|
| 1 | +### Helm: PostgreSQL and Redis for GitGuardian |
| 2 | + |
| 3 | +This folder provides ready-to-use Helm configurations to deploy PostgreSQL and Redis in your Kubernetes cluster for use with the GitGuardian application. |
| 4 | + |
| 5 | +- PostgreSQL topologies: |
| 6 | + - **HA (replication)**: primary with read replica(s); recommended for production for resilience and read scaling. |
| 7 | + - **Standalone**: single-primary setup; suitable for PoC or testing only. |
| 8 | +- Redis topology: |
| 9 | + - **Standalone** with persistence (aligned with the scaling guide). If you require Redis replication/sentinel, extend these values as needed. |
| 10 | +- All presets are available in three sizes aligned with the GitGuardian scaling guide: **small**, **medium**, **large**. |
| 11 | + |
| 12 | +### Recommendation for cloud providers |
| 13 | + |
| 14 | +If you deploy GitGuardian on a public cloud, prefer the provider's managed services for PostgreSQL and Redis instead of running them in-cluster: |
| 15 | + |
| 16 | +- AWS: [Amazon RDS/Aurora (PostgreSQL)](https://docs.gitguardian.com/self-hosting/installation/databases/postgres-rds), [Amazon ElastiCache (Redis)](https://docs.gitguardian.com/self-hosting/installation/databases/redis-elasticache) |
| 17 | +- GCP: [Cloud SQL for PostgreSQL](https://docs.gitguardian.com/self-hosting/installation/databases/postgres-cloudsql), [Memorystore for Redis](https://docs.gitguardian.com/self-hosting/installation/databases/redis-memorystore) |
| 18 | +- Azure: [Azure Database for PostgreSQL](https://docs.gitguardian.com/self-hosting/installation/databases/postgres-azure), [Azure Cache for Redis](https://docs.gitguardian.com/self-hosting/installation/databases/redis-azure-cache) |
| 19 | + |
| 20 | +These Helm values are intended for existing-cluster installations or environments where managed services are not available. Managed services typically offer higher availability, automated backups/maintenance, and operational SLAs. |
| 21 | + |
| 22 | +⚠️ Deploying PostgreSQL/Redis using these Bitnami Helm examples on Red Hat OpenShift is not supported. |
| 23 | + |
| 24 | +Presets are mapped as follows: |
| 25 | + |
| 26 | +- PostgreSQL |
| 27 | + - Small: Primary 4 vCPU / 8 GiB / 200 Gi; Read replica 2 vCPU / 4 GiB / 200 Gi |
| 28 | + - Medium: Primary 8 vCPU / 32 GiB / 250 Gi; Read replica 4 vCPU / 16 GiB / 250 Gi |
| 29 | + - Large: Primary 16 vCPU / 64 GiB / 300 Gi; Read replica 8 vCPU / 32 GiB / 300 Gi |
| 30 | +- Redis (standalone) |
| 31 | + - Small: 2 vCPU / 2 GiB / 20 Gi |
| 32 | + - Medium: 4 vCPU / 8 GiB / 40 Gi |
| 33 | + - Large: 8 vCPU / 16 GiB / 100 Gi |
| 34 | + |
| 35 | +For broader infrastructure guidance and context on these sizes, see the GitGuardian Scaling guide: [Scaling](https://docs.gitguardian.com/self-hosting/management/infrastructure-management/scaling). |
| 36 | + |
| 37 | +You can customize storage classes, resource requests/limits, and replica counts by editing the values files or using `--set` overrides. |
| 38 | + |
| 39 | +### Prerequisites |
| 40 | + |
| 41 | +- Helm 3.x and `kubectl` configured against your target cluster |
| 42 | +- A default `StorageClass` or an explicit one you will set in values files |
