Skip to content

Commit 46f05e1

Browse files
batazorbatazor
committed
feat: wire apps to shared postgres
1 parent e4b918b commit 46f05e1

7 files changed

Lines changed: 160 additions & 72 deletions

File tree

‎argocd/boundaries/auth/kratos.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,10 +56,10 @@ spec:
5656
jqPathExpressions:
5757
- .spec.rules[] | select(.name|test("autogen-."))
5858
- kind: Secret
59-
name: kratos-postgres-pguser-grafana
59+
name: shortlink-postgres-pguser-grafana
6060
jqPathExpressions:
6161
- .data
6262
- kind: Secret
63-
name: kratos-postgres-pguser-kratos
63+
name: shortlink-postgres-pguser-kratos
6464
jqPathExpressions:
6565
- .data

‎argocd/boundaries/shop/common/application.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,6 @@ spec:
5050
jqPathExpressions:
5151
- .spec.rules[] | select(.name|test("autogen-."))
5252
- kind: Secret
53-
name: shop-postgres-pguser-grafana
53+
name: shortlink-postgres-pguser-grafana
5454
jqPathExpressions:
5555
- .data

‎argocd/infrastructure/kubernetes-replicator/application.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: kubernetes-replicator
5+
namespace: argocd
6+
annotations:
7+
notifications.argoproj.io/subscribe.on-sync-succeeded.slack: gitops
8+
argocd.argoproj.io/manifest-generate-paths: ./ops/Helm/addons/kubernetes-replicator
9+
finalizers:
10+
- resources-finalizer.argocd.argoproj.io
11+
spec:
12+
project: shortlink
13+
destination:
14+
name: ''
15+
namespace: kubernetes-replicator
16+
server: 'https://kubernetes.default.svc'
17+
source:
18+
path: ops/Helm/addons/kubernetes-replicator
19+
repoURL: 'https://github.com/shortlink-org/helm'
20+
targetRevision: HEAD
21+
helm:
22+
releaseName: kubernetes-replicator
23+
valueFiles:
24+
- values.yaml
25+
syncPolicy:
26+
automated:
27+
prune: true
28+
allowEmpty: true
29+
selfHeal: true
30+
managedNamespaceMetadata:
31+
labels:
32+
pod-security.kubernetes.io/enforce: privileged
33+
pod-security.kubernetes.io/enforce-version: latest
34+
syncOptions:
35+
- CreateNamespace=true
36+
- ServerSideApply=true
37+
- ApplyOutOfSyncOnly=true
38+
retry:
39+
limit: 2
40+
backoff:
41+
duration: 10s
42+
maxDuration: 3m0s
43+
factor: 2
44+
ignoreDifferences:
45+
- group: kyverno.io
46+
kind: ClusterPolicy
47+
jqPathExpressions:
48+
- .spec.rules[] | select(.name|test("autogen-."))

‎argocd/infrastructure/store/postgres-operator/application.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,3 +48,39 @@ spec:
4848
name: crunchy-postgres-exporter
4949
jqPathExpressions:
5050
- .spec.podMetricsEndpoints[] | select(.action)
51+
- kind: Secret
52+
name: shortlink-postgres-pguser-admin
53+
jqPathExpressions:
54+
- .data
55+
- kind: Secret
56+
name: shortlink-postgres-pguser-grafana
57+
jqPathExpressions:
58+
- .data
59+
- kind: Secret
60+
name: shortlink-postgres-pguser-kratos
61+
jqPathExpressions:
62+
- .data
63+
- kind: Secret
64+
name: shortlink-postgres-pguser-shop
65+
jqPathExpressions:
66+
- .data
67+
- kind: Secret
68+
name: shortlink-postgres-pguser-oms
69+
jqPathExpressions:
70+
- .data
71+
- kind: Secret
72+
name: shortlink-postgres-pguser-delivery
73+
jqPathExpressions:
74+
- .data
75+
- kind: Secret
76+
name: shortlink-postgres-pguser-temporal
77+
jqPathExpressions:
78+
- .data
79+
- kind: Secret
80+
name: shortlink-postgres-pguser-spicedb
81+
jqPathExpressions:
82+
- .data
83+
- kind: Secret
84+
name: shortlink-postgres-pguser-partman
85+
jqPathExpressions:
86+
- .data

‎argocd/kustomize/auth/spicedb-operator/kustomization.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,8 @@ resources:
66
- https://github.com/authzed/spicedb-operator/config?ref=v1.24.0
77
- spicedb/secret.yaml
88
- spicedb/spiceDBCluster.yaml
9-
- spicedb/postgres-operator.yaml
9+
# PostgresCluster moved to the shared postgres-operator chart.
10+
# - spicedb/postgres-operator.yaml
1011
- spicedb/grpcRoute.yaml
1112

1213
images:

