add helm with postgres + docs

helm-charts/infisical-standalone-postgres/.gitignore

@@ -1,4 +0,0 @@
-charts/
-node_modules/
-package*.json
-*.bak

helm-charts/infisical-standalone-postgres/.helmignore

@@ -1,23 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/

helm-charts/infisical-standalone-postgres/Chart.lock

@@ -1,6 +1,12 @@
 dependencies:
-- name: ingress-nginx
-  repository: https://kubernetes.github.io/ingress-nginx
-  version: 4.0.13
-digest: sha256:5d15260ba09f284ec40b254d79cd16bb80abd641fe14809a2de19d24c7920221
-generated: "2024-01-26T20:15:50.215645-05:00"
+  - name: ingress-nginx
+    repository: https://kubernetes.github.io/ingress-nginx
+    version: 4.0.13
+  - name: postgresql
+    repository: https://charts.bitnami.com/bitnami
+    version: 14.1.3
+  - name: redis
+    repository: https://charts.bitnami.com/bitnami
+    version: 18.14.0
+digest: sha256:296e0ef65914eea70af7e7904188b2efa37089c785305109abc70b7bed42306b
+generated: "2024-02-20T01:25:47.224526-05:00"

helm-charts/infisical-standalone-postgres/Chart.yaml

@@ -7,16 +7,24 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.0.1
+version: 1.0.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "0.0.1"
+appVersion: "1.0.0"
 
 dependencies:
   - name: ingress-nginx
     version: 4.0.13
     repository: https://kubernetes.github.io/ingress-nginx
     condition: ingress.nginx.enabled
+  - name: postgresql
+    version: 14.1.3
+    repository: https://charts.bitnami.com/bitnami
+    condition: postgresql.enabled
+  - name: redis
+    version: 18.14.0
+    repository: https://charts.bitnami.com/bitnami
+    condition: redis.enabled

helm-charts/infisical-standalone-postgres/templates/NOTES.txt

@@ -20,6 +20,8 @@
 │   Current installation (infisical) :
 │   • infisical          : {{ .Values.infisical.enabled }}
 |   • nginx              : {{ .Values.ingress.nginx.enabled }}
+|   • Postgres DB        : {{ .Values.postgresql.enabled }}
+|   • Redis              : {{ .Values.redis.enabled }}
 │
 ╰―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――┤
 

helm-charts/infisical-standalone-postgres/templates/_helpers.tpl

@@ -30,7 +30,6 @@ heritage: {{ .Release.Service }}
 {{ include "infisical.common.metaLabels" . }}
 {{- end -}}
 
-
 {{- define "infisical.labels" -}}
 {{ include "infisical.matchLabels" . }}
 {{ include "infisical.common.metaLabels" . }}
@@ -57,3 +56,52 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{- end -}}
 {{- end -}}
 {{- end -}}
+
+{{- define "infisical.postgresService" -}}
+{{- if .Values.postgresql.fullnameOverride -}}
+{{- .Values.postgresql.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-postgresql" .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "infisical.postgresDBConnectionString" -}}
+{{- $dbUsername := .Values.postgresql.auth.username -}}
+{{- $dbPassword := .Values.postgresql.auth.password -}}
+{{- $dbName := .Values.postgresql.auth.database -}}
+{{- $serviceName := include "infisical.postgresService" . -}}
+{{- printf "postgresql://%s:%s@%s:5432/%s" $dbUsername $dbPassword $serviceName $dbName -}}
+{{- end -}}
+
+{{/*
+Create a fully qualified redis name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "infisical.redis.fullname" -}}
+{{- if .Values.redis.fullnameOverride -}}
+{{- .Values.redis.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- printf "%s-%s" .Release.Name .Values.redis.name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s-%s" .Release.Name $name .Values.redis.name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+
+{{- define "infisical.redisServiceName" -}}
+{{- if .Values.redis.fullnameOverride -}}
+{{- printf "%s-master" .Values.redis.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-master" .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+
+
+{{- define "infisical.redisConnectionString" -}}
+{{- $password := .Values.redis.auth.password -}}
+{{- $serviceName := include "infisical.redisServiceName" . -}}
+{{- printf "redis://default:%s@%s:6379" $password "redis-master" -}}
+{{- end -}}

