EE 2.0

Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 name: pgdog-control
 description: PgDog Control
 type: application
-version: 0.1.10
+version: 0.2.0
 appVersion: "v2026-04-06"

files/aws-iam-policy.json

@@ -0,0 +1,32 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "RdsTopology",
+      "Effect": "Allow",
+      "Action": [
+        "rds:DescribeDBClusters",
+        "rds:DescribeDBInstances",
+        "rds:DescribeDBClusterParameters",
+        "rds:DescribeDBParameters"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "CloudWatchMetrics",
+      "Effect": "Allow",
+      "Action": [
+        "cloudwatch:GetMetricData"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "Ec2InstanceTypeSpecs",
+      "Effect": "Allow",
+      "Action": [
+        "ec2:DescribeInstanceTypes"
+      ],
+      "Resource": "*"
+    }
+  ]
+}

templates/_helpers.tpl

@@ -0,0 +1,110 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "pgdog-control.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+Truncated at 63 chars per the DNS naming spec.
+*/}}
+{{- define "pgdog-control.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Chart name and version, as used by the helm.sh/chart label.
+*/}}
+{{- define "pgdog-control.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Resource names for each component (preserve existing names for compatibility).
+*/}}
+{{- define "pgdog-control.control.fullname" -}}
+{{- printf "%s-control" .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Name for resources shared across releases — cluster-scoped objects
+(ClusterRole, ClusterRoleBinding) and the namespaced Role/RoleBinding
+written into each writeNamespace, which is reachable by every install
+of this chart. Includes the release namespace so multiple installs on
+the same cluster don't collide.
+*/}}
+{{- define "pgdog-control.control.clusterFullname" -}}
+{{- printf "%s-%s-control" .Release.Name .Release.Namespace | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "pgdog-control.redis.fullname" -}}
+{{- printf "%s-redis" .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+ServiceAccount name for the control component. Falls back to the
+control fullname when not explicitly set in values.
+*/}}
+{{- define "pgdog-control.control.serviceAccountName" -}}
+{{- if .Values.control.rbac.serviceAccountName }}
+{{- .Values.control.rbac.serviceAccountName }}
+{{- else }}
+{{- include "pgdog-control.control.fullname" . }}
+{{- end }}
+{{- end }}
+
+{{/*
+Common labels shared by all resources.
+*/}}
+{{- define "pgdog-control.commonLabels" -}}
+helm.sh/chart: {{ include "pgdog-control.chart" . }}
+app.kubernetes.io/part-of: {{ include "pgdog-control.name" . }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- end }}
+
+{{/*
+Labels for the control component.
+*/}}
+{{- define "pgdog-control.labels" -}}
+{{ include "pgdog-control.commonLabels" . }}
+{{ include "pgdog-control.selectorLabels" . }}
+{{- end }}
+
+{{/*
+Selector labels for the control component.
+*/}}
+{{- define "pgdog-control.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "pgdog-control.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/component: control
+{{- end }}
+
+{{/*
+Labels for the redis component.
+*/}}
+{{- define "pgdog-control.redis.labels" -}}
+{{ include "pgdog-control.commonLabels" . }}
+{{ include "pgdog-control.redis.selectorLabels" . }}
+{{- end }}
+
+{{/*
+Selector labels for the redis component.
+*/}}
+{{- define "pgdog-control.redis.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "pgdog-control.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/component: redis
+{{- end }}

templates/aws-secret.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.control.aws.accessKeyId -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "pgdog-control.control.fullname" . }}-aws-creds
+  labels:
+    {{- include "pgdog-control.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  AWS_ACCESS_KEY_ID: {{ .Values.control.aws.accessKeyId | quote }}
+  AWS_SECRET_ACCESS_KEY: {{ required "control.aws.secretAccessKey is required when accessKeyId is set" .Values.control.aws.secretAccessKey | quote }}
+  {{- with .Values.control.aws.sessionToken }}
+  AWS_SESSION_TOKEN: {{ . | quote }}
+  {{- end }}
+{{- end -}}

