From f3c9d4c26941483cec5f95d275adfe328b1af0dc Mon Sep 17 00:00:00 2001 From: mcgin314 Date: Thu, 13 Mar 2025 14:33:58 -0400 Subject: [PATCH 01/67] Set modules --- main.tf | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/main.tf b/main.tf index 8c1ac82..b775da0 100644 --- a/main.tf +++ b/main.tf @@ -19,15 +19,15 @@ resource "kubernetes_namespace" "keycloak" { } module "service_account" { - #source = "git@github.it.census.gov:SOA/tfmod-config-job.git//service-account?ref=1.0.0" - source = "git@github.it.census.gov:SOA/tfmod-config-job.git//service-account" + # tflint-ignore: terraform_module_pinned_source + source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//service-account" namespace = kubernetes_namespace.keycloak.metadata[0].name } module "pre_install" { - #source = "git@github.it.census.gov:SOA/tfmod-config-job.git//config-job?ref=1.0.0" - source = "git@github.it.census.gov:SOA/tfmod-config-job.git//config-job" + # tflint-ignore: terraform_module_pinned_source + source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job" namespace = kubernetes_namespace.keycloak.metadata[0].name service_account_name = module.service_account.service_account_name @@ -53,8 +53,9 @@ resource "helm_release" "keycloak" { } module "service-ingress" { - #source = "git@github.it.census.gov:SOA/tfmod-service-ingress-istio-simple.git/?ref=1.0.0" - source = "git@github.it.census.gov:SOA/tfmod-service-ingress-istio-simple.git/" + # tflint-ignore: terraform_module_version + # tflint-ignore: terraform_module_pinned_source + source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-istio-service-ingress.git?ref=main" publicHostname = var.keycloak_hostname publicDomain = var.cluster_domain From 7ca5f679a3e33382674231cee03d095a731ca133 Mon Sep 17 00:00:00 2001 From: mcgin314 Date: Thu, 10 Apr 2025 11:02:30 -0400 Subject: [PATCH 02/67] Switch to keycloak x, create intial working version --- .cz.yaml | 10 + .github/workflows/terraform-ci.yml | 104 + .gitignore | 1 - .pre-commit-config.yaml | 109 + README.md | 118 + charts/keycloakx/.bumpversion.cfg | 7 + charts/keycloakx/.helmignore | 25 + charts/keycloakx/Chart.yaml | 23 + charts/keycloakx/OWNERS | 4 + charts/keycloakx/README.md | 596 ++++ charts/keycloakx/ci/h2-values.yaml | 35 + .../examples/postgresql-kubeping/Dockerfile | 9 + .../cache-ispn-kubeping.xml | 86 + .../keycloak-db-values.yaml | 7 + .../keycloak-server-values.yaml | 66 + .../examples/postgresql-kubeping/readme.md | 79 + .../postgresql/keycloak-db-values.yaml | 7 + .../postgresql/keycloak-server-values.yaml | 46 + .../keycloakx/examples/postgresql/readme.md | 43 + charts/keycloakx/examples/readme.md | 10 + charts/keycloakx/templates/NOTES.txt | 61 + charts/keycloakx/templates/_helpers.tpl | 76 + .../templates/configmap-startup.yaml | 14 + .../keycloakx/templates/database-secret.yaml | 12 + charts/keycloakx/templates/hpa.yaml | 23 + charts/keycloakx/templates/ingress.yaml | 112 + charts/keycloakx/templates/networkpolicy.yaml | 52 + .../templates/poddisruptionbudget.yaml | 14 + .../keycloakx/templates/prometheusrule.yaml | 29 + charts/keycloakx/templates/rbac.yaml | 27 + charts/keycloakx/templates/route.yaml | 39 + charts/keycloakx/templates/secrets.yaml | 30 + .../keycloakx/templates/service-headless.yaml | 24 + charts/keycloakx/templates/service-http.yaml | 62 + .../keycloakx/templates/serviceaccount.yaml | 47 + .../keycloakx/templates/servicemonitor.yaml | 42 + charts/keycloakx/templates/statefulset.yaml | 235 ++ .../templates/test/configmap-test.yaml | 76 + charts/keycloakx/templates/test/pod-test.yaml | 45 + charts/keycloakx/values.schema.json | 512 ++++ charts/keycloakx/values.yaml | 546 ++++ charts/postgresql/.helmignore | 25 + charts/postgresql/CHANGELOG.md | 2387 +++++++++++++++++ charts/postgresql/Chart.lock | 6 + charts/postgresql/Chart.yaml | 39 + charts/postgresql/README.md | 1140 ++++++++ charts/postgresql/charts/common/.helmignore | 26 + charts/postgresql/charts/common/CHANGELOG.md | 639 +++++ charts/postgresql/charts/common/Chart.yaml | 26 + charts/postgresql/charts/common/README.md | 235 ++ .../charts/common/templates/_affinities.tpl | 155 ++ .../charts/common/templates/_capabilities.tpl | 253 ++ .../common/templates/_compatibility.tpl | 46 + .../charts/common/templates/_errors.tpl | 85 + .../charts/common/templates/_images.tpl | 115 + .../charts/common/templates/_ingress.tpl | 73 + .../charts/common/templates/_labels.tpl | 46 + .../charts/common/templates/_names.tpl | 71 + .../charts/common/templates/_resources.tpl | 50 + .../charts/common/templates/_secrets.tpl | 192 ++ .../charts/common/templates/_storage.tpl | 21 + .../charts/common/templates/_tplvalues.tpl | 52 + .../charts/common/templates/_utils.tpl | 77 + .../charts/common/templates/_warnings.tpl | 109 + .../templates/validations/_cassandra.tpl | 51 + .../common/templates/validations/_mariadb.tpl | 108 + .../common/templates/validations/_mongodb.tpl | 67 + .../common/templates/validations/_mysql.tpl | 67 + .../templates/validations/_postgresql.tpl | 105 + .../common/templates/validations/_redis.tpl | 48 + .../templates/validations/_validations.tpl | 51 + charts/postgresql/charts/common/values.yaml | 8 + charts/postgresql/templates/NOTES.txt | 121 + charts/postgresql/templates/_helpers.tpl | 455 ++++ .../postgresql/templates/backup/cronjob.yaml | 138 + .../templates/backup/networkpolicy.yaml | 32 + charts/postgresql/templates/backup/pvc.yaml | 34 + charts/postgresql/templates/extra-list.yaml | 9 + .../templates/primary/configmap.yaml | 26 + .../templates/primary/extended-configmap.yaml | 20 + .../primary/initialization-configmap.yaml | 17 + .../templates/primary/metrics-configmap.yaml | 18 + .../templates/primary/metrics-svc.yaml | 31 + .../templates/primary/networkpolicy.yaml | 78 + charts/postgresql/templates/primary/pdb.yaml | 29 + .../primary/preinitialization-configmap.yaml | 17 + .../templates/primary/servicemonitor.yaml | 46 + .../templates/primary/statefulset.yaml | 705 +++++ .../templates/primary/svc-headless.yaml | 31 + charts/postgresql/templates/primary/svc.yaml | 54 + .../postgresql/templates/prometheusrule.yaml | 22 + charts/postgresql/templates/psp.yaml | 42 + .../templates/read/extended-configmap.yaml | 20 + .../templates/read/metrics-configmap.yaml | 18 + .../templates/read/metrics-svc.yaml | 31 + .../templates/read/networkpolicy.yaml | 80 + charts/postgresql/templates/read/pdb.yaml | 29 + .../templates/read/servicemonitor.yaml | 46 + .../templates/read/statefulset.yaml | 588 ++++ .../templates/read/svc-headless.yaml | 33 + charts/postgresql/templates/read/svc.yaml | 56 + charts/postgresql/templates/role.yaml | 32 + charts/postgresql/templates/rolebinding.yaml | 24 + charts/postgresql/templates/secrets.yaml | 120 + .../postgresql/templates/serviceaccount.yaml | 18 + charts/postgresql/templates/tls-secrets.yaml | 30 + .../templates/update-password/job.yaml | 235 ++ .../templates/update-password/new-secret.yaml | 32 + .../update-password/previous-secret.yaml | 32 + charts/postgresql/values.schema.json | 156 ++ charts/postgresql/values.yaml | 1924 +++++++++++++ copy_images.tf | 74 +- data.tf | 27 + database.tf.off | 85 + examples/complete/main.tf | 22 + keycloak-db-values.yaml | 33 + keycloak-server-values.yaml | 66 + keycloak-values.yaml.tmpl | 73 - main.tf | 177 +- outputs.tf | 66 +- requirements.tf | 20 +- variables.tf | 100 +- version.tf | 4 + 123 files changed, 15816 insertions(+), 196 deletions(-) create mode 100644 .cz.yaml create mode 100644 .github/workflows/terraform-ci.yml create mode 100644 .pre-commit-config.yaml create mode 100644 charts/keycloakx/.bumpversion.cfg create mode 100644 charts/keycloakx/.helmignore create mode 100644 charts/keycloakx/Chart.yaml create mode 100644 charts/keycloakx/OWNERS create mode 100644 charts/keycloakx/README.md create mode 100644 charts/keycloakx/ci/h2-values.yaml create mode 100644 charts/keycloakx/examples/postgresql-kubeping/Dockerfile create mode 100644 charts/keycloakx/examples/postgresql-kubeping/cache-ispn-kubeping.xml create mode 100644 charts/keycloakx/examples/postgresql-kubeping/keycloak-db-values.yaml create mode 100644 charts/keycloakx/examples/postgresql-kubeping/keycloak-server-values.yaml create mode 100644 charts/keycloakx/examples/postgresql-kubeping/readme.md create mode 100644 charts/keycloakx/examples/postgresql/keycloak-db-values.yaml create mode 100644 charts/keycloakx/examples/postgresql/keycloak-server-values.yaml create mode 100644 charts/keycloakx/examples/postgresql/readme.md create mode 100644 charts/keycloakx/examples/readme.md create mode 100644 charts/keycloakx/templates/NOTES.txt create mode 100644 charts/keycloakx/templates/_helpers.tpl create mode 100644 charts/keycloakx/templates/configmap-startup.yaml create mode 100644 charts/keycloakx/templates/database-secret.yaml create mode 100644 charts/keycloakx/templates/hpa.yaml create mode 100644 charts/keycloakx/templates/ingress.yaml create mode 100644 charts/keycloakx/templates/networkpolicy.yaml create mode 100644 charts/keycloakx/templates/poddisruptionbudget.yaml create mode 100644 charts/keycloakx/templates/prometheusrule.yaml create mode 100644 charts/keycloakx/templates/rbac.yaml create mode 100644 charts/keycloakx/templates/route.yaml create mode 100644 charts/keycloakx/templates/secrets.yaml create mode 100644 charts/keycloakx/templates/service-headless.yaml create mode 100644 charts/keycloakx/templates/service-http.yaml create mode 100644 charts/keycloakx/templates/serviceaccount.yaml create mode 100644 charts/keycloakx/templates/servicemonitor.yaml create mode 100644 charts/keycloakx/templates/statefulset.yaml create mode 100644 charts/keycloakx/templates/test/configmap-test.yaml create mode 100644 charts/keycloakx/templates/test/pod-test.yaml create mode 100644 charts/keycloakx/values.schema.json create mode 100644 charts/keycloakx/values.yaml create mode 100644 charts/postgresql/.helmignore create mode 100644 charts/postgresql/CHANGELOG.md create mode 100644 charts/postgresql/Chart.lock create mode 100644 charts/postgresql/Chart.yaml create mode 100644 charts/postgresql/README.md create mode 100644 charts/postgresql/charts/common/.helmignore create mode 100644 charts/postgresql/charts/common/CHANGELOG.md create mode 100644 charts/postgresql/charts/common/Chart.yaml create mode 100644 charts/postgresql/charts/common/README.md create mode 100644 charts/postgresql/charts/common/templates/_affinities.tpl create mode 100644 charts/postgresql/charts/common/templates/_capabilities.tpl create mode 100644 charts/postgresql/charts/common/templates/_compatibility.tpl create mode 100644 charts/postgresql/charts/common/templates/_errors.tpl create mode 100644 charts/postgresql/charts/common/templates/_images.tpl create mode 100644 charts/postgresql/charts/common/templates/_ingress.tpl create mode 100644 charts/postgresql/charts/common/templates/_labels.tpl create mode 100644 charts/postgresql/charts/common/templates/_names.tpl create mode 100644 charts/postgresql/charts/common/templates/_resources.tpl create mode 100644 charts/postgresql/charts/common/templates/_secrets.tpl create mode 100644 charts/postgresql/charts/common/templates/_storage.tpl create mode 100644 charts/postgresql/charts/common/templates/_tplvalues.tpl create mode 100644 charts/postgresql/charts/common/templates/_utils.tpl create mode 100644 charts/postgresql/charts/common/templates/_warnings.tpl create mode 100644 charts/postgresql/charts/common/templates/validations/_cassandra.tpl create mode 100644 charts/postgresql/charts/common/templates/validations/_mariadb.tpl create mode 100644 charts/postgresql/charts/common/templates/validations/_mongodb.tpl create mode 100644 charts/postgresql/charts/common/templates/validations/_mysql.tpl create mode 100644 charts/postgresql/charts/common/templates/validations/_postgresql.tpl create mode 100644 charts/postgresql/charts/common/templates/validations/_redis.tpl create mode 100644 charts/postgresql/charts/common/templates/validations/_validations.tpl create mode 100644 charts/postgresql/charts/common/values.yaml create mode 100644 charts/postgresql/templates/NOTES.txt create mode 100644 charts/postgresql/templates/_helpers.tpl create mode 100644 charts/postgresql/templates/backup/cronjob.yaml create mode 100644 charts/postgresql/templates/backup/networkpolicy.yaml create mode 100644 charts/postgresql/templates/backup/pvc.yaml create mode 100644 charts/postgresql/templates/extra-list.yaml create mode 100644 charts/postgresql/templates/primary/configmap.yaml create mode 100644 charts/postgresql/templates/primary/extended-configmap.yaml create mode 100644 charts/postgresql/templates/primary/initialization-configmap.yaml create mode 100644 charts/postgresql/templates/primary/metrics-configmap.yaml create mode 100644 charts/postgresql/templates/primary/metrics-svc.yaml create mode 100644 charts/postgresql/templates/primary/networkpolicy.yaml create mode 100644 charts/postgresql/templates/primary/pdb.yaml create mode 100644 charts/postgresql/templates/primary/preinitialization-configmap.yaml create mode 100644 charts/postgresql/templates/primary/servicemonitor.yaml create mode 100644 charts/postgresql/templates/primary/statefulset.yaml create mode 100644 charts/postgresql/templates/primary/svc-headless.yaml create mode 100644 charts/postgresql/templates/primary/svc.yaml create mode 100644 charts/postgresql/templates/prometheusrule.yaml create mode 100644 charts/postgresql/templates/psp.yaml create mode 100644 charts/postgresql/templates/read/extended-configmap.yaml create mode 100644 charts/postgresql/templates/read/metrics-configmap.yaml create mode 100644 charts/postgresql/templates/read/metrics-svc.yaml create mode 100644 charts/postgresql/templates/read/networkpolicy.yaml create mode 100644 charts/postgresql/templates/read/pdb.yaml create mode 100644 charts/postgresql/templates/read/servicemonitor.yaml create mode 100644 charts/postgresql/templates/read/statefulset.yaml create mode 100644 charts/postgresql/templates/read/svc-headless.yaml create mode 100644 charts/postgresql/templates/read/svc.yaml create mode 100644 charts/postgresql/templates/role.yaml create mode 