Skip to content

Commit 8e52252

Browse files
emmanuelmathotemmanuelmathot
committed
Refactor PostgreSQL configuration and remove deprecated database setup
- Introduced a unified PostgreSQL configuration structure in values.yaml, replacing the old db configuration. - Added new helper functions for managing PostgreSQL environment variables and secrets based on the selected configuration type (postgrescluster, external-plaintext, external-secret). - Removed old database-related templates (ConfigMap, Deployment, PVC, Secrets, Service) that are no longer needed. - Updated the pgstacbootstrap job and configmap templates to align with the new PostgreSQL configuration. - Implemented validation for PostgreSQL settings to ensure required fields are set based on the selected type.
1 parent e4bd39e commit 8e52252

File tree

10 files changed

+269
-277
lines changed

10 files changed

+269
-277
lines changed

‎helm-chart/eoapi/templates/_helpers.tpl‎

Lines changed: 215 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -62,63 +62,82 @@ Create the name of the service account to use
6262
{{- end }}
6363

6464
{{/*
65-
Secrets for postgres/postgis access have to be
66-
derived from what the crunchydata operator creates
65+
PostgreSQL environment variables based on the configured type
66+
*/}}
67+
{{- define "eoapi.postgresqlEnv" -}}
68+
{{- if eq .Values.postgresql.type "postgrescluster" }}
69+
{{- include "eoapi.postgresclusterSecrets" . }}
70+
{{- else if eq .Values.postgresql.type "external-plaintext" }}
71+
{{- include "eoapi.externalPlaintextPgSecrets" . }}
72+
{{- else if eq .Values.postgresql.type "external-secret" }}
73+
{{- include "eoapi.externalSecretPgSecrets" . }}
74+
{{- end }}
75+
{{- end }}
6776

68-
Also note that we want to use the pgbouncer-<port|host|uri>
69-
but currently it doesn't support `search_path` parameters
70-
(https://github.com/pgbouncer/pgbouncer/pull/73) which
71-
are required for much of *pgstac
77+
{{/*
78+
PostgreSQL cluster secrets
7279
*/}}
73-
{{- define "eoapi.pgstacSecrets" -}}
80+
{{- define "eoapi.postgresclusterSecrets" -}}
7481
{{- range $userName, $v := .Values.postgrescluster.users -}}
7582
{{/* do not render anything for the "postgres" user */}}
7683
{{- if not (eq (index $v "name") "postgres") }}
77-
- name: POSTGRES_USER
84+
# Standard PostgreSQL environment variables
85+
- name: PGUSER
7886
valueFrom:
7987
secretKeyRef:
8088
name: {{ $.Release.Name }}-pguser-{{ index $v "name" }}
8189
key: user
82-
- name: POSTGRES_PORT
90+
- name: PGPORT
8391
valueFrom:
8492
secretKeyRef:
8593
name: {{ $.Release.Name }}-pguser-{{ index $v "name" }}
8694
key: port
87-
- name: POSTGRES_HOST
95+
- name: PGHOST
8896
valueFrom:
8997
secretKeyRef:
9098
name: {{ $.Release.Name }}-pguser-{{ index $v "name" }}
9199
key: host
92-
- name: POSTGRES_HOST_READER
100+
- name: PGPASSWORD
93101
valueFrom:
94102
secretKeyRef:
95103
name: {{ $.Release.Name }}-pguser-{{ index $v "name" }}
96-
key: host
97-
- name: POSTGRES_HOST_WRITER
104+
key: password
105+
- name: PGDATABASE
98106
valueFrom:
99107
secretKeyRef:
100108
name: {{ $.Release.Name }}-pguser-{{ index $v "name" }}
101-
key: host
102-
- name: POSTGRES_PASS
109+
key: dbname
110+
- name: PGBOUNCER_URI
103111
valueFrom:
104112
secretKeyRef:
105113
name: {{ $.Release.Name }}-pguser-{{ index $v "name" }}
106-
key: password
107-
- name: POSTGRES_DBNAME
114+
key: pgbouncer-uri
115+
# Legacy variables for backward compatibility
116+
- name: POSTGRES_USER
108117
valueFrom:
109118
secretKeyRef:
110119
name: {{ $.Release.Name }}-pguser-{{ index $v "name" }}
111-
key: dbname
112-
- name: PGBOUNCER_URI
120+
key: user
121+
- name: POSTGRES_PORT
113122
valueFrom:
114123
secretKeyRef:
115124
name: {{ $.Release.Name }}-pguser-{{ index $v "name" }}
116-
key: pgbouncer-uri
117-
- name: DATABASE_URL
125+
key: port
126+
- name: POSTGRES_HOST
118127
valueFrom:
119128
secretKeyRef:
120129
name: {{ $.Release.Name }}-pguser-{{ index $v "name" }}
121-
key: uri
130+
key: host
131+
- name: POSTGRES_PASS
132+
valueFrom:
133+
secretKeyRef:
134+
name: {{ $.Release.Name }}-pguser-{{ index $v "name" }}
135+
key: password
136+
- name: POSTGRES_DBNAME
137+
valueFrom:
138+
secretKeyRef:
139+
name: {{ $.Release.Name }}-pguser-{{ index $v "name" }}
140+
key: dbname
122141
{{- end }}
123142
{{- end }}
124143
- name: PGADMIN_URI
@@ -128,6 +147,180 @@ are required for much of *pgstac
128147
key: uri
129148
{{- end }}
130149

