add helm with postgres + docs

2026-10-08 06:27:40 +00:00 · 2024-02-23 21:20:58 -05:00
parent 2142f5736c
commit 46f0fb7a41
19 changed files with 412 additions and 424 deletions
@@ -20,6 +20,8 @@
 │   Current installation (infisical) :
 │   • infisical          : {{ .Values.infisical.enabled }}
 |   • nginx              : {{ .Values.ingress.nginx.enabled }}
+|   • Postgres DB        : {{ .Values.postgresql.enabled }}
+|   • Redis              : {{ .Values.redis.enabled }}
 │
 ╰―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――┤

@@ -30,7 +30,6 @@ heritage: {{ .Release.Service }}
 {{ include "infisical.common.metaLabels" . }}
 {{- end -}}

-
 {{- define "infisical.labels" -}}
 {{ include "infisical.matchLabels" . }}
 {{ include "infisical.common.metaLabels" . }}
@@ -57,3 +56,52 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{- end -}}
 {{- end -}}
 {{- end -}}
+
+{{- define "infisical.postgresService" -}}
+{{- if .Values.postgresql.fullnameOverride -}}
+{{- .Values.postgresql.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-postgresql" .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "infisical.postgresDBConnectionString" -}}
+{{- $dbUsername := .Values.postgresql.auth.username -}}
+{{- $dbPassword := .Values.postgresql.auth.password -}}
+{{- $dbName := .Values.postgresql.auth.database -}}
+{{- $serviceName := include "infisical.postgresService" . -}}
+{{- printf "postgresql://%s:%s@%s:5432/%s" $dbUsername $dbPassword $serviceName $dbName -}}
+{{- end -}}
+
+{{/*
+Create a fully qualified redis name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "infisical.redis.fullname" -}}
+{{- if .Values.redis.fullnameOverride -}}
+{{- .Values.redis.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- printf "%s-%s" .Release.Name .Values.redis.name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s-%s" .Release.Name $name .Values.redis.name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+
+{{- define "infisical.redisServiceName" -}}
+{{- if .Values.redis.fullnameOverride -}}
+{{- printf "%s-master" .Values.redis.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-master" .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+
+
+{{- define "infisical.redisConnectionString" -}}
+{{- $password := .Values.redis.auth.password -}}
+{{- $serviceName := include "infisical.redisServiceName" . -}}
+{{- printf "redis://default:%s@%s:6379" $password "redis-master" -}}
+{{- end -}}
@@ -28,10 +28,19 @@ spec:
    {{- with $infisicalValues.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- if $infisicalValues.autoDatabaseSchemaMigration }}
+      initContainers:
+      - name: "migration-init"
+        image: "groundnuty/k8s-wait-for:1.3"
+        imagePullPolicy: {{ $infisicalValues.image.pullPolicy }}
+        args: 
+        - "job"
+        - "{{ .Release.Name }}-schema-migration-{{ .Release.Revision }}"
    {{- end }}
      containers:
      - name: {{ template "infisical.name" . }}-{{ $infisicalValues.name }}
-        image: "{{ $infisicalValues.image.repository }}:{{ $infisicalValues.image.tag | default "latest" }}"
+        image: "{{ $infisicalValues.image.repository }}:{{ $infisicalValues.image.tag }}"
        imagePullPolicy: {{ $infisicalValues.image.pullPolicy }}
        readinessProbe:
          httpGet:
@@ -41,9 +50,18 @@ spec:
          periodSeconds: 5
        ports: 
        - containerPort: 8080
+        env:
+        {{- if .Values.postgresql.enabled }}
+        - name: DB_CONNECTION_URI
+          value: {{ include "infisical.postgresDBConnectionString" . }}
+        {{- end }}
+        {{- if .Values.redis.enabled }}
+        - name: REDIS_URL
+          value: {{ include "infisical.redisConnectionString" . }}
+        {{- end }}
        envFrom:
        - secretRef:
-            name: {{ $infisicalValues.kubeSecretRef | default (include "infisical.fullname" .) }}
+            name: {{ $infisicalValues.kubeSecretRef }}
        {{- if  $infisicalValues.resources }}
        resources: {{- toYaml $infisicalValues.resources | nindent 12 }}
        {{- end }}
@@ -66,7 +84,7 @@ spec:
  ports:
    - protocol: TCP
      port: 8080
-      targetPort: 8080 # container port 
+      targetPort: 8080
      {{- if eq $infisicalValues.service.type "NodePort" }}
      nodePort: {{ $infisicalValues.service.nodePort }}
      {{- end }}
@@ -1,50 +0,0 @@
-{{ if .Values.ingress.enabled }}
-{{- $ingress := .Values.ingress }}
-{{- if and $ingress.ingressClassName (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
-  {{- if not (hasKey $ingress.annotations "kubernetes.io/ingress.class") }}
-  {{- $_ := set $ingress.annotations "kubernetes.io/ingress.class" $ingress.ingressClassName}}
-  {{- end }}
-{{- end }}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: infisical-ingress
-  {{- with $ingress.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  {{- if and $ingress.ingressClassName (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
-  ingressClassName: {{ $ingress.ingressClassName | default "nginx" }}
-  {{- end }}
-{{- if $ingress.tls }}
-  tls:
-  {{- range $ingress.tls }}
-    - hosts:
-      {{- range .hosts }}
-        - {{ . | quote }}
-      {{- end }}
-      secretName: {{ .secretName }}
-  {{- end }}
-{{- end }}
-  rules:
-    - http:
-        paths:
-        - path: /
-          pathType: Prefix
-          backend:
-            service:
-              name: {{ include "infisical.fullname" . }}
-              port:
-                number: 8080
-        - path: /ss-webhook
-          pathType: Exact
-          backend:
-            service:
-              name: {{ include "infisical.fullname" . }}
-              port:
-                number: 8080
-      {{- if $ingress.hostName }}
-      host: {{ $ingress.hostName }}
-      {{- end }}
-{{ end }}
@@ -0,0 +1,20 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: k8s-wait-for-infisical-schema-migration
+rules:
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["get", "watch", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: default
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: k8s-wait-for-infisical-schema-migration
+  apiGroup: rbac.authorization.k8s.io
@@ -0,0 +1,32 @@
+{{- $infisicalValues := .Values.infisical }}
+{{- if $infisicalValues.autoDatabaseSchemaMigration }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "{{ .Release.Name }}-schema-migration-{{ .Release.Revision }}"
+  labels:
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+spec:
+  backoffLimit: 10
+  template:
+    metadata:
+      name: "{{ .Release.Name }}-create-tables"
+      labels:
+        app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+        app.kubernetes.io/instance: {{ .Release.Name | quote }}
+        helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    spec:
+      restartPolicy: OnFailure
+      containers:
+        - name: infisical-schema-migration
+          image: "{{ $infisicalValues.image.repository }}:{{ $infisicalValues.image.tag }}"
+          command: ["npm", "run", "migration:latest"]
+          env:
+          {{- if .Values.postgresql.enabled }}
+          - name: DB_CONNECTION_URI
+            value: {{ include "infisical.postgresDBConnectionString" . }}
+          {{- end }}
+          envFrom:
+          - secretRef:
+              name: {{ $infisicalValues.kubeSecretRef }}
+{{- end }}