Add persistent mariadb

Brutus5000 · Brutus5000 · commit 4e220c60702f · 2024-11-02T00:39:24.000+01:00
diff --git a/apps/ergochat/config/ircd.yaml b/apps/ergochat/config/ircd.yaml
@@ -827,10 +827,8 @@ datastore:
     port: 3306
     # if socket-path is set, it will be used instead of host:port
     #socket-path: "/var/run/mysqld/mysqld.sock"
-    user: "ergochat"
-    # Define ERGO__DATASTORE__MYSQL__PASSWORD in secret
-    # password: "banana"
-    history-database: "ergochat"
+    # Values for `user` and `history-database` are defined in configmap
+    # You have to define ERGO__DATASTORE__MYSQL__PASSWORD in secret
     timeout: 3s
     max-conns: 4
     # this may be necessary to prevent middleware from closing your connections:
diff --git a/apps/ergochat/templates/config.yaml b/apps/ergochat/templates/config.yaml
@@ -5,6 +5,8 @@ metadata:
   labels:
     app: ergochat
 data:
+  ERGO__DATASTORE__MYSQL__USER: "ergochat"
+  ERGO__DATASTORE__MYSQL__HISTORY_DATABASE: "ergochat"
   "auth.sh": |-
     #!/bin/sh
     read input
diff --git a/apps/faf-lobby-server/templates/config.yaml b/apps/faf-lobby-server/templates/config.yaml
@@ -6,7 +6,9 @@ metadata:
     app: faf-lobby-server
 data:
   CONFIGURATION_FILE: "/config/config.yaml"
-  # Redundant, but required for rabbitmq init script
+  # Redundant, but required for rabbitmq/mariadb init script
   MQ_USER: "faf-lobby-server"
+  DB_LOGIN: "faf-python-server"
+  DB_NAME: "faf_lobby"
   "config.yaml": |-
 {{ tpl ( .Files.Get "config/config.yaml" ) . | indent 4 }}
diff --git a/apps/faf-mariadb/Chart.yaml b/apps/faf-mariadb/Chart.yaml
@@ -0,0 +1,3 @@
+apiVersion: v2
+name: faf-mariadb
+version: 1.0.0
diff --git a/apps/faf-mariadb/templates/service.yaml b/apps/faf-mariadb/templates/service.yaml
diff --git a/apps/faf-replay-server/templates/config.yaml b/apps/faf-replay-server/templates/config.yaml
@@ -8,4 +8,7 @@ data:
   RS_CONFIG_FILE: "/config/config.yaml"
   RUST_LOG: "info"
   "config.yaml": |-
-{{ tpl ( .Files.Get "config/config.yaml") . | indent 4 }}
+{{ tpl ( .Files.Get "config/config.yaml") . | indent 4 }}
+  # Just for mariadb init script! keep in sync with config file template
+  RS_DB_USERNAME: "faf-legacy-live-replay-server"
+  RS_DB_DATABASE: "faf_lobby"
diff --git a/apps/faf-user-service/templates/config.yaml b/apps/faf-user-service/templates/config.yaml
@@ -20,5 +20,6 @@ data:
   HYDRA_BASE_ADMIN_URL: "http://ory-hydra:4445"
   DB_URL: "jdbc:mariadb://mariadb:3306/faf_lobby?ssl=false"
   DB_USERNAME: "faf-user-service"
+  DB_DATABASE: "faf_lobby" # for mariadb init script
   LOBBY_URL: "wss://ws.{{.Values.baseDomain}}"
   IRC_TOKEN_TTL: "300"
diff --git a/apps/ory-hydra/templates/config.yaml b/apps/ory-hydra/templates/config.yaml
@@ -11,3 +11,6 @@ data:
   URLS_CONSENT: "https://user.{{.Values.baseDomain}}/oauth2/consent"
   STRATEGIES_ACCESS_TOKEN: "jwt"
   OAUTH2_CLIENT_CREDENTIALS_DEFAULT_GRANT_ALLOWED_SCOPE: "true"
+  # These are only used for mariadb init script, it is redundant in the DSN secret! Don't forget to also create a secret for DB_PASSWORD
+  DB_USER: "hydra"
+  DB_NAME: "hydra"
