diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index 4fb3a90..4c4d602 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -2,7 +2,7 @@ ## Project Overview -Kubernetes Helm chart for deploying [Gitea](https://gitea.com). Uses Go/Helm templating (`templates/`), YAML values (`values.yaml`), and includes sub-charts for PostgreSQL, PostgreSQL-HA, Valkey, and Valkey-cluster. +Kubernetes Helm chart for deploying [Gitea](https://gitea.com). Uses Go/Helm templating (`templates/`), YAML values (`values.yaml`), and includes sub-charts for PostgreSQL, Valkey, and Valkey-cluster. The HA-ready database is provisioned as a CloudNativePG `Cluster` resource, the operator itself is not part of the chart. ## Build & Test diff --git a/Chart.lock b/Chart.lock index 783590c..0a7289f 100644 --- a/Chart.lock +++ b/Chart.lock @@ -2,11 +2,8 @@ dependencies: - name: postgresql repository: oci://registry-1.docker.io/bitnamicharts version: 16.7.27 -- name: postgresql-ha - repository: oci://registry-1.docker.io/bitnamicharts - version: 16.3.2 - name: valkey repository: https://valkey.io/valkey-helm version: 0.10.0 -digest: sha256:1afecbf0d4fc9f48e31417573d4bed7e0ac7848040b9e0c5f3989ada9d1f944f -generated: "2026-07-20T19:52:11.548874634+02:00" +digest: sha256:40619b69b9527f2044de588b227cf6b174011d4aa16cc048690cc970ce9ecd35 +generated: "2026-10-03T23:18:30.630364276+02:00" diff --git a/Chart.yaml b/Chart.yaml index 339e914..e404859 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -41,11 +41,6 @@ dependencies: repository: oci://registry-1.docker.io/bitnamicharts version: 16.7.27 condition: postgresql.enabled - # https://github.com/bitnami/charts/blob/main/bitnami/postgresql-ha/Chart.yaml - - name: postgresql-ha - repository: oci://registry-1.docker.io/bitnamicharts - version: 16.3.2 - condition: postgresql-ha.enabled # https://github.com/bitnami/charts/blob/main/bitnami/valkey/Chart.yaml - name: valkey repository: https://valkey.io/valkey-helm diff --git a/README.md b/README.md index 2b45802..0c98810 100644 --- a/README.md +++ b/README.md @@ -58,7 +58,7 @@ - [ReadinessProbe](#readinessprobe) - [StartupProbe](#startupprobe) - [valkey](#valkey) - - [PostgreSQL HA](#postgresql-ha) + - [CloudNativePG](#cloudnativepg) - [PostgreSQL](#postgresql) - [Advanced](#advanced) - [Contributing](#contributing) @@ -97,10 +97,13 @@ Users can also configure their own external providers via the configuration. ### HA Dependencies -These dependencies are enabled by default: +- PostgreSQL ([CloudNativePG](https://cloudnative-pg.io/)), disabled by default +- Valkey ([Official Valkey Helm Chart](https://github.com/valkey-io/valkey-helm)), enabled by default -- PostgreSQL HA ([Bitnami PostgreSQL-HA](https://github.com/bitnami/charts/blob/main/bitnami/postgresql-ha/Chart.yaml)) -- Valkey ([Official Valkey Helm Chart](https://github.com/valkey-io/valkey-helm)) +CloudNativePG is **not** bundled as a sub-chart. +Only the `Cluster` resource is rendered by this chart, the [CloudNativePG operator](https://cloudnative-pg.io/documentation/current/installation_upgrade/) must already be installed cluster-wide. +Because that operator cannot be assumed to be present, `cloudnativePG.enabled` defaults to `false`. +Set it to `true` once the operator is installed, or use either the `postgresql` sub-chart or an external database instead. ### Non-HA Dependencies @@ -122,7 +125,7 @@ Alternatively you can also use a versioning helper tool like [renovate](https:// Please double-check the image repository and available tags in the sub-chart: -- [PostgreSQL-HA](https://hub.docker.com/r/bitnami/postgresql-repmgr/tags) +- [CloudNativePG](https://github.com/cloudnative-pg/postgres-containers/pkgs/container/postgresql) - [PostgreSQL](https://hub.docker.com/r/bitnami/postgresql/tags) - [Valkey](https://hub.docker.com/r/valkey/valkey/tags) @@ -223,17 +226,20 @@ _All default settings are made directly in the generated `app.ini`, not in the V #### Database defaults If a builtIn database is enabled the database configuration is set automatically. -For example, PostgreSQL builtIn will appear in the `app.ini` as: +For example, the CloudNativePG `Cluster` will appear in the `app.ini` as: ```ini [database] DB_TYPE = postgres -HOST = RELEASE-NAME-postgresql.default.svc.cluster.local:5432 +HOST = RELEASE-NAME-postgresql-rw.default.svc.cluster.local:5432 NAME = gitea -PASSWD = gitea USER = gitea ``` +`PASSWD` is not part of the generated `app.ini`. +It is injected into the `init-app-ini` init container as the `GITEA__database__PASSWD` environment variable, sourced +from the credentials Secret referenced by `cloudnativePG.credentials`, and merged into the `app.ini` at startup. + #### Server defaults The server defaults are a bit more complex. @@ -346,7 +352,7 @@ If HA is not needed/desired, the following configurations can be used to deploy enabled: true postgresql: enabled: true - postgresql-ha: + cloudnativePG: enabled: false persistence: @@ -377,7 +383,7 @@ If HA is not needed/desired, the following configurations can be used to deploy enabled: false postgresql: enabled: false - postgresql-ha: + cloudnativePG: enabled: false persistence: @@ -489,7 +495,7 @@ Priority (highest to lowest) for defining app.ini variables: Any external database listed in [https://docs.gitea.com/installation/database-prep/](https://docs.gitea.com/installation/database-prep/) can be used instead of the built-in PostgreSQL. In fact, it is **highly recommended** to use an external database to ensure a stable Gitea installation longterm. -If an external database is used, no matter which type, make sure to set `postgresql.enabled` to `false` to disable the use of the built-in PostgreSQL. +If an external database is used, no matter which type, make sure to set `postgresql.enabled` and `cloudnativePG.enabled` to `false` to disable the use of the built-in PostgreSQL. ```yaml gitea: @@ -505,7 +511,7 @@ gitea: postgresql: enabled: false -postgresql-ha: +cloudnativePG: enabled: false ``` @@ -1035,8 +1041,8 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | `deployment.labels` | Labels for the deployment. | `{}` | | `deployment.affinity` | Affinity for the deployment. | `{}` | | `deployment.dnsConfig` | dnsConfig of the Gitea deployment. | `{}` | -| `deployment.gitea.env` | Additional environment variables to pass to the gitea container. | `[]` | -| `deployment.gitea.envFrom` | List of environment variables mounted from configMaps or secrets for the gitea container. | `[]` | +| `deployment.gitea.env` | Additional environment variables to pass to the Gitea container. | `[]` | +| `deployment.gitea.envFrom` | List of environment variables mounted from configMaps or secrets for the Gitea container. | `[]` | | `deployment.gitea.image.registry` | image registry, e.g. gcr.io,docker.io. | `docker.gitea.com` | | `deployment.gitea.image.repository` | Image to start for this pod. | `gitea` | | `deployment.gitea.