Skip to content

Commit e6bf5e2

Browse files
QuentinBissonQuentinBisson
authored
Improve CNPG templating (#428)
* Improve CNPG templating * Refactor object store credentials handling
1 parent 31b6d79 commit e6bf5e2

File tree

7 files changed

+117
-98
lines changed

7 files changed

+117
-98
lines changed

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
### Changed
11+
12+
- Improve CNPG templates.
13+
1014
## [2.33.0] - 2026-03-02
1115

1216
### Changed

‎helm/grafana/templates/cnpg/_helpers.tpl‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{{/*
2+
Object store credentials for CNPG barman-cloud ObjectStore resources.
3+
4+
Outputs the appropriate credentials block based on the configured storage type.
5+
Intended to be called with `{{- include "grafana.cnpg.objectStoreCredentials" . | nindent 4 }}`.
6+
7+
Credential paths:
8+
9+
S3 with explicit keys:
10+
Condition: objectStorage.type == "s3" AND s3.accessKeyId AND s3.secretAccessKey are set
11+
Use case: customers providing their own S3 bucket with static credentials
12+
Source: the <cluster-name>-access-keys Secret (rendered by access-keys-secret.yaml)
13+
14+
S3 with IRSA:
15+
Condition: objectStorage.type == "s3", no explicit keys
16+
Use case: AWS/CAPA clusters with an IAM role configured for the CNPG service account
17+
Source: pod's IAM role via IRSA (no secret needed)
18+
19+
Azure with Crossplane:
20+
Condition: objectStorage.type == "azure" AND crossplane.azure.enabled == true
21+
Use case: CAPZ clusters where Crossplane provisions the storage account
22+
Source: connection string from the Crossplane-generated secret
23+
(key: attribute.primary_blob_connection_string)
24+
25+
Azure manual:
26+
Condition: objectStorage.type == "azure", Crossplane not enabled
27+
Use case: non-Crossplane Azure installs with an existing storage account
28+
Source: azureCredentials passthrough from objectStorage.azure.credentials
29+
*/}}
30+
{{- define "grafana.cnpg.objectStoreCredentials" -}}
31+
{{- if eq .Values.postgresqlCluster.objectStorage.type "s3" }}
32+
{{- if and .Values.postgresqlCluster.objectStorage.s3.accessKeyId .Values.postgresqlCluster.objectStorage.s3.secretAccessKey }}
33+
endpointURL: {{ .Values.postgresqlCluster.objectStorage.s3.endpointURL }}
34+
s3Credentials:
35+
region: {{ .Values.postgresqlCluster.objectStorage.s3.region }}
36+
accessKeyId:
37+
name: {{ .Values.postgresqlCluster.name }}-access-keys
38+
key: ACCESS_KEY_ID
39+
secretAccessKey:
40+
name: {{ .Values.postgresqlCluster.name }}-access-keys
41+
key: SECRET_ACCESS_KEY
42+
{{- else }}
43+
s3Credentials:
44+
inheritFromIAMRole: true
45+
{{- end }}
46+
{{- else if eq .Values.postgresqlCluster.objectStorage.type "azure" }}
47+
{{- if .Values.postgresqlCluster.crossplane.azure.enabled }}
48+
azureCredentials:
49+
connectionString:
50+
name: {{ .Values.postgresqlCluster.crossplane.azure.container.name }}
51+
key: attribute.primary_blob_connection_string
52+
{{- else }}
53+
{{- with .Values.postgresqlCluster.objectStorage.azure.credentials }}
54+
azureCredentials:
55+
{{- toYaml . | nindent 2 }}
56+
{{- end }}
57+
{{- end }}
58+
{{- else }}
59+
{{- fail "Unsupported object storage type. Supported types are 's3' and 'azure'." }}
60+
{{- end }}
61+
{{- end -}}

‎helm/grafana/templates/cnpg/bucket.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
# TODO remove once we have migrated onprem clusters to use crossplane for bucket management
2+
13
{{- if and (.Values.postgresqlCluster.enabled) (and (.Values.postgresqlCluster.backup.enabled) (.Values.postgresqlCluster.objectStorage.bucket.create)) }}
24
apiVersion: objectstorage.giantswarm.io/v1alpha1
35
kind: Bucket

‎helm/grafana/templates/cnpg/objectstore-backup.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{{- if and .Values.postgresqlCluster.enabled .Values.postgresqlCluster.backup.enabled }}
2+
---
3+
apiVersion: barmancloud.cnpg.io/v1
4+
kind: ObjectStore
5+
metadata:
6+
labels:
7+
{{- include "grafana.labels" . | nindent 4 }}
8+
observability.giantswarm.io/tenant: giantswarm
9+
name: {{ .Values.postgresqlCluster.name }}-objectstore-backup
10+
namespace: {{ .Release.Namespace }}
11+
spec:
12+
configuration:
13+
destinationPath: {{ .Values.postgresqlCluster.backup.destinationPath | quote }}
14+
{{- include "grafana.cnpg.objectStoreCredentials" . | nindent 4 }}
15+
wal:
16+
compression: gzip
17+
retentionPolicy: {{ .Values.postgresqlCluster.backup.retentionPolicy | quote }}
18+
{{- end }}

‎helm/grafana/templates/cnpg/objectstore-recovery.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{{- if and .Values.postgresqlCluster.enabled .Values.postgresqlCluster.recovery.enabled }}
2+
---
3+
apiVersion: barmancloud.cnpg.io/v1
4+
kind: ObjectStore
5+
metadata:
6+
labels:
7+
{{- include "grafana.labels" . | nindent 4 }}
8+
observability.giantswarm.io/tenant: giantswarm
9+
name: {{ .Values.postgresqlCluster.name }}-objectstore-recovery
10+
namespace: {{ .Release.Namespace }}
11+
spec:
12+
configuration:
13+
destinationPath: {{ .Values.postgresqlCluster.recovery.destinationPath | quote }}
14+
{{- include "grafana.cnpg.objectStoreCredentials" . | nindent 4 }}
15+
wal:
16+
compression: gzip
17+
{{- end }}

‎helm/grafana/templates/cnpg/objectstores.yaml‎

Lines changed: 0 additions & 91 deletions
This file was deleted.

‎helm/grafana/values.yaml‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -59,15 +59,23 @@ postgresqlCluster:
5959
accessKeyId: ""
6060
secretAccessKey: ""
6161
azure:
62-
#-- For Azure object storage access
63-
# storageAccount:
64-
# name: storageAccountName
65-
# key: accountName
66-
# storageKey:
67-
# name: storageKeyName
68-
# key: accountKey
62+
#-- Azure object storage credentials. Two paths are supported:
63+
#
64+
# Crossplane (CAPZ): set crossplane.azure.enabled: true. Credentials are
65+
# auto-configured from the Crossplane-generated connection secret
66+
# (key: attribute.primary_blob_connection_string). No manual input needed.
67+
#
68+
# Manual (non-Crossplane): provide explicit secret references, e.g.:
69+
# credentials:
70+
# storageAccount:
71+
# name: <secret-name>
72+
# key: <key-holding-account-name>
73+
# storageKey:
74+
# name: <secret-name>
75+
# key: <key-holding-account-key>
6976
credentials: {}
7077
#-- Bucket CR config
78+
# TODO remove once we have migrated onprem clusters to use crossplane for bucket management
7179
bucket:
7280
create: false
7381
name: "giantswarm-installationName-grafana-postgresql"

0 commit comments

Comments
 (0)