diff --git a/cluster/storage/values.yaml b/cluster/storage/values.yaml
@@ -8,6 +8,11 @@ managedStorages:
   #   pvc:
   #     name: optional string, default is <pv.name>-pvc
   #     namespace: faf-apps
+  - pv:
+      name: mariadb
+      size: 100Gi
+    pvc:
+      namespace: faf-infra
   - pv:
       name: postgres
       size: 50Gi
@@ -83,6 +88,3 @@ managedStorages:
       size: 1Gi
     pvc:
       namespace: faf-apps
-#  - name: mariadb
-#    namespace: faf-apps
-#    size: 20Gi
diff --git a/infra/mariadb/Chart.yaml b/infra/mariadb/Chart.yaml
diff --git a/infra/mariadb/templates/config.yaml b/infra/mariadb/templates/config.yaml
@@ -0,0 +1,45 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: mariadb
+  labels:
+    app: mariadb
+data:
+  "mysql.cnf": |-
+    [mariadb]
+    innodb_buffer_pool_instances = 4
+    innodb_buffer_pool_size      = 4G
+
+    #sql_mode = STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION
+
+    # Statistics
+    userstat                     = 1
+
+    plugin_load_add = query_response_time
+    query_response_time_stats = on
+
+    # ?
+    event_scheduler              = on
+
+    # Log thicc queries
+    slow_query_log               = 1
+
+    # Increase IOPS
+    innodb_io_capacity = 2000
+    innodb_io_capacity_max = 5000
+
+    # Magic Mozilla configuration
+    # https://github.com/letsencrypt/openzfs-nvme-databases
+    #innodb_checksum_algorithm    = none
+    innodb_doublewrite           = 0
+    innodb_file_per_table        = on
+    innodb_log_write_ahead_size  = 16384
+    innodb_use_native_aio        = 0
+    innodb_use_atomic_writes     = 0
+    innodb_flush_neighbors       = 0
+
+    # Enable replication features for Debezium
+    log_bin                     = mysql-bin
+    binlog_format               = ROW
+    binlog_row_image            = FULL
+    binlog_expire_logs_seconds  = 864000
diff --git a/infra/mariadb/templates/secret.yaml b/infra/mariadb/templates/secret.yaml
@@ -0,0 +1,19 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: mariadb
+  namespace: faf-infra
+spec:
+  authentication:
+    universalAuth:
+      credentialsRef:
+        secretName: infisical-machine-identity
+        secretNamespace: faf-ops
+      secretsScope:
+        projectSlug: {{.Values.infisical.projectSlug}}
+        envSlug: {{.Values.infisical.envSlug}}
+        secretsPath: "/mariadb"
+  managedSecretReference:
+    secretName: mariadb
+    secretNamespace: faf-infra
+    creationPolicy: "Owner"
diff --git a/infra/mariadb/templates/service.yaml b/infra/mariadb/templates/service.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mariadb
+  labels:
+    app: mariadb
+spec:
+  selector:
+    app: mariadb
+  ports:
+    - port: 3306
+      targetPort: 3306
diff --git a/infra/mariadb/templates/statefulset.yaml b/infra/mariadb/templates/statefulset.yaml
@@ -0,0 +1,45 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: mariadb
+  labels:
+    app: mariadb
+spec:
+  serviceName: mariadb
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: mariadb
+  template:
+    metadata:
+      labels:
+        app: mariadb
+    spec:
+      containers:
+        - image: mariadb:10.7
