mirror of
https://github.com/dredx/prole.git
synced 2026-09-28 13:54:30 +00:00
16a3dce584
- Pin Prometheus/Alertmanager + Grafana to merlin.prole.org in k3s to avoid PV node-affinity issues - Taint myrddin.prole.org as control-plane-only and add CNPG toleration - Prevent init_cloudnative_pg from deploying prole-svc-kong into the DB namespace - GitOps-manage Kong declarative config via ConfigMap + add placement/init tests
119 lines
3.3 KiB
YAML
119 lines
3.3 KiB
YAML
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: prole-db
|
|
spec:
|
|
instances: 3
|
|
imageName: k3d-prole-registry:5000/prole-db:18-125
|
|
postgresUID: 100
|
|
postgresGID: 101
|
|
maxSyncReplicas: 1
|
|
|
|
tolerations:
|
|
- key: "node-role.kubernetes.io/control-plane"
|
|
operator: "Exists"
|
|
effect: "NoSchedule"
|
|
affinity:
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: prole.org/node-role
|
|
operator: In
|
|
values:
|
|
- db
|
|
podAntiAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
- labelSelector:
|
|
matchExpressions:
|
|
- key: cnpg.io/cluster
|
|
operator: In
|
|
values:
|
|
- prole-db
|
|
topologyKey: kubernetes.io/hostname
|
|
|
|
postgresql:
|
|
parameters:
|
|
shared_buffers: 256MB
|
|
pg_stat_statements.max: '10000'
|
|
pg_stat_statements.track: all
|
|
shared_preload_libraries:
|
|
- pg_stat_statements
|
|
- pg_tde
|
|
pg_hba:
|
|
# allow password access from remote hosts if environment is "#dev"
|
|
- local all postgres trust
|
|
- local all prole scram-sha-256
|
|
- host all postgres all scram-sha-256
|
|
- host prole prole-db all scram-sha-256
|
|
- host all all all scram-sha-256
|
|
- hostssl prole prole-db all scram-sha-256
|
|
# - host all all all gss include_realm=1 krb_realm=EXAMPLE.COM
|
|
|
|
bootstrap:
|
|
initdb:
|
|
database: prole-db
|
|
owner: prole
|
|
localeCollate: 'en_US.utf8'
|
|
localeCType: 'en_US.utf8'
|
|
secret:
|
|
name: prole-db-user
|
|
postInitTemplateSQL:
|
|
- CREATE EXTENSION IF NOT EXISTS pg_stat_statements;
|
|
postInitSQL:
|
|
- CREATE EXTENSION IF NOT EXISTS pg_tde;
|
|
- CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
|
- GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO prole;
|
|
- CREATE EXTENSION IF NOT EXISTS postgis;
|
|
- CREATE EXTENSION IF NOT EXISTS postgis_topology;
|
|
- CREATE EXTENSION IF NOT EXISTS vector;
|
|
- CREATE EXTENSION IF NOT EXISTS tds_fdw;
|
|
- GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO prole;
|
|
- GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA topology TO prole;
|
|
- CREATE SCHEMA IF NOT EXISTS storage;
|
|
- CREATE SCHEMA IF NOT EXISTS graphql_public;
|
|
- CREATE ROLE anon NOLOGIN;
|
|
- CREATE ROLE authenticator LOGIN;
|
|
- GRANT USAGE ON SCHEMA public TO anon;
|
|
- GRANT USAGE ON SCHEMA storage TO anon;
|
|
- GRANT USAGE ON SCHEMA graphql_public TO anon;
|
|
- GRANT anon TO authenticator;
|
|
|
|
certificates:
|
|
serverTLSSecret: prole-db-tls
|
|
serverCASecret: prole-db-ca
|
|
|
|
enableSuperuserAccess: true
|
|
env:
|
|
- name: AWS_REGION
|
|
value: garage
|
|
- name: AWS_DEFAULT_REGION
|
|
value: garage
|
|
|
|
storage:
|
|
size: 1Gi
|
|
pvcTemplate:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 1Gi
|
|
storageClassName: prole-iscsi
|
|
selector:
|
|
matchLabels:
|
|
prole.storage/role: data
|
|
walStorage:
|
|
size: 1Gi
|
|
pvcTemplate:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 1Gi
|
|
storageClassName: prole-iscsi
|
|
selector:
|
|
matchLabels:
|
|
prole.storage/role: wal
|
|
monitoring:
|
|
enablePodMonitor: false
|