Skip to content

Commit 4d89690

Browse files
nemernanemerna
authored
refactor: update PostgreSQL configuration to use CloudNativePG (#165)
- Removed PostgreSQL Helm dependency and updated documentation to reflect the use of CloudNativePG operator. - Refactored values.yaml, values-dev.yaml, and values-prod.yaml to align with new PostgreSQL configuration structure. - Updated helper functions in _helpers.tpl to accommodate changes in PostgreSQL settings. - Adjusted secret.yaml to reflect the new configuration logic for PostgreSQL.
1 parent 8a94589 commit 4d89690

File tree

10 files changed

+131
-150
lines changed

10 files changed

+131
-150
lines changed

‎deploy/Makefile‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -96,8 +96,6 @@ deploy-prod: ## Deploy to production environment (sast-ai-prod namespace)
9696

9797
.PHONY: _deploy
9898
_deploy: ## Internal deployment target
99-
@helm repo add bitnami https://charts.bitnami.com/bitnami >/dev/null 2>&1 || true
100-
@helm repo update >/dev/null 2>&1
10199
@cd $(CHART_PATH) && helm dependency update
102100
@helm install $(RELEASE_NAME) $(CHART_PATH) \
103101
-f $(CHART_PATH)/values.yaml \
@@ -129,8 +127,6 @@ upgrade-prod: ## Upgrade production deployment
129127

130128
.PHONY: _upgrade
131129
_upgrade: ## Internal upgrade target
132-
@helm repo add bitnami https://charts.bitnami.com/bitnami >/dev/null 2>&1 || true
133-
@helm repo update >/dev/null 2>&1
134130
@cd $(CHART_PATH) && helm dependency update
135131
@helm upgrade $(RELEASE_NAME) $(CHART_PATH) \
136132
-f $(CHART_PATH)/values.yaml \
@@ -182,8 +178,9 @@ status: ## Show deployment status
182178
.PHONY: wait-pods
183179
wait-pods: ## Wait for pods to be ready
184180
@echo "Waiting for SAST AI to be ready..."
185-
@echo "Checking PostgreSQL database..."
186-
@$(KUBECTL_CMD) wait --for=condition=ready pod -l app.kubernetes.io/name=postgresql -n $(NAMESPACE) --timeout=300s
181+
@echo "Checking CloudNativePG PostgreSQL cluster..."
182+
@$(KUBECTL_CMD) wait --for=condition=ready cluster $(RELEASE_NAME)-db -n $(NAMESPACE) --timeout=300s 2>/dev/null || \
183+
$(KUBECTL_CMD) wait --for=condition=ready pod -l cnpg.io/cluster=$(RELEASE_NAME)-db -n $(NAMESPACE) --timeout=300s
187184
@echo "Database is ready!"
188185
@echo "Checking SAST AI application..."
189186
@$(KUBECTL_CMD) wait --for=condition=ready pod -l app.kubernetes.io/name=sast-ai -n $(NAMESPACE) --timeout=300s

‎deploy/sast-ai-chart/Chart.yaml‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,8 @@ sources:
1717
maintainers:
1818
- name: SAST AI Team
1919
email: sast-ai@redhat.com
20-
dependencies:
21-
- name: postgresql
22-
version: 15.5.38
23-
repository: "https://charts.bitnami.com/bitnami"
24-
condition: postgresql.enabled
20+
# CloudNativePG is deployed via operator CRD - no Helm dependency needed
21+
# The CloudNativePG operator must be installed in the cluster beforehand
2522
annotations:
2623
category: Developer Tools
2724
licenses: Apache-2.0

‎deploy/sast-ai-chart/templates/_helpers.tpl‎

Lines changed: 31 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -76,11 +76,29 @@ Create the name of the configmap to use
7676
{{- end }}
7777