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` | @@ -1122,7 +1128,7 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | `gatewayAPI.core.backendTLSPolicy.targetRefs` | Target references for the BackendTLSPolicy. Defaults to the HTTP service. | `[]` | | `gatewayAPI.core.backendTLSPolicy.validation` | Validation configuration (required when enabled). See `docs/gateway-api.md`. | `{}` | | `gatewayAPI.core.backendTLSPolicy.validation.caCertificateRefs` | CA certificate references for the BackendTLSPolicy validation. See `docs/gateway-api.md`. | | -| `gatewayAPI.core.backendTLSPolicy.validation.hostname` | Hostname for the BackendTLSPolicy validation. Must be the Common Name (CN) or a Subject Alternative Name (SAN) of the gitea server certificate. See `docs/gateway-api.md`. | | +| `gatewayAPI.core.backendTLSPolicy.validation.hostname` | Hostname for the BackendTLSPolicy validation. Must be the Common Name (CN) or a Subject Alternative Name (SAN) of the Gitea server certificate. See `docs/gateway-api.md`. | | | `gatewayAPI.core.httpRoute.enabled` | Render an HTTPRoute resource. | `false` | | `gatewayAPI.core.httpRoute.annotations` | Annotations applied to the HTTPRoute. | `{}` | | `gatewayAPI.core.httpRoute.labels` | Additional labels applied to the HTTPRoute. | `{}` | @@ -1153,7 +1159,7 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | `ingress.hosts[0].host` | Default Ingress host. | `git.example.com` | | `ingress.hosts[0].paths[0].path` | Default Ingress path. | `/` | | `ingress.tls` | Ingress tls settings. | `[]` | -| `namespace` | An explicit namespace to deploy gitea into. Defaults to the release namespace if not specified. | `""` | +| `namespace` | An explicit namespace to deploy Gitea into. Defaults to the release namespace if not specified. | `""` | ### Network @@ -1213,7 +1219,7 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | `secrets.config.existingSecret.secretName` | Name of the already existing config Secret. | `""` | | `secrets.config.new.annotations` | Annotations for the config Secret. | `{}` | | `secrets.config.new.labels` | Labels for the config Secret. | `{}` | -| `secrets.gpg.enabled` | Enable mounting of a GPG key to sign git commits. | `false` | +| `secrets.gpg.enabled` | Enable mounting of a GPG key to sign Git commits. | `false` | | `secrets.gpg.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` | | `secrets.gpg.existingSecret.enabled` | Use an already existing Secret instead of creating the GPG key Secret. | `false` | | `secrets.gpg.existingSecret.secretName` | Name of the already existing GPG key Secret. | `""` | @@ -1370,6 +1376,37 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | `gitea.startupProbe.successThreshold` | Success threshold for startup probe. | `1` | | `gitea.startupProbe.failureThreshold` | Failure threshold for startup probe. | `10` | +### CloudNativePG + +| Name | Description | Value | +| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------- | +| `cloudnativePG.enabled` | Provision a CloudNativePG `Cluster` for Gitea. Requires the CloudNativePG operator to be installed in the cluster. | `false` | +| `cloudnativePG.annotations` | Annotations for the CloudNativePG `Cluster`. | `{}` | +| `cloudnativePG.labels` | Additional labels for the CloudNativePG `Cluster`. | `{}` | +| `cloudnativePG.image.registry` | Image registry. | `ghcr.io` | +| `cloudnativePG.image.repository` | Image repository. | `cloudnative-pg/postgresql` | +| `cloudnativePG.image.tag` | Image tag. | `18.0` | +| `cloudnativePG.instances` | Number of PostgreSQL instances. Values greater than `1` provision a HA-ready cluster with streaming replication. | `3` | +| `cloudnativePG.credentials.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the credentials Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` | +| `cloudnativePG.credentials.database` | Name of the database to create. CloudNativePG requires it as a literal in the `Cluster`, hence it cannot be sourced from a Secret. | `gitea` | +| `cloudnativePG.credentials.username` | Name of the database owner to create. CloudNativePG requires it as a literal in the `Cluster`, hence it cannot be sourced from a Secret. | `gitea` | +| `cloudnativePG.credentials.existingSecret.enabled` | Use an already existing Secret instead of creating the credentials Secret. | `false` | +| `cloudnativePG.credentials.existingSecret.secretName` | Name of the already existing credentials Secret. Must be of type `kubernetes.io/basic-auth` and its `username` must match `cloudnativePG.credentials.username`. | `""` | +| `cloudnativePG.credentials.existingSecret.passwordKey` | Key of the password in the existing credentials Secret. | `password` | +| `cloudnativePG.credentials.new.annotations` | Annotations for the credentials Secret. | `{}` | +| `cloudnativePG.credentials.new.labels` | Labels for the credentials Secret. | `{}` | +| `cloudnativePG.credentials.new.password` | Password of the database owner. | `gitea` | +| `cloudnativePG.postgresql.parameters` | Custom PostgreSQL configuration parameters. | `{}` | +| `cloudnativePG.storage.size` | Size of the data volume. | `10Gi` | +| `cloudnativePG.storage.storageClass` | Storage class of the data volume. Defaults to the cluster's default storage class. | `""` | +| `cloudnativePG.walStorage.enabled` | Store the write-ahead log on a dedicated volume. | `false` | +| `cloudnativePG.walStorage.size` | Size of the write-ahead log volume. | `2Gi` | +| `cloudnativePG.walStorage.storageClass` | Storage class of the write-ahead log volume. Defaults to the cluster's default storage class. | `""` | +| `cloudnativePG.monitoring.enablePodMonitor` | Create a `PodMonitor` for the CloudNativePG `Cluster`. | `false` | +| `cloudnativePG.affinity` | Affinity for the PostgreSQL pods. | `{}` | +| `cloudnativePG.priorityClassName` | Priority class name for the PostgreSQL pods. | `""` | +| `cloudnativePG.resources` | Kubernetes