Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat!: enable istio and netpols for everything #37

Merged
merged 12 commits into from
Jun 12, 2024
30 changes: 30 additions & 0 deletions bundle/uds-bundle.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,11 @@ metadata:
# x-release-please-end

packages:
# this sets up the namespaces that we will need in order to configure the default databases (and corresponding secrets) that are setup below
- name: dev-namespaces
path: ../
ref: 0.1.0

- name: postgres-operator
path: ../
# x-release-please-start-version
Expand All @@ -22,3 +24,31 @@ packages:
- name: POSTGRESQL
description: "Configure postgres using CRs via the uds-postgres-config chart"
path: postgresql
default:
enabled: true # Set to false to not create the PostgreSQL resource
teamId: "uds"
volume:
size: "10Gi"
numberOfInstances: 2
users:
gitlab.gitlab: [] # database owner
sonarqube.sonarqube: [] # database owner
mattermost.mattermost: [] # database owner
databases:
gitlabdb: gitlab.gitlab
mattermostdb: mattermost.mattermost
sonarqubedb: sonarqube.sonarqube
version: "13"
ingress:
remoteGenerated: Anywhere
- name: ACID_PG_CLUSTER_NETWORKING
description: "Allow connectivity to the acid pg cluster for testing (see tests/ folder)"
path: custom
default:
- direction: Egress
selector:
app.kubernetes.io/name: postgres-operator
remoteNamespace: acid
remoteSelector:
cluster-name: pg-cluster
description: "Egress to a non-default pg cluster"
19 changes: 0 additions & 19 deletions bundle/uds-config.yaml
Original file line number Diff line number Diff line change
@@ -1,19 +0,0 @@
variables:
postgres-operator:
postgresql:
enabled: true # Set to false to not create the PostgreSQL resource
Racer159 marked this conversation as resolved.
Show resolved Hide resolved
teamId: "uds"
volume:
size: "10Gi"
numberOfInstances: 2
users:
gitlab.gitlab: [] # database owner
sonarqube.sonarqube: [] # database owner
mattermost.mattermost: [] # database owner
databases:
gitlabdb: gitlab.gitlab
mattermostdb: mattermost.mattermost
sonarqubedb: sonarqube.sonarqube
version: "13"
ingress:
remoteGenerated: Anywhere
16 changes: 0 additions & 16 deletions chart/templates/peer-auth-exception.yaml

This file was deleted.

2 changes: 1 addition & 1 deletion chart/templates/postgres-minimal.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: acid.zalan.do/v1
kind: postgresql
metadata:
name: pg-cluster
namespace: {{ .Release.Namespace }}
namespace: postgres
spec:
teamId: {{ .Values.postgresql.teamId | quote }}
volume:
Expand Down
2 changes: 1 addition & 1 deletion chart/templates/postgres-svc.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ apiVersion: v1
kind: Service
metadata:
name: pg-cluster-headless
namespace: {{ .Release.Namespace }}
namespace: postgres
spec:
clusterIP: None
ports:
Expand Down
41 changes: 41 additions & 0 deletions chart/templates/uds-package-postgres.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
{{- if .Values.postgresql.enabled }}
apiVersion: uds.dev/v1alpha1
kind: Package
metadata:
name: postgres
namespace: postgres
spec:
network:
allow:
- direction: Ingress
remoteGenerated: IntraNamespace

- direction: Egress
remoteGenerated: IntraNamespace

{{- if kindIs "slice" .Values.postgresql.ingress -}}
{{- range .Values.postgresql.ingress }}
- direction: Ingress
selector:
cluster-name: pg-cluster
{{ . | toYaml | nindent 8 }}
{{- end }}
{{- else }}
- direction: Ingress
selector:
cluster-name: pg-cluster
{{- .Values.postgresql.ingress | toYaml | nindent 8 }}
{{- end }}

- direction: Ingress
selector:
app.kubernetes.io/name: postgres-operator
remoteNamespace: {{ .Release.Namespace }}
remoteSelector:
app.kubernetes.io/name: postgres-operator

- direction: Egress
selector:
cluster-name: pg-cluster
remoteGenerated: KubeAPI
{{- end }}
33 changes: 23 additions & 10 deletions chart/templates/uds-package.yaml
Original file line number Diff line number Diff line change
@@ -1,24 +1,37 @@
{{- if .Values.postgresql.enabled }}
apiVersion: uds.dev/v1alpha1
kind: Package
metadata:
name: postgres
name: postgres-operator
namespace: {{ .Release.Namespace }}
spec:
network:
allow:
- direction: Ingress
remoteGenerated: IntraNamespace
{{- if .Values.postgresql.enabled }}
- direction: Egress
remoteGenerated: IntraNamespace
{{- if .Values.postgresql.ingress }}
- direction: Ingress
selector:
app.kubernetes.io/name: postgres-operator
remoteNamespace: postgres
remoteSelector:
cluster-name: pg-cluster
{{- .Values.postgresql.ingress | toYaml | nindent 8 }}
{{- end }}