150+
{{/*
151+
External PostgreSQL with plaintext credentials
152+
*/}}
153+
{{- define "eoapi.externalPlaintextPgSecrets" -}}
154+
# Standard PostgreSQL environment variables
155+
- name: PGUSER
156+
value: {{ .Values.postgresql.external.credentials.username | quote }}
157+
- name: PGPORT
158+
value: {{ .Values.postgresql.external.port | quote }}
159+
- name: PGHOST
160+
value: {{ .Values.postgresql.external.host | quote }}
161+
- name: PGPASSWORD
162+
value: {{ .Values.postgresql.external.credentials.password | quote }}
163+
- name: PGDATABASE
164+
value: {{ .Values.postgresql.external.database | quote }}
165+
# Legacy variables for backward compatibility
166+
- name: POSTGRES_USER
167+
value: {{ .Values.postgresql.external.credentials.username | quote }}
168+
- name: POSTGRES_PORT
169+
value: {{ .Values.postgresql.external.port | quote }}
170+
- name: POSTGRES_HOST
171+
value: {{ .Values.postgresql.external.host | quote }}
172+
- name: POSTGRES_PASS
173+
value: {{ .Values.postgresql.external.credentials.password | quote }}
174+
- name: POSTGRES_DBNAME
175+
value: {{ .Values.postgresql.external.database | quote }}
176+
{{- end }}
177+
178+
{{/*
179+
External PostgreSQL with secret credentials
180+
*/}}
181+
{{- define "eoapi.externalSecretPgSecrets" -}}
182+
# Standard PostgreSQL environment variables
183+
- name: PGUSER
184+
valueFrom:
185+
secretKeyRef:
186+
name: {{ .Values.postgresql.external.existingSecret.name }}
187+
key: {{ .Values.postgresql.external.existingSecret.keys.username }}
188+
- name: PGPASSWORD
189+
valueFrom:
190+
secretKeyRef:
191+
name: {{ .Values.postgresql.external.existingSecret.name }}
192+
key: {{ .Values.postgresql.external.existingSecret.keys.password }}
193+
# Legacy variables for backward compatibility
194+
- name: POSTGRES_USER
195+
valueFrom:
196+
secretKeyRef:
197+
name: {{ .Values.postgresql.external.existingSecret.name }}
198+
key: {{ .Values.postgresql.external.existingSecret.keys.username }}
199+
- name: POSTGRES_PASS
200+
valueFrom:
201+
secretKeyRef:
202+
name: {{ .Values.postgresql.external.existingSecret.name }}
203+
key: {{ .Values.postgresql.external.existingSecret.keys.password }}
204+
205+
# Host, port, and database can be from the secret or from values
206+
{{- if .Values.postgresql.external.existingSecret.keys.host }}
207+
- name: PGHOST
208+
valueFrom:
209+
secretKeyRef:
210+
name: {{ .Values.postgresql.external.existingSecret.name }}
211+
key: {{ .Values.postgresql.external.existingSecret.keys.host }}
212+
- name: POSTGRES_HOST
213+
valueFrom:
214+
secretKeyRef:
215+
name: {{ .Values.postgresql.external.existingSecret.name }}
216+
key: {{ .Values.postgresql.external.existingSecret.keys.host }}
217+
{{- else }}
218+
- name: PGHOST
219+
value: {{ .Values.postgresql.external.host | quote }}
220+
- name: POSTGRES_HOST
221+