100644 charts/postgresql/templates/rolebinding.yaml create mode 100644 charts/postgresql/templates/secrets.yaml create mode 100644 charts/postgresql/templates/serviceaccount.yaml create mode 100644 charts/postgresql/templates/tls-secrets.yaml create mode 100644 charts/postgresql/templates/update-password/job.yaml create mode 100644 charts/postgresql/templates/update-password/new-secret.yaml create mode 100644 charts/postgresql/templates/update-password/previous-secret.yaml create mode 100644 charts/postgresql/values.schema.json create mode 100644 charts/postgresql/values.yaml create mode 100644 data.tf create mode 100644 database.tf.off create mode 100644 examples/complete/main.tf create mode 100644 keycloak-db-values.yaml create mode 100644 keycloak-server-values.yaml delete mode 100644 keycloak-values.yaml.tmpl create mode 100644 version.tf diff --git a/.cz.yaml b/.cz.yaml new file mode 100644 index 0000000..012238e --- /dev/null +++ b/.cz.yaml @@ -0,0 +1,10 @@ +--- +commitizen: + name: cz_conventional_commits + tag_format: v$version + version: 0.1.0 + version_files: + - version.tf:module_version + bump_message: "bump: version $current_version → $new_version" + changelog_incremental: true + update_changelog_on_bump: true diff --git a/.github/workflows/terraform-ci.yml b/.github/workflows/terraform-ci.yml new file mode 100644 index 0000000..cf3f91c --- /dev/null +++ b/.github/workflows/terraform-ci.yml @@ -0,0 +1,104 @@ +name: 'Terraform Module CI' + +on: + push: + branches: + - main + paths: + - '**/*.tf' + pull_request: + branches: + - main + paths: + - '**/*.tf' + workflow_dispatch: + +permissions: + contents: read + pull-requests: write + +jobs: + validate: + name: 'Validate Module' + runs-on: self-hosted + + steps: + - name: Checkout + uses: actions/checkout@v3 + + - name: Setup Terraform + uses: hashicorp/setup-terraform@v2 + with: + terraform_version: 1.5.0 + + - name: Terraform Init + run: | + terraform init -backend=false + + - name: Terraform Format + run: | + terraform fmt -check + + - name: Terraform Validate + run: | + terraform validate + + - name: Run tflint + uses: terraform-linters/setup-tflint@v3 + if: github.event_name == 'pull_request' + + - name: Lint Terraform + if: github.event_name == 'pull_request' + run: | + tflint --format compact + + - name: Run Checkov + uses: bridgecrewio/checkov-action@master + with: + directory: . + framework: terraform + skip_check: CKV_AWS_115,CKV_AWS_116 + quiet: true + soft_fail: true + output_format: sarif + output_file: checkov-results.sarif + + release: + name: 'Create Release' + needs: validate + if: github.ref == 'refs/heads/main' && github.event_name == 'push' + runs-on: self-hosted + permissions: + contents: write + + steps: + - uses: actions/checkout@v3 + with: + fetch-depth: 0 + + - name: Setup Python + uses: actions/setup-python@v4 + with: + python-version: '3.9' + + - name: Install Commitizen + run: | + pip install commitizen + + - name: Bump Version and Generate Changelog + id: cz + run: | + cz bump --yes + echo "new_version=$(cz version --project)" >> $GITHUB_OUTPUT + echo "changelog=$(cz changelog --dry-run)" >> $GITHUB_OUTPUT + + - name: Create Release + uses: actions/create-release@v1 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + tag_name: v${{ steps.cz.outputs.new_version }} + release_name: Release v${{ steps.cz.outputs.new_version }} + draft: false + prerelease: false + body: ${{ steps.cz.outputs.changelog }} diff --git a/.gitignore b/.gitignore index 7c1cae9..403ffa9 100644 --- a/.gitignore +++ b/.gitignore @@ -35,4 +35,3 @@ override.tf.json # Ignore CLI configuration files .terraformrc terraform.rc - diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..7d247a5 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,109 @@ +repos: +- repo: https://github.com/pre-commit/pre-commit-hooks + rev: v5.0.0 + hooks: + # Git style + - id: check-added-large-files + - id: check-merge-conflict + - id: forbid-new-submodules + - id: no-commit-to-branch + - id: check-byte-order-marker + - id: check-case-conflict + - id: check-json + - id: check-symlinks + # - id: check-vcs-permalinks + - id: check-toml + - id: check-xml + # - id: detect-private-key + - id: requirements-txt-fixer + - id: sort-simple-yaml + + # Common errors + - id: end-of-file-fixer + - id: trailing-whitespace + args: [--markdown-linebreak-ext=md] + exclude: CHANGELOG.md + # - id: check-yaml + - id: check-merge-conflict + - id: check-executables-have-shebangs + + # Cross platform + - id: check-case-conflict + - id: mixed-line-ending + args: [--fix=lf] + + # Security + - id: detect-aws-credentials + args: ['--allow-missing-credentials'] + # - id: detect-private-key + +# JSON5 Linter +- repo: https://github.com/pre-commit/mirrors-prettier + rev: v4.0.0-alpha.8 + hooks: + - id: prettier + # https://prettier.io/docs/en/options.html#parser + files: '.json5$' + +# Terraform Hooks +- repo: https://github.com/antonbabenko/pre-commit-terraform + rev: v1.97.3 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases + hooks: + - id: terraform_fmt + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + - id: terraform_docs + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + - id: terraform_tflint + name: Terraform validate with tflint + description: Validates all Terraform configuration files with TFLint. + require_serial: true + entry: hooks/terraform_tflint.sh + language: script + files: (\.tf|\.tfvars)$ + exclude: \.(terraform/.*|terragrunt-cache)$ + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + - id: terragrunt_fmt + name: Terragrunt fmt + description: Rewrites all Terragrunt configuration files to a canonical format. + entry: hooks/terragrunt_fmt.sh + language: script + files: (\.hcl)$ + exclude: \.(terraform/.*|terragrunt-cache)$ + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + # Will require dependency mocks + # - id: terragrunt_validate + # name: Terragrunt validate + # description: Validates all Terragrunt configuration files. + # entry: hooks/terragrunt_validate.sh + # language: script + # files: (\.hcl)$ + # exclude: \.(terraform/.*|terragrunt-cache)$ + # args: + # - --hook-config=--parallelism-ci-cpu-cores=2 + # - id: terragrunt_validate_inputs + # name: Terragrunt validate inputs + # description: Validates Terragrunt unused and undefined inputs. + # entry: hooks/terragrunt_validate_inputs.sh + # language: script + # files: (\.hcl)$ + # exclude: \.(terraform/.*|terragrunt-cache)$ + # args: + # - --hook-config=--parallelism-ci-cpu-cores=2 + # - id: terragrunt_providers_lock + # name: Terragrunt providers lock + # description: Updates provider signatures in dependency lock files using terragrunt. + # entry: hooks/terragrunt_providers_lock.sh + # language: script + # files: (terragrunt|\.terraform\.lock)\.hcl$ + # exclude: \.(terraform/.*|terragrunt-cache)$ + # args: + # - --hook-config=--parallelism-ci-cpu-cores=2 + +- repo: https://github.com/ljnsn/cz-conventional-gitmoji + rev: v0.6.1 + hooks: + - id: conventional-gitmoji diff --git a/README.md b/README.md index 335e7d7..bc977c9 100644 --- a/README.md +++ b/README.md @@ -1 +1,119 @@ # tfmod-keycloak + +Terraform module for deploying and configuring Keycloak on EKS clusters. + +## Overview +- Deploys Keycloak identity and access management solution +- Configures AWS integration for authentication +- Sets up default realms and clients +- Manages pod security and networking policies + +## Prerequisites +- Kubernetes cluster (EKS) +- Helm v3+ +- AWS credentials with required permissions +- IAM roles and policies configured + +## Usage + +Basic example: +```hcl +module "keycloak" { + source = "git@github.e.it.census.gov:terraform-modules/tfmod-keycloak.git" + + cluster_name = "my-eks-cluster" + keycloak_version = "21.1.1" + gogatekeeper_version = "3.7.4" +} +``` + +## Architecture +The module deploys the following components: +- Keycloak server pods with high availability +- PostgreSQL database for persistence +- GoGatekeeper for authentication proxy +- Required network policies and security groups + +### Network Flow +1. External traffic -> ALB/NLB +2. ALB/NLB -> Keycloak Service +3. Keycloak -> PostgreSQL +4. GoGatekeeper -> Keycloak for auth + +## Operations + +### Monitoring +The module exposes the following metrics endpoints: +- Keycloak metrics: `/metrics` +- GoGatekeeper metrics: `/oauth/metrics` + +### Troubleshooting +Common issues and solutions: +1. Database connectivity issues - Check security groups +2. Authentication failures - Verify realm configuration +3. Performance problems - Check resource requests/limits + + + +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 0.13 | +| [aws](#requirement\_aws) | ~> 5.14 | +| [helm](#requirement\_helm) | ~> 2.11 | +| [keycloak](#requirement\_keycloak) | >= 5.0.0 | +| [kubernetes](#requirement\_kubernetes) | ~> 2.23 | +| [null](#requirement\_null) | ~> 3.2 | +| [random](#requirement\_random) | ~> 3.6 | + +## Providers + +| Name | Version | +|------|---------| +| [helm](#provider\_helm) | 2.17.0 | + +## Modules + +| Name | Source | Version | +|------|--------|---------| +| [images](#module\_images) | git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/ | tf-upgrade | +| [ingress\_resources](#module\_ingress\_resources) | git@github.e.it.census.gov:SCT-Engineering/tfmod-istio-service-ingress.git | main | + +## Resources + +| Name | Type | +|------|------| +| [helm_release.keycloak](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [cluster\_domain](#input\_cluster\_domain) | The domain name used to reference ingresses for the cluster. | `string` | n/a | yes | +| [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes | +| [default\_storage\_class](#input\_default\_storage\_class) | The default storage class to use for persistent volumes | `string` | `"gp3-encrypted"` | no | +| [keycloak\_database](#input\_keycloak\_database) | The name of the database to create in the RDS instance. | `string` | `"keycloak"` | no | +| [keycloak\_password](#input\_keycloak\_password) | The initial password for the database. | `string` | `"keycloak"` | no | +| [keycloak\_tag](#input\_keycloak\_tag) | The image tag associated with the keycloak\_chart\_version | `string` | `"22.0.1-debian-11-r30"` | no | +| [keycloak\_user](#input\_keycloak\_user) | The username for the database. | `string` | `"keycloak"` | no | +| [namespace](#input\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no | +| [postgresql\_tag](#input\_postgresql\_tag) | The tag of the postgresql image to use. | `string` | `"17.4.0"` | no | +| [profile](#input\_profile) | AWS config profile used to upload images into ECR | `string` | `""` | no | +| [service\_name](#input\_service\_name) | The name of the service to be deployed in the EKS cluster. | `string` | `"service"` | no | +| [telemetry\_namespace](#input\_telemetry\_namespace) | The namespace used for telemetry. | `string` | `"namespace"` | no | + +## Outputs + +| Name | Description | +|------|-------------| +| [admin\_internal\_endpoint](#output\_admin\_internal\_endpoint) | internal endpoint for admin | +| [client\_id](#output\_client\_id) | The client ID for accessing keycloak. | +| [client\_secret](#output\_client\_secret) | The client secret for accessing keycloak. | +| [discovery\_url](#output\_discovery\_url) | The URL for discovering keycloak services. | +| [module\_name](#output\_module\_name) | The name of this module. | +| [module\_version](#output\_module\_version) | The version of this module. | +| [namespace](#output\_namespace) | The namespace in which keycloak gets installed in. | +| [provider\_config](#output\_provider\_config) | Add provider configuration block for easier consumption | +| [public\_endpoint](#output\_public\_endpoint) | The endpoint at which keycloak can be reached from outside the cluster. | + diff --git a/charts/keycloakx/.bumpversion.cfg b/charts/keycloakx/.bumpversion.cfg new file mode 100644 index 0000000..a7b47d8 --- /dev/null +++ b/charts/keycloakx/.bumpversion.cfg @@ -0,0 +1,7 @@ +[bumpversion] +current_version = 7.0.0 +commit = true +tag = false +message = Bump keycloakx chart version: {current_version} → {new_version} + +[bumpversion:file:Chart.yaml] diff --git a/charts/keycloakx/.helmignore b/charts/keycloakx/.helmignore new file mode 100644 index 0000000..cf02291 --- /dev/null +++ b/charts/keycloakx/.helmignore @@ -0,0 +1,25 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +ci/ +examples/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/keycloakx/Chart.yaml b/charts/keycloakx/Chart.yaml new file mode 100644 index 0000000..293f570 --- /dev/null +++ b/charts/keycloakx/Chart.yaml @@ -0,0 +1,23 @@ +apiVersion: v2 +name: keycloakx +version: 7.0.1 +appVersion: 26.0.7 +description: Keycloak.X - Open Source Identity and Access Management for Modern Applications and Services +keywords: + - sso + - idm + - openid connect + - saml + - kerberos + - oauth + - ldap + - keycloakx + - quarkus +home: https://www.keycloak.org/ +icon: https://www.keycloak.org/resources/images/keycloak_logo_200px.svg +sources: + - https://github.com/codecentric/helm-charts + - https://github.com/keycloak/keycloak/tree/main/quarkus/container +maintainers: + - name: thomasdarimont + email: thomas.darimont+github@gmail.com diff --git a/charts/keycloakx/OWNERS b/charts/keycloakx/OWNERS new file mode 100644 index 0000000..8855f63 --- /dev/null +++ b/charts/keycloakx/OWNERS @@ -0,0 +1,4 @@ +approvers: + - thomasdarimont +reviewers: + - thomasdarimont diff --git a/charts/keycloakx/README.md b/charts/keycloakx/README.md new file mode 100644 index 0000000..c3c4066 --- /dev/null +++ b/charts/keycloakx/README.md @@ -0,0 +1,596 @@ +# Keycloak-X + +[Keycloak-X](http://www.keycloak.org/) is an open source identity and access management for modern applications and services. + +Note that this chart is the logical successor of the Wildfly based [codecentric/keycloak](https://github.com/codecentric/helm-charts/tree/master/charts/keycloak) chart. + +## TL;DR; + +```console +$ cat << EOF > values.yaml +command: + - "/opt/keycloak/bin/kc.sh" + - "start" + - "--http-port=8080" + - "--hostname-strict=false" +extraEnv: | + - name: KEYCLOAK_ADMIN + value: admin + - name: KEYCLOAK_ADMIN_PASSWORD + value: admin + - name: JAVA_OPTS_APPEND + value: >- + -Djgroups.dns.query={{ include "keycloak.fullname" . }}-headless +EOF + +$ helm install keycloak codecentric/keycloakx --values ./values.yaml +``` +Note that the default configuration is not suitable for production since it uses a h2 file database by default. +It is strongly recommended to use a dedicated database with Keycloak. + +For more examples see the [examples](./examples) folder. + +## Introduction + +This chart bootstraps a [Keycloak](http://www.keycloak.org/) StatefulSet on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. +It provisions a fully featured Keycloak installation. +For more information on Keycloak and its capabilities, see its [documentation](http://www.keycloak.org/documentation.html). + +## Installing the Chart + +To install the chart with the release name `keycloakx`: + +```console +$ helm install keycloak codecentric/keycloakx +``` + +or via GitHub Container Registry: + +```console +$ helm install keycloak oci://ghcr.io/codecentric/helm-charts/keycloakx --version +``` + +## Uninstalling the Chart + +To uninstall the `keycloakx` deployment: + +```console +$ helm uninstall keycloakx +``` + +## Configuration + +The following table lists the configurable parameters of the Keycloak-X chart and their default values. + +| Parameter | Description | Default | +|-----------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `fullnameOverride` | Optionally override the fully qualified name | `""` | +| `nameOverride` | Optionally override the name | `""` | +| `replicas` | The number of replicas to create | `1` | +| `image.repository` | The Keycloak image repository | `quay.io/keycloak/keycloak` | +| `image.tag` | Overrides the Keycloak image tag whose default is the chart version | `""` | +| `image.digest` | Overrides the Keycloak image tag with a digest | `""` | +| `image.pullPolicy` | The Keycloak image pull policy | `IfNotPresent` | +| `imagePullSecrets` | Image pull secrets for the Pod | `[]` | +| `hostAliases` | Mapping between IPs and hostnames that will be injected as entries in the Pod's hosts files | `[]` | +| `enableServiceLinks` | Indicates whether information about services should be injected into Pod's environment variables, matching the syntax of Docker links | `true` | +| `updateStrategy` | StatefulSet update strategy. One of `RollingUpdate` or `OnDelete` | `RollingUpdate` | +| `podManagementPolicy` | Pod management policy. One of `Parallel` or `OrderedReady` | `Parallel` | +| `restartPolicy` | Pod restart policy. One of `Always`, `OnFailure`, or `Never` | `Always` | +| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `serviceAccount.allowReadPods` | Specifies whether the ServiceAccount can get or list pods | `false` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | `""` | +| `serviceAccount.annotations` | Additional annotations for the ServiceAccount | `{}` | +| `serviceAccount.labels` | Additional labels for the ServiceAccount | `{}` | +| `serviceAccount.imagePullSecrets` | Image pull secrets that are attached to the ServiceAccount | `[]` | +| `serviceAccount.automountServiceAccountToken` | Automount API credentials for the Service Account | `true` | +| `rbac.create` | Specifies whether RBAC resources are to be created | `false` +| `rbac.rules` | Custom RBAC rules, e. g. for KUBE_PING | `[]` +| `podSecurityContext` | SecurityContext for the entire Pod. Every container running in the Pod will inherit this SecurityContext. This might be relevant when other components of the environment inject additional containers into running Pods (service meshes are the most prominent example for this) | `{"fsGroup":1000}` | +| `securityContext` | SecurityContext for the Keycloak container | `{"runAsNonRoot":true,"runAsUser":1000}` | +| `extraInitContainers` | Additional init containers, e. g. for providing custom themes | `[]` | +| `skipInitContainers` | Skip all init containers (to avoid issues with service meshes which require sidecar proxies for connectivity) | `false` +| `extraContainers` | Additional sidecar containers, e. g. for a database proxy, such as Google's cloudsql-proxy | `[]` | +| `lifecycleHooks` | Lifecycle hooks for the Keycloak container | `{}` | +| `terminationGracePeriodSeconds` | Termination grace period in seconds for Keycloak shutdown. Clusters with a large cache might need to extend this to give Infinispan more time to rebalance | `60` | +| `clusterDomain` | The internal Kubernetes cluster domain | `cluster.local` | +| `command` | Overrides the default entrypoint of the Keycloak container | `[]` | +| `args` | Overrides the default args for the Keycloak container | `[]` | +| `extraEnv` | Additional environment variables for Keycloak | `""` | +| `extraEnvFrom` | Additional environment variables for Keycloak mapped from a Secret or ConfigMap | `""` | +| `priorityClassName` | Pod priority class name | `""` | +| `affinity` | Pod affinity | Hard node and soft zone anti-affinity | +| `topologySpreadConstraints` | Topology spread constraints | Constraints used to spread pods | +| `nodeSelector` | Node labels for Pod assignment | `{}` | +| `tolerations` | Node taints to tolerate | `[]` | +| `podLabels` | Additional Pod labels | `{}` | +| `podAnnotations` | Additional Pod annotations | `{}` | +| `livenessProbe` | Liveness probe configuration | `{"httpGet":{"path":"{{ tpl .Values.http.relativePath $ \| trimSuffix "/" }}/","port":"http"},"initialDelaySeconds":0,"timeoutSeconds":5}` | +| `readinessProbe` | Readiness probe configuration | `{"httpGet":{"path":"{{ tpl .Values.http.relativePath $ \| trimSuffix "/" }}/realms/master","port":"http"},"initialDelaySeconds":30,"timeoutSeconds":1}` | +| `startupProbe` | Startup probe configuration | `{"httpGet":{"path":"{{ tpl .Values.http.relativePath $ \| trimSuffix "/" }}/","port":"http"},"initialDelaySeconds":30,"timeoutSeconds":5, "failureThreshold": 60, "periodSeconds": 5}` | +| `resources` | Pod resource requests and limits | `{}` | +| `extraVolumes` | Add additional volumes, e. g. for custom themes | `""` | +| `extraVolumeMounts` | Add additional volumes mounts, e. g. for custom themes | `""` | +| `extraPorts` | Add additional ports, e. g. for admin console or exposing JGroups ports | `[]` | +| `podDisruptionBudget` | Pod disruption budget | `{}` | +| `statefulsetAnnotations` | Annotations for the StatefulSet | `{}` | +| `statefulsetLabels` | Additional labels for the StatefulSet | `{}` | +| `secrets` | Configuration for secrets that should be created | `{}` | +| `service.annotations` | Annotations for HTTP service | `{}` | +| `service.labels` | Additional labels for headless and HTTP Services | `{}` | +| `service.type` | The Service type | `ClusterIP` | +| `service.loadBalancerIP` | Optional IP for the load balancer. Used for services of type LoadBalancer only | `""` | +| `loadBalancerSourceRanges` | Optional List of allowed source ranges (CIDRs). Used for service of type LoadBalancer only | `[]` | +| `service.externalTrafficPolicy` | Optional external traffic policy. Used for services of type LoadBalancer only | `"Cluster"` | +| `service.httpPort` | The http Service port | `80` | +| `service.httpNodePort` | The HTTP Service node port if type is NodePort | `""` | +| `service.httpsPort` | The HTTPS Service port | `8443` | +| `service.httpsNodePort` | The HTTPS Service node port if type is NodePort | `""` | +| `service.extraPorts` | Additional Service ports, e. g. for custom admin console | `[]` | +| `service.sessionAffinity` | sessionAffinity for Service, e. g. "ClientIP" | `""` | +| `service.sessionAffinityConfig` | sessionAffinityConfig for Service | `{}` | +| `serviceHeadless.annotations` | Annotations for headless service | `{}` | +| `ingress.enabled` | If `true`, an Ingress is created | `false` | +| `ingress.rules` | List of Ingress Ingress rule | see below | +| `ingress.rules[0].host` | Host for the Ingress rule | `{{ .Release.Name }}.keycloak.example.com` | +| `ingress.rules[0].paths` | Paths for the Ingress rule | see below | +| `ingress.rules[0].paths[0].path` | Path for the Ingress rule | `/` | +| `ingress.rules[0].paths[0].pathType` | Path Type for the Ingress rule | `Prefix` | +| `ingress.servicePort` | The Service port targeted by the Ingress | `http` | +| `ingress.annotations` | Ingress annotations | `{}` | +| `ingress.ingressClassName` | The name of the Ingress Class associated with the ingress | `""` | +| `ingress.labels` | Additional Ingress labels | `{}` | +| `ingress.tls` | TLS configuration | see below | +| `ingress.tls[0].hosts` | List of TLS hosts | `[keycloak.example.com]` | +| `ingress.tls[0].secretName` | Name of the TLS secret | `""` | +| `ingress.console.enabled` | If `true`, an Ingress for the console is created | `false` | +| `ingress.console.rules` | List of Ingress Ingress rule for the console | see below | +| `ingress.console.rules[0].host` | Host for the Ingress rule for the console | `{{ .Release.Name }}.keycloak.example.com` | +| `ingress.console.rules[0].paths` | Paths for the Ingress rule for the console | see below | +| `ingress.console.rules[0].paths[0].path` | Path for the Ingress rule for the console | `[{{ tpl .Values.http.relativePath $ \| trimSuffix "/" }}/admin]` | +| `ingress.console.rules[0].paths[0].pathType` | Path Type for the Ingress rule for the console | `Prefix` | +| `ingress.console.annotations` | Ingress annotations for the console | `{}` | +| `ingress.console.ingressClassName` | The name of the Ingress Class associated with the console ingress | `""` | +| `ingress.console.tls` | TLS configuration | see below | +| `ingress.console.tls[0].hosts` | List of TLS hosts | `[keycloak.example.com]` | +| `ingress.console.tls[0].secretName` | Name of the TLS secret | `""` | +| `networkPolicy.enabled` | If true, the ingress network policy is deployed | `false` +| `networkPolicy.extraFrom` | Allows to define allowed external ingress traffic (see Kubernetes doc for network policy `from` format) | `[]` +| `networkPolicy.egress` | Allows to define allowed egress from Keycloak pods (see Kubernetes doc for network policy `egress` format) | `[]` +| `route.enabled` | If `true`, an OpenShift Route is created | `false` | +| `route.path` | Path for the Route | `/` | +| `route.annotations` | Route annotations | `{}` | +| `route.labels` | Additional Route labels | `{}` | +| `route.host` | Host name for the Route | `""` | +| `route.tls.enabled` | If `true`, TLS is enabled for the Route | `true` | +| `route.tls.insecureEdgeTerminationPolicy` | Insecure edge termination policy of the Route. Can be `None`, `Redirect`, or `Allow` | `Redirect` | +| `route.tls.termination` | TLS termination of the route. Can be `edge`, `passthrough`, or `reencrypt` | `edge` | +| `dbchecker.image.repository` | Docker image used to check database readiness at startup | `docker.io/busybox` | +| `dbchecker.image.tag` | Image tag for the dbchecker image | `1.32` | +| `dbchecker.image.pullPolicy` | Image pull policy for the dbchecker image | `IfNotPresent` | +| `dbchecker.securityContext` | SecurityContext for the dbchecker container | `{"allowPrivilegeEscalation":false,"runAsGroup":1000,"runAsNonRoot":true,"runAsUser":1000}` | +| `dbchecker.resources` | Resource requests and limits for the dbchecker container | `{"limits":{"cpu":"10m","memory":"16Mi"},"requests":{"cpu":"10m","memory":"16Mi"}}` | +| `database.hostname` | Database Hostname | unset | +| `database.port` | Database Port | unset | +| `database.username` | Database User | unset | +| `database.password` | Database Password | unset | +| `database.existingSecret` | Existing Secret containing database password (expects key `password`) | unset | +| `database.database` | Database | unset | +| `cache.stack` | Cache / Cluster Discovery, use `custom` to disable automatic configruation. | `default` | +| `proxy.enabled` | If `true`, the `KC_PROXY` env variable will be set to the configured mode | `true` | +| `proxy.mode` | The configured proxy mode | `edge` | +| `http.relativePath` | The relative http path (context-path) | `/auth` | +| `http.internalPort` | The port of the internal management interface | `http-internal` | +| `http.internalScheme` | The scheme of the internal management interface | `HTTP` | +| `metrics.enabled` | If `true` then the metrics endpoint is exposed | `true` | +| `health.enabled` | If `true` then the health endpoint is exposed. If the `readinessProbe` is is needed `metrics.enable` must be `true`. | `true` | +| `serviceMonitor.enabled` | If `true`, a ServiceMonitor resource for the prometheus-operator is created | `false` | +| `serviceMonitor.namespace` | Optionally sets a target namespace in which to deploy the ServiceMonitor resource | `""` | +| `serviceMonitor.namespaceSelector` | Optionally sets a namespace selector for the ServiceMonitor | `{}` | +| `serviceMonitor.annotations` | Annotations for the ServiceMonitor | `{}` | +| `serviceMonitor.labels` | Additional labels for the ServiceMonitor | `{}` | +| `serviceMonitor.interval` | Interval at which Prometheus scrapes metrics | `10s` | +| `serviceMonitor.scrapeTimeout` | Timeout for scraping | `10s` | +| `serviceMonitor.path` | The path at which metrics are served | `{{ tpl .Values.http.relativePath $ \| trimSuffix "/" }}/metrics` | +| `serviceMonitor.port` | The Service port at which metrics are served | `http` | +| `extraServiceMonitor.enabled` | If `true`, an additional ServiceMonitor resource for the prometheus-operator is created. Could be used for additional metrics via [Keycloak Metrics SPI](https://github.com/aerogear/keycloak-metrics-spi) | `false` | +| `extraServiceMonitor.namespace` | Optionally sets a target namespace in which to deploy the additional ServiceMonitor resource | `""` | +| `extraServiceMonitor.namespaceSelector` | Optionally sets a namespace selector for the additional ServiceMonitor | `{}` | +| `extraServiceMonitor.annotations` | Annotations for the additional ServiceMonitor | `{}` | +| `extraServiceMonitor.labels` | Additional labels for the additional ServiceMonitor | `{}` | +| `extraServiceMonitor.interval` | Interval at