7878
{{/*
79-
PostgreSQL hostname
79+
PostgreSQL cluster name
80+
*/}}
81+
{{- define "sast-ai.postgres.clusterName" -}}
82+
{{- printf "%s-db" (include "sast-ai.fullname" .) }}
83+
{{- end }}
84+
85+
{{/*
86+
PostgreSQL hostname - CloudNativePG creates a service with -rw suffix for read-write access
8087
*/}}
8188
{{- define "sast-ai.postgresql.host" -}}
82-
{{- if .Values.postgresql.enabled }}
83-
{{- printf "%s-postgresql" .Release.Name }}
89+
{{- if .Values.postgres.enabled }}
90+
{{- printf "%s-rw" (include "sast-ai.postgres.clusterName" .) }}
91+
{{- else }}
92+
{{- .Values.externalDatabase.host }}
93+
{{- end }}
94+
{{- end }}
95+
96+
{{/*
97+
PostgreSQL read-only hostname - CloudNativePG creates a service with -ro suffix for read-only access
98+
*/}}
99+
{{- define "sast-ai.postgresql.hostReadOnly" -}}
100+
{{- if .Values.postgres.enabled }}
101+
{{- printf "%s-ro" (include "sast-ai.postgres.clusterName" .) }}
84102
{{- else }}
85103
{{- .Values.externalDatabase.host }}
86104
{{- end }}
@@ -90,7 +108,7 @@ PostgreSQL hostname
90108
PostgreSQL port
91109
*/}}
92110
{{- define "sast-ai.postgresql.port" -}}
93-
{{- if .Values.postgresql.enabled }}
111+
{{- if .Values.postgres.enabled }}
94112
{{- 5432 }}
95113
{{- else }}
96114
{{- .Values.externalDatabase.port }}
@@ -101,8 +119,8 @@ PostgreSQL port
101119
PostgreSQL database name
102120
*/}}
103121
{{- define "sast-ai.postgresql.database" -}}
104-
{{- if .Values.postgresql.enabled }}
105-
{{- .Values.postgresql.auth.database }}
122+
{{- if .Values.postgres.enabled }}
123+
{{- .Values.postgres.database }}
106124
{{- else }}
107125
{{- .Values.externalDatabase.database }}
108126
{{- end }}
@@ -112,19 +130,20 @@ PostgreSQL database name
112130
PostgreSQL username
113131
*/}}
114132
{{- define "sast-ai.postgresql.username" -}}
115-
{{- if .Values.postgresql.enabled }}
116-
{{- .Values.postgresql.auth.username }}
133+
{{- if .Values.postgres.enabled }}
134+
{{- .Values.postgres.username }}
117135
{{- else }}
118136
{{- .Values.externalDatabase.username }}
119137
{{- end }}
120138
{{- end }}
121139

122140
{{/*
123141
PostgreSQL password secret name
142+
CloudNativePG creates a secret named {cluster-name}-app with all connection details
124143
*/}}
125144
{{- define "sast-ai.postgresql.secretName" -}}
126-
{{- if .Values.postgresql.enabled }}
127-
{{- printf "%s-postgresql" .Release.Name }}
145+
{{- if .Values.postgres.enabled }}
146+
{{- printf "%s-app" (include "sast-ai.postgres.clusterName" .) }}
128147
{{- else }}
129148
{{- if .Values.externalDatabase.existingSecret }}
130149
{{- .Values.externalDatabase.existingSecret }}
@@ -136,9 +155,10 @@ PostgreSQL password secret name
136155

137156
{{/*
138157
PostgreSQL password secret key
158+
CloudNativePG uses 'password' as the key in the app secret
139159
*/}}
140160
{{- define "sast-ai.postgresql.secretKey" -}}
141-
{{- if .Values.postgresql.enabled }}
161+
{{- if .Values.postgres.enabled }}
142162
{{- "password" }}
143163
{{- else }}
144164
{{- if .Values.externalDatabase.existingSecretPasswordKey }}
@@ -157,10 +177,3 @@ Common annotations
157177
{{ toYaml . }}
158178
{{- end }}
159179
{{- end }}
160-
161-
{{/*
162-
PostgreSQL service account name
163-
*/}}
164-
{{- define "sast-ai.postgresql.serviceAccountName" -}}
165-
{{- printf "%s-postgresql" (include "sast-ai.fullname" .) }}
166-
{{- end }}