templates/configmap.yaml

@@ -0,0 +1,138 @@
+{{- $config := .Values.control.config | default dict -}}
+{{- $auth := $config.auth | default dict -}}
+{{- $cookieSecret := "" -}}
+{{- if $auth.cookie_secret -}}
+{{- $cookieSecret = $auth.cookie_secret -}}
+{{- else -}}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace (printf "%s-secrets" .Release.Name) -}}
+{{- if and $existing (index $existing.data "cookie_secret") -}}
+{{- $cookieSecret = index $existing.data "cookie_secret" | b64dec -}}
+{{- end -}}
+{{- end -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "pgdog-control.control.fullname" . }}-config
+  labels:
+    {{- include "pgdog-control.labels" . | nindent 4 }}
+data:
+  control.toml: |
+    {{- with $config.rds }}
+    [rds]
+    {{- with .refresh_interval_secs }}
+    refresh_interval_secs = {{ . }}
+    {{- end }}
+    {{- end }}
+
+    {{- with $config.kube }}
+
+    [kube]
+    {{- with .refresh_interval_secs }}
+    refresh_interval_secs = {{ . }}
+    {{- end }}
+    {{- end }}
+
+    {{- with $config.dns }}
+
+    [dns]
+    {{- with .refresh_interval_secs }}
+    refresh_interval_secs = {{ . }}
+    {{- end }}
+    {{- end }}
+
+    {{- with $config.cloudwatch }}
+
+    [cloudwatch]
+    {{- with .refresh_interval_secs }}
+    refresh_interval_secs = {{ . }}
+    {{- end }}
+    {{- with .lookback_secs }}
+    lookback_secs = {{ . }}
+    {{- end }}
+    {{- with .period_secs }}
+    period_secs = {{ . }}
+    {{- end }}
+    {{- end }}
+
+    {{- with $config.store }}
+
+    [store]
+    {{- with .tick_secs }}
+    tick_secs = {{ . }}
+    {{- end }}
+    {{- with .stale_after_secs }}
+    stale_after_secs = {{ . }}
+    {{- end }}
+    {{- with .evict_after_secs }}
+    evict_after_secs = {{ . }}
+    {{- end }}
+    {{- with .metrics_retention_secs }}
+    metrics_retention_secs = {{ . }}
+    {{- end }}
+    {{- end }}
+
+    {{- with $config.helm }}
+
+    [helm]
+    {{- with .chart }}
+    chart = {{ . | quote }}
+    {{- end }}
+    {{- with .repo }}
+    repo = {{ . | quote }}
+    {{- end }}
+    {{- end }}
+
+    {{- if or $cookieSecret (gt (len $auth) 0) }}
+
+    [auth]
+    {{- if $cookieSecret }}
+    cookie_secret = {{ $cookieSecret | quote }}
+    {{- end }}
+    {{- with $auth.redirect_base_url }}
+    redirect_base_url = {{ . | quote }}
+    {{- end }}
+    {{- if hasKey $auth "cookie_secure" }}
+    cookie_secure = {{ $auth.cookie_secure }}
+    {{- end }}
+    {{- with $auth.session_max_age_days }}
+    session_max_age_days = {{ . }}
+    {{- end }}
+    {{- with $auth.state_max_age_min }}
+    state_max_age_min = {{ . }}
+    {{- end }}
+    {{- with $auth.github }}
+
+    [auth.github]
+    {{- with .client_id }}
+    client_id = {{ . | quote }}
+    {{- end }}
+    {{- with .client_secret }}
+    client_secret = {{ . | quote }}
+    {{- end }}
+    {{- with .allowed_orgs }}
+    allowed_orgs = [{{ range $i, $org := . }}{{ if $i }}, {{ end }}{{ $org | quote }}{{ end }}]
+    {{- end }}
+    {{- end }}
+    {{- with $auth.google }}
+
+    [auth.google]
+    {{- with .client_id }}
+    client_id = {{ . | quote }}
+    {{- end }}
+    {{- with .client_secret }}
+    client_secret = {{ . | quote }}
+    {{- end }}
+    {{- with .allowed_domains }}
+    allowed_domains = [{{ range $i, $d := . }}{{ if $i }}, {{ end }}{{ $d | quote }}{{ end }}]
+    {{- end }}
+    {{- end }}
+    {{- end }}
+
+    {{- $redis := $config.redis | default dict }}
+    {{- $redisUrl := $redis.url | default (printf "redis://%s.%s.svc.cluster.local:6379" (include "pgdog-control.redis.fullname" .) .Release.Namespace) }}
+
+    [redis]
+    url = {{ $redisUrl | quote }}
+    {{- with $redis.save_interval_secs }}
+    save_interval_secs = {{ . }}
+    {{- end }}