which Prometheus scrapes metrics | `10s` | +| `extraServiceMonitor.scrapeTimeout` | Timeout for scraping | `10s` | +| `extraServiceMonitor.path` | The path at which metrics are served | `{{ tpl .Values.http.relativePath $ \| trimSuffix "/" }}/metrics` | +| `extraServiceMonitor.port` | The Service port at which metrics are served | `http` | +| `prometheusRule.enabled` | If `true`, a PrometheusRule resource for the prometheus-operator is created | `false` | +| `prometheusRule.namespace` | Optionally sets a target namespace in which to deploy the PrometheusRule resource | `""` | +| `prometheusRule.annotations` | Annotations for the PrometheusRule | `{}` | +| `prometheusRule.labels` | Additional labels for the PrometheusRule | `{}` | +| `prometheusRule.rules` | List of rules for Prometheus | `[]` | +| `autoscaling.enabled` | Enable creation of a HorizontalPodAutoscaler resource | `false` | +| `autoscaling.labels` | Additional labels for the HorizontalPodAutoscaler resource | `{}` | +| `autoscaling.minReplicas` | The minimum number of Pods when autoscaling is enabled | `3` | +| `autoscaling.maxReplicas` | The maximum number of Pods when autoscaling is enabled | `10` | +| `autoscaling.metrics` | The metrics configuration for the HorizontalPodAutoscaler | `[{"resource":{"name":"cpu","target":{"averageUtilization":80,"type":"Utilization"}},"type":"Resource"}]` | +| `autoscaling.behavior` | The scaling policy configuration for the HorizontalPodAutoscaler | `{"scaleDown":{"policies":[{"periodSeconds":300,"type":"Pods","value":1}],"stabilizationWindowSeconds":300}` | +| `test.enabled` | If `true`, test resources are created | `false` | +| `test.image.repository` | The image for the test Pod | `docker.io/seleniarm/standalone-chromium` | +| `test.image.tag` | The tag for the test Pod image | `117.0` | +| `test.image.pullPolicy` | The image pull policy for the test Pod image | `IfNotPresent` | +| `test.podSecurityContext` | SecurityContext for the entire test Pod | `{"fsGroup":1000}` | +| `test.securityContext` | SecurityContext for the test container | `{"runAsNonRoot":true,"runAsUser":1000}` | +| `test.deletionPolicy` | `helm.sh/hook-delete-policy` for the test Pod | `before-hook-creation` | + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example: + +```console +$ helm install keycloak codecentric/keycloakx -n keycloak --set replicas=1 +``` + +Alternatively, a YAML file that specifies the values for the parameters can be provided while +installing the chart. For example: + +```console +$ helm install keycloak codecentric/keycloakx -n keycloak --values values.yaml +``` + +The chart offers great flexibility. +It can be configured to work with the official Keycloak-X Docker image but any custom image can be used as well. + +For the official Docker image, please check it's configuration at https://github.com/keycloak/keycloak/tree/main/quarkus/container. + +### Usage of the `tpl` Function + +The `tpl` function allows us to pass string values from `values.yaml` through the templating engine. +It is used for the following values: + +* `extraInitContainers` +* `extraContainers` +* `extraEnv` +* `extraEnvFrom` +* `affinity` +* `extraVolumeMounts` +* `extraVolumes` +* `livenessProbe` +* `readinessProbe` +* `startupProbe` +* `topologySpreadConstraints` + +Additionally, custom labels and annotations can be set on various resources the values of which being passed through `tpl` as well. + +It is important that these values be configured as strings. +Otherwise, installation will fail. +See example for Google Cloud Proxy or default affinity configuration in `values.yaml`. + +### JVM Settings + +Keycloak sets the following system properties by default: +`-Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m` + +You can override these by setting the `JAVA_OPTS` environment variable. +Make sure you configure container support. +This allows you to only configure memory using Kubernetes resources and the JVM will automatically adapt. + +```yaml +extraEnv: | + - name: JAVA_OPTS + value: >- + -XX:MaxRAMPercentage=50.0 +``` + +Alternatively one can append custom JVM options by setting the `JAVA_OPTS_APPEND` environment variable. + +The parameter `-Djava.net.preferIPv4Stack=true` is [optional](https://github.com/keycloak/keycloak/commit/ee205c8fbc1846f679bd604fa8d25310c117c87e) for [Keycloak >= v22](https://www.keycloak.org/server/configuration-production#_configure_keycloak_server_with_ipv4_or_ipv6). + +The parameter `-XX:+UseContainerSupport` is no longer required for [Keycloak >= v21 based on JDK v17](https://github.com/keycloak/keycloak/blob/release/21.0/quarkus/container/Dockerfile#L20). + +The parameter `-Djava.awt.headless=true` is no longer required for Quarkus based Keycloak as it is set by [default](https://quarkus.io/guides/building-native-image). + +#### Using an External Database + +The Keycloak Docker image supports various database types. +Configuration happens in a generic manner. + +##### Using a Secret Managed by the Chart + +The following examples uses a PostgreSQL database with a secret that is managed by the Helm chart. + +```yaml +dbchecker: + enabled: true + +database: + vendor: postgres + hostname: mypostgres + port: 5432 + username: '{{ .Values.dbUser }}' + password: '{{ .Values.dbPassword }}' + database: mydb +``` + +`dbUser` and `dbPassword` are custom values you'd then specify on the commandline using `--set-string`. + +##### Using an Existing Secret + +The following examples uses a PostgreSQL database with an existing secret. + +```yaml +dbchecker: + enabled: true + +database: + vendor: postgres + hostname: mypostgres + port: 5432 + database: mydb + username: db-user + existingSecret: byo-db-creds # Password is retrieved via .password +``` + +### Creating a Keycloak Admin User + +The Keycloak-X Docker image supports creating an initial admin user. +It must be configured via environment variables: + +* `KEYCLOAK_ADMIN` +* `KEYCLOAK_ADMIN_PASSWORD` + +This can be done like so in the `values.yaml`, where the `KEYCLOAK_ADMIN` is an insecure example with the value in plaintext. +The `KEYCLOAK_ADMIN_PASSWORD` is referenced from already existing secret but for testing it can be set with `value` too. +```yaml +extraEnv: | + - name: KEYCLOAK_ADMIN + value: admin + - name: KEYCLOAK_ADMIN_PASSWORD + valueFrom: + secretKeyRef: + name: keycloak-admin-password + key: password +``` + +### High Availability and Clustering + +For high availability, Keycloak must be run with multiple replicas (`replicas > 1`). +The chart has a helper template (`keycloak.serviceDnsName`) that creates the DNS name based on the headless service. + +#### DNS_PING Service Discovery + +JGroups discovery via DNS_PING is enabled by default but needs an additional JVM setting, which can be configured as follows: + +```yaml +extraEnv: | + - name: JAVA_OPTS_APPEND + value: >- + -Djgroups.dns.query={{ include "keycloak.fullname" . }}-headless +``` + +#### Custom Service Discovery + +If a custom JGroups discovery is needed, then you can configure: + +```yaml +cache: + stack: custom +``` + +You can then reference your custom infinispan configuration file, e.g. `cache-custom.xml` via the `KC_CACHE_CONFIG_FILE` environment variable. +Note that the `cache-custom.xml` must be available via `/opt/keycloak/conf/cache-custom.xml`. + +```yaml +extraEnv: | + - name: KC_CACHE + value: "ispn" + - name: KC_CACHE_CONFIG_FILE + value: cache-custom.xml +``` + +#### Autoscaling + +Due to the caches in Keycloak only replicating to a few nodes (two in the example configuration above) and the limited controls around autoscaling built into Kubernetes, it has historically been problematic to autoscale Keycloak. +However, in Kubernetes 1.18 [additional controls were introduced](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-configurable-scaling-behavior) which make it possible to scale down in a more controlled manner. + +The example autoscaling configuration in the values file scales from three up to a maximum of ten Pods using CPU utilization as the metric. Scaling up is done as quickly as required but scaling down is done at a maximum rate of one Pod per five minutes. + +Autoscaling can be enabled as follows: + +```yaml +autoscaling: + enabled: true +``` + +KUBE_PING service discovery seems to be the most reliable mechanism to use when enabling autoscaling, due to being faster than DNS_PING at detecting changes in the cluster. + +### Running Keycloak Behind a Reverse Proxy + +When running Keycloak behind a reverse proxy, which is the case when using an ingress controller, +proxy address forwarding must be enabled as follows: + +```yaml +extraEnv: | + - name: KC_PROXY + value: "passthrough" +``` + +### Providing a Custom Theme + +One option is certainly to provide a custom Keycloak-X image that includes the theme. +However, if you prefer to stick with the official Keycloak-X image, you can use an init container as theme provider. + +Create your own theme and package it up into a Docker image. + +```docker +FROM busybox +COPY mytheme /mytheme +``` + +In combination with an `emptyDir` that is shared with the Keycloak container, configure an init container that runs your theme image and copies the theme over to the right place where Keycloak will pick it up automatically. + +```yaml +extraInitContainers: | + - name: theme-provider + image: myuser/mytheme:1 + imagePullPolicy: IfNotPresent + command: + - sh + args: + - -c + - | + echo "Copying theme..." + cp -R /mytheme/* /theme + volumeMounts: + - name: theme + mountPath: /theme + +extraVolumeMounts: | + - name: theme + mountPath: /opt/keycloak/themes/mytheme + +extraVolumes: | + - name: theme + emptyDir: {} +``` + +### Using Google Cloud SQL Proxy + +Depending on your environment you may need a local proxy to connect to the database. +This is, e. g., the case for Google Kubernetes Engine when using Google Cloud SQL. +Create the secret for the credentials as documented [here](https://cloud.google.com/sql/docs/postgres/connect-kubernetes-engine) and configure the proxy as a sidecar. + +Because `extraContainers` is a string that is passed through the `tpl` function, it is possible to create custom values and use them in the string. + +```yaml +database: + vendor: postgres + hostname: '127.0.0.1' + port: 5432 + database: postgres + username: myuser + password: mypassword + +# Custom values for Google Cloud SQL +cloudsql: + project: my-project + region: europe-west1 + instance: my-instance + +extraContainers: | + - name: cloudsql-proxy + image: gcr.io/cloudsql-docker/gce-proxy:1.17 + command: + - /cloud_sql_proxy + args: + - -instances={{ .Values.cloudsql.project }}:{{ .Values.cloudsql.region }}:{{ .Values.cloudsql.instance }}=tcp:5432 + - -credential_file=/secrets/cloudsql/credentials.json + volumeMounts: + - name: cloudsql-creds + mountPath: /secrets/cloudsql + readOnly: true + +extraVolumes: | + - name: cloudsql-creds + secret: + secretName: cloudsql-instance-credentials +``` + +### Changing the Context Path + +By default, Keycloak-X is served under context `/auth`. +Trailing slash is removed from path. This can be changed to another context path like `/` as follows: + +```yaml +http: + relativePath: '/' +``` + +Alternatively, you may supply it via CLI flag: + +```console +--set-string http.relativePath=/ +``` + +### Prometheus Metrics Support + +#### Keycloak Metrics + +Keycloak-X can expose metrics via `/auth/metrics`. + +Metrics are enabled by default via: +```yaml +metrics: + enabled: true +``` + +Add a ServiceMonitor if using prometheus-operator: + +```yaml +serviceMonitor: + # If `true`, a ServiceMonitor resource for the prometheus-operator is created + enabled: true +``` + +Checkout `values.yaml` for customizing the ServiceMonitor and for adding custom Prometheus rules. + +Add annotations if you don't use prometheus-operator: + +```yaml +service: + annotations: + prometheus.io/scrape: "true" + prometheus.io/port: "8080" +``` + +#### Keycloak Metrics SPI + +Optionally, it is possible to add [Keycloak Metrics SPI](https://github.com/aerogear/keycloak-metrics-spi) via init container. +Note that the `keycloak-metrics-spi.jar` needs to be added to the `/opt/keycloak/providers` directory. + +A separate `ServiceMonitor` can be enabled to scrape metrics from the SPI: + +```yaml +extraServiceMonitor: + # If `true`, an additional ServiceMonitor resource for the prometheus-operator is created + enabled: true +``` + +Checkout `values.yaml` for customizing this ServiceMonitor. + +Note that the metrics endpoint is exposed on the HTTP port. +You may want to restrict access to it in your ingress controller configuration. +For ingress-nginx, this could be done as follows: + +```yaml +annotations: + nginx.ingress.kubernetes.io/server-snippet: | + location ~* /auth/realms/[^/]+/metrics { + return 403; + } +``` + +## Why StatefulSet? + +The headless service that governs the StatefulSet is used for DNS discovery via DNS_PING. + +## Bad Gateway and Proxy Buffer Size in Nginx + +A common issue with Keycloak and nginx is that the proxy buffer may be too small for what Keycloak is trying to send. This will result in a Bad Gateway (502) error. There are [many](https://github.com/kubernetes/ingress-nginx/issues/4637) [issues](https://stackoverflow.com/questions/56126864/why-do-i-get-502-when-trying-to-authenticate) around the internet about this. The solution is to increase the buffer size of nginx. This can be done by creating an annotation in the ingress specification: + +```yaml +ingress: + annotations: + nginx.ingress.kubernetes.io/proxy-buffer-size: "128k" +``` + +## Upgrading + +Notes for upgrading from previous Keycloak chart versions. + +### From chart < 18.0.0 + +* Keycloak is updated to 18.0.0 +* Added new `health.enabled` option. + +Keycloak 18.0.0 allows to enable the health endpoint independently of the metrics endpoint via the `health-enabled` setting. +We reflect that via the new config option `health.enabled`. + +Please read the additional notes about [Migrating to 18.0.0](https://www.keycloak.org/docs/latest/upgrading/index.html#migrating-to-18-0-0) in the Keycloak documentation. + diff --git