+          imagePullPolicy: Always
+          name: mariadb
+          ports:
+            - containerPort: 3306
+              protocol: TCP
+          envFrom:
+            - secretRef:
+                name: mariadb
+          volumeMounts:
+            - name: mariadb-pvc
+              mountPath: /var/lib/mysql
+            - name: config
+              mountPath: /etc/mysql/mariadb.conf.d/mysqld-custom.cnf
+              subPath: mysqld-custom.cnf
+            - name: config
+              mountPath: /root/.my.cnf
+              subPath: mysql.cnf
+      restartPolicy: Always
+      volumes:
+        - name: config
+          configMap:
+            name: mariadb
+        - name: mariadb-pvc
+          persistentVolumeClaim:
+            claimName: mariadb-pvc
diff --git a/scripts/init-mariadb.sh b/scripts/init-mariadb.sh
@@ -0,0 +1,48 @@
+#!/bin/sh
+# Setup rabbitmq vhost and users
+export NAMESPACE="faf-infra"
+
+# fail on errors
+set -e
+
+. ./k8s-helpers.sh
+
+check_resource_exists_or_fail secret postgres
+check_resource_exists_or_fail statefulset postgres
+check_resource_exists_or_fail pod mariadb-0
+
+MYSQL_ROOT_PASSWORD=$(get_secret_value "mariadb" "MARIADB_ROOT_PASSWORD")
+
+create_user_and_db() {
+    SERVICE_NAMESPACE=$1
+    SERVICE_NAME=$2
+    DB_USER=$(NAMESPACE=$SERVICE_NAMESPACE get_config_value "$SERVICE_NAME" "$3")
+    DB_PASSWORD=$(NAMESPACE=$SERVICE_NAMESPACE get_secret_value "$SERVICE_NAME" "$4")
+    DB_NAME=$(NAMESPACE=$SERVICE_NAMESPACE get_config_value "$SERVICE_NAME" "$5")
+    DB_OPTIONS=${6:-}
+
+    kubectl -n $NAMESPACE exec -i mariadb-0 -- mysql --user=root --password=${MYSQL_ROOT_PASSWORD} <<SQL_SCRIPT
+      CREATE DATABASE IF NOT EXISTS \`${DB_NAME}\` ${DB_OPTIONS};
+      CREATE USER IF NOT EXISTS '${DB_USER}'@'%' IDENTIFIED BY '${DB_PASSWORD}';
+      GRANT ALL PRIVILEGES ON \`${DB_NAME}\`.* TO '${DB_USER}'@'%';
+SQL_SCRIPT
+    echo "User $DB_USER created."
+}
+
+# faf_lobby database
+create_user_and_db faf-apps faf-api DATABASE_USERNAME DATABASE_PASSWORD DATABASE_NAME
+create_user_and_db faf-apps faf-user-service DB_USERNAME DB_PASSWORD DB_DATABASE
+create_user_and_db faf-apps faf-lobby-server DB_LOGIN DB_PASSWORD DB_NAME
+create_user_and_db faf-apps faf-replay-server RS_DB_USERNAME RS_DB_PASSWORD RS_DB_DATABASE
+create_user_and_db faf-apps faf-policy-server DATABASE_USER DATABASE_PASSWORD DATABASE_NAME
+
+# league database
+create_user_and_db faf-apps faf-api LEAGUE_DATABASE_USERNAME LEAGUE_DATABASE_PASSWORD LEAGUE_DATABASE_NAME
+create_user_and_db faf-apps faf-league-service DB_LOGIN DB_PASSWORD DB_NAME
+
+# others
+create_user_and_db faf-apps wordpress WORDPRESS_DB_USER WORDPRESS_DB_PASSWORD WORDPRESS_DB_NAME
+create_user_and_db faf-apps ory-hydra DB_USER DB_PASSWORD DB_NAME "CHARSET utf8mb4 COLLATE utf8mb4_unicode_ci"
+create_user_and_db faf-apps ergochat ERGO__DATASTORE__MYSQL__USER ERGO__DATASTORE__MYSQL__PASSWORD ERGO__DATASTORE__MYSQL__HISTORY_DATABASE
+
+echo "All users and databases have been processed."

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+apiVersion: v2`
	`2`	`+name: faf-mariadb`
	`3`	`+version: 1.0.0`