value: {{ .Values.postgresql.external.host | quote }}
222+
{{- end }}
223+
224+
{{- if .Values.postgresql.external.existingSecret.keys.port }}
225+
- name: PGPORT
226+
valueFrom:
227+
secretKeyRef:
228+
name: {{ .Values.postgresql.external.existingSecret.name }}
229+
key: {{ .Values.postgresql.external.existingSecret.keys.port }}
230+
- name: POSTGRES_PORT
231+
valueFrom:
232+
secretKeyRef:
233+
name: {{ .Values.postgresql.external.existingSecret.name }}
234+
key: {{ .Values.postgresql.external.existingSecret.keys.port }}
235+
{{- else }}
236+
- name: PGPORT
237+
value: {{ .Values.postgresql.external.port | quote }}
238+
- name: POSTGRES_PORT
239+
value: {{ .Values.postgresql.external.port | quote }}
240+
{{- end }}
241+
242+
{{- if .Values.postgresql.external.existingSecret.keys.database }}
243+
- name: PGDATABASE
244+
valueFrom:
245+
secretKeyRef:
246+
name: {{ .Values.postgresql.external.existingSecret.name }}
247+
key: {{ .Values.postgresql.external.existingSecret.keys.database }}
248+
- name: POSTGRES_DBNAME
249+
valueFrom:
250+
secretKeyRef:
251+
name: {{ .Values.postgresql.external.existingSecret.name }}
252+
key: {{ .Values.postgresql.external.existingSecret.keys.database }}
253+
{{- else }}
254+
- name: PGDATABASE
255+
value: {{ .Values.postgresql.external.database | quote }}
256+
- name: POSTGRES_DBNAME
257+
value: {{ .Values.postgresql.external.database | quote }}
258+
{{- end }}
259+
{{- end }}
260+
261+
{{/*
262+
Validate PostgreSQL configuration
263+
*/}}
264+
{{- define "eoapi.validatePostgresql" -}}
265+
{{- if eq .Values.postgresql.type "postgrescluster" }}
266+
{{- if not .Values.postgrescluster.enabled }}
267+
{{- fail "When postgresql.type is 'postgrescluster', postgrescluster.enabled must be true" }}
268+
{{- end }}
269+
{{- include "eoapi.validatePostgresCluster" . }}
270+
{{- else if eq .Values.postgresql.type "external-plaintext" }}
271+
{{- if not .Values.postgresql.external.host }}
272+
{{- fail "When postgresql.type is 'external-plaintext', postgresql.external.host must be set" }}
273+
{{- end }}
274+
{{- if not .Values.postgresql.external.credentials.username }}
275+
{{- fail "When postgresql.type is 'external-plaintext', postgresql.external.credentials.username must be set" }}
276+
{{- end }}
277+
{{- if not .Values.postgresql.external.credentials.password }}
278+
{{- fail "When postgresql.type is 'external-plaintext', postgresql.external.credentials.password must be set" }}
279+
{{- end }}
280+
{{- else if eq .Values.postgresql.type "external-secret" }}
281+
{{- if not .Values.postgresql.external.existingSecret.name }}
282+
{{- fail "When postgresql.type is 'external-secret', postgresql.external.existingSecret.name must be set" }}
283+
{{- end }}
284+
{{- if not .Values.postgresql.external.existingSecret.keys.username }}
285+