‎deploy/sast-ai-chart/templates/cnpg-cluster.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{{- if .Values.postgres.enabled }}
2+
apiVersion: postgresql.cnpg.io/v1
3+
kind: Cluster
4+
metadata:
5+
name: {{ include "sast-ai.fullname" . }}-db
6+
labels:
7+
{{- include "sast-ai.labels" . | nindent 4 }}
8+
app.kubernetes.io/component: database
9+
{{- with (include "sast-ai.annotations" .) }}
10+
annotations:
11+
{{- . | nindent 4 }}
12+
{{- end }}
13+
spec:
14+
description: "PostgreSQL database for SAST AI Orchestrator"
15+
imageName: ghcr.io/cloudnative-pg/postgresql:{{ .Values.postgres.version }}
16+
instances: {{ .Values.postgres.instances }}
17+
18+
# Primary update strategy
19+
primaryUpdateStrategy: unsupervised
20+
primaryUpdateMethod: switchover
21+
22+
# Bootstrap configuration
23+
bootstrap:
24+
initdb:
25+
database: {{ .Values.postgres.database }}
26+
owner: {{ .Values.postgres.username }}
27+
28+
# Storage configuration
29+
storage:
30+
size: {{ .Values.postgres.storage.size }}
31+
{{- if .Values.postgres.storage.storageClass }}
32+
storageClass: {{ .Values.postgres.storage.storageClass }}
33+
{{- end }}
34+
35+
# Resource configuration
36+
resources:
37+
{{- toYaml .Values.postgres.resources | nindent 4 }}
38+
39+
# OpenShift specific: Let the operator handle security contexts
40+
enableSuperuserAccess: false
41+
{{- end }}

‎deploy/sast-ai-chart/templates/postgresql-serviceaccount.yaml‎

Lines changed: 0 additions & 34 deletions
This file was deleted.

‎deploy/sast-ai-chart/templates/postgresql.yaml‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎deploy/sast-ai-chart/templates/secret.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if and (not .Values.postgresql.enabled) (not .Values.externalDatabase.existingSecret) -}}
1+
{{- if and (not .Values.postgres.enabled) (not .Values.externalDatabase.existingSecret) -}}
22
apiVersion: v1
33
kind: Secret
44
metadata:

‎deploy/sast-ai-chart/values-dev.yaml‎

Lines changed: 11 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -39,24 +39,17 @@ route:
3939
annotations:
4040
haproxy.router.openshift.io/timeout: 60s
4141

42-
## PostgreSQL configuration - smaller resources for dev
43-
postgresql:
44-
auth:
45-
postgresPassword: "postgres-dev"
46-
username: "quarkus"
47-
password: "quarkus"
48-
database: "sast-ai"
49-
primary:
50-
persistence:
51-
enabled: true
52-
size: 4Gi # Smaller storage for dev
53-
resources:
54-
limits:
55-
cpu: 250m
56-
memory: 256Mi
57-
requests:
58-
cpu: 100m
59-
memory: 128Mi
42+
## PostgreSQL configuration - dev sizing
43+
postgres:
44+
storage:
45+
size: 4Gi
46+
resources:
47+
limits:
48+
cpu: 250m
49+
memory: 256Mi
50+
requests:
51+
cpu: 100m
52+
memory: 128Mi
6053

6154
## Horizontal Pod Autoscaler - disabled for dev
6255
hpa:

‎deploy/sast-ai-chart/values-prod.yaml‎

Lines changed: 11 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -40,23 +40,17 @@ route:
4040
haproxy.router.openshift.io/timeout: 300s
4141