| 43 | +- Cluster capacity matching the selected preset(s) |
| 44 | +- A Kubernetes namespace where PostgreSQL, Redis, and the GitGuardian application will be installed. |
| 45 | + - Example: `kubectl create ns gitguardian` |
| 46 | +- An image pull secret named `gim-replicated-registry` in `<namespace>` to download the PostgreSQL image: |
| 47 | + ```bash |
| 48 | + LICENSE_ID="<your_licenseID>" |
| 49 | + NAMESPACE=<namespace> |
| 50 | + echo "{\"auths\": {\"proxy.replicated.com\": {\"auth\": \"$(echo -n \"${LICENSE_ID}:${LICENSE_ID}\" | base64)\"}, \"registry.replicated.com\": {\"auth\": \"$(echo -n \"${LICENSE_ID}:${LICENSE_ID}\" | base64)\"}}}" > ~/.docker/config.json |
| 51 | + kubectl -n $NAMESPACE create secret generic gim-replicated-registry \ |
| 52 | + --from-file=.dockerconfigjson=$HOME/.docker/config.json \ |
| 53 | + --type=kubernetes.io/dockerconfigjson |
| 54 | + ``` |
| 55 | + - If you need help obtaining your LICENSE_ID, contact support at [email protected]. |
| 56 | + |
| 57 | +### Quick start |
| 58 | + |
| 59 | +Use the commands below to install Bitnami charts with the preset values files. Replace `<namespace>` accordingly. |
| 60 | + |
| 61 | +1) Add Bitnami repo (if not already added) and create/use a namespace: |
| 62 | + |
| 63 | +```bash |
| 64 | +helm repo add bitnami https://charts.bitnami.com/bitnami && helm repo update |
| 65 | +NAMESPACE=<namespace> |
| 66 | +kubectl get ns "$NAMESPACE" >/dev/null 2>&1 || kubectl create ns "$NAMESPACE" |
| 67 | +``` |
| 68 | + |
| 69 | +2) Optional: customize a values file |
| 70 | + |
| 71 | +Edit the YAML presets under `values/postgres/` (and `values/redis/` later) to fit your environment. Typical edits include `auth.username`, `auth.database`, `persistence.storageClass`, `persistence.size`, and `resources`. |
| 72 | + |
| 73 | +3) Install PostgreSQL (choose topology and size): |
| 74 | + |
| 75 | +```bash |
| 76 | +# Standalone (PoC/testing) - small preset |
| 77 | +helm upgrade --install pg bitnami/postgresql \ |
| 78 | + -n "$NAMESPACE" \ |
| 79 | + -f helm-pg-redis/values/postgres/common.yaml \ |
| 80 | + -f helm-pg-redis/values/postgres/standalone-small.yaml \ |
| 81 | + --wait |
| 82 | + |
| 83 | +# HA (recommended for production) - medium preset |
| 84 | +helm upgrade --install pg bitnami/postgresql \ |
| 85 | + -n "$NAMESPACE" \ |
| 86 | + -f helm-pg-redis/values/postgres/common.yaml \ |
| 87 | + -f helm-pg-redis/values/postgres/ha-medium.yaml \ |
| 88 | + --wait |
| 89 | +``` |
| 90 | + |
| 91 | +4) Install Redis (choose size): |
| 92 | + |
| 93 | +```bash |
| 94 | +# Standalone - small preset |
| 95 | +helm upgrade --install redis bitnami/redis \ |
| 96 | + -n "$NAMESPACE" \ |
| 97 | + -f helm-pg-redis/values/redis/common.yaml \ |
| 98 | + -f helm-pg-redis/values/redis/standalone-small.yaml \ |
| 99 | + --wait |
| 100 | + |
| 101 | +# Standalone - large preset |
| 102 | +helm upgrade --install redis bitnami/redis \ |
| 103 | + -n "$NAMESPACE" \ |
| 104 | + -f helm-pg-redis/values/redis/common.yaml \ |
| 105 | + -f helm-pg-redis/values/redis/standalone-large.yaml \ |
| 106 | + --wait |
| 107 | +``` |
| 108 | + |
| 109 | +5) Retrieve credentials and assemble connection strings: |
| 110 | + |