a/charts/keycloakx/ci/h2-values.yaml b/charts/keycloakx/ci/h2-values.yaml new file mode 100644 index 0000000..46b71a2 --- /dev/null +++ b/charts/keycloakx/ci/h2-values.yaml @@ -0,0 +1,35 @@ +command: + - "/opt/keycloak/bin/kc.sh" + - "--verbose" + - "start" + - --hostname-strict=false + +extraEnv: | + - name: KEYCLOAK_ADMIN + valueFrom: + secretKeyRef: + name: {{ include "keycloak.fullname" . }}-admin-creds + key: user + - name: KEYCLOAK_ADMIN_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "keycloak.fullname" . }}-admin-creds + key: password + - name: JAVA_OPTS_APPEND + value: >- + -XX:MaxRAMPercentage=50.0 + -Djgroups.dns.query={{ include "keycloak.fullname" . }}-headless + +database: + vendor: dev-file + +secrets: + admin-creds: + annotations: + my-test-annotation: Test secret for {{ include "keycloak.fullname" . }} + stringData: + user: admin + password: secret + +test: + enabled: true diff --git a/charts/keycloakx/examples/postgresql-kubeping/Dockerfile b/charts/keycloakx/examples/postgresql-kubeping/Dockerfile new file mode 100644 index 0000000..f65ef6b --- /dev/null +++ b/charts/keycloakx/examples/postgresql-kubeping/Dockerfile @@ -0,0 +1,9 @@ +FROM quay.io/keycloak/keycloak:26.0.7 + +ENV JGROUPS_KUBERNETES_VERSION 1.0.16.Final + +# Downlaod JGroups KubePing extension +RUN curl -s -L -o /opt/keycloak/providers/jgroups-kubernetes-$JGROUPS_KUBERNETES_VERSION.jar https://search.maven.org/remotecontent?filepath=org/jgroups/kubernetes/jgroups-kubernetes/$JGROUPS_KUBERNETES_VERSION/jgroups-kubernetes-$JGROUPS_KUBERNETES_VERSION.jar + +# Add custom kubeping configuration file +COPY cache-ispn-kubeping.xml /opt/keycloak/conf diff --git a/charts/keycloakx/examples/postgresql-kubeping/cache-ispn-kubeping.xml b/charts/keycloakx/examples/postgresql-kubeping/cache-ispn-kubeping.xml new file mode 100644 index 0000000..e720ff8 --- /dev/null +++ b/charts/keycloakx/examples/postgresql-kubeping/cache-ispn-kubeping.xml @@ -0,0 +1,86 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/charts/keycloakx/examples/postgresql-kubeping/keycloak-db-values.yaml b/charts/keycloakx/examples/postgresql-kubeping/keycloak-db-values.yaml new file mode 100644 index 0000000..4dde3d7 --- /dev/null +++ b/charts/keycloakx/examples/postgresql-kubeping/keycloak-db-values.yaml @@ -0,0 +1,7 @@ +# See https://github.com/bitnami/charts/tree/master/bitnami/postgresql +global: + postgresql: + auth: + username: dbusername + password: dbpassword + database: keycloak diff --git a/charts/keycloakx/examples/postgresql-kubeping/keycloak-server-values.yaml b/charts/keycloakx/examples/postgresql-kubeping/keycloak-server-values.yaml new file mode 100644 index 0000000..626fc0b --- /dev/null +++ b/charts/keycloakx/examples/postgresql-kubeping/keycloak-server-values.yaml @@ -0,0 +1,66 @@ +# This is an example configuration, for production grade configuration see the Keycloak documentation. +# See https://www.keycloak.org/server/configuration +# See https://www.keycloak.org/server/all-config +command: + - "/opt/keycloak/bin/kc.sh" + - "--verbose" + - "start" + - "--http-port=8080" + - "--hostname-strict=false" + - "--spi-events-listener-jboss-logging-success-level=info" + - "--spi-events-listener-jboss-logging-error-level=warn" + +# Disable default cache configuration +cache: + stack: custom + +image: + # The custom image repository + repository: thomasdarimont/keycloakx-kubeping + # Overrides the Keycloak image tag whose default is the chart appVersion + tag: latest + +extraEnv: | + - name: KC_CACHE_CONFIG_FILE + value: cache-ispn-kubeping.xml + - name: KEYCLOAK_ADMIN + valueFrom: + secretKeyRef: + name: {{ include "keycloak.fullname" . }}-admin-creds + key: user + - name: KEYCLOAK_ADMIN_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "keycloak.fullname" . }}-admin-creds + key: password + - name: JAVA_OPTS_APPEND + value: >- + -XX:MaxRAMPercentage=50.0 + -Dkubeping_namespace={{ .Release.Namespace }} + -Dkubeping_label="keycloak-cluster=default" + +serviceAccount: + create: true + allowReadPods: true + +podLabels: + keycloak-cluster: default + +dbchecker: + enabled: true + +database: + vendor: postgres + hostname: keycloak-db-postgresql + port: 5432 + username: dbusername + password: dbpassword + database: keycloak + +secrets: + admin-creds: + annotations: + my-test-annotation: Test secret for {{ include "keycloak.fullname" . }} + stringData: + user: admin + password: secret diff --git a/charts/keycloakx/examples/postgresql-kubeping/readme.md b/charts/keycloakx/examples/postgresql-kubeping/readme.md new file mode 100644 index 0000000..6010acd --- /dev/null +++ b/charts/keycloakx/examples/postgresql-kubeping/readme.md @@ -0,0 +1,79 @@ +# Keycloak.X with KUBE_PING + +This example shows how to use KUBE_PING JGroup cluster discovery with Keycloak.X. + +Since Keycloak.X (17.0.x, 18.0.x) does not support jgroups KUBE_PING out of the box, +we need to download the library and copy it into a custom docker image. + +Note that we use some customizations in the `keycloak-server-values.yaml` file: +- Set environment variable `KC_CACHE_CONFIG_FILE=cache-ispn-kubeping.xml` to our custom cache config file +- Disable automatic cache configuration via `cache.stack=custom` +- Configure `kubeping_namespace` and `kubeping_label` system properties via `JAVA_OPTS_APPEND` +- Configure serviceAccount.create=true and serviceAccount.allowReadPods=true to allow kube_ping to enlist keycloak pods + +# Setup + +## Add repository +``` +helm repo add bitnami https://charts.bitnami.com/bitnami +helm repo add codecentric https://codecentric.github.io/helm-charts +``` + +## Update helm repos +``` +helm repo update +``` + +## Build custom Docker Image + +This custom image automatically downloads the jgroups-kubernetes library. +``` +docker build -t thomasdarimont/keycloakx-kubeping . +``` + +We need to make the custom docker image available in the Kubernetes cluster. This is up to your k8s environment. +With [kind](https://kind.sigs.k8s.io/docs/user/quick-start/) you can use `kind load docker-image thomasdarimont/keycloakx-kubeping:latest`. + +## Deploy a PostgreSQL database +``` +helm install keycloak-db bitnami/postgresql --values ./keycloak-db-values.yaml +``` + +# Deploy Keycloak + +``` +helm install keycloak codecentric/keycloakx --values ./keycloak-server-values.yaml +``` + +If everything worked you should now see log entries like this: +``` +... +keycloak 2022-04-09 15:14:55,997 INFO [org.jgroups.protocols.kubernetes.KUBE_PING] (keycloak-cache-init) namespace default set; clustering enabled +... +``` + +On a new Keycloak pod you should see the following log entries: +``` +... +15:16:20,184 INFO [org.jgroups.protocols.kubernetes.KUBE_PING] (keycloak-cache-init) namespace default set; clustering enabled +15:16:20,395 INFO [org.infinispan.CLUSTER] (keycloak-cache-init) ISPN000094: Received new cluster view for channel ISPN: [keycloak-keycloakx-0-34953|1] (2) [keycloak-keycloakx-0-34953, keycloak-keycloakx-1-34016] +15:16:20,399 INFO [org.infinispan.CLUSTER] (keycloak-cache-init) ISPN000079: Channel `ISPN` local address is `keycloak-keycloakx-1-34016`, physical addresses are `[10.244.0.22:7800]` +... +``` + +# Access Keycloak +Once Keycloak is running, forward the HTTP service port to 8080. + +``` +kubectl port-forward service/keycloak-keycloakx-http 8080:80 +``` + +You can then access the Keycloak Admin-Console via `http://localhost:8080/auth` with +username: `admin` and password: `secret`. + +# Remove Keycloak + +``` +helm uninstall keycloak +helm uninstall keycloak-db +``` diff --git a/charts/keycloakx/examples/postgresql/keycloak-db-values.yaml b/charts/keycloakx/examples/postgresql/keycloak-db-values.yaml new file mode 100644 index 0000000..4dde3d7 --- /dev/null +++ b/charts/keycloakx/examples/postgresql/keycloak-db-values.yaml @@ -0,0 +1,7 @@ +# See https://github.com/bitnami/charts/tree/master/bitnami/postgresql +global: + postgresql: + auth: + username: dbusername + password: dbpassword + database: keycloak diff --git a/charts/keycloakx/examples/postgresql/keycloak-server-values.yaml b/charts/keycloakx/examples/postgresql/keycloak-server-values.yaml new file mode 100644 index 0000000..3b03e6a --- /dev/null +++ b/charts/keycloakx/examples/postgresql/keycloak-server-values.yaml @@ -0,0 +1,46 @@ +# This is an example configuration, for production grade configuration see the Keycloak documentation. +# See https://www.keycloak.org/server/configuration +# See https://www.keycloak.org/server/all-config +command: + - "/opt/keycloak/bin/kc.sh" + - "--verbose" + - "start" + - "--http-port=8080" + - "--hostname-strict=false" + - "--spi-events-listener-jboss-logging-success-level=info" + - "--spi-events-listener-jboss-logging-error-level=warn" + +extraEnv: | + - name: KEYCLOAK_ADMIN + valueFrom: + secretKeyRef: + name: {{ include "keycloak.fullname" . }}-admin-creds + key: user + - name: KEYCLOAK_ADMIN_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "keycloak.fullname" . }}-admin-creds + key: password + - name: JAVA_OPTS_APPEND + value: >- + -XX:MaxRAMPercentage=50.0 + -Djgroups.dns.query={{ include "keycloak.fullname" . }}-headless + +dbchecker: + enabled: true + +database: + vendor: postgres + hostname: keycloak-db-postgresql + port: 5432 + username: dbusername + password: dbpassword + database: keycloak + +secrets: + admin-creds: + annotations: + my-test-annotation: Test secret for {{ include "keycloak.fullname" . }} + stringData: + user: admin + password: secret diff --git a/charts/keycloakx/examples/postgresql/readme.md b/charts/keycloakx/examples/postgresql/readme.md new file mode 100644 index 0000000..665f56f --- /dev/null +++ b/charts/keycloakx/examples/postgresql/readme.md @@ -0,0 +1,43 @@ +# Keycloak.X with PostgreSQL + +This example shows how to configure Keycloak.X to use a PostgreSQL database. + +# Setup + +## Add repository +``` +helm repo add bitnami https://charts.bitnami.com/bitnami +helm repo add codecentric https://codecentric.github.io/helm-charts +``` + +## Update helm repos +``` +helm repo update +``` + +## Deploy a PostgreSQL database +``` +helm install keycloak-db bitnami/postgresql --values ./keycloak-db-values.yaml +``` + +# Deploy Keycloak +``` +helm install keycloak codecentric/keycloakx --values ./keycloak-server-values.yaml +``` + +# Access Keycloak +Once Keycloak is running, forward the HTTP service port to 8080. + +``` +kubectl port-forward service/keycloak-keycloakx-http 8080:80 +``` + +You can then access the Keycloak Admin-Console via `http://localhost:8080/auth` with +username: `admin` and password: `secret`. + +# Remove Keycloak + +``` +helm uninstall keycloak +helm uninstall keycloak-db +``` diff --git a/charts/keycloakx/examples/readme.md b/charts/keycloakx/examples/readme.md new file mode 100644 index 0000000..51b5438 --- /dev/null +++ b/charts/keycloakx/examples/readme.md @@ -0,0 +1,10 @@ +# KeycloakX Helm Chart Examples + +Various examples for using the helm chart for custom deployments. + +## Keycloak.X with PostgreSQL + +- See [using Keycloak.X with PostgreSQL](./postgresql/readme.md). + +## Keycloak.X with KUBE_PING +- See [using Keycloak.X with KUBE_PING](./postgresql-kubeping/readme.md). diff --git a/charts/keycloakx/templates/NOTES.txt b/charts/keycloakx/templates/NOTES.txt new file mode 100644 index 0000000..da4e504 --- /dev/null +++ b/charts/keycloakx/templates/NOTES.txt @@ -0,0 +1,61 @@ +*********************************************************************** +* * +* Keycloak.X Helm Chart by codecentric AG * +* * +*********************************************************************** + +{{- if .Values.ingress.enabled }} + +Keycloak was installed with an Ingress and an be reached at the following URL(s): +{{ range $unused, $rule := .Values.ingress.rules }} + {{- range $rule.paths }} + - http{{ if $.Values.ingress.tls }}s{{ end }}://{{ tpl $rule.host $ }}{{ .path }} + {{- end }} +{{- end }} + +{{- else if eq "NodePort" .Values.service.type }} + +Keycloak was installed with a Service of type NodePort. +{{ if .Values.service.httpNodePort }} +Get its HTTP URL with the following commands: + +export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} service {{ include "keycloak.fullname" . }}-http --template='{{"{{ range .spec.ports }}{{ if eq .name \"http\" }}{{ .nodePort }}{{ end }}{{ end }}"}}') +export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") +echo "http://$NODE_IP:$NODE_PORT" +{{- end }} +{{ if .Values.service.httpsNodePort }} +Get its HTTPS URL with the following commands: + +export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} service {{ include "keycloak.fullname" . }}-http --template='{{"{{ range .spec.ports }}{{ if eq .name \"https\" }}{{ .nodePort }}{{ end }}{{ end }}"}}') +export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") +echo "http://$NODE_IP:$NODE_PORT" +{{- end }} + +{{- else if eq "LoadBalancer" .Values.service.type }} + +Keycloak was installed with a Service of type LoadBalancer + +NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} service -w {{ include "keycloak.fullname" . }}' + +Get its HTTP URL with the following commands: + +export SERVICE_IP=$(kubectl get service --namespace {{ .Release.Namespace }} {{ include "keycloak.fullname" . }}-http --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") +echo "http://$SERVICE_IP:{{ .Values.service.httpPort }}" + +Get its HTTPS URL with the following commands: + +export SERVICE_IP=$(kubectl get service --namespace {{ .Release.Namespace }} {{ include "keycloak.fullname" . }}-http --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") +echo "http://$SERVICE_IP:{{ .Values.service.httpsPort }}" + +{{- else if eq "ClusterIP" .Values.service.type }} + +Keycloak was installed with a Service of type ClusterIP + +Create a port-forwarding with the following commands: + +export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "keycloak.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o name) +echo "Visit http://127.0.0.1:8080 to use your application" +kubectl --namespace {{ .Release.Namespace }} port-forward "$POD_NAME" 8080 + +{{- end }} diff --git a/charts/keycloakx/templates/_helpers.tpl b/charts/keycloakx/templates/_helpers.tpl new file mode 100644 index 0000000..93fe4af --- /dev/null +++ b/charts/keycloakx/templates/_helpers.tpl @@ -0,0 +1,76 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "keycloak.