4242
## PostgreSQL configuration - production sizing
43-
postgresql:
44-
auth:
45-
postgresPassword: "postgres-prod-secure"
46-
username: "quarkus"
47-
password: "quarkus-prod-secure"
48-
database: "sast-ai-prod"
49-
primary:
50-
persistence:
51-
enabled: true
52-
size: 20Gi # Larger storage for prod
53-
resources:
54-
limits:
55-
cpu: 1000m
56-
memory: 1Gi
57-
requests:
58-
cpu: 500m
59-
memory: 512Mi
43+
postgres:
44+
database: "sast-ai-prod"
45+
storage:
46+
size: 20Gi
47+
resources:
48+
limits:
49+
cpu: 1000m
50+
memory: 1Gi
51+
requests:
52+
cpu: 500m
53+
memory: 512Mi
6054

6155
## Horizontal Pod Autoscaler - enabled for prod
6256
hpa:

‎deploy/sast-ai-chart/values.yaml‎

Lines changed: 31 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -74,50 +74,38 @@ route:
7474
insecureEdgeTerminationPolicy: Redirect
7575
annotations: {}
7676

77-
## PostgreSQL configuration (base settings)
78-
postgresql:
77+
## PostgreSQL configuration (CloudNativePG)
78+
## Requires CloudNativePG operator to be installed in the cluster
79+
## See: https://cloudnative-pg.io/
80+
postgres:
81+
# Enable/disable PostgreSQL deployment
7982
enabled: true
80-
# Pin PostgreSQL image version for stability and reproducibility
81-
# Prevents unexpected version changes during deployments
82-
image:
83-
registry: docker.io
84-
repository: bitnamilegacy/postgresql
85-
tag: "16.4.0-debian-12-r14"
86-
# Inherit labels from parent chart for proper cleanup
87-
commonLabels:
88-
app.kubernetes.io/name: "{{ include \"sast-ai.name\" . }}"
89-
app.kubernetes.io/instance: "{{ .Release.Name }}"
90-
app.kubernetes.io/version: "{{ .Chart.AppVersion }}"
91-
app.kubernetes.io/managed-by: "{{ .Release.Service }}"
92-
primary:
93-
persistence:
94-
enabled: true
95-
size: 8Gi
96-
storageClass: ""
97-
resources:
98-
limits:
99-
cpu: 500m
100-
memory: 512Mi
101-
requests:
102-
cpu: 250m
103-
memory: 256Mi
104-
# OpenShift compatibility
105-
podSecurityContext:
106-
enabled: false
107-
containerSecurityContext:
108-
enabled: false
109-
# Use dedicated service account for PostgreSQL with anyuid SCC
110-
serviceAccount:
111-
create: false
112-
name: "" # Will be overridden in the postgresql template
113-
# OpenShift compatibility settings
114-
volumePermissions:
115-
enabled: false
116-
shmVolume:
117-
chmod:
118-
enabled: false
119-
120-
## External PostgreSQL configuration (when postgresql.enabled is false)
83+
84+
# PostgreSQL version
85+
version: "16.4"
86+
87+
# Number of instances (1 = standalone, 2+ = HA with streaming replication)
88+
instances: 1
89+
90+
# Database and user configuration
91+
database: "sast-ai"
92+
username: "quarkus"
93+
94+
# Storage size
95+
storage:
96+
size: 8Gi
97+
storageClass: "" # Use default storage class if empty
98+
99+
# Resource configuration
100+
resources:
101+
limits:
102+
cpu: 500m
103+
memory: 512Mi
104+
requests:
105+
cpu: 250m
106+
memory: 256Mi
107+
108+
## External PostgreSQL configuration (when postgres.enabled is false)
121109
externalDatabase:
122110
host: ""
123111
port: 5432

0 commit comments

Comments
 (0)