diff --git a/services/databases/pgadmin/00-namespace.yaml b/services/databases/pgadmin/00-namespace.yaml new file mode 100644 index 0000000..370291f --- /dev/null +++ b/services/databases/pgadmin/00-namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: pgadmin diff --git a/services/databases/pgadmin/01-certificates.yaml b/services/databases/pgadmin/01-certificates.yaml new file mode 100644 index 0000000..c064af2 --- /dev/null +++ b/services/databases/pgadmin/01-certificates.yaml @@ -0,0 +1,13 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: pgadmin-cert + namespace: pgadmin +spec: + secretName: pgadmin-cert + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: pgadmin.niaefeup.pt + dnsNames: + - pgadmin.niaefeup.pt diff --git a/services/databases/pgadmin/02-ingress-routes.yaml b/services/databases/pgadmin/02-ingress-routes.yaml new file mode 100644 index 0000000..b959376 --- /dev/null +++ b/services/databases/pgadmin/02-ingress-routes.yaml @@ -0,0 +1,17 @@ +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: pgadmin-https + namespace: pgadmin +spec: + entryPoints: + - websecure + routes: + - match: Host(`pgadmin.niaefeup.pt`) + kind: Rule + services: + - name: pgadmin4 + port: 80 + tls: + secretName: pgadmin-cert diff --git a/services/databases/pgadmin/deploy.sh b/services/databases/pgadmin/deploy.sh new file mode 100755 index 0000000..9df389a --- /dev/null +++ b/services/databases/pgadmin/deploy.sh @@ -0,0 +1,13 @@ +#!/bin/bash + +helm repo add runix https://helm.runix.net + +kubectl apply -f $(dirname $0)/00-namespace.yaml + +helm upgrade --install pgadmin4 runix/pgadmin4\ + --version 1.62.0\ + --values $(dirname $0)/values.yaml\ + --namespace pgadmin + +kubectl apply -f $(dirname $0)/01-certificates.yaml +kubectl apply -f $(dirname $0)/02-ingress-routes.yaml diff --git a/services/databases/pgadmin/values.yaml b/services/databases/pgadmin/values.yaml new file mode 100644 index 0000000..15b06f1 --- /dev/null +++ b/services/databases/pgadmin/values.yaml @@ -0,0 +1,543 @@ +## Global image configuration +global: + ## Overrides the Docker registry globally for all images + imageRegistry: "" + ## Add additional image pull secrets globally + ## Support both full format (- name: secret) and short format (- secret) + ## These will be merged with any chart-specific pull secrets + imagePullSecrets: [] + +## Workload type - Deployment or StatefulSet +## StatefulSet is useful for stable storage and network identity +## When using StatefulSet, PVCs are managed via volumeClaimTemplates +workload: + ## Kind can be either "Deployment" or "StatefulSet" + kind: Deployment + +## Number of pgAdmin4 replicas +replicaCount: 1 + +## pgAdmin4 container image +image: + registry: docker.io + repository: dpage/pgadmin4 + ## Overrides the image tag whose default is the chart appVersion + tag: "" + pullPolicy: IfNotPresent + +## Optionally specify an array of imagePullSecrets +## Secrets must be manually created in the namespace +## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ +imagePullSecrets: [] + # - RegistryKeySecret + +## Deployment annotations +annotations: {} + +## The number of old history to retain to allow rollback +revisionHistoryLimit: 10 + +## Add labels to all the deployed resources +commonLabels: {} + +## Priority class name for pod scheduling +priorityClassName: "" + +## Deployment entrypoint override +## Useful when there's a requirement to modify container's default +## Ref: https://www.vaultproject.io/docs/platform/k8s/injector/examples#environment-variable-example +## Ref: https://github.com/postgres/pgadmin4/blob/master/Dockerfile#L206 +# command: "['/bin/sh', '-c', 'source /vault/secrets/config && ']" + +## Service configuration +service: + type: ClusterIP + clusterIP: "" + loadBalancerIP: "" + port: 80 + targetPort: 80 + # targetPort: 4181 # To be used with a proxy extraContainer + portName: http + + ## Special annotations at the service level, e.g. + ## this will set vnet internal IPs rather than public IPs + ## service.beta.kubernetes.io/azure-load-balancer-internal: "true" + annotations: {} + + ## Specify the nodePort value for the service types + ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + # nodePort: + +## Pod Service Account +## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ +serviceAccount: + ## Specifies whether a service account should be created + create: false + ## Annotations to add to the service account + annotations: {} + ## The name of the service account to use + ## If not set and create is true, a name is generated using the fullname template + name: "" + ## Opt out of API credential automounting + ## If you don't want the kubelet to automatically mount a ServiceAccount's API credentials, + ## you can opt out of the default behavior + automountServiceAccountToken: false + +## Pod HostAliases +## Ref: https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ +hostAliases: [] + # - ip: "127.0.0.1" + # hostnames: + # - "pgadmin4.local" + +## Strategy used to replace old Pods by new ones +## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy +strategy: {} + # type: RollingUpdate + # rollingUpdate: + # maxSurge: 0 + # maxUnavailable: 1 + +## Pre-load pgAdmin4 with servers at first start-up +## Servers are imported only the first time the config DB is created +## Ref: https://www.pgadmin.org/docs/pgadmin4/latest/import_export_servers.html +serverDefinitions: + ## Enable/disable server import + enabled: true + + ## Storage for the server JSON: + ## ConfigMap - plain text (good for non-secret data) + ## Secret - base-64 (better for credentials) + resourceType: ConfigMap + + ## Use this only when `resourceType` = ConfigMap - point to an existing ConfigMap + ## that already holds your `servers.json` + existingConfigmap: "" + + ## Use this only when `resourceType` = Secret - point to an existing Secret + ## that already holds your `servers.json` + existingSecret: "" + + ## Set to true to put raw JSON under `stringData` (handy for dry-runs/debug) + ## Leave false to keep the default base-64 in `data` + useStringData: false + + ## Annotations for ConfigMap or Secret, if you are not using existing resources + annotations: {} + # vault.security.example.io/vault-role: my-role + + ## Inline server definitions (ignore if you point to an existing resource) + ## You can use Helm templates here, e.g. Host: "{{ .Values.example.host }}" + servers: + ni-superuser: + Name: "CNPG Cluster" + Group: "Servers" + Username: "ni" + Host: "cnpg-cluster-rw.pg.svc.cluster.local" + Port: 5432 + SSLMode: "prefer" + MaintenanceDB: "postgres" + Comment: "Superuser — sees all schemas" + Password: + +## Pre-load pgAdmin4 with user preferences +## This mounts a preferences.json file to override default UI settings such as themes, +## display options, or query tool behavior +## Ref: https://www.pgadmin.org/docs/pgadmin4/latest/preferences.html +preferences: + ## Enable/disable preferences + enabled: false + + ## If using an existing ConfigMap, it must contain a key named `preferences.json` + existingConfigMap: "" + + data: {} + # misc:user_interface:theme: dark + +## Network policy configuration +networkPolicy: + enabled: true + +## HTTP route configuration +httpRoute: + enabled: false + annotations: {} + hostnames: [] + parentRefs: {} + matches: [] + +## Ingress configuration +## Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/ +ingress: + enabled: false + ## For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName + ## Ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress + # ingressClassName: traefik + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + labels: {} + hosts: + - host: chart-example.local + paths: + - path: / + pathType: Prefix + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +## Istio ingress configuration +## Use Istio Gateway and VirtualService instead of Ingress +istioIngress: + enabled: false + + ## The label selector for your existing Istio Ingress Gateway pods + ## This tells the Gateway resource which gateway deployment to attach to + ## Example: "ingressgateway" is a common default label + selector: "" + + ## A list of hostnames this Gateway will manage + endpoints: + - "test.example.com" + + ## TLS configuration for Istio Gateway + tls: + enabled: false + ## The name of the K8s Secret containing the cert + ## Istio's Gateway resource will reference this name in its credentialName field + ## Should be in istio-ingress namespace where istio ingress gateway is installed + secretCertName: "my-istio-tls-secret" + + ## Defines the ports on the Istio Ingress Gateway + gateway: + enabled: false + ports: + http: + number: 80 + protocol: HTTP + ## If true, the template generates a rule to redirect HTTP->HTTPS + isTlsRedirect: true + isTlsTermination: false + https: + number: 443 + protocol: HTTPS + isTlsRedirect: false + ## If true, the gateway terminates TLS (handles HTTPS) + isTlsTermination: true + ## SIMPLE: Standard TLS, MUTUAL: mTLS, PASSTHROUGH: Send TLS to pod + tlsMode: SIMPLE + + ## Istio VirtualService configuration + ## The VirtualService defines how traffic is routed after it enters the Gateway + virtualService: + enabled: false + gateway: "" + config: + ## http is a list of ordered routing rules. First match wins + http: + - name: "pgadmin-route" + match: + - uri: + prefix: "/" + route: + - destination: + host: "pgadmin" + portNumber: 80 + weight: 100 + rewrite: + uri: "/" + corsPolicy: + allowOrigins: + - exact: "*" + allowHeaders: + - "*" + allowMethods: + - "*" + exposeHeaders: + - "*" + maxAge: "24h" + +## Additional config maps to be mounted inside a container +## Can be used to map config maps for sidecar as well +extraConfigmapMounts: [] + # - name: certs-configmap + # mountPath: /etc/ssl/certs + # subPath: "" + # configMap: certs-configmap + # readOnly: true + +## Additional secret mounts to be mounted inside a container +extraSecretMounts: [] + # - name: pgpassfile + # secret: pgpassfile + # subPath: pgpassfile + # mountPath: "/var/lib/pgadmin/storage/pgadmin/file.pgpass" + # readOnly: true + +## Additional volumes to be mounted inside a container +extraVolumeMounts: [] + +## Specify additional containers in extraContainers +## For example, to add an authentication proxy to a pgadmin4 pod +extraContainers: | +# - name: proxy +# image: quay.io/gambol99/keycloak-proxy:latest +# args: +# - -provider=github +# - -client-id= +# - -client-secret= +# - -github-org= +# - -email-domain=* +# - -cookie-secret= +# - -http-address=http://0.0.0.0:4181 +# - -upstream-url=http://127.0.0.1:3000 +# ports: +# - name: proxy-web +# containerPort: 4181 + +## Name of existing secret to use for default pgadmin credentials +## env.password will be ignored and picked up from this secret +existingSecret: "" + +## Name of key in existing secret to use for default pgadmin credentials +## Only used when existingSecret is set +secretKeys: + pgadminPasswordKey: password + +## pgAdmin4 startup configuration +## Values in here get injected as environment variables +## Chart reinstall needed to apply changes +env: + ## Can be email or nickname + email: + password: + + # pgpassfile: /var/lib/pgadmin/storage/pgadmin/file.pgpass + + ## Set context path for application (e.g. /pgadmin4/*) + # contextPath: /pgadmin4 + + ## If True, allows pgAdmin4 to create session cookies based on IP address + ## Ref: https://www.pgadmin.org/docs/pgadmin4/latest/config_py.html + enhanced_cookie_protection: "False" + + ## Add custom environment variables that will be injected to deployment + ## Ref: https://www.pgadmin.org/docs/pgadmin4/latest/container_deployment.html + variables: [] + # - name: PGADMIN_LISTEN_ADDRESS + # value: "0.0.0.0" + # - name: PGADMIN_LISTEN_PORT + # value: "8080" + +## Additional environment variables from ConfigMaps +envVarsFromConfigMaps: [] + # - array-of + # - config-map-names + +## Additional environment variables from Secrets +envVarsFromSecrets: [] + # - array-of + # - secret-names + +## Additional environment variables +envVarsExtra: [] + # - name: POSTGRES_USERNAME + # valueFrom: + # secretKeyRef: + # name: pgadmin.pgadmin-db.credentials.postgresql.acid.zalan.do + # key: username + # - name: POSTGRES_PASSWORD + # valueFrom: + # secretKeyRef: + # name: pgadmin.pgadmin-db.credentials.postgresql.acid.zalan.do + # key: password + +## Persistent volume configuration +persistentVolume: + ## If true, pgAdmin4 will create/use a Persistent Volume Claim + ## If false, use emptyDir + enabled: true + + ## pgAdmin4 Persistent Volume Claim annotations + annotations: {} + + ## pgAdmin4 Persistent Volume access modes + ## Must match those of existing PV or dynamic provisioner + ## Ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ + accessModes: + - ReadWriteOnce + + ## pgAdmin4 Persistent Volume Size + size: 1Gi + + ## pgAdmin4 Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS & OpenStack) + storageClass: "longhorn-locality-no-backup" + # existingClaim: "" + + ## Subdirectory of pgAdmin4 Persistent Volume to mount + ## Useful if the volume's root directory is not empty + subPath: "" + +## Additional volumes to be added to the deployment +extraVolumes: [] + +## Security context to be added to pgAdmin4 pods +securityContext: + runAsUser: 5050 + runAsGroup: 5050 + fsGroup: 5050 + +## Container security context +containerSecurityContext: + enabled: false + allowPrivilegeEscalation: false + +## pgAdmin4 health check probe configuration +## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ +livenessProbe: + periodSeconds: 20 + timeoutSeconds: 5 + failureThreshold: 3 + +readinessProbe: + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + +startupProbe: + failureThreshold: 18 + periodSeconds: 10 + +## Required to be enabled pre pgAdmin4 4.16 release, to set the ACL on /var/lib/pgadmin +## Ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ +VolumePermissions: + ## If true, enables an InitContainer to set permissions on /var/lib/pgadmin + enabled: false + +## List of extra manifests to deploy +extraDeploy: [] + +## Additional InitContainers to initialize the pod +extraInitContainers: | +# - name: add-folder-for-pgpass +# image: "dpage/pgadmin4:latest" +# command: ["/bin/mkdir", "-p", "/var/lib/pgadmin/storage/pgadmin"] +# volumeMounts: +# - name: pgadmin-data +# mountPath: /var/lib/pgadmin +# securityContext: +# runAsUser: 5050 + +## Container port configuration +containerPorts: + http: 80 + +## Resource limits and requests +## We usually recommend not to specify default resources and to leave this as a conscious +## choice for the user. This also increases chances charts run on environments with little +## resources, such as Minikube. If you do want to specify resources, uncomment the following +## lines, adjust them as necessary, and remove the curly braces after 'resources:' +## You might also want to increase failure threshold value in startup probe configuration to +## allow the container to start successfully on CPU limited environments +resources: {} + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +## Horizontal Pod Autoscaling +## Ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/ +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 + +## Node labels for pgAdmin4 pod assignment +## Ref: https://kubernetes.io/docs/user-guide/node-selection/ +nodeSelector: {} + +## Node tolerations for server scheduling to nodes with taints +## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ +tolerations: [] + +## Pod affinity +affinity: {} + +## Topology Spread Constraints to control how Pods are spread across your cluster +## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ +topologySpreadConstraints: [] + +## Pod DNS Policy +## Ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy +dnsPolicy: "" + +## Update pod DNS Config +## Ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config +dnsConfig: {} +# nameservers: +# - 192.0.2.1 +# searches: +# - ns1.svc.cluster-domain.example +# - my.dns.search.suffix +# options: +# - name: ndots +# value: "2" +# - name: edns0 + +## Pod annotations +podAnnotations: {} + +## Templated pod annotations +templatedPodAnnotations: |- +# checksum/configmap-oauth2: {{ include "/templates/configmap-oauth2.yaml" $ | sha256sum }} +# checksum/secret-oauth2: "{{ include "/templates/secret-oauth2.yaml" $ | sha256sum }}" +# checksum/secret-pgpass: "{{ include "/templates/secret-pgpass.yaml" $ | sha256sum }}" + +## Pod labels +podLabels: {} + # key1: value1 + # key2: value2 + +## The name of the Namespace to deploy +## If not set, .Release.Namespace is used +namespace: pgadmin + +## Init container configuration +init: + ## Init container resources + resources: {} + +## Chart test configuration +test: + enabled: false + ## Container image for test-connection.yaml + image: + registry: docker.io + repository: busybox + tag: latest + ## Resources request/limit for test-connection Pod + resources: {} + # limits: + # cpu: 50m + # memory: 32Mi + # requests: + # cpu: 25m + # memory: 16Mi + ## Security context for test-connection Pod + securityContext: + runAsUser: 5051 + runAsGroup: 5051 + fsGroup: 5051 + + ## Container Security context for test-connection Pod + containerSecurityContext: + readOnlyRootFilesystem: true