‎argocd/kustomize/auth/spicedb-operator/spicedb/postgres-operator.yaml‎

Lines changed: 68 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -1,65 +1,68 @@
1-
apiVersion: postgres-operator.crunchydata.com/v1
2-
kind: PostgresCluster
3-
metadata:
4-
name: spicedb-postgres
5-
annotations:
6-
argocd.argoproj.io/sync-wave: "1"
7-
spec:
8-
postgresVersion: 18
9-
metadata:
10-
annotations:
11-
sidecar.istio.io/inject: "false"
12-
instances:
13-
- name: spicedb
14-
replicas: 1
15-
metadata:
16-
annotations:
17-
sidecar.istio.io/inject: "false"
18-
dataVolumeClaimSpec:
19-
storageClassName: local-path
20-
accessModes:
21-
- "ReadWriteOnce"
22-
resources:
23-
requests:
24-
storage: 1Gi
25-
# NOTE: wait new version chart > 5.6.0
26-
# limit:
27-
# storage: 2Gi
28-
patroni:
29-
dynamicConfiguration:
30-
postgresql:
31-
parameters:
32-
track_commit_timestamp: "on"
33-
# TODO: enable pgmonitor_bgw
34-
shared_preload_libraries: pg_stat_statements,auto_explain,pgaudit
35-
pgmonitor_bgw.dbname: postgres,spicedb
36-
pgmonitor_bgw.role: "postgres"
37-
# backups:
38-
# pgbackrest:
39-
# metadata:
40-
# annotations:
41-
# sidecar.istio.io/inject: "false"
42-
# repos:
43-
# - name: repo1
44-
# volume:
45-
# volumeClaimSpec:
46-
# storageClassName: local-path
47-
# accessModes:
48-
# - "ReadWriteOnce"
49-
# resources:
50-
# requests:
51-
# storage: 1Gi
52-
monitoring:
53-
pgmonitor:
54-
exporter:
55-
image: registry.developers.crunchydata.com/crunchydata/crunchy-postgres-exporter:latest
56-
users:
57-
- name: admin
58-
databases:
59-
- postgres
60-
- spicedb
61-
options: "SUPERUSER"
62-
- name: spicedb
63-
databases:
64-
- spicedb
65-
options: "SUPERUSER"
1+
# Legacy per-application PostgresCluster.
2+
# The live SpiceDB database now uses shortlink-postgres from the shared postgres-operator chart.
3+
#
4+
# apiVersion: postgres-operator.crunchydata.com/v1
5+
# kind: PostgresCluster
6+
# metadata:
7+
# name: spicedb-postgres
8+
# annotations:
9+
# argocd.argoproj.io/sync-wave: "1"
10+
# spec:
11+
# postgresVersion: 18
12+
# metadata:
13+
# annotations:
14+
# sidecar.istio.io/inject: "false"
15+
# instances:
16+
# - name: spicedb
17+
# replicas: 1
18+
# metadata:
19+
# annotations:
20+
# sidecar.istio.io/inject: "false"
21+
# dataVolumeClaimSpec:
22+
# storageClassName: local-path
23+
# accessModes:
24+
# - "ReadWriteOnce"
25+
# resources:
26+
# requests:
27+
# storage: 1Gi
28+
# # NOTE: wait new version chart > 5.6.0
29+
# # limit:
30+
# # storage: 2Gi
31+
# patroni:
32+
# dynamicConfiguration:
33+
# postgresql:
34+
# parameters:
35+
# track_commit_timestamp: "on"
36+
# # TODO: enable pgmonitor_bgw
37+
# shared_preload_libraries: pg_stat_statements,auto_explain,pgaudit
38+
# pgmonitor_bgw.dbname: postgres,spicedb
39+
# pgmonitor_bgw.role: "postgres"
40+
# # backups:
41+
# # pgbackrest:
42+
# # metadata:
43+
# # annotations:
44+
# # sidecar.istio.io/inject: "false"
45+
# # repos:
46+
# # - name: repo1
47+
# # volume:
48+
# # volumeClaimSpec:
49+
# # storageClassName: local-path
50+
# # accessModes:
51+
# # - "ReadWriteOnce"
52+
# # resources:
53+
# # requests:
54+
# # storage: 1Gi
55+
# monitoring:
56+
# pgmonitor:
57+
# exporter:
58+
# image: registry.developers.crunchydata.com/crunchydata/crunchy-postgres-exporter:latest
59+
# users:
60+
# - name: admin
61+
# databases:
62+
# - postgres
63+
# - spicedb
64+
# options: "SUPERUSER"
65+
# - name: spicedb
66+
# databases:
67+
# - spicedb
68+
# options: "SUPERUSER"

‎argocd/kustomize/auth/spicedb-operator/spicedb/spiceDBCluster.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ kind: SpiceDBCluster
33
metadata:
44
name: shortlink
55
annotations:
6-
# After PostgresCluster (wave 1): needs spicedb-postgres-pguser-spicedb secret.
6+
# After shared PostgresCluster (wave 1): needs shortlink-postgres-pguser-spicedb secret.
77
argocd.argoproj.io/sync-wave: "2"
88
spec:
99
config:
@@ -59,7 +59,7 @@ spec:
5959
- name: SPICEDB_DATASTORE_CONN_URI
6060
valueFrom:
6161
secretKeyRef:
62-
name: spicedb-postgres-pguser-spicedb
62+
name: shortlink-postgres-pguser-spicedb
6363
key: uri
6464

6565
- name: SPICEDB_DISPATCH_CACHE_METRICS
@@ -99,5 +99,5 @@ spec:
9999
- name: SPICEDB_DATASTORE_CONN_URI
100100
valueFrom:
101101
secretKeyRef:
102-
name: spicedb-postgres-pguser-spicedb
102+
name: shortlink-postgres-pguser-spicedb
103103
key: uri

0 commit comments

Comments
 (0)