resources for the PostgreSQL containers. | `{}` | + ### valkey | Name | Description | Value | @@ -1394,28 +1431,6 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | `valkey.metrics.exporter.image.repository` | Image repository. | `oliver006/redis_exporter` | | `valkey.metrics.exporter.image.tag` | Image tag. | `""` | -### PostgreSQL HA - -| Name | Description | Value | -| -------------------------------------------------- | ----------------------------------------------------------------- | --------------------------------- | -| `postgresql-ha.enabled` | Enable PostgreSQL HA. | `true` | -| `postgresql-ha.global.postgresql.database` | Name for a custom database to create (overrides `auth.database`). | `gitea` | -| `postgresql-ha.global.postgresql.username` | Name for a custom user to create (overrides `auth.username`). | `gitea` | -| `postgresql-ha.global.postgresql.password` | Name for a custom password to create (overrides `auth.password`). | `gitea` | -| `postgresql-ha.metrics.image.repository` | Image repository, eg. `bitnamilegacy/postgres-exporter`. | `bitnamilegacy/postgres-exporter` | -| `postgresql-ha.postgresql.image.repository` | Image repository, eg. `bitnamilegacy/postgresql-repmgr`. | `bitnamilegacy/postgresql-repmgr` | -| `postgresql-ha.postgresql.repmgrPassword` | Repmgr Password. | `changeme2` | -| `postgresql-ha.postgresql.postgresPassword` | postgres Password. | `changeme1` | -| `postgresql-ha.postgresql.password` | Password for the `gitea` user (overrides `auth.password`). | `changeme4` | -| `postgresql-ha.pgpool.adminPassword` | pgpool adminPassword. | `changeme3` | -| `postgresql-ha.pgpool.image.repository` | Image repository, eg. `bitnamilegacy/pgpool`. | `bitnamilegacy/pgpool` | -| `postgresql-ha.pgpool.srCheckPassword` | pgpool srCheckPassword. | `changeme4` | -| `postgresql-ha.service.ports.postgresql` | PostgreSQL service port (overrides `service.ports.postgresql`). | `5432` | -| `postgresql-ha.persistence.enabled` | Enable persistence. | `true` | -| `postgresql-ha.persistence.storageClass` | Persistent Volume Storage Class. | `""` | -| `postgresql-ha.persistence.size` | PVC Storage Request for PostgreSQL HA volume. | `10Gi` | -| `postgresql-ha.volumePermissions.image.repository` | Image repository, eg. `bitnamilegacy/os-shell`. | `bitnamilegacy/os-shell` | - ### PostgreSQL | Name | Description | Value | @@ -1466,7 +1481,7 @@ If you miss this, blindly upgrading may delete your Postgres instance and you ma - All Secrets created by this chart are now configured through the new `secrets` section. It exposes `annotations`, `labels`, a checksum-annotation toggle and an `existingSecret` reference for each of the `admin`, `config`, `gpg`, `init`, `inlineConfig` and `metrics` Secrets. - + - The `gitea.admin` object has been replaced by `secrets.admin`. The chart fails to render if `gitea.admin` is still set. Migrate as follows: @@ -1687,11 +1702,23 @@ If you want to switch to a RWX volume and go for HA, you need to If you are running with a non-HA PG DB from a previous chart release, you need to set -- `postgresql-ha.enabled=false` +- `cloudnativePG.enabled=false` - `postgresql.enabled=true` This is needed to stay with your existing single-instance DB (as the HA-variant is the new default). + + +**Transitioning from Postgres HA to CloudNativePG** + + +The `postgresql-ha` sub-chart has been replaced by a [CloudNativePG](https://cloudnative-pg.io/) `Cluster` resource, configured via `cloudnativePG`. +The CloudNativePG operator is not bundled with this chart and has to be installed cluster-wide beforehand. + +There is no in-place migration path between the two: dump the database of the old `postgresql-ha` deployment with `pg_dump`, remove the `postgresql-ha` values and deploy the chart with `cloudnativePG.enabled=true`. +Afterwards restore the dump into the new cluster. +Alternatively, point the new `Cluster` at the existing data via one of the [CloudNativePG bootstrap methods](https://cloudnative-pg.io/documentation/current/bootstrap/). + **Change of env-to-ini prefix** diff --git a/docs/ha-setup.md b/docs/ha-setup.md index f4d7c4a..61c04a8 100644 --- a/docs/ha-setup.md +++ b/docs/ha-setup.md @@ -28,8 +28,8 @@ In addition, the following components are required for full HA-readiness: - A HA-ready cache (`valkey-cluster`) - A HA-ready DB -`postgres.enabled`, which default to `true`, must be set to `false` for a HA setup. -The default `postgres` chart dependency is not HA-ready (there's a dedicated `postgres-ha` chart). +`postgresql.enabled`, which defaults to `false`, must stay disabled for a HA setup. +The `postgresql` chart dependency is not HA-ready, use the `cloudnativePG` option instead. The following sections discuss each of the components in more detail. Note that for each component discussed, the shown configurations only provides a (working) starting point, not necessarily the most optimal setup. @@ -153,15 +153,33 @@ persistence: ## Database -If you do not have an HA-ready DB, using a managed database service in the cloud might be the easiest and most robust solution. -Remember: disable the built-in `postgres` dependency and configure the database connection manually via `gitea.config.database`: +By enabling `cloudnativePG`, the chart renders a [CloudNativePG](https://cloudnative-pg.io/) `Cluster`, which provides a HA-ready PostgreSQL via streaming replication. +The CloudNativePG operator itself is not part of this chart and has to be [installed cluster-wide](https://cloudnative-pg.io/documentation/current/installation_upgrade/) beforehand. +For that reason the option is disabled by default. ```yml +cloudnativePG: + enabled: true + instances: 3 + storage: + size: 10Gi + storageClass: + walStorage: + enabled: true + size: 2Gi + storageClass: +``` + +If you do not want to run the operator, using a managed database service in the cloud might be the easiest and most robust solution. +Remember: keep `cloudnativePG` and `postgresql` disabled and configure the database connection manually via `gitea.config.database`: + +```yml +cloudnativePG: + enabled: false +postgresql: + enabled: false + gitea: - database: - builtIn: - postgresql: - enabled: false config: database: DB_TYPE: postgres diff --git a/templates/_clusters.tpl b/templates/_clusters.tpl new file mode 100644 index 0000000..b2297f1 --- /dev/null +++ b/templates/_clusters.tpl @@ -0,0 +1,24 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* annotations */}} + +{{- define "gitea.cluster.cloudnativePG.annotations" -}} +{{- with .Values.cloudnativePG.annotations }} +{{- toYaml . -}} +{{- end }} +{{- end }} + +{{/* labels */}} + +{{- define "gitea.cluster.cloudnativePG.labels" -}} +{{ include "gitea.labels" . }} +{{- with .Values.cloudnativePG.labels }} +{{ toYaml . }} +{{- end }} +{{- end }} + +{{/* names */}} + +{{- define "gitea.cluster.cloudnativePG.name" -}} +{{ include "gitea.fullname" . }}-postgresql +{{- end }} diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index dc6aed8..7da9248 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -174,9 +174,9 @@ app.kubernetes.io/name: {{ include "gitea.name" . }} app.kubernetes.io/instance: {{ .Release.Name }} {{- end -}} -{{- define "postgresql-ha.dns" -}} -{{- if (index .Values "postgresql-ha").enabled -}} -{{- printf "%s-postgresql-ha-pgpool.