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +*/}} +{{- define "keycloak.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "keycloak.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "keycloak.labels" -}} +helm.sh/chart: {{ include "keycloak.chart" . }} +{{ include "keycloak.selectorLabels" . }} +app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | trunc 63 | quote }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "keycloak.selectorLabels" -}} +app.kubernetes.io/name: {{ include "keycloak.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "keycloak.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "keycloak.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{/* +Create the service DNS name. +*/}} +{{- define "keycloak.serviceDnsName" -}} +{{ include "keycloak.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} +{{- end }} + +{{- define "keycloak.databasePasswordEnv" -}} +{{- if or .Values.database.password .Values.database.existingSecret -}} +- name: KC_DB_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Values.database.existingSecret | default (printf "%s-database" (include "keycloak.fullname" . ))}} + key: {{ .Values.database.existingSecretKey | default "password" }} + {{- end }} +{{- end -}} diff --git a/charts/keycloakx/templates/configmap-startup.yaml b/charts/keycloakx/templates/configmap-startup.yaml new file mode 100644 index 0000000..72fffa7 --- /dev/null +++ b/charts/keycloakx/templates/configmap-startup.yaml @@ -0,0 +1,14 @@ +{{- if .Values.startupScripts }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "keycloak.fullname" . }}-startup + namespace: {{ .Release.Namespace }} + labels: + {{- include "keycloak.labels" . | nindent 4 }} +data: + {{- range $key, $value := .Values.startupScripts }} + {{ $key }}: | + {{- tpl $value $ | nindent 4 }} + {{- end }} +{{- end -}} diff --git a/charts/keycloakx/templates/database-secret.yaml b/charts/keycloakx/templates/database-secret.yaml new file mode 100644 index 0000000..2bd4056 --- /dev/null +++ b/charts/keycloakx/templates/database-secret.yaml @@ -0,0 +1,12 @@ +{{- if and .Values.database.password (not .Values.database.existingSecret) -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "keycloak.fullname" $ }}-database + namespace: {{ .Release.Namespace }} + labels: + {{- include "keycloak.labels" $ | nindent 4 }} +type: Opaque +stringData: + password: {{ .Values.database.password | quote }} +{{- end }} diff --git a/charts/keycloakx/templates/hpa.yaml b/charts/keycloakx/templates/hpa.yaml new file mode 100644 index 0000000..e1c9435 --- /dev/null +++ b/charts/keycloakx/templates/hpa.yaml @@ -0,0 +1,23 @@ +{{- if .Values.autoscaling.enabled }} +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "keycloak.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "keycloak.labels" . | nindent 4 }} + {{- range $key, $value := .Values.autoscaling.labels }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: StatefulSet + name: {{ include "keycloak.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + {{- toYaml .Values.autoscaling.metrics | nindent 4 }} + behavior: + {{- toYaml .Values.autoscaling.behavior | nindent 4 }} +{{- end }} diff --git a/charts/keycloakx/templates/ingress.yaml b/charts/keycloakx/templates/ingress.yaml new file mode 100644 index 0000000..ccc94f7 --- /dev/null +++ b/charts/keycloakx/templates/ingress.yaml @@ -0,0 +1,112 @@ +{{- $ingress := .Values.ingress -}} +{{- if $ingress.enabled -}} +{{- $apiVersion := "networking.k8s.io/v1" -}} +apiVersion: {{ $apiVersion }} +kind: Ingress +metadata: + name: {{ include "keycloak.fullname" . }} + namespace: {{ .Release.Namespace }} + {{- with $ingress.annotations }} + annotations: + {{- range $key, $value := . }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} + {{- end }} + labels: + {{- include "keycloak.labels" . | nindent 4 }} + {{- range $key, $value := $ingress.labels }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} +spec: +{{- if $ingress.ingressClassName }} + ingressClassName: {{ $ingress.ingressClassName }} +{{- end }} +{{- if $ingress.tls }} + tls: + {{- range $ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ tpl . $ | quote }} + {{- end }} + {{- with .secretName }} + secretName: {{ tpl . $ }} + {{- end }} + {{- end }} +{{- end }} + rules: + {{- range .Values.ingress.rules }} + - host: {{ tpl .host $ | quote }} + http: + paths: + {{- range .paths }} + - path: {{ tpl .path $ | quote }} + pathType: {{ .pathType }} + backend: + service: + name: {{ include "keycloak.fullname" $ }}-http + port: + name: {{ $ingress.servicePort }} + {{- end }} + {{- end }} +{{- if $ingress.console.enabled }} +--- +apiVersion: {{ $apiVersion }} +kind: Ingress +metadata: + name: {{ include "keycloak.fullname" . }}-console + namespace: {{ .Release.Namespace }} + {{- with $ingress.console.annotations }} + annotations: + {{- range $key, $value := . }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} + {{- end }} + labels: + {{- include "keycloak.labels" . | nindent 4 }} + {{- range $key, $value := $ingress.labels }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} +spec: +{{- if $ingress.console.ingressClassName }} + ingressClassName: {{ $ingress.console.ingressClassName }} +{{- end }} +{{- if $ingress.console.tls }} + tls: + {{- range $ingress.console.tls }} + - hosts: + {{- range .hosts }} + - {{ tpl . $ | quote }} + {{- end }} + {{- with .secretName }} + secretName: {{ tpl . $ }} + {{- end }} + {{- end }} +{{ else if $ingress.tls }} + tls: + {{- range $ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ tpl . $ | quote }} + {{- end }} + {{- with .secretName }} + secretName: {{ tpl . $ }} + {{- end }} + {{- end }} +{{- end }} + rules: + {{- range .Values.ingress.console.rules }} + - host: {{ tpl .host $ | quote }} + http: + paths: + {{- range .paths }} + - path: {{ tpl .path $ | quote }} + pathType: {{ .pathType }} + backend: + service: + name: {{ include "keycloak.fullname" $ }}-http + port: + name: {{ $ingress.servicePort }} + {{- end }} + {{- end }} +{{- end -}} +{{- end -}} diff --git a/charts/keycloakx/templates/networkpolicy.yaml b/charts/keycloakx/templates/networkpolicy.yaml new file mode 100644 index 0000000..f375327 --- /dev/null +++ b/charts/keycloakx/templates/networkpolicy.yaml @@ -0,0 +1,52 @@ +{{- if .Values.networkPolicy.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "keycloak.fullname" . | quote }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "keycloak.labels" . | nindent 4 }} + {{- range $key, $value := .Values.networkPolicy.labels }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} +spec: + policyTypes: + - Ingress + {{- if .Values.networkPolicy.egress }} + - Egress + {{- end}} + podSelector: + matchLabels: + {{- include "keycloak.selectorLabels" . | nindent 6 }} + ingress: + {{- with .Values.networkPolicy.extraFrom }} + - from: + {{- toYaml . | nindent 8 }} + ports: + - protocol: TCP + port: 8080 + - protocol: TCP + port: 8443 + {{ range $.Values.extraPorts }} + - protocol: {{ default "TCP" .protocol }} + port: {{ .containerPort }} + {{- end }} + {{- end }} + - from: + - podSelector: + matchLabels: + {{- include "keycloak.selectorLabels" . | nindent 14 }} + ports: + - protocol: TCP + port: 8080 + - protocol: TCP + port: 8443 + {{ range .Values.extraPorts }} + - protocol: {{ default "TCP" .protocol }} + port: {{ .containerPort }} + {{- end }} + {{- if .Values.networkPolicy.egress }} + egress: + {{- .Values.networkPolicy.egress | toYaml | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/keycloakx/templates/poddisruptionbudget.yaml b/charts/keycloakx/templates/poddisruptionbudget.yaml new file mode 100644 index 0000000..14de61b --- /dev/null +++ b/charts/keycloakx/templates/poddisruptionbudget.yaml @@ -0,0 +1,14 @@ +{{- if .Values.podDisruptionBudget -}} +apiVersion: {{ ternary "policy/v1" "policy/v1beta1" (semverCompare ">=1.21.0-0" .Capabilities.KubeVersion.Version) }} +kind: PodDisruptionBudget +metadata: + name: {{ include "keycloak.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "keycloak.labels" . | nindent 4 }} +spec: + selector: + matchLabels: + {{- include "keycloak.selectorLabels" . | nindent 6 }} + {{- toYaml .Values.podDisruptionBudget | nindent 2 }} +{{- end -}} diff --git a/charts/keycloakx/templates/prometheusrule.yaml b/charts/keycloakx/templates/prometheusrule.yaml new file mode 100644 index 0000000..b7d3648 --- /dev/null +++ b/charts/keycloakx/templates/prometheusrule.yaml @@ -0,0 +1,29 @@ +{{- with .Values.prometheusRule -}} +{{- if .enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule +metadata: + name: {{ include "keycloak.fullname" $ }} + {{- with .namespace }} + namespace: {{ . }} + {{- else }} + namespace: {{ $.Release.Namespace }} + {{- end }} + {{- with .annotations }} + annotations: + {{- range $key, $value := . }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} + {{- end }} + labels: + {{- include "keycloak.labels" $ | nindent 4 }} + {{- range $key, $value := .labels }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} +spec: + groups: + - name: {{ include "keycloak.fullname" $ }} + rules: + {{- toYaml .rules | nindent 8 }} +{{- end }} +{{- end -}} diff --git a/charts/keycloakx/templates/rbac.yaml b/charts/keycloakx/templates/rbac.yaml new file mode 100644 index 0000000..d74dbab --- /dev/null +++ b/charts/keycloakx/templates/rbac.yaml @@ -0,0 +1,27 @@ +{{- if and .Values.rbac.create .Values.rbac.rules }} +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "keycloak.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "keycloak.labels" . | nindent 4 }} +rules: + {{- toYaml .Values.rbac.rules | nindent 2 }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "keycloak.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "keycloak.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "keycloak.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ include "keycloak.serviceAccountName" . }} + namespace: {{ .Release.Namespace | quote }} +{{- end }} diff --git a/charts/keycloakx/templates/route.yaml b/charts/keycloakx/templates/route.yaml new file mode 100644 index 0000000..5635373 --- /dev/null +++ b/charts/keycloakx/templates/route.yaml @@ -0,0 +1,39 @@ +{{- $route := .Values.route -}} +{{- if $route.enabled -}} +apiVersion: route.openshift.io/v1 +kind: Route +metadata: + name: {{ include "keycloak.fullname" . }} + namespace: {{ .Release.Namespace }} + {{- with $route.annotations }} + annotations: + {{- range $key, $value := . }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} + {{- end }} + labels: + {{- include "keycloak.labels" . | nindent 4 }} + {{- range $key, $value := $route.labels }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} +spec: +{{- if $route.host }} + host: {{ tpl $route.host $ | quote }} +{{- end }} + path: {{ $route.path }} + port: + {{- if or (not $route.tls.enabled) (eq $route.tls.termination "edge") }} + targetPort: http + {{- else}} + targetPort: https + {{- end}} + to: + kind: Service + name: {{ include "keycloak.fullname" $ }}-http + weight: 100 + {{- if $route.tls.enabled }} + tls: + insecureEdgeTerminationPolicy: {{ $route.tls.insecureEdgeTerminationPolicy }} + termination: {{ $route.tls.termination }} + {{- end }} +{{- end -}} diff --git a/charts/keycloakx/templates/secrets.yaml b/charts/keycloakx/templates/secrets.yaml new file mode 100644 index 0000000..b3b15c9 --- /dev/null +++ b/charts/keycloakx/templates/secrets.yaml @@ -0,0 +1,30 @@ +{{- range $nameSuffix, $values := .Values.secrets }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "keycloak.fullname" $ }}-{{ $nameSuffix }} + namespace: {{ $.Release.Namespace }} + {{- with $values.annotations }} + annotations: + {{- range $key, $value := . }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} + {{- end }} + labels: + {{- include "keycloak.labels" $ | nindent 4 }} + {{- range $key, $value := $values.labels }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} +type: {{ default "Opaque" $values.type }} +{{- with $values.data }} +data: + {{- toYaml . | nindent 2 }} +{{- end }} +{{- with $values.stringData }} +stringData: + {{- range $key, $value := . }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 2 }} + {{- end }} +{{- end }} +{{- end -}} diff --git a/charts/keycloakx/templates/service-headless.yaml b/charts/keycloakx/templates/service-headless.yaml new file mode 100644 index 0000000..7fe0fc7 --- /dev/null +++ b/charts/keycloakx/templates/service-headless.yaml @@ -0,0 +1,24 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "keycloak.fullname" . }}-headless + namespace: {{ .Release.Namespace }} + {{- with .Values.serviceHeadless.annotations }} + annotations: + {{- range $key, $value := . }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} + {{- end }} + labels: + {{- include "keycloak.labels" . | nindent 4 }} + app.kubernetes.io/component: headless +spec: + type: ClusterIP + clusterIP: None + ports: + - name: http + port: {{ .Values.service.httpPort }} + targetPort: http + protocol: TCP + selector: + {{- include "keycloak.selectorLabels" . | nindent 4 }} diff --git a/charts/keycloakx/templates/service-http.yaml b/charts/keycloakx/templates/service-http.yaml new file mode 100644 index 0000000..a222ad3 --- /dev/null +++ b/charts/keycloakx/templates/service-http.yaml @@ -0,0 +1,62 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "keycloak.fullname" . }}-http + namespace: {{ .Release.Namespace }} + {{- with .Values.service.annotations }} + annotations: + {{- range $key, $value := . }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} + {{- end }} + labels: + {{- include "keycloak.labels" . | nindent 4 }} + {{- range $key, $value := .Values.service.labels }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} + app.kubernetes.io/component: http +spec: + type: {{ .Values.service.type }} + {{- if and (eq "LoadBalancer" .Values.service.type) .Values.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.service.loadBalancerIP }} + {{- end }} + {{- if and (eq "LoadBalancer" .Values.service.type) .Values.