helm-charts/infisical-standalone-postgres/templates/infisical.yaml

@@ -28,10 +28,19 @@ spec:
     {{- with $infisicalValues.affinity }}
       affinity:
         {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- if $infisicalValues.autoDatabaseSchemaMigration }}
+      initContainers:
+      - name: "migration-init"
+        image: "groundnuty/k8s-wait-for:1.3"
+        imagePullPolicy: {{ $infisicalValues.image.pullPolicy }}
+        args: 
+        - "job"
+        - "{{ .Release.Name }}-schema-migration-{{ .Release.Revision }}"
     {{- end }}
       containers:
       - name: {{ template "infisical.name" . }}-{{ $infisicalValues.name }}
-        image: "{{ $infisicalValues.image.repository }}:{{ $infisicalValues.image.tag | default "latest" }}"
+        image: "{{ $infisicalValues.image.repository }}:{{ $infisicalValues.image.tag }}"
         imagePullPolicy: {{ $infisicalValues.image.pullPolicy }}
         readinessProbe:
           httpGet:
@@ -41,9 +50,18 @@ spec:
           periodSeconds: 5
         ports: 
         - containerPort: 8080
+        env:
+        {{- if .Values.postgresql.enabled }}
+        - name: DB_CONNECTION_URI
+          value: {{ include "infisical.postgresDBConnectionString" . }}
+        {{- end }}
+        {{- if .Values.redis.enabled }}
+        - name: REDIS_URL
+          value: {{ include "infisical.redisConnectionString" . }}
+        {{- end }}
         envFrom:
         - secretRef:
-            name: {{ $infisicalValues.kubeSecretRef | default (include "infisical.fullname" .) }}
+            name: {{ $infisicalValues.kubeSecretRef }}
         {{- if  $infisicalValues.resources }}
         resources: {{- toYaml $infisicalValues.resources | nindent 12 }}
         {{- end }}
@@ -66,7 +84,7 @@ spec:
   ports:
     - protocol: TCP
       port: 8080
-      targetPort: 8080 # container port 
+      targetPort: 8080
       {{- if eq $infisicalValues.service.type "NodePort" }}
       nodePort: {{ $infisicalValues.service.nodePort }}
       {{- end }}

helm-charts/infisical-standalone-postgres/templates/ingress.yaml

@@ -1,50 +0,0 @@
-{{ if .Values.ingress.enabled }}
-{{- $ingress := .Values.ingress }}
-{{- if and $ingress.ingressClassName (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
-  {{- if not (hasKey $ingress.annotations "kubernetes.io/ingress.class") }}
-  {{- $_ := set $ingress.annotations "kubernetes.io/ingress.class" $ingress.ingressClassName}}
-  {{- end }}
-{{- end }}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: infisical-ingress
-  {{- with $ingress.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  {{- if and $ingress.ingressClassName (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
-  ingressClassName: {{ $ingress.ingressClassName | default "nginx" }}
-  {{- end }}
-{{- if $ingress.tls }}
-  tls:
-  {{- range $ingress.tls }}
-    - hosts:
-      {{- range .hosts }}
-        - {{ . | quote }}
-      {{- end }}
-      secretName: {{ .secretName }}
-  {{- end }}
-{{- end }}
-  rules:
-    - http:
-        paths:
-        - path: /
-          pathType: Prefix
-          backend:
-            service:
-              name: {{ include "infisical.fullname" . }}
-              port:
-                number: 8080
-        - path: /ss-webhook
-          pathType: Exact
-          backend:
-            service:
-              name: {{ include "infisical.fullname" . }}
-              port:
-                number: 8080
-      {{- if $ingress.hostName }}
-      host: {{ $ingress.hostName }}
-      {{- end }}
-{{ end }}

helm-charts/infisical-standalone-postgres/templates/jobs-rbac.yaml

@@ -0,0 +1,20 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: k8s-wait-for-infisical-schema-migration
+rules:
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["get", "watch", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: default
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: k8s-wait-for-infisical-schema-migration
+  apiGroup: rbac.authorization.k8s.io