%s.svc.%s:%g" .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "postgresql-ha" "service" "ports" "postgresql") -}} +{{- define "cloudnativePG.dns" -}} +{{- if .Values.cloudnativePG.enabled -}} +{{- printf "%s-rw.%s.svc.%s:5432" (include "gitea.cluster.cloudnativePG.name" .) (.Values.namespace | default .Release.Namespace) .Values.clusterDomain -}} {{- end -}} {{- end -}} @@ -441,14 +441,14 @@ https {{- end -}} {{- define "gitea.inline_configuration.defaults.database" -}} - {{- if (index .Values "postgresql-ha" "enabled") -}} + {{- if .Values.cloudnativePG.enabled -}} + {{/* PASSWD is injected as an env-to-ini variable from the credentials Secret. */}} {{- $_ := set .Values.gitea.config.database "DB_TYPE" "postgres" -}} {{- if not (.Values.gitea.config.database.HOST) -}} - {{- $_ := set .Values.gitea.config.database "HOST" (include "postgresql-ha.dns" .) -}} + {{- $_ := set .Values.gitea.config.database "HOST" (include "cloudnativePG.dns" .) -}} {{- end -}} - {{- $_ := set .Values.gitea.config.database "NAME" (index .Values "postgresql-ha" "global" "postgresql" "database") -}} - {{- $_ := set .Values.gitea.config.database "USER" (index .Values "postgresql-ha" "global" "postgresql" "username") -}} - {{- $_ := set .Values.gitea.config.database "PASSWD" (index .Values "postgresql-ha" "global" "postgresql" "password") -}} + {{- $_ := set .Values.gitea.config.database "NAME" .Values.cloudnativePG.credentials.database -}} + {{- $_ := set .Values.gitea.config.database "USER" .Values.cloudnativePG.credentials.username -}} {{- end -}} {{- if (index .Values "postgresql" "enabled") -}} {{- $_ := set .Values.gitea.config.database "DB_TYPE" "postgres" -}} diff --git a/templates/_initContainers.tpl b/templates/_initContainers.tpl index 143971a..0b02fe3 100644 --- a/templates/_initContainers.tpl +++ b/templates/_initContainers.tpl @@ -84,6 +84,13 @@ value: /tmp/existing-envs - name: ENV_TO_INI_MOUNT_POINT value: /env-to-ini-mounts + {{- if .Values.cloudnativePG.enabled }} + - name: GITEA__database__PASSWD + valueFrom: + secretKeyRef: + key: {{ include "gitea.secret.cloudnativePG.passwordKey" . }} + name: {{ include "gitea.secret.cloudnativePG.name" . }} + {{- end }} {{- if .Values.deployment.gitea.env }} {{- toYaml .Values.deployment.gitea.env | nindent 4 }} {{- end }} diff --git a/templates/_pods.tpl b/templates/_pods.tpl index 8b30928..246f00f 100644 --- a/templates/_pods.tpl +++ b/templates/_pods.tpl @@ -9,6 +9,11 @@ checksum/admin: {{ include "gitea.secret.checksum" (list . "admin") }} {{- end }} +{{/* secret - cloudnativePG */}} +{{- if and .Values.cloudnativePG.enabled .Values.cloudnativePG.credentials.addSHASumAnnotation }} +checksum/cloudnativePG: {{ include "gitea.secret.checksum" (list . "cloudnativePG") }} +{{- end }} + {{/* secret - config */}} {{- if and .Values.secrets.config.enabled .Values.secrets.config.addSHASumAnnotation }} checksum/config: {{ include "gitea.secret.checksum" (list . "config") }} diff --git a/templates/_secrets.tpl b/templates/_secrets.tpl index 2c8480e..9f3ed9c 100644 --- a/templates/_secrets.tpl +++ b/templates/_secrets.tpl @@ -8,6 +8,12 @@ {{- end }} {{- end }} +{{- define "gitea.secret.cloudnativePG.annotations" -}} +{{- with .Values.cloudnativePG.credentials.new.annotations }} +{{- toYaml . -}} +{{- end }} +{{- end }} + {{- define "gitea.secret.config.annotations" -}} {{- with .Values.secrets.config.new.annotations }} {{- toYaml . -}} @@ -49,7 +55,11 @@ Arguments: (list $root $key) {{- define "gitea.secret.checksum" -}} {{- $root := index . 0 -}} {{- $key := index . 1 -}} -{{- if (index $root.Values.secrets $key).existingSecret.enabled -}} +{{- $config := index $root.Values.secrets $key -}} +{{- if eq $key "cloudnativePG" -}} +{{- $config = $root.Values.cloudnativePG.credentials -}} +{{- end -}} +{{- if $config.existingSecret.enabled -}} {{- $namespace := $root.Values.namespace | default $root.Release.Namespace -}} {{- $name := include (printf "gitea.secret.%s.name" $key) $root -}} {{- lookup "v1" "Secret" $namespace $name | toYaml | sha256sum -}} @@ -68,6 +78,13 @@ Arguments: (list $root $key) {{- end }} {{- end }} +{{- define "gitea.secret.cloudnativePG.labels" -}} +{{ include "gitea.labels" . }} +{{- with .Values.cloudnativePG.credentials.new.labels }} +{{ toYaml . }} +{{- end }} +{{- end }} + {{- define "gitea.secret.config.labels" -}} {{ include "gitea.labels" . }} {{- with .Values.secrets.config.new.labels }} @@ -113,6 +130,14 @@ Arguments: (list $root $key) {{- end -}} {{- end }} +{{- define "gitea.secret.cloudnativePG.name" -}} +{{- if .Values.cloudnativePG.credentials.existingSecret.enabled -}} +{{ required "`cloudnativePG.credentials.existingSecret.secretName` must be set when `cloudnativePG.credentials.existingSecret.enabled` is enabled" .Values.cloudnativePG.credentials.existingSecret.secretName }} +{{- else -}} +{{ include "gitea.cluster.cloudnativePG.name" . }}-app +{{- end -}} +{{- end }} + {{- define "gitea.secret.config.name" -}} {{- if .Values.secrets.config.existingSecret.enabled -}} {{ required "`secrets.config.existingSecret.secretName` must be set when `secrets.config.existingSecret.enabled` is enabled" .Values.secrets.config.existingSecret.secretName }} @@ -179,6 +204,14 @@ username {{- end -}} {{- end }} +{{- define "gitea.secret.cloudnativePG.passwordKey" -}} +{{- if .Values.cloudnativePG.credentials.existingSecret.enabled -}} +{{ .Values.cloudnativePG.credentials.existingSecret.passwordKey }} +{{- else -}} +password +{{- end -}} +{{- end }} + {{- define "gitea.secret.gpg.gpgHomeKey" -}} {{- if .Values.secrets.gpg.existingSecret.enabled -}} {{ .Values.secrets.gpg.existingSecret.gpgHomeKey }} diff --git a/templates/cluster.yaml b/templates/cluster.yaml new file mode 100644 index 0000000..6cea386 --- /dev/null +++ b/templates/cluster.yaml @@ -0,0 +1,45 @@ +{{- if .Values.cloudnativePG.enabled -}} +{{- $registry := .Values.global.imageRegistry | default .Values.cloudnativePG.image.registry -}} +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + {{- with (include "gitea.cluster.cloudnativePG.annotations" .) }} + annotations: + {{- . | nindent 4 }} + {{- end }} + labels: + {{- include "gitea.cluster.cloudnativePG.labels" . | nindent 4 }} + name: {{ include "gitea.cluster.cloudnativePG.name" . }} + namespace: {{ .Values.namespace | default .Release.Namespace }} +spec: + affinity: + {{- toYaml .Values.cloudnativePG.affinity | nindent 4 }} + bootstrap: + initdb: + database: {{ .Values.cloudnativePG.credentials.database | quote }} + owner: {{ .Values.cloudnativePG.credentials.username | quote }} + secret: + name: {{ include "gitea.secret.cloudnativePG.name" . }} + imageName: {{ printf "%s/%s:%s" $registry .Values.cloudnativePG.image.repository (.Values.cloudnativePG.image.tag | toString) | quote }} + instances: {{ .Values.cloudnativePG.instances }} + monitoring: + enablePodMonitor: {{ .Values.cloudnativePG.monitoring.enablePodMonitor }} + postgresql: + parameters: + {{- toYaml .Values.cloudnativePG.postgresql.parameters | nindent 6 }} + priorityClassName: {{ .Values.cloudnativePG.priorityClassName | quote }} + resources: + {{- toYaml .Values.cloudnativePG.resources | nindent 4 }} + storage: + size: {{ .Values.cloudnativePG.storage.size | quote }} + {{- with .Values.cloudnativePG.storage.storageClass }} + storageClass: {{ . | quote }} + {{- end }} + {{- if .Values.cloudnativePG.walStorage.enabled }} + walStorage: + size: {{ .Values.cloudnativePG.walStorage.size | quote }} + {{- with .Values.cloudnativePG.walStorage.storageClass }} + storageClass: {{ . | quote }} + {{- end }} + {{- end }} +{{- end -}} diff --git a/templates/deprecation.yaml b/templates/deprecation.yaml index 8c87b78..d3758d6 100644 --- a/templates/deprecation.yaml +++ b/templates/deprecation.yaml @@ -95,6 +95,11 @@ {{- fail "`openshift.hostUsers` does no longer exist. Please refer to the changelog and configure `deployment.hostUsers` instead." -}} {{- end -}} + {{/* POSTGRESQL HA */}} + {{- if index .Values "postgresql-ha" -}} + {{- fail "`postgresql-ha` does no longer exist. Please refer to the changelog and configure `cloudnativePG` instead, which requires the CloudNativePG operator to be installed in the cluster." -}} + {{- end -}} + {{/* PRIORITY CLASS NAME */}} {{- if .Values.priorityClassName -}} {{- fail "`priorityClassName` does no longer exist. Please refer to the changelog and configure `deployment.priorityClassName` instead." -}} diff --git a/templates/secret_cloudnativePG.yaml b/templates/secret_cloudnativePG.yaml new file mode 100644 index 0000000..de86646 --- /dev/null +++ b/templates/secret_cloudnativePG.yaml @@ -0,0 +1,18 @@ +{{- if and .Values.cloudnativePG.enabled (not .Values.cloudnativePG.credentials.existingSecret.enabled) -}} +apiVersion: v1 +kind: Secret +metadata: + {{- with (include "gitea.secret.cloudnativePG.annotations" .) }} + annotations: + {{- . | nindent 4 }} + {{- end }} + labels: + {{- include "gitea.secret.cloudnativePG.labels" . | nindent 4 }} + name: {{ include "gitea.secret.cloudnativePG.name" . }} + namespace: {{ .Values.namespace | default .Release.Namespace }} +type: kubernetes.io/basic-auth +data: + password: {{ required "`cloudnativePG.credentials.new.password` must be set when `cloudnativePG.enabled` is enabled" .Values.cloudnativePG.credentials.new.password | b64enc | quote }} + {{- /* CloudNativePG requires the username of a basic-auth bootstrap Secret to match the owner of the Cluster. */}} + username: {{ required "`cloudnativePG.credentials.username` must be set when `cloudnativePG.enabled` is enabled" .Values.cloudnativePG.credentials.username | b64enc | quote }} +{{- end -}} diff --git a/templates/secret_config.yaml b/templates/secret_config.yaml index 61bc051..340e290 100644 --- a/templates/secret_config.yaml +++ b/templates/secret_config.yaml @@ -22,8 +22,8 @@ data: {{- define "gitea.config.assertions" -}} {{- /*assert that only one PG dep is enabled */ -}} - {{- if and (.Values.postgresql.enabled) (index .Values "postgresql-ha" "enabled") -}} - {{- fail "Only one of postgresql or postgresql-ha can be enabled at the same time." -}} + {{- if and (.Values.postgresql.enabled) (.Values.cloudnativePG.enabled) -}} + {{- fail "Only one of postgresql or cloudnativePG can be enabled at the same time." -}} {{- end }} {{- /* multiple replicas assertions */ -}} diff --git a/unittests/helm/cluster/basics.yaml b/unittests/helm/cluster/basics.yaml new file mode 100644 index 0000000..574c5cf --- /dev/null +++ b/unittests/helm/cluster/basics.yaml @@ -0,0 +1,131 @@ +suite: Test cluster basics +release: + name: gitea-unittests + namespace: testing +tests: + - it: "Render nothing when cloudnativePG is disabled" + templates: + - templates/cluster.yaml + - templates/secret_cloudnativePG.yaml + set: + cloudnativePG: + enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: "Render the Cluster with the default values" + template: templates/cluster.yaml + set: + cloudnativePG: + enabled: true + asserts: + - containsDocument: + kind: Cluster + apiVersion: postgresql.cnpg.io/v1 + name: gitea-unittests-postgresql + namespace: testing + - equal: + path: spec.instances + value: 3 + - equal: + path: spec.imageName + value: "ghcr.io/cloudnative-pg/postgresql:18.0" + - equal: + path: spec.bootstrap.initdb + value: + database: "gitea" + owner: "gitea" + secret: + name: gitea-unittests-postgresql-app + - equal: + path: spec.storage.size + value: "10Gi" + - notExists: + path: spec.storage.storageClass + - notExists: + path: spec.walStorage + + - it: "Render the credential Secret with the default values" + template: templates/secret_cloudnativePG.yaml + set: + cloudnativePG: + enabled: true + asserts: + - containsDocument: + kind: Secret + apiVersion: v1 + name: gitea-unittests-postgresql-app + namespace: testing + - equal: + path: type + value: kubernetes.io/basic-auth + - equal: + path: data.password + decodeBase64: true + value: "gitea" + - equal: + path: data.username + decodeBase64: true + value: "gitea" + - notExists: + path: data.database + - notExists: + path: stringData + + - it: "Render no credential Secret when an existing Secret is used" + template: templates/secret_cloudnativePG.yaml + set: + cloudnativePG: + enabled: true + credentials: + existingSecret: + enabled: true + secretName: my-credentials + asserts: + - hasDocuments: + count: 0 + + - it: "Reference the existing Secret in the Cluster" + template: templates/cluster.yaml + set: + cloudnativePG: + enabled: true + credentials: + existingSecret: + enabled: true + secretName: my-credentials + database: my-database + username: my-username + asserts: + - equal: + path: spec.bootstrap.initdb + value: + database: "my-database" + owner: "my-username" + secret: + name: my-credentials + + - it: "Apply the storage and walStorage customizations" + template: templates/cluster.yaml + set: + cloudnativePG: + enabled: true + storage: + size: 1337Mi + storageClass: my-storage-class + walStorage: + enabled: true + size: 42Mi + storageClass: my-wal-storage-class + asserts: + - equal: + path: spec.storage + value: + size: "1337Mi" + storageClass: "my-storage-class" + - equal: + path: spec.walStorage + value: + size: "42Mi" + storageClass: "my-wal-storage-class" diff --git a/unittests/helm/config/database.yaml b/unittests/helm/config/database.yaml new file mode 100644 index 0000000..2140550 --- /dev/null +++ b/unittests/helm/config/database.yaml @@ -0,0 +1,59 @@ +suite: Test config database +release: + name: gitea-unittests + namespace: testing +tests: + - it: "Connect to the read-write Service of the CloudNativePG Cluster" + template: templates/secret_inlineConfig.yaml + set: + cloudnativePG: + enabled: true + asserts: + - documentIndex: 0 + matchRegex: + path: data.database + decodeBase64: true + pattern: HOST=gitea-unittests-postgresql-rw.testing.svc.cluster.local:5432 + + - it: "Connect to the read-write Service of the CloudNativePG Cluster with a custom cluster domain" + template: templates/secret_inlineConfig.yaml + set: + clusterDomain: my-special-cluster.local + cloudnativePG: + enabled: true + asserts: + - documentIndex: 0 + matchRegex: + path: data.database + decodeBase64: true + pattern: HOST=gitea-unittests-postgresql-rw.testing.svc.my-special-cluster.local:5432 + + - it: "Connect to the configured CloudNativePG database" + template: templates/secret_inlineConfig.yaml + set: + cloudnativePG: + enabled: true + credentials: + database: gitea-database + username: gitea-username + asserts: + - documentIndex: 0 + equal: + path: data.database + decodeBase64: true + value: |- + DB_TYPE=postgres + HOST=gitea-unittests-postgresql-rw.testing.svc.cluster.local:5432 + NAME=gitea-database + USER=gitea-username + + - it: "Fail when postgresql and cloudnativePG are enabled at the same time" + template: templates/secret_config.yaml + set: + postgresql: + enabled: true + cloudnativePG: + enabled: true + asserts: + - failedTemplate: + errorMessage: "Only one of postgresql or cloudnativePG can be enabled at the same time." diff --git a/unittests/helm/dependency-checks/customizationIntegrityPostgresql.yaml b/unittests/helm/dependency-checks/customizationIntegrityPostgresql.yaml index d9c06b8..5aadb4b 100644 --- a/unittests/helm/dependency-checks/customizationIntegrityPostgresql.yaml +++ b/unittests/helm/dependency-checks/customizationIntegrityPostgresql.yaml @@ -3,7 +3,7 @@ release: name: gitea-unittests namespace: testing set: - postgresql-ha: + cloudnativePG: enabled: false postgresql: enabled: true diff --git a/unittests/helm/dependency-checks/customizationIntegrityPostgresqlHA.yaml b/unittests/helm/dependency-checks/customizationIntegrityPostgresqlHA.yaml deleted file mode 100644 index 53cfda4..0000000 --- a/unittests/helm/dependency-checks/customizationIntegrityPostgresqlHA.yaml +++ /dev/null @@ -1,129 +0,0 @@ -suite: Test dependency customization integrity of postgresql-ha -release: - name: gitea-unittests - namespace: testing -set: - postgresql: - enabled: false - postgresql-ha: - enabled: true - global: - postgresql: - database: gitea-database - password: gitea-password - username: gitea-username - postgresql: - repmgrPassword: custom-password-repmgr - postgresPassword: custom-password-postgres - password: custom-password-overwritten-by-global-postgresql-password - pgpool: - adminPassword: custom-password-pgpool - srCheckPassword: custom-password-sr-check - service: - ports: - postgresql: 1234 - persistence: - size: 1337Mi -tests: - - it: "[postgresql-ha] Apply the database settings" - template: charts/postgresql-ha/templates/postgresql/statefulset.yaml - asserts: - - documentIndex: 0 - contains: - path: spec.template.spec.containers[0].env - content: - name: POSTGRES_DB - value: "gitea-database" - - documentIndex: 0 - contains: - path: spec.template.spec.containers[0].env - content: - name: POSTGRES_USER - value: "gitea-username" - - it: "[postgresql-ha] Apply the database passwords" - template: charts/postgresql-ha/templates/postgresql/secrets.yaml - asserts: - - documentIndex: 0 - equal: - path: data["repmgr-password"] - value: "Y3VzdG9tLXBhc3N3b3JkLXJlcG1ncg==" - - documentIndex: 0 - equal: - path: data["postgres-password"] - value: "Y3VzdG9tLXBhc3N3b3JkLXBvc3RncmVz" - - documentIndex: 0 - equal: - path: data["password"] - value: "Z2l0ZWEtcGFzc3dvcmQ=" # postgresql-ha.postgresql.password is overwritten by postgresql-ha.global.postgresql.password and should not be referenced here - - it: "[postgresql-ha] Apply pgpool.adminPassword" - template: charts/postgresql-ha/templates/pgpool/secrets.yaml - asserts: - - documentIndex: 0 - equal: - path: data["admin-password"] - value: "Y3VzdG9tLXBhc3N3b3JkLXBncG9vbA==" - - it: "[postgresql-ha] Apply pgpool.srCheckPassword" - template: charts/postgresql-ha/templates/pgpool/secrets.yaml - asserts: - - documentIndex: 0 - equal: - path: data["sr-check-password"] - value: "Y3VzdG9tLXBhc3N3b3JkLXNyLWNoZWNr" - - it: "[postgresql-ha] Apply persistence.size" - template: charts/postgresql-ha/templates/postgresql/statefulset.yaml - asserts: - - documentIndex: 0 - equal: - path: spec.volumeClaimTemplates[0].spec.resources.requests.storage - value: "1337Mi" - - it: "[postgresql-ha] Apply service.ports.postgresql" - template: charts/postgresql-ha/templates/pgpool/service.yaml - asserts: - - documentIndex: 0 - equal: - path: spec.ports[0].port - value: 1234 - - it: "[postgresql-ha] Render the