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: + {{- toYaml .Values.service.loadBalancerSourceRanges | nindent 4 }} + {{- end }} + {{- if eq "LoadBalancer" .Values.service.type }} + externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy }} + {{- end }} + {{- if .Values.service.sessionAffinity }} + sessionAffinity: {{ .Values.service.sessionAffinity }} + {{- with .Values.service.sessionAffinityConfig }} + sessionAffinityConfig: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} + ports: + - name: '{{ .Values.http.internalPort }}' + port: 9000 + protocol: TCP + targetPort: '{{ .Values.http.internalPort }}' + - name: http + port: {{ .Values.service.httpPort }} + targetPort: http + {{- if and (or (eq "NodePort" .Values.service.type) (eq "LoadBalancer" .Values.service.type) ) .Values.service.httpNodePort }} + nodePort: {{ .Values.service.httpNodePort }} + {{- end }} + protocol: TCP + {{- if .Values.service.httpsPort }} + - name: https + port: {{ .Values.service.httpsPort }} + targetPort: https + {{- if and (or (eq "NodePort" .Values.service.type) (eq "LoadBalancer" .Values.service.type) ) .Values.service.httpsNodePort }} + nodePort: {{ .Values.service.httpsNodePort }} + {{- end }} + protocol: TCP + {{- end }} + {{- with .Values.service.extraPorts }} + {{- toYaml . | nindent 4 }} + {{- end }} + selector: + {{- include "keycloak.selectorLabels" . | nindent 4 }} diff --git a/charts/keycloakx/templates/serviceaccount.yaml b/charts/keycloakx/templates/serviceaccount.yaml new file mode 100644 index 0000000..1a7766e --- /dev/null +++ b/charts/keycloakx/templates/serviceaccount.yaml @@ -0,0 +1,47 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "keycloak.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- range $key, $value := . }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} + {{- end }} + labels: + {{- include "keycloak.labels" . | nindent 4 }} + {{- range $key, $value := .Values.serviceAccount.labels }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} +imagePullSecrets: + {{- toYaml .Values.serviceAccount.imagePullSecrets | nindent 4 }} +automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} + +--- + + {{- if .Values.serviceAccount.allowReadPods -}} +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: jgroups-kubeping-pod-reader-{{ .Release.Namespace }} +rules: + - apiGroups: [""] + resources: ["pods"] + verbs: ["get", "list"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: jgroups-kubeping-api-access-{{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: jgroups-kubeping-pod-reader-{{ .Release.Namespace }} +subjects: + - kind: ServiceAccount + name: {{ include "keycloak.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + {{- end }} +{{- end }} diff --git a/charts/keycloakx/templates/servicemonitor.yaml b/charts/keycloakx/templates/servicemonitor.yaml new file mode 100644 index 0000000..c8c13b1 --- /dev/null +++ b/charts/keycloakx/templates/servicemonitor.yaml @@ -0,0 +1,42 @@ +{{- range $key, $serviceMonitor := dict "keycloakx" .Values.serviceMonitor "extra" .Values.extraServiceMonitor }} +{{- with $serviceMonitor }} +{{- if .enabled }} +--- +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "keycloak.fullname" $ }}-{{ $key }} + {{- with .namespace }} + namespace: {{ . }} + {{- else }} + namespace: {{ $.Release.Namespace }} + {{- end }} + {{- with .annotations }} + annotations: + {{- range $key, $value := . }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} + {{- end }} + labels: + {{- include "keycloak.labels" $ | nindent 4 }} + {{- range $key, $value := .labels }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} +spec: + {{- with .namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} + {{- end }} + selector: + matchLabels: + {{- include "keycloak.selectorLabels" $ | nindent 6 }} + app.kubernetes.io/component: http + endpoints: + - port: {{ tpl .port $ | quote }} + path: {{ tpl .path $ | quote }} + scheme: {{ $.Values.http.internalScheme | lower }} + interval: {{ .interval }} + scrapeTimeout: {{ .scrapeTimeout }} +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/keycloakx/templates/statefulset.yaml b/charts/keycloakx/templates/statefulset.yaml new file mode 100644 index 0000000..00add77 --- /dev/null +++ b/charts/keycloakx/templates/statefulset.yaml @@ -0,0 +1,235 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ include "keycloak.fullname" . }} + namespace: {{ .Release.Namespace }} + {{- with .Values.statefulsetAnnotations }} + annotations: + {{- range $key, $value := . }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} + {{- end }} + labels: + {{- include "keycloak.labels" . | nindent 4 }} + {{- range $key, $value := .Values.statefulsetLabels }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: + {{- include "keycloak.selectorLabels" . | nindent 6 }} + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicas }} + {{- end }} + serviceName: {{ include "keycloak.fullname" . }}-headless + podManagementPolicy: {{ .Values.podManagementPolicy }} + updateStrategy: + type: {{ .Values.updateStrategy }} + template: + metadata: + annotations: + checksum/config-startup: {{ include (print .Template.BasePath "/configmap-startup.yaml") . | sha256sum }} + checksum/secrets: {{ tpl (toYaml .Values.secrets) . | sha256sum }} + {{- range $key, $value := .Values.podAnnotations }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 8 }} + {{- end }} + labels: + {{- include "keycloak.selectorLabels" . | nindent 8 }} + {{- range $key, $value := .Values.podLabels }} + {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 8 }} + {{- end }} + spec: + {{- if not .Values.skipInitContainers }} + {{- if or .Values.dbchecker.enabled .Values.extraInitContainers }} + initContainers: + {{- if and .Values.dbchecker.enabled }} + - name: dbchecker + image: "{{ .Values.dbchecker.image.repository }}{{- if (.Values.dbchecker.image.digest) -}}@{{ .Values.dbchecker.image.digest }}{{- else -}}:{{ .Values.dbchecker.image.tag }} {{- end }}" + imagePullPolicy: {{ .Values.dbchecker.image.pullPolicy }} + securityContext: + {{- toYaml .Values.dbchecker.securityContext | nindent 12 }} + command: + - sh + - -c + - | + echo 'Waiting for Database to become ready...' + + until printf "." && nc -z -w 2 {{ required ".Values.database.hostname is required if dbchecker is enabled!" .Values.database.hostname }} {{ required ".Values.database.port is required if dbchecker is enabled!" .Values.database.port }}; do + sleep 2; + done; + + echo 'Database OK ✓' + resources: + {{- toYaml .Values.dbchecker.resources | nindent 12 }} + {{- end }} + {{- with .Values.extraInitContainers }} + {{- tpl . $ | nindent 8 }} + {{- end }} + {{- end }} + {{- end }} + containers: + - name: keycloak + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.repository }}{{- if (.Values.image.digest) -}}@{{ .Values.image.digest }}{{- else -}}:{{ .Values.image.tag | default .Chart.AppVersion }} {{- end }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + {{- if .Values.command }} + command: + {{- toYaml .Values.command | nindent 12 }} + {{- end }} + {{- if .Values.args }} + args: + {{- toYaml .Values.args | nindent 12 }} + {{- end }} + {{- with .Values.lifecycleHooks }} + lifecycle: + {{- tpl . $ | nindent 12 }} + {{- end }} + env: + {{- if and (.Values.http.relativePath) (eq .Values.http.relativePath "/") }} + - name: KC_HTTP_RELATIVE_PATH + value: {{ tpl .Values.http.relativePath $ }} + {{ else }} + - name: KC_HTTP_RELATIVE_PATH + value: {{ tpl .Values.http.relativePath $ | trimSuffix "/" }} + {{- end }} + {{- if eq .Values.cache.stack "default" }} + - name: KC_CACHE + value: "ispn" + - name: KC_CACHE_STACK + value: "kubernetes" + {{- end }} + {{- if .Values.proxy.enabled }} + - name: KC_PROXY_HEADERS + value: {{ .Values.proxy.mode }} + {{- end }} + {{- if .Values.proxy.http.enabled }} + - name: KC_HTTP_ENABLED + value: "true" + {{- end }} + {{- if .Values.database.vendor }} + - name: KC_DB + value: {{ .Values.database.vendor }} + {{- end }} + {{- if .Values.database.hostname }} + - name: KC_DB_URL_HOST + value: {{ .Values.database.hostname }} + {{- end }} + {{- if .Values.database.port }} + - name: KC_DB_URL_PORT + value: {{ .Values.database.port | quote }} + {{- end }} + {{- if .Values.database.database }} + - name: KC_DB_URL_DATABASE + value: {{ .Values.database.database }} + {{- end }} + {{- if .Values.database.username }} + - name: KC_DB_USERNAME + value: {{ .Values.database.username }} + {{- end }} + {{- if or .Values.database.password .Values.database.existingSecret -}} + {{- include "keycloak.databasePasswordEnv" . | nindent 12 }} + {{- end }} + {{- if .Values.metrics.enabled }} + - name: KC_METRICS_ENABLED + value: "true" + {{- end }} + {{- if .Values.health.enabled }} + - name: KC_HEALTH_ENABLED + value: "true" + {{- end }} + {{- with .Values.extraEnv }} + {{- tpl . $ | nindent 12 }} + {{- end }} + envFrom: + {{- with .Values.extraEnvFrom }} + {{- tpl . $ | nindent 12 }} + {{- end }} + ports: + - name: http + containerPort: 8080 + protocol: TCP + - name: '{{ .Values.http.internalPort }}' + containerPort: 9000 + protocol: TCP + {{- if .Values.service.httpsPort }} + - name: https + containerPort: 8443 + protocol: TCP + {{- end }} + {{- with .Values.extraPorts }} + {{- toYaml . | nindent 12 }} + {{- end }} + {{- if .Values.health.enabled }} + {{- with .Values.livenessProbe }} + livenessProbe: + {{- tpl . $ | nindent 12 }} + {{- end }} + {{- if .Values.metrics.enabled }} + {{- with .Values.readinessProbe }} + readinessProbe: + {{- tpl . $ | nindent 12 }} + {{- end }} + {{- end}} + {{- with .Values.startupProbe }} + startupProbe: + {{- tpl . $ | nindent 12 }} + {{- end }} + {{- end }} + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + {{- with .Values.extraVolumeMounts }} + {{- tpl . $ | nindent 12 }} + {{- end }} + {{- with .Values.extraContainers }} + {{- tpl . $ | nindent 8 }} + {{- end }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "keycloak.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- with .Values.hostAliases }} + hostAliases: + {{- toYaml . | nindent 8 }} + {{- end }} + enableServiceLinks: {{ .Values.enableServiceLinks }} + restartPolicy: {{ .Values.restartPolicy }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- tpl . $ | nindent 8 }} + {{- end }} + {{- with .Values.topologySpreadConstraints }} + topologySpreadConstraints: + {{- tpl . $ | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.priorityClassName }} + priorityClassName: {{ . }} + {{- end }} + terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} + volumes: + {{- with .Values.startupScripts }} + - name: startup + configMap: + name: {{ include "keycloak.fullname" $ }}-startup + defaultMode: 0555 + items: + {{- range $key, $value := . }} + - key: {{ $key }} + path: {{ $key }} + {{- end }} + {{- end }} + {{- with .Values.extraVolumes }} + {{- tpl . $ | nindent 8 }} + {{- end }} diff --git a/charts/keycloakx/templates/test/configmap-test.yaml b/charts/keycloakx/templates/test/configmap-test.yaml new file mode 100644 index 0000000..ab2f47f --- /dev/null +++ b/charts/keycloakx/templates/test/configmap-test.yaml @@ -0,0 +1,76 @@ +{{- if .Values.test.enabled }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "keycloak.fullname" . }}-test + namespace: {{ .Release.Namespace }} + labels: + {{- include "keycloak.labels" . | nindent 4 }} + annotations: + helm.sh/hook: test + helm.sh/hook-delete-policy: hook-succeeded +data: + test.sh: | + #!/usr/bin/env bash + set -eu + + if ! python3 -c 'import selenium' &> /dev/null + then + if ! command -v pip3 &> /dev/null + then + echo 'Installing pip3...' + export PATH="$PATH:$HOME/.local/bin" + mkdir -p "$HOME/.config/pip" + echo -e '[global]\nbreak-system-packages = true' > "$HOME/.config/pip/pip.conf" + wget -q -P "$HOME" https://bootstrap.pypa.io/get-pip.py + python3 "$HOME/get-pip.py" --user 1> /dev/null + fi + + echo 'Installing selemium module...' + pip3 -q install selenium + fi + + python3 "$(dirname $0)/test.py" + test.py: | + import os + from selenium import webdriver + from selenium.webdriver.common.by import By + from selenium.webdriver.support.ui import WebDriverWait + from selenium.webdriver.chrome.options import Options + from selenium.webdriver.support import expected_conditions + + print('Creating chrome driver in headless mode') + chrome_options = Options() + chrome_options.add_argument("--headless") + chrome_options.add_argument('--no-sandbox') + chrome_options.add_argument('--disable-dev-shm-usage') + driver = webdriver.Chrome(options=chrome_options) + + base_url = 'http://{{ include "keycloak.fullname" . }}-http{{ if ne 80 (int .Values.service.httpPort) }}:{{ .Values.service.httpPort }}{{ end }}' + + print('Opening Keycloak...') + driver.get('{0}{{ tpl .Values.http.relativePath . | trimSuffix "/" }}/admin/'.format(base_url)) + + username = os.environ['KEYCLOAK_USER'] + password = os.environ['KEYCLOAK_PASSWORD'] + + username_input = WebDriverWait(driver, 30).until(expected_conditions.presence_of_element_located((By.ID, "username"))) + password_input = WebDriverWait(driver, 30).until(expected_conditions.presence_of_element_located((By.ID, "password"))) + login_button = WebDriverWait(driver, 30).until(expected_conditions.presence_of_element_located((By.ID, "kc-login"))) + + print('Entering username...') + username_input.send_keys(username) + + print('Entering password...') + password_input.send_keys(password) + + print('Clicking login button...') + login_button.click() + + WebDriverWait(driver, 30).until(lambda driver: '{{ tpl .Values.http.relativePath . | trimSuffix "/" }}/admin/master/console/' in driver.current_url) + + print('Admin console visible. Login successful.') + + driver.quit() + + {{- end }} diff --git a/charts/keycloakx/templates/test/pod-test.yaml b/charts/keycloakx/templates/test/pod-test.yaml new file mode 100644 index 0000000..fe4e599 --- /dev/null +++ b/charts/keycloakx/templates/test/pod-test.yaml @@ -0,0 +1,45 @@ +{{- if .Values.test.enabled }} +apiVersion: v1 +kind: Pod +metadata: + name: {{ include "keycloak.fullname" . }}-test + namespace: {{ .Release.Namespace }} + labels: + {{- include "keycloak.labels" . | nindent 4 }} + app.kubernetes.io/component: test + annotations: + helm.sh/hook: test + helm.sh/hook-delete-policy: {{ .Values.test.deletionPolicy }} +spec: + securityContext: + {{- toYaml .Values.test.podSecurityContext | nindent 4 }} + containers: + - name: keycloak-test + image: "{{ .Values.test.image.repository }}{{- if (.Values.test.image.digest) -}}@{{ .Values.test.image.digest }}{{- else -}}:{{ .Values.test.image.tag }} {{- end }}" + imagePullPolicy: {{ .Values.test.image.pullPolicy }} + securityContext: + {{- toYaml .Values.test.securityContext | nindent 8 }} + command: + - bash + args: + - /tests/test.sh + env: + - name: KEYCLOAK_USER + valueFrom: + secretKeyRef: + name: {{ include "keycloak.fullname" . }}-admin-creds + key: user + - name: KEYCLOAK_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "keycloak.fullname" . }}-admin-creds + key: password + volumeMounts: + - name: tests + mountPath: /tests + volumes: + - name: tests + configMap: + name: {{ include "keycloak.fullname" . }}-test + restartPolicy: Never +{{- end }} diff --git a/charts/keycloakx/values.schema.json b/charts/keycloakx/values.schema.json new file mode 100644 index 0000000..8b355b6 --- /dev/null +++ b/charts/keycloakx/values.schema.json @@ -0,0 +1,512 @@ +{ + "$schema": "http://json-schema.org/schema#", + "type": "object", + "required": [ + "image" + ], + "definitions": { + "image": { + "type": "object", + "required": [ + "repository", + "tag" + ], + "properties": { + "pullPolicy": { + "type": "string", + "pattern": "^(Always|Never|IfNotPresent)$" + }, + "repository": { + "type": "string" + }, + "tag": { + "type": ["string", "integer"] + }, + "digest": { + "type": "string" + } + } + }, + "imagePullSecrets": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string" + } + } + } + } + }, + "properties": { + "affinity": { + "type": "string" + }, + "args": { + "type": "array" + }, + "clusterDomain": { + "type": "string" + }, + "command": { + "type": "array" + }, + "enableServiceLinks": { + "type": "boolean" + }, + "extraContainers": { + "type": "string" + }, + "extraEnv": { + "type": "string" + }, + "extraEnvFrom": { + "type": "string" + }, + "extraInitContainers": { + "type": "string" + }, + "extraPorts": { + "type": "array" + }, + "extraVolumeMounts": { + "type": "string" + }, + "extraVolumes": { + "type": "string" + }, + "fullnameOverride": { + "type": "string" + }, + "hostAliases": { + "type": "array" + }, + "http": { + "relativePath": "string", + "internalPort": "string", + "internalScheme": "string" + }, + "image": { + "$ref": "#/definitions/image" + }, + "imagePullSecrets": { + "$ref": "#/definitions/imagePullSecrets" + }, + "ingress": { + "type": "object", + "properties": { + "annotations": { + "type": "object" + }, + "enabled": { + "type": "boolean" + }, + "labels": { + "type": "object" + }, + "rules": { + "type": "array", + "items": { + "type": "object", + "properties": { + "host": { + "type": "string" + }, + "paths": { + "type": "array", + "items": { + "type": "object", + "properties": { + "path": { + "type": "string" + }, + "pathType": { + "type": "string" + } + } + } + } + } + } + }, + "servicePort": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ] + }, + "tls": { + "type": "array", + "items": { + "type": "object", + "properties": { + "hosts": { + "type": "array", + "items": { + "items": { + "type": "string" + } + }, + "secretName": { + "type": "string" + } + } + } + } + } + }, + "lifecycleHooks": { + "type": "string" + }, + "livenessProbe": { + "type": "string" + }, + "nameOverride": { + "type": "string" + }, + "nodeSelector": { + "type": "object" + }, + "dbchecker": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "image": { + "$ref": "#/definitions/image" + }, + "resources": { + "type": "object", + "properties": { + "limits": { + "type": "object", + "properties": { + "cpu": { + "type": "string" + }, + "memory": { + "type": "string" + } + } + }, + "requests": { + "type": "object", + "properties": { + "cpu": { + "type": "string" + }, + "memory": { + "type": "string" + } + } + } + } + }, + "securityContext": { + "type": "object" + } + } + }, + "podAnnotations": { + "type": "object" + }, + "podDisruptionBudget": { + "type": "object" + }, + "podLabels": { + "type": "object" + }, + "podManagementPolicy": { + "type": "string" + }, + "updateStrategy": { + "type": "string" + }, + "podSecurityContext": { + "type": "object" + }, + "cache": { + "type": "object", + "properties": { + "stack": { + "type": "string" + } + } + }, + "proxy": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "mode": { + "type": "string" + } + } + }, + "metrics": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + } + }, + "health": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + } + }, + "database": { + "type": "object", + "properties": { + "vendor": { + "type": "string" + }, + "hostname": { + "type": "string" + }, + "port": { + "type": "integer" + }, + "username": { + "type": "string" + }, + "password": { + "type": "string" + }, + "database": { + "type": "string" + }, + "existingSecret": { + "type": "string" + } + } + }, + "priorityClassName": { + "type": "string" + }, + "prometheusRule": { + "type": "object" + }, + "serviceMonitor": { + "type": "object" + }, + "extraServiceMonitor": { + "type": "object" + }, + "readinessProbe": { + "type": "string" + }, + "replicas": { + "type": "integer" + }, + "resources": { + "type": "object" + }, + "restartPolicy": { + "type": "string" + }, + "route": { + "type": "object", + "properties": { + "annotations": { + "type": "object" + }, + "enabled": { + "type": "boolean" + }, + "host": { + "type": "string" + }, + "labels": { + "type": "object" + }, + "path": { + "type": "string" + }, + "tls": { + "type": "object" + } + } + }, + "secrets": { + "type": "object" + }, + "securityContext": { + "type": "object" + }, + "service": { + "type": "object", + "properties": { + "annotations": { + "type": "object" + }, + "extraPorts": { + "type": "array" + }, + "loadBalancerSourceRanges": { + "type": "array" + }, + "httpNodePort": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "null" + } + ] + }, + "httpPort": { + "type": "integer" + }, + "httpsNodePort": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "null" + } + ] + }, + "httpsPort": { + "type": "integer" + }, + "labels": { + "type": "object" + }, + "nodePort": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "null" + } + ] + }, + "type": { + "type": "string" + }, + "loadBalancerIP": { + "type": "string" + }, + "sessionAffinity": { + "type": "string" + }, + "sessionAffinityConfig": { + "type": "object" + } + } + }, + "serviceHeadless": { + "type": "object", + "properties": { + "annotations": { + "type": "object" + } + } + }, + "serviceAccount": { + "type": "object", + "properties": { + "annotations": { + "type": "object" + }, + "create": { + "type": "boolean" + }, + "allowReadPods": { + "type": "boolean" + }, + "imagePullSecrets": { + "$ref": "#/definitions/imagePullSecrets" + }, + "labels": { + "type": "object" + }, + "name": { + "type": "string" + }, + "automountServiceAccountToken": { + "type": "boolean" + } + } + }, + "rbac": { + "type": "object", + "properties": { + "create": { + "type": "boolean" + }, + "rules": { + "type": "array" + } + } + }, + "statefulsetAnnotations": { + "type": "object" + }, + "statefulsetLabels": { + "type": "object" + }, + "terminationGracePeriodSeconds": { + "type": "integer" + }, + "autoscaling": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "labels": { + "type": "object" + }, + "minReplicas": { + "type": "integer" + }, + "maxReplicas": { + "type": "integer" + }, + "metrics": { + "type": "array" + }, + "behavior": { + "type": "object" + } + } + }, + "test": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "image": { + "$ref": "#/definitions/image" + }, + "podSecurityContext": { + "type": "object" + }, + "securityContext": { + "type": "object" + } + } + }, + "tolerations": { + "type": "array" + } + } + } +} diff --git a/charts/keycloakx/values.yaml b/charts/keycloakx/values.yaml new file mode 100644 index 0000000..4c06ba8 --- /dev/null +++ b/charts/keycloakx/values.yaml @@ -0,0 +1,546 @@ +# Optionally override the fully qualified name +fullnameOverride: "" + +# Optionally override the name +nameOverride: "" + +# The number of replicas to create (has no effect if autoscaling enabled) +replicas: 1 + +image: + # The Keycloak image repository + repository: quay.io/keycloak/keycloak + # Overrides the Keycloak image tag whose default is the chart appVersion + tag: "26.0.7" + # Overrides the Keycloak image tag with a specific digest + digest: "" + # The Keycloak image pull policy + pullPolicy: IfNotPresent + +# Image pull secrets for the Pod +imagePullSecrets: [] +# - name: myRegistrKeySecretName + +# Mapping between IPs and hostnames that will be injected as entries in the Pod's hosts files +hostAliases: [] +# - ip: "1.2.3.4" +# hostnames: +# - "my.host.com" + +# Indicates whether information about services should be injected into Pod's environment variables, matching the syntax of Docker links +enableServiceLinks: true + +# Pod management policy. One of `Parallel` or `OrderedReady` +podManagementPolicy: OrderedReady + +# StatefulSet's update strategy +updateStrategy: RollingUpdate + +# Pod restart policy. One of `Always`, `OnFailure`, or `Never` +restartPolicy: Always + +serviceAccount: + # Specifies whether a ServiceAccount should be created + create: true + # Specifies whether the ServiceAccount can get and list pods + allowReadPods: false + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + # Additional annotations for the ServiceAccount + annotations: {} + # Additional labels for the ServiceAccount + labels: {} + # Image pull secrets that are attached to the ServiceAccount + imagePullSecrets: [] + # Automount API credentials for the Service Account + automountServiceAccountToken: true + +rbac: + create: false + rules: [] + # RBAC rules for KUBE_PING + # - apiGroups: + # - "" + # resources: + # - pods + # verbs: + # - get + # - list + +# SecurityContext for the entire Pod. Every container running in the Pod will inherit this SecurityContext. This might be relevant when other components of the environment inject additional containers into running Pods (service meshes are the most prominent example for this) +podSecurityContext: + fsGroup: 1000 + +# SecurityContext for the Keycloak container +securityContext: + runAsUser: 1000 + runAsNonRoot: true + +# Additional init containers, e. g. for providing custom themes +extraInitContainers: "" + +# When using service meshes which rely on a sidecar, it may be necessary to skip init containers altogether, +# since the sidecar doesn't start until the init containers are done, and the sidecar may be required +# for network access. +# For example, Istio in strict mTLS mode prevents the dbchecker init container from ever completing +skipInitContainers: false + +# Additional sidecar containers, e. g. for a database proxy, such as Google's cloudsql-proxy +extraContainers: "" + +# Lifecycle hooks for the Keycloak container +lifecycleHooks: | +# postStart: +# exec: +# command: +# - /bin/sh +# - -c +# - ls + +# Termination grace period in seconds for Keycloak shutdown. Clusters with a large cache might need to extend this to give Infinispan more time to rebalance +terminationGracePeriodSeconds: 60 + +# The internal Kubernetes cluster domain +clusterDomain: cluster.local + +## Overrides the default entrypoint of the Keycloak container +command: [] + +## Overrides the default args for the Keycloak container +args: [] + +# Additional environment variables for Keycloak +extraEnv: "" + # - name: KC_LOG_LEVEL + # value: DEBUG + +# Additional environment variables for Keycloak mapped from Secret or ConfigMap +extraEnvFrom: "" + +# Pod priority class name +priorityClassName: "" + +# Pod affinity +affinity: | + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + {{- include "keycloak.selectorLabels" . | nindent 10 }} + matchExpressions: + - key: app.kubernetes.io/component + operator: NotIn + values: + - test + topologyKey: kubernetes.io/hostname + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 100 + podAffinityTerm: + labelSelector: + matchLabels: + {{- include "keycloak.selectorLabels" . | nindent 12 }} + matchExpressions: + - key: app.kubernetes.io/component + operator: NotIn + values: + - test + topologyKey: topology.kubernetes.io/zone + +# Topology spread constraints template +topologySpreadConstraints: + +# Node labels for Pod assignment +nodeSelector: {} + +# Node taints to tolerate +tolerations: [] + +# Additional Pod labels +podLabels: {} + +# Additional Pod annotations +podAnnotations: {} + +# Liveness probe configuration +livenessProbe: | + httpGet: + path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/health/live' + port: '{{ .Values.http.internalPort }}' + scheme: '{{ .Values.http.internalScheme }}' + initialDelaySeconds: 0 + timeoutSeconds: 5 + +# Readiness probe configuration +readinessProbe: | + httpGet: + path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/health/ready' + port: '{{ .Values.http.internalPort }}' + scheme: '{{ .Values.http.internalScheme }}' + initialDelaySeconds: 10 + timeoutSeconds: 1 + +# Startup probe configuration +startupProbe: | + httpGet: + path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/health' + port: '{{ .Values.http.internalPort }}' + scheme: '{{ .Values.http.internalScheme }}' + initialDelaySeconds: 15 + timeoutSeconds: 1 + failureThreshold: 60 + periodSeconds: 5 + +# Pod resource requests and limits +resources: {} + # requests: + # cpu: "500m" + # memory: "1024Mi" + # limits: + # cpu: "500m" + # memory: "1024Mi" + +# Add additional volumes, e. g. for custom themes +extraVolumes: "" + +# Add additional volumes mounts, e. g. for custom themes +extraVolumeMounts: "" + +# Add additional ports, e. g. for admin console or exposing JGroups ports +extraPorts: [] + +# Pod disruption budget +podDisruptionBudget: {} +# maxUnavailable: 1 +# minAvailable: 1 + +# Annotations for the StatefulSet +statefulsetAnnotations: {} + +# Additional labels for the StatefulSet +