helm-charts/infisical-standalone-postgres/templates/schema-migration-job.yaml

@@ -0,0 +1,32 @@
+{{- $infisicalValues := .Values.infisical }}
+{{- if $infisicalValues.autoDatabaseSchemaMigration }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "{{ .Release.Name }}-schema-migration-{{ .Release.Revision }}"
+  labels:
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+spec:
+  backoffLimit: 10
+  template:
+    metadata:
+      name: "{{ .Release.Name }}-create-tables"
+      labels:
+        app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+        app.kubernetes.io/instance: {{ .Release.Name | quote }}
+        helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    spec:
+      restartPolicy: OnFailure
+      containers:
+        - name: infisical-schema-migration
+          image: "{{ $infisicalValues.image.repository }}:{{ $infisicalValues.image.tag }}"
+          command: ["npm", "run", "migration:latest"]
+          env:
+          {{- if .Values.postgresql.enabled }}
+          - name: DB_CONNECTION_URI
+            value: {{ include "infisical.postgresDBConnectionString" . }}
+          {{- end }}
+          envFrom:
+          - secretRef:
+              name: {{ $infisicalValues.kubeSecretRef }}
+{{- end }}

helm-charts/infisical-standalone-postgres/values.yaml

@@ -1,96 +1,62 @@
-## @section Common parameters
-##
-
-## @param nameOverride Override release name
-##
 nameOverride: ""
-## @param fullnameOverride Override release fullname
-##
 fullnameOverride: ""
 
-## @section Infisical backend parameters
-## Documentation : https://infisical.com/docs/self-hosting/deployments/kubernetes
-##
-
 infisical:
-  ## @param backend.enabled Enable backend
-  ##
   enabled: true
-  ## @param backend.name Backend name
-  ##
   name: infisical
-  ## @param backend.fullnameOverride Backend fullnameOverride
-  ##
+  autoDatabaseSchemaMigration: true
   fullnameOverride: ""
-  ## @param backend.podAnnotations Backend pod annotations
-  ##
   podAnnotations: {}
-  ## @param backend.deploymentAnnotations Backend deployment annotations
-  ##
   deploymentAnnotations: {}
-  ## @param backend.replicaCount Backend replica count
-  ##
   replicaCount: 2
-  ## Backend image parameters
-  ##
+
   image:
-    ## @param backend.image.repository Backend image repository
-    ##
-    repository: akhilmhdh/destruction
-    ## @param backend.image.tag Backend image tag
-    ##
-    tag: "latest"
-    ## @param backend.image.pullPolicy Backend image pullPolicy
-    ##
+    repository: infisical/infisical
+    tag: "v0.46.3-postgres"
     pullPolicy: IfNotPresent
-  ## @param backend.affinity Backend pod affinity
-  ##
+
   affinity: {}
-  ## @param backend.kubeSecretRef Backend secret resource reference name (containing required [backend configuration variables](https://infisical.com/docs/self-hosting/configuration/envars))
-  ##
-  kubeSecretRef: ""
-  ## Backend service
-  ##
+  kubeSecretRef: "infisical-secrets"
   service:
-    ## @param backend.service.annotations Backend service annotations
-    ##
     annotations: {}
-    ## @param backend.service.type Backend service type
-    ##
     type: ClusterIP
-    ## @param backend.service.nodePort Backend service nodePort (used if above type is `NodePort`)
-    ##
     nodePort: ""
 
-## @section Ingress parameters
-##
+  resources:
+    limits:
+      memory: 210Mi
+    requests:
+      cpu: 200m
 
 ingress:
-  ## @param ingress.enabled Enable ingress
-  ##
   enabled: true
-  ## @param ingress.ingressClassName Ingress class name
-  ##
+  hostName: ""
   ingressClassName: nginx
-  ## @param ingress.nginx.enabled Ingress controller
-  ##
   nginx:
     enabled: true
-  ## @param ingress.annotations Ingress annotations
-  ##
-  annotations:
-    {}
-    # kubernetes.io/ingress.class: "nginx"
-    # cert-manager.io/issuer: letsencrypt-nginx
-  ## @param ingress.hostName Ingress hostname (your custom domain name, e.g. `infisical.example.org`)
-  ## Replace with your own domain
-  ##
-  hostName: ""
-  ## @param ingress.tls Ingress TLS hosts (matching above hostName)
-  ## Replace with your own domain
-  ##
+  annotations: {}
   tls:
     []
     # - secretName: letsencrypt-prod
     #   hosts:
     #     - some.domain.com
+
+postgresql:
+  enabled: true
+  name: "postgresql"
+  fullnameOverride: "postgresql"
+  auth:
+    username: infisical
+    password: root
+    database: infisicalDB
+
+redis:
+  enabled: true
+  name: "redis"
+  fullnameOverride: "redis"
+  cluster:
+    enabled: false
+  usePassword: true
+  auth:
+    password: "mysecretpassword"
+  architecture: standalone