referenced Service" - template: charts/postgresql-ha/templates/pgpool/service.yaml - asserts: - - containsDocument: - kind: Service - apiVersion: v1 - name: gitea-unittests-postgresql-ha-pgpool - namespace: testing - - it: "[gitea] Connect to the pgpool Service" - template: templates/secret_inlineConfig.yaml - asserts: - - documentIndex: 0 - matchRegex: - path: data.database - decodeBase64: true - pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.cluster.local:1234 - - it: "[gitea] Connect to the pgpool Service with a custom cluster domain" - set: - clusterDomain: my-special-cluster.local - template: templates/secret_inlineConfig.yaml - asserts: - - documentIndex: 0 - matchRegex: - path: data.database - decodeBase64: true - pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.my-special-cluster.local:1234 - - it: "[gitea] Connect to the configured database" - template: templates/secret_inlineConfig.yaml - asserts: - - documentIndex: 0 - matchRegex: - path: data.database - decodeBase64: true - pattern: NAME=gitea-database - - documentIndex: 0 - matchRegex: - path: data.database - decodeBase64: true - pattern: USER=gitea-username - - documentIndex: 0 - matchRegex: - path: data.database - decodeBase64: true - pattern: PASSWD=gitea-password diff --git a/unittests/helm/dependency-checks/majorImageBump.yaml b/unittests/helm/dependency-checks/majorImageBump.yaml index 59e862f..2c881bb 100644 --- a/unittests/helm/dependency-checks/majorImageBump.yaml +++ b/unittests/helm/dependency-checks/majorImageBump.yaml @@ -3,25 +3,12 @@ release: name: gitea-unittests namespace: testing tests: - - it: "[postgresql-ha] Detect major image version upgrades" - template: charts/postgresql-ha/templates/postgresql/statefulset.yaml - set: - postgresql: - enabled: false - postgresql-ha: - enabled: true - asserts: - - documentIndex: 0 - matchRegex: - path: spec.template.spec.containers[0].image - # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST - pattern: bitnamilegacy/postgresql-repmgr:17.+$ - it: "[postgresql] Detect major image version upgrades" template: charts/postgresql/templates/primary/statefulset.yaml set: postgresql: enabled: true - postgresql-ha: + cloudnativePG: enabled: false asserts: - documentIndex: 0 diff --git a/unittests/helm/deployment/checksumAnnotations.yaml b/unittests/helm/deployment/checksumAnnotations.yaml index 817845d..f42a14a 100644 --- a/unittests/helm/deployment/checksumAnnotations.yaml +++ b/unittests/helm/deployment/checksumAnnotations.yaml @@ -5,6 +5,7 @@ release: templates: - templates/deployment.yaml - templates/secret_admin.yaml + - templates/secret_cloudnativePG.yaml - templates/secret_config.yaml - templates/secret_gpg.yaml - templates/secret_init.yaml @@ -14,6 +15,8 @@ tests: - it: "Omit the checksum annotations by default" template: templates/deployment.yaml set: + cloudnativePG.enabled: true + secrets.admin.enabled: true secrets.config.enabled: true secrets.gpg.enabled: true @@ -26,6 +29,8 @@ tests: asserts: - notExists: path: spec.template.metadata.annotations["checksum/admin"] + - notExists: + path: spec.template.metadata.annotations["checksum/cloudnativePG"] - notExists: path: spec.template.metadata.annotations["checksum/config"] - notExists: @@ -40,6 +45,9 @@ tests: - it: "Add a checksum annotation for every Secret when addSHASumAnnotation is enabled" template: templates/deployment.yaml set: + cloudnativePG.credentials.addSHASumAnnotation: true + cloudnativePG.enabled: true + secrets.admin.addSHASumAnnotation: true secrets.admin.enabled: true @@ -63,6 +71,8 @@ tests: asserts: - exists: path: spec.template.metadata.annotations["checksum/admin"] + - exists: + path: spec.template.metadata.annotations["checksum/cloudnativePG"] - exists: path: spec.template.metadata.annotations["checksum/config"] - exists: diff --git a/unittests/helm/deployment/cloudnativePG.yaml b/unittests/helm/deployment/cloudnativePG.yaml new file mode 100644 index 0000000..480616b --- /dev/null +++ b/unittests/helm/deployment/cloudnativePG.yaml @@ -0,0 +1,67 @@ +suite: Test deployment cloudnativePG credentials +release: + name: gitea-unittests + namespace: testing +templates: + - templates/deployment.yaml + - templates/secret_cloudnativePG.yaml +tests: + - it: "Inject no database password when cloudnativePG is disabled" + template: templates/deployment.yaml + set: + cloudnativePG: + enabled: false + asserts: + - notContains: + path: spec.template.spec.initContainers[1].env + content: + name: GITEA__database__PASSWD + any: true + + - it: "Inject the database password from the rendered Secret" + template: templates/deployment.yaml + set: + cloudnativePG: + enabled: true + asserts: + - contains: + path: spec.template.spec.initContainers[1].env + content: + name: GITEA__database__PASSWD + valueFrom: + secretKeyRef: + key: password + name: gitea-unittests-postgresql-app + + - it: "Inject the database password from an existing Secret" + template: templates/deployment.yaml + set: + cloudnativePG: + enabled: true + credentials: + existingSecret: + enabled: true + secretName: my-credentials + passwordKey: my-password-key + asserts: + - contains: + path: spec.template.spec.initContainers[1].env + content: + name: GITEA__database__PASSWD + valueFrom: + secretKeyRef: + key: my-password-key + name: my-credentials + + - it: "Fail when an existing Secret is used without a name" + template: templates/deployment.yaml + set: + cloudnativePG: + enabled: true + credentials: + existingSecret: + enabled: true + secretName: "" + asserts: + - failedTemplate: + errorMessage: "`cloudnativePG.credentials.existingSecret.secretName` must be set when `cloudnativePG.credentials.existingSecret.enabled` is enabled" diff --git a/unittests/helm/deprecation/deployment.yaml b/unittests/helm/deprecation/deployment.yaml index 8923355..0b2f399 100644 --- a/unittests/helm/deprecation/deployment.yaml +++ b/unittests/helm/deprecation/deployment.yaml @@ -98,6 +98,13 @@ tests: asserts: - failedTemplate: errorMessage: "`openshift.hostUsers` does no longer exist. Please refer to the changelog and configure `deployment.hostUsers` instead." + - it: "Fail when the removed `postgresql-ha` value is set" + set: + postgresql-ha: + enabled: true + asserts: + - failedTemplate: + errorMessage: "`postgresql-ha` does no longer exist. Please refer to the changelog and configure `cloudnativePG` instead, which requires the CloudNativePG operator to be installed in the