes/apps/default/cloudnative-pg/ks.yaml
Normal file
45
kubernetes/apps/default/cloudnative-pg/ks.yaml
Normal file
@@ -0,0 +1,45 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/kustomization_v1beta2.json
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-cloudnative-pg-app
|
||||
namespace: flux-system
|
||||
labels:
|
||||
substitution.flux.home.arpa/enabled: "true"
|
||||
spec:
|
||||
path: ./kubernetes/apps/default/cloudnative-pg/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-ops-kubernetes
|
||||
healthChecks:
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
name: cloudnative-pg
|
||||
namespace: default
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 3m
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/kustomization_v1beta2.json
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-cloudnative-pg-cluster
|
||||
namespace: flux-system
|
||||
labels:
|
||||
substitution.flux.home.arpa/enabled: "true"
|
||||
spec:
|
||||
dependsOn:
|
||||
- name: cluster-apps-cloudnative-pg-app
|
||||
- name: cluster-apps-kyverno
|
||||
path: ./kubernetes/apps/default/cloudnative-pg/cluster
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-ops-kubernetes
|
||||
wait: true
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 3m
|
||||
65
kubernetes/apps/default/cloudnative-pg/readme.md
Normal file
65
kubernetes/apps/default/cloudnative-pg/readme.md
Normal file
@@ -0,0 +1,65 @@
|
||||
# cloudnative-pg
|
||||
|
||||
## S3 Configuration
|
||||
|
||||
1. Create `~/.mc/config.json`
|
||||
|
||||
```json
|
||||
{
|
||||
"version": "10",
|
||||
"aliases": {
|
||||
"minio": {
|
||||
"url": "https://s3.<domain>",
|
||||
"accessKey": "<access-key>",
|
||||
"secretKey": "<secret-key>",
|
||||
"api": "S3v4",
|
||||
"path": "auto"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
2. Create the outline user and password
|
||||
|
||||
```sh
|
||||
mc admin user add minio postgresql <super-secret-password>
|
||||
```
|
||||
|
||||
3. Create the outline bucket
|
||||
|
||||
```sh
|
||||
mc mb minio/postgresql
|
||||
```
|
||||
|
||||
4. Create `postgresql-user-policy.json`
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Action": [
|
||||
"s3:ListBucket",
|
||||
"s3:PutObject",
|
||||
"s3:GetObject",
|
||||
"s3:DeleteObject"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": ["arn:aws:s3:::postgresql/*", "arn:aws:s3:::postgresql"],
|
||||
"Sid": ""
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
5. Apply the bucket policies
|
||||
|
||||
```sh
|
||||
mc admin policy add minio postgresql-private postgresql-user-policy.json
|
||||
```
|
||||
|
||||
6. Associate private policy with the user
|
||||
|
||||
```sh
|
||||
mc admin policy set minio postgresql-private user=postgresql
|
||||
```
|
||||
Reference in New Issue
Block a user