{{- fail "When postgresql.type is 'external-secret', postgresql.external.existingSecret.keys.username must be set" }}
286+
{{- end }}
287+
{{- if not .Values.postgresql.external.existingSecret.keys.password }}
288+
{{- fail "When postgresql.type is 'external-secret', postgresql.external.existingSecret.keys.password must be set" }}
289+
{{- end }}
290+
{{- if not .Values.postgresql.external.existingSecret.keys.host }}
291+
{{- if not .Values.postgresql.external.host }}
292+
{{- fail "When postgresql.type is 'external-secret' and existingSecret.keys.host is not set, postgresql.external.host must be set" }}
293+
{{- end }}
294+
{{- end }}
295+
{{- else }}
296+
{{- fail "postgresql.type must be one of: 'postgrescluster', 'external-plaintext', 'external-secret'" }}
297+
{{- end }}
298+
{{- end }}
299+
300+
{{/*
301+
Map legacy configuration to new postgresql configuration
302+
*/}}
303+
{{- define "eoapi.mapLegacyPostgresql" -}}
304+
{{- $postgresql := dict }}
305+
{{- if .Values.postgrescluster.enabled }}
306+
{{- $_ := set $postgresql "type" "postgrescluster" }}
307+
{{- else if .Values.db.enabled }}
308+
{{- $_ := set $postgresql "type" "external-plaintext" }}
309+
{{- $external := dict }}
310+
{{- $_ := set $external "host" .Values.db.settings.secrets.POSTGRES_HOST }}
311+
{{- $_ := set $external "port" .Values.db.settings.secrets.POSTGRES_PORT }}
312+
{{- $_ := set $external "database" .Values.db.settings.secrets.POSTGRES_DB }}
313+
{{- $credentials := dict }}
314+
{{- $_ := set $credentials "username" .Values.db.settings.secrets.POSTGRES_USER }}
315+
{{- $_ := set $credentials "password" .Values.db.settings.secrets.POSTGRES_PASSWORD }}
316+
{{- $_ := set $external "credentials" $credentials }}
317+
{{- $_ := set $postgresql "external" $external }}
318+
{{- else }}
319+
{{- $_ := set $postgresql "type" "postgrescluster" }}
320+
{{- end }}
321+
{{- $postgresql | toYaml }}
322+
{{- end }}
323+
131324
{{/*
132325
values.schema.json doesn't play nice combined value checks
133326
so we use this helper function to check autoscaling rules
@@ -192,17 +385,3 @@ that you can only use traefik as ingress when `testing=true`
192385
{{- end -}}
193386
194387
{{- end -}}
195-
196-
{{/*
197-
validate:
198-
that you cannot have db.enabled and (postgrescluster.enabled or pgstacBootstrap.enabled)
199-
*/}}
200-
{{- define "eoapi.validateTempDB" -}}
201-
{{- if and (.Values.db.enabled) (.Values.postgrescluster.enabled) -}}
202-
{{- fail "you cannot use have both db.enabled and postgresclsuter.enabled" -}}
203-
{{- end -}}
204-
{{- if and (.Values.db.enabled) (.Values.pgstacBootstrap.enabled) -}}
205-
{{- fail "you cannot use have both db.enabled and pgstacBootstrap.enabled" -}}
206-
{{- end -}}
207-
208-
{{- end -}}

‎helm-chart/eoapi/templates/db/configmap.yaml‎

Lines changed: 0 additions & 38 deletions
This file was deleted.

0 commit comments

Comments
 (0)