| 111 | +```bash |
| 112 | +NAMESPACE="$NAMESPACE" |
| 113 | + |
| 114 | +# PostgreSQL |
| 115 | +PG_RELEASE=pg |
| 116 | +PG_PRIMARY_SERVICE="$PG_RELEASE-postgresql" |
| 117 | +PG_PASSWORD=$(kubectl get secret -n "$NAMESPACE" "$PG_RELEASE-postgresql" -o jsonpath='{.data.postgres-password}' | base64 -d) |
| 118 | +# Optional app user password if set via auth.password |
| 119 | +PG_APP_PASSWORD=$(kubectl get secret -n "$NAMESPACE" "$PG_RELEASE-postgresql" -o jsonpath='{.data.password}' 2>/dev/null | base64 -d || true) |
| 120 | + |
| 121 | +echo "PostgreSQL host: $PG_PRIMARY_SERVICE.$NAMESPACE.svc.cluster.local:5432" |
| 122 | +echo "PostgreSQL postgres user password: $PG_PASSWORD" |
| 123 | +echo "PostgreSQL app user password (if configured): ${PG_APP_PASSWORD:-<not-set>}" |
| 124 | + |
| 125 | +# Redis |
| 126 | +REDIS_RELEASE=redis |
| 127 | +REDIS_SERVICE="$REDIS_RELEASE-redis-master" # standalone/replication master service |
| 128 | +REDIS_PASSWORD=$(kubectl get secret -n "$NAMESPACE" "$REDIS_RELEASE-redis" -o jsonpath='{.data.redis-password}' | base64 -d) |
| 129 | + |
| 130 | +echo "Redis host: $REDIS_SERVICE.$NAMESPACE.svc.cluster.local:6379" |
| 131 | +echo "Redis password: $REDIS_PASSWORD" |
| 132 | +``` |
| 133 | + |
| 134 | +### Using with GitGuardian |
| 135 | + |
| 136 | +Provide these connection details to the GitGuardian application (via your Helm values for the GitGuardian chart, KOTS config, or environment): |
| 137 | + |
| 138 | +For deploying GitGuardian in an existing Kubernetes cluster using Helm, follow the official guide: [Helm-based installation](https://docs.gitguardian.com/self-hosting/installation/installation-existing-helm). |
| 139 | + |
| 140 | +- PostgreSQL |
| 141 | + - Note: The values below are example defaults and can be customized via `auth.username`, `auth.database`, and optionally `auth.password` in the values files. |
| 142 | + - Host: `<pg-release>-postgresql.<namespace>.svc.cluster.local` |
| 143 | + - Port: `5432` |
| 144 | + - Database: `gitguardian-db` (if using the provided values) |
| 145 | + - Username: `gitguardian-user` (if using the provided values) or `postgres` |
| 146 | + - Password: from secret above |
| 147 | + - Example URL: `postgresql://gitguardian-user:<password>@<host>:5432/gitguardian-db` |
| 148 | + |
| 149 | +- Redis |
| 150 | + - Host: `<redis-release>-redis-master.<namespace>.svc.cluster.local` |
| 151 | + - Port: `6379` |
| 152 | + - Password: from secret above |
| 153 | + - Example URL: `redis://:<password>@<host>:6379/0` |
| 154 | + |
| 155 | +If you use the PostgreSQL HA presets, the read service is also available (Bitnami creates a `-read` service for replicas). GitGuardian generally needs a single primary endpoint for writes; configure read/write splitting only if supported and desired within your environment. |
| 156 | + |
| 157 | +### Uninstall |
| 158 | + |
| 159 | +Replace $NAMESPACE accordingly. |
| 160 | + |
| 161 | +```bash |
| 162 | +helm uninstall pg -n $NAMESPACE || true |
| 163 | +helm uninstall redis -n $NAMESPACE || true |
| 164 | +``` |
| 165 | + |
| 166 | +This deletes only the Helm releases. PersistentVolumes may remain depending on your `reclaimPolicy` and release settings. |
0 commit comments