- direction: Egress
selector:
cluster-name: pg-cluster
app.kubernetes.io/name: postgres-operator
remoteGenerated: KubeAPI
{{- end }}

# Custom rules for other scenarios (such as connecting to a non-default pg cluster)
{{- range .Values.custom }}
- direction: {{ .direction }}
selector:
{{ .selector | toYaml | nindent 10 }}
{{- if not .remoteGenerated }}
remoteNamespace: {{ .remoteNamespace }}
remoteSelector:
{{ .remoteSelector | toYaml | nindent 10 }}
port: {{ .port }}
{{- else }}
remoteGenerated: {{ .remoteGenerated }}
{{- end }}
description: {{ .description }}
{{- end }}
18 changes: 14 additions & 4 deletions chart/values.yaml
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
postgresql:
enabled: false
ingress: []

# teamId: "uds"
# volume:
Expand All @@ -13,9 +14,18 @@ postgresql:
# yourdb: youruser
# version: "13"
# ingress:
# remoteGenerated: Anywhere
# - remoteGenerated: Anywhere
# or
# ingress:
# remoteNamespace: tempo
# remoteSelector:
# app.kubernetes.io/name: tempo
# - remoteNamespace: tempo
# remoteSelector:
# app.kubernetes.io/name: tempo

custom: []
# - direction: Egress
# selector:
# app.kubernetes.io/name: postgres-operator
# remoteNamespace: acid
# remoteSelector:
# cluster-name: pg-cluster
# description: "Egress to a non-default pg cluster"
7 changes: 6 additions & 1 deletion common/zarf.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ components:
required: true
charts:
- name: uds-postgres-config
namespace: postgres
namespace: postgres-operator
version: 0.1.0
localPath: ../chart
- name: postgres-operator
Expand All @@ -20,6 +20,11 @@ components:
- ../values/values.yaml
actions:
onDeploy:
before:
# this shims postgres operator versions v0.11.1-uds.1 and below to the new config chart namespace layout
- cmd: ./zarf tools kubectl annotate --overwrite postgresql -n postgres pg-cluster meta.helm.sh/release-namespace=postgres-operator || true
- cmd: ./zarf tools kubectl annotate --overwrite service -n postgres pg-cluster-headless meta.helm.sh/release-namespace=postgres-operator || true
- cmd: ./zarf tools kubectl annotate --overwrite package -n postgres postgres meta.helm.sh/release-namespace=postgres-operator || true
after:
- description: Validate Postgres Operator Package
maxTotalSeconds: 300
Expand Down
4 changes: 4 additions & 0 deletions src/namespace/gitlab-ns.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,3 +2,7 @@ kind: Namespace
apiVersion: v1
metadata:
name: gitlab
# This label is only needed for testing!
# In a real deployment this namespace would be controlled by a UDS Package / the UDS Operator
labels:
istio-injection: enabled
4 changes: 4 additions & 0 deletions src/namespace/mattermost-ns.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,3 +2,7 @@ kind: Namespace
apiVersion: v1
metadata:
name: mattermost
# This label is only needed for testing!
# In a real deployment this namespace would be controlled by a UDS Package / the UDS Operator
labels:
istio-injection: enabled
4 changes: 4 additions & 0 deletions src/namespace/sonarqube-ns.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,3 +2,7 @@ kind: Namespace
apiVersion: v1
metadata:
name: sonarqube
# This label is only needed for testing!
# In a real deployment this namespace would be controlled by a UDS Package / the UDS Operator
labels:
istio-injection: enabled
8 changes: 8 additions & 0 deletions tasks.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,14 @@ tasks:
- task: dependencies:create
- task: create:test-bundle

- name: dev
Racer159 marked this conversation as resolved.
Show resolved Hide resolved
description: Deploy Postgres Operator on existing cluster
actions:
- task: create-pg-package
- task: dependencies:create
- task: create-pg-test-bundle
- task: deploy:test-bundle

# CI will execute the following (via uds-common/.github/actions/test) so they need to be here with these names

- name: test-package
Expand Down
2 changes: 2 additions & 0 deletions tests/postgres/db-seed-cross-namespace.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@ kind: Job
metadata:
name: db-seed-job
namespace: gitlab
labels:
app: gitlab
spec:
template:
spec:
Expand Down
2 changes: 2 additions & 0 deletions tests/postgres/db-seed.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@ kind: Job
metadata:
name: db-seed-job
namespace: acid
labels:
app: acid
spec:
template:
spec:
Expand Down
4 changes: 4 additions & 0 deletions tests/postgres/postgres-minimal.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,10 @@ kind: Namespace
apiVersion: v1
metadata:
name: acid
# This label is only needed for testing!
# In a real deployment this namespace would be controlled by a UDS Package / the UDS Operator
labels:
istio-injection: enabled
---
apiVersion: acid.zalan.do/v1
kind: postgresql
Expand Down