Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat!: enable istio and netpols for everything #37

Merged
merged 12 commits into from
Jun 12, 2024
30 changes: 30 additions & 0 deletions bundle/uds-bundle.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,11 @@ metadata:
# x-release-please-end

packages:
# this sets up the namespaces that we will need in order to configure the default databases (and corresponding secrets) that are setup below
- name: dev-namespaces
path: ../
ref: 0.1.0

- name: postgres-operator
path: ../
# x-release-please-start-version
Expand All @@ -22,3 +24,31 @@ packages:
- name: POSTGRESQL
description: "Configure postgres using CRs via the uds-postgres-config chart"
path: postgresql
default:
enabled: true # Set to false to not create the PostgreSQL resource
teamId: "uds"
volume:
size: "10Gi"
numberOfInstances: 2
users:
gitlab.gitlab: [] # database owner
sonarqube.sonarqube: [] # database owner
mattermost.mattermost: [] # database owner
databases:
gitlabdb: gitlab.gitlab
mattermostdb: mattermost.mattermost
sonarqubedb: sonarqube.sonarqube
version: "13"
ingress:
remoteGenerated: Anywhere
- name: ACID_PG_CLUSTER_NETWORKING
description: "Allow connectivity to the acid pg cluster for testing (see tests/ folder)"
path: custom
default:
- direction: Egress
selector:
app.kubernetes.io/name: postgres-operator
remoteNamespace: acid
remoteSelector:
cluster-name: pg-cluster
description: "Egress to a non-default pg cluster"
19 changes: 0 additions & 19 deletions bundle/uds-config.yaml
Original file line number Diff line number Diff line change
@@ -1,19 +0,0 @@
variables:
postgres-operator:
postgresql:
enabled: true # Set to false to not create the PostgreSQL resource
Racer159 marked this conversation as resolved.
Show resolved Hide resolved
teamId: "uds"
volume:
size: "10Gi"
numberOfInstances: 2
users:
gitlab.gitlab: [] # database owner
sonarqube.sonarqube: [] # database owner
mattermost.mattermost: [] # database owner
databases:
gitlabdb: gitlab.gitlab
mattermostdb: mattermost.mattermost
sonarqubedb: sonarqube.sonarqube
version: "13"
ingress:
remoteGenerated: Anywhere
16 changes: 0 additions & 16 deletions chart/templates/peer-auth-exception.yaml

This file was deleted.

34 changes: 34 additions & 0 deletions chart/templates/uds-package-postgres.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
{{- if .Values.postgresql.enabled }}
apiVersion: uds.dev/v1alpha1
kind: Package
metadata:
name: postgres
namespace: {{ .Release.Namespace }}
spec:
network:
allow:
- direction: Ingress
remoteGenerated: IntraNamespace

- direction: Egress
remoteGenerated: IntraNamespace

{{- if .Values.postgresql.ingress }}
- direction: Ingress
selector:
cluster-name: pg-cluster
{{- .Values.postgresql.ingress | toYaml | nindent 8 }}
{{- end }}

- direction: Ingress
selector:
app.kubernetes.io/name: postgres-operator
remoteNamespace: postgres-operator
remoteSelector:
app.kubernetes.io/name: postgres-operator

- direction: Egress
selector:
cluster-name: pg-cluster
remoteGenerated: KubeAPI
{{- end }}
35 changes: 24 additions & 11 deletions chart/templates/uds-package.yaml
Original file line number Diff line number Diff line change
@@ -1,24 +1,37 @@
{{- if .Values.postgresql.enabled }}
apiVersion: uds.dev/v1alpha1
kind: Package
metadata:
name: postgres
namespace: {{ .Release.Namespace }}
name: postgres-operator
namespace: postgres-operator
spec:
network:
allow:
- direction: Ingress
remoteGenerated: IntraNamespace
{{- if .Values.postgresql.enabled }}
- direction: Egress
remoteGenerated: IntraNamespace
{{- if .Values.postgresql.ingress }}
- direction: Ingress
selector:
app.kubernetes.io/name: postgres-operator
remoteNamespace: {{ .Release.Namespace }}
remoteSelector:
cluster-name: pg-cluster
{{- .Values.postgresql.ingress | toYaml | nindent 8 }}
{{- end }}

- direction: Egress
selector:
cluster-name: pg-cluster
app.kubernetes.io/name: postgres-operator
remoteGenerated: KubeAPI
{{- end }}

# Custom rules for other scenarios (such as connecting to a non-default pg cluster)
{{- range .Values.custom }}
- direction: {{ .direction }}
selector:
{{ .selector | toYaml | nindent 10 }}
{{- if not .remoteGenerated }}
remoteNamespace: {{ .remoteNamespace }}
remoteSelector:
{{ .remoteSelector | toYaml | nindent 10 }}
port: {{ .port }}
{{- else }}
remoteGenerated: {{ .remoteGenerated }}
{{- end }}
description: {{ .description }}
{{- end }}
9 changes: 9 additions & 0 deletions chart/values.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -19,3 +19,12 @@ postgresql:
# remoteNamespace: tempo
# remoteSelector:
# app.kubernetes.io/name: tempo

custom: []
# - direction: Egress
# selector:
# app.kubernetes.io/name: postgres-operator
# remoteNamespace: acid
# remoteSelector:
# cluster-name: pg-cluster
# description: "Egress to a non-default pg cluster"
2 changes: 2 additions & 0 deletions src/namespace/gitlab-ns.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,3 +2,5 @@ kind: Namespace
apiVersion: v1
metadata:
name: gitlab
labels:
istio-injection: enabled
2 changes: 2 additions & 0 deletions src/namespace/mattermost-ns.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,3 +2,5 @@ kind: Namespace
apiVersion: v1
metadata:
name: mattermost
labels:
istio-injection: enabled
2 changes: 2 additions & 0 deletions src/namespace/sonarqube-ns.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,3 +2,5 @@ kind: Namespace
apiVersion: v1
metadata:
name: sonarqube
labels:
istio-injection: enabled
8 changes: 8 additions & 0 deletions tasks.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,14 @@ tasks:
- task: dependencies:create
- task: create:test-bundle

- name: dev
Racer159 marked this conversation as resolved.
Show resolved Hide resolved
description: Deploy Valkey on existing cluster
Racer159 marked this conversation as resolved.
Show resolved Hide resolved
actions:
- task: create-pg-package
- task: dependencies:create
- task: create-pg-test-bundle
- task: deploy:test-bundle

# CI will execute the following (via uds-common/.github/actions/test) so they need to be here with these names

- name: test-package
Expand Down
2 changes: 2 additions & 0 deletions tests/postgres/postgres-minimal.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@ kind: Namespace
apiVersion: v1
metadata:
name: acid
labels:
istio-injection: enabled
---
apiVersion: acid.zalan.do/v1
kind: postgresql
Expand Down