cluster." - it: "Fail when the removed `priorityClassName` value is set" set: priorityClassName: high-priority diff --git a/values.yaml b/values.yaml index b48f49a..d36475d 100644 --- a/values.yaml +++ b/values.yaml @@ -1112,6 +1112,86 @@ gitea: successThreshold: 1 failureThreshold: 10 +## @section CloudNativePG +# The CloudNativePG operator itself is not part of this chart. It must be installed cluster-wide beforehand: +# https://cloudnative-pg.io/documentation/current/installation_upgrade/ +cloudnativePG: + ## @param cloudnativePG.enabled Provision a CloudNativePG `Cluster` for Gitea. Requires the CloudNativePG operator to be installed in the cluster. + enabled: false + + ## @param cloudnativePG.annotations Annotations for the CloudNativePG `Cluster`. + ## @param cloudnativePG.labels Additional labels for the CloudNativePG `Cluster`. + annotations: {} + labels: {} + + ## @param cloudnativePG.image.registry Image registry. + ## @param cloudnativePG.image.repository Image repository. + ## @param cloudnativePG.image.tag Image tag. + image: + registry: ghcr.io + repository: cloudnative-pg/postgresql + tag: "18.0" + + ## @param cloudnativePG.instances Number of PostgreSQL instances. Values greater than `1` provision a HA-ready cluster with streaming replication. + instances: 3 + + credentials: + ## @param cloudnativePG.credentials.addSHASumAnnotation Add a pod annotation with the SHA sum of the credentials Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). + addSHASumAnnotation: false + + ## @param cloudnativePG.credentials.database Name of the database to create. CloudNativePG requires it as a literal in the `Cluster`, hence it cannot be sourced from a Secret. + ## @param cloudnativePG.credentials.username Name of the database owner to create. CloudNativePG requires it as a literal in the `Cluster`, hence it cannot be sourced from a Secret. + database: gitea + username: gitea + + ## @param cloudnativePG.credentials.existingSecret.enabled Use an already existing Secret instead of creating the credentials Secret. + ## @param cloudnativePG.credentials.existingSecret.secretName Name of the already existing credentials Secret. Must be of type `kubernetes.io/basic-auth` and its `username` must match `cloudnativePG.credentials.username`. + ## @param cloudnativePG.credentials.existingSecret.passwordKey Key of the password in the existing credentials Secret. + existingSecret: + enabled: false + secretName: "" + passwordKey: password + + ## @param cloudnativePG.credentials.new.annotations Annotations for the credentials Secret. + ## @param cloudnativePG.credentials.new.labels Labels for the credentials Secret. + ## @param cloudnativePG.credentials.new.password Password of the database owner. + new: + annotations: {} + labels: {} + password: gitea + + ## @param cloudnativePG.postgresql.parameters Custom PostgreSQL configuration parameters. + postgresql: + parameters: {} + + ## @param cloudnativePG.storage.size Size of the data volume. + ## @param cloudnativePG.storage.storageClass Storage class of the data volume. Defaults to the cluster's default storage class. + storage: + size: 10Gi + storageClass: "" + + ## @param cloudnativePG.walStorage.enabled Store the write-ahead log on a dedicated volume. + ## @param cloudnativePG.walStorage.size Size of the write-ahead log volume. + ## @param cloudnativePG.walStorage.storageClass Storage class of the write-ahead log volume. Defaults to the cluster's default storage class. + walStorage: + enabled: false + size: 2Gi + storageClass: "" + + ## @param cloudnativePG.monitoring.enablePodMonitor Create a `PodMonitor` for the CloudNativePG `Cluster`. + monitoring: + enablePodMonitor: false + + ## @param cloudnativePG.affinity Affinity for the PostgreSQL pods. + affinity: {} + + ## @param cloudnativePG.priorityClassName Priority class name for the PostgreSQL pods. + priorityClassName: "" + + ## @param cloudnativePG.resources Kubernetes resources for the PostgreSQL containers. + resources: {} + + ## @section valkey valkey: ## @param valkey.enabled Enable valkey standalone or replicated. @@ -1170,62 +1250,6 @@ valkey: repository: oliver006/redis_exporter tag: "" -## @section PostgreSQL HA -postgresql-ha: - ## @param postgresql-ha.enabled Enable PostgreSQL HA. - enabled: true - - ## @param postgresql-ha.global.postgresql.database Name for a custom database to create (overrides `auth.database`). - ## @param postgresql-ha.global.postgresql.username Name for a custom user to create (overrides `auth.username`). - ## @param postgresql-ha.global.postgresql.password Name for a custom password to create (overrides `auth.password`). - global: - postgresql: - database: gitea - password: gitea - username: gitea - - ## @param postgresql-ha.metrics.image.repository Image repository, eg. `bitnamilegacy/postgres-exporter`. - metrics: - image: - repository: bitnamilegacy/postgres-exporter - - ## @param postgresql-ha.postgresql.image.repository Image repository, eg. `bitnamilegacy/postgresql-repmgr`. - ## @param postgresql-ha.postgresql.repmgrPassword Repmgr Password. - ## @param postgresql-ha.postgresql.postgresPassword postgres Password. - ## @param postgresql-ha.postgresql.password Password for the `gitea` user (overrides `auth.password`). - postgresql: - image: - repository: bitnamilegacy/postgresql-repmgr - repmgrPassword: changeme2 - postgresPassword: changeme1 - password: changeme4 - - ## @param postgresql-ha.pgpool.adminPassword pgpool adminPassword. - ## @param postgresql-ha.pgpool.image.repository Image repository, eg. `bitnamilegacy/pgpool`. - ## @param postgresql-ha.pgpool.srCheckPassword pgpool srCheckPassword. - pgpool: - adminPassword: changeme3 - image: - repository: bitnamilegacy/pgpool - srCheckPassword: changeme4 - - ## @param postgresql-ha.service.ports.postgresql PostgreSQL service port (overrides `service.ports.postgresql`). - service: - ports: - postgresql: 5432 - - ## @param postgresql-ha.persistence.enabled Enable persistence. - ## @param postgresql-ha.persistence.storageClass Persistent Volume Storage Class. - ## @param postgresql-ha.persistence.size PVC Storage Request for PostgreSQL HA volume. - persistence: - enabled: true - storageClass: "" - size: 10Gi - - ## @param postgresql-ha.volumePermissions.image.repository Image repository, eg. `bitnamilegacy/os-shell`. - volumePermissions: - image: - repository: bitnamilegacy/os-shell ## @section PostgreSQL postgresql: