feat: Add PostgreSQL support and enhance Helm chart annotations

- Implemented PostgreSQL support in backup cronjob, statefulsets, and other templates.
- Added common annotations for better resource management and identification.
- Introduced external database CIDR configuration for network policies.
- Enhanced validation checks for external database usage and resource requests.
- Created a new PVC template for backup storage.
- Updated values.yaml and values.schema.json to accommodate new configurations.

Author: fabioluciano

charts/devlake/templates/_helpers.tpl

@@ -40,6 +40,15 @@ helm.sh/chart: {{ include "devlake.chart" . }}
 app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{- end }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
+app.kubernetes.io/part-of: devlake
+{{- end -}}
+
+{{/*
+Common annotations
+*/}}
+{{- define "devlake.annotations" -}}
+meta.helm.sh/release-name: {{ .Release.Name }}
+meta.helm.sh/release-namespace: {{ .Release.Namespace }}
 {{- end -}}
 
 {{/*
@@ -66,8 +75,10 @@ Create the name of the service account to use
 {{- define "devlake.serviceAccountName" -}}
 {{- if .Values.serviceAccount.name -}}
 {{- .Values.serviceAccount.name -}}
-{{- else -}}
+{{- else if .Values.serviceAccount.create -}}
 {{- include "devlake.fullname" . }}-sa
+{{- else -}}
+default
 {{- end -}}
 {{- end -}}
 

charts/devlake/templates/backup-cronjob.yaml

@@ -21,6 +21,9 @@ metadata:
   name: {{ include "devlake.fullname" . }}-backup
   labels:
     {{- include "devlake.labels" . | nindent 4 }}
+    app.kubernetes.io/component: backup
+  annotations:
+    {{- include "devlake.annotations" . | nindent 4 }}
 spec:
   schedule: "{{ .Values.backup.schedule }}"
   successfulJobsHistoryLimit: {{ .Values.backup.successfulJobsHistoryLimit }}
@@ -45,7 +48,11 @@ spec:
               type: RuntimeDefault
           containers:
           - name: backup
+            {{- if eq .Values.database.type "mysql" }}
             image: "{{ .Values.backup.image.repository }}:{{ .Values.backup.image.tag }}"
+            {{- else if eq .Values.database.type "postgresql" }}
+            image: "postgres:{{ .Values.backup.image.postgresTag | default "14" }}"
+            {{- end }}
             imagePullPolicy: {{ .Values.backup.image.pullPolicy }}
             securityContext:
               readOnlyRootFilesystem: true
@@ -69,10 +76,10 @@ spec:
               echo "Starting backup at ${TIMESTAMP}..."
 
               {{- if eq .Values.database.type "mysql" }}
-              mysqldump -h$(MYSQL_SERVER) -P$(MYSQL_PORT) -u$(MYSQL_USER) -p$(MYSQL_PASSWORD) $(MYSQL_DATABASE) \
+              mysqldump -h"${MYSQL_SERVER}" -P"${MYSQL_PORT}" -u"${MYSQL_USER}" -p"${MYSQL_PASSWORD}" "${MYSQL_DATABASE}" \
                 --single-transaction --quick --lock-tables=false | gzip > "${BACKUP_FILE}"
               {{- else if eq .Values.database.type "postgresql" }}
-              PGPASSWORD=$(DB_PASSWORD) pg_dump -h $(DB_SERVER) -p $(DB_PORT) -U $(DB_USER) $(DB_DATABASE) \
+              PGPASSWORD="${DB_PASSWORD}" pg_dump -h "${DB_SERVER}" -p "${DB_PORT}" -U "${DB_USER}" "${DB_DATABASE}" \
                 --no-owner --no-acl | gzip > "${BACKUP_FILE}"
               {{- end }}
 

charts/devlake/templates/backup-pvc.yaml

@@ -0,0 +1,36 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+{{- if and .Values.backup.enabled (not .Values.backup.pvc.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "devlake.fullname" . }}-backup
+  labels:
+    {{- include "devlake.labels" . | nindent 4 }}
+    app.kubernetes.io/component: storage
+  annotations:
+    {{- include "devlake.annotations" . | nindent 4 }}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  {{- with .Values.backup.pvc.storageClassName }}
+  storageClassName: "{{ . }}"
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.backup.pvc.size | default "10Gi" }}
+{{- end }}

charts/devlake/templates/configmap.yaml

@@ -21,8 +21,15 @@ metadata:
   name: {{ include "devlake.db.configmap" . }}
   labels:
     {{- include "devlake.labels" . | nindent 4 }}
+    app.kubernetes.io/component: config
+  annotations:
+    {{- include "devlake.annotations" . | nindent 4 }}
 data:
   # Database connection configuration (non-sensitive)
+  # Note: Environment variable naming differs by database type:
+  #   - MySQL: MYSQL_* prefix (standard MySQL client convention)
+  #   - PostgreSQL: DB_* prefix (PostgreSQL client convention)
+  # This follows each database's standard naming to avoid conflicts
 {{- if eq .Values.database.type "mysql" }}
   MYSQL_USER: "{{ .Values.database.username }}"
   MYSQL_DATABASE: "{{ .Values.database.database }}"

charts/devlake/templates/deployments.yaml

@@ -22,9 +22,12 @@ metadata:
   name: {{ include "devlake.fullname" . }}-ui
   labels:
     {{- include "devlake.labels" . | nindent 4 }}
+    app.kubernetes.io/component: ui
     {{- with .Values.ui.deployment.extraLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+  annotations:
+    {{- include "devlake.annotations" . | nindent 4 }}
 spec:
   replicas: {{ .Values.ui.replicaCount }}
   revisionHistoryLimit: {{ .Values.ui.revisionHistoryLimit }}
@@ -127,10 +130,13 @@ kind: Deployment
 metadata:
   name: {{ include "devlake.fullname" . }}-lake
   labels:
-  {{- include "devlake.labels" . | nindent 4 }}
-  {{- with .Values.lake.deployment.extraLabels }}
-  {{- toYaml . | nindent 4 }}
-  {{- end }}
+    {{- include "devlake.labels" . | nindent 4 }}
+    app.kubernetes.io/component: lake
+    {{- with .Values.lake.deployment.extraLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  annotations:
+    {{- include "devlake.annotations" . | nindent 4 }}
 spec:
   replicas: {{ .Values.lake.replicaCount }}
   revisionHistoryLimit: {{ .Values.lake.revisionHistoryLimit }}
@@ -257,11 +263,6 @@ spec:
         - {{- $volume | toYaml | nindent 10 }}
         {{- end }}
       {{- end }}
-      {{- if .Values.lake.hostNetwork }}
-      # DEPRECATED in 2.1.0. Will be removed in 2.2.0.
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-      {{- end }}
       {{- with .Values.lake.nodeSelector }}
       nodeSelector:
       {{- toYaml . | nindent 8 }}

charts/devlake/templates/external-secret.yaml

@@ -22,6 +22,9 @@ metadata:
   name: {{ include "devlake.fullname" . }}-external-secret
   labels:
     {{- include "devlake.labels" . | nindent 4 }}
+    app.kubernetes.io/component: secret
+  annotations:
+    {{- include "devlake.annotations" . | nindent 4 }}
 spec:
   secretStoreRef:
     name: {{ .Values.externalSecrets.secretStoreRef.name }}

charts/devlake/templates/hpa.yaml

@@ -22,6 +22,9 @@ metadata:
   name: {{ include "devlake.fullname" . }}-lake
   labels:
     {{- include "devlake.labels" . | nindent 4 }}
+    app.kubernetes.io/component: lake
+  annotations:
+    {{- include "devlake.annotations" . | nindent 4 }}
 spec:
   scaleTargetRef:
     apiVersion: apps/v1
@@ -45,6 +48,9 @@ metadata:
   name: {{ include "devlake.fullname" . }}-ui
   labels:
     {{- include "devlake.labels" . | nindent 4 }}
+    app.kubernetes.io/component: ui
+  annotations:
+    {{- include "devlake.annotations" . | nindent 4 }}
 spec:
   scaleTargetRef:
     apiVersion: apps/v1

charts/devlake/templates/ingresses.yaml

@@ -35,10 +35,12 @@ metadata:
   name: {{ $fullName }}
   labels:
     {{- include "devlake.labels" . | nindent 4 }}
+    app.kubernetes.io/component: ingress
     {{- with .Values.ingress.extraLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
   annotations:
+    {{- include "devlake.annotations" . | nindent 4 }}
   {{- if .Values.ingress.useDefaultNginx }}
     nginx.ingress.kubernetes.io/rate-limit: {{ .Values.ingress.rateLimit | quote }}
   {{- end }}

charts/devlake/templates/networkpolicy-database.yaml

@@ -22,6 +22,9 @@ metadata:
   name: {{ include "devlake.fullname" . }}-database
   labels:
     {{- include "devlake.labels" . | nindent 4 }}
+    app.kubernetes.io/component: network-policy
+  annotations:
+    {{- include "devlake.annotations" . | nindent 4 }}
 spec:
   podSelector:
     matchLabels:
@@ -37,14 +40,14 @@ spec:
       ports:
         - protocol: TCP
           port: {{ if eq .Values.database.type "mysql" }}3306{{ else }}5432{{ end }}
-{{- if .Values.grafana.enabled }}
-    # Grafana dashboard access (when grafana.enabled=true)
+{{- if and .Values.grafana.enabled (eq .Values.database.type "mysql") }}
+    # Grafana dashboard access (only for MySQL - Grafana dashboards don't support PostgreSQL datasources)
     - from:
         - podSelector:
             matchLabels:
               app.kubernetes.io/name: grafana
       ports:
         - protocol: TCP
-          port: {{ if eq .Values.database.type "mysql" }}3306{{ else }}5432{{ end }}
+          port: 3306
 {{- end }}
 {{- end }}

charts/devlake/templates/networkpolicy-lake.yaml

@@ -22,6 +22,9 @@ metadata:
   name: {{ include "devlake.fullname" . }}-lake
   labels:
     {{- include "devlake.labels" . | nindent 4 }}
+    app.kubernetes.io/component: network-policy
+  annotations:
+    {{- include "devlake.annotations" . | nindent 4 }}
 spec:
   podSelector:
     matchLabels:
@@ -39,21 +42,37 @@ spec:
           port: 8080
   egress:
     # Database access
+{{- if .Values.database.useExternal }}
+    # External database access
+    - to:
+{{- if .Values.networkPolicy.externalDatabaseCIDRs }}
+{{- range .Values.networkPolicy.externalDatabaseCIDRs }}
+        - ipBlock:
+            cidr: {{ . }}
+{{- end }}
+{{- else }}
+        - ipBlock:
+            cidr: 0.0.0.0/0
+{{- end }}
+      ports:
+        - protocol: TCP
+          port: {{ include "database.port" . }}
+{{- else }}
+    # Internal database access
     - to:
         - podSelector:
             matchLabels:
               devlakeComponent: {{ if eq .Values.database.type "mysql" }}mysql{{ else }}postgresql{{ end }}
       ports:
         - protocol: TCP
           port: {{ if eq .Values.database.type "mysql" }}3306{{ else }}5432{{ end }}
-    # DNS resolution (scoped to kube-dns pods in kube-system)
+{{- end }}
+    # DNS resolution
+    # Allow DNS to kube-system namespace (supports both kube-dns and CoreDNS)
     - to:
         - namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
       ports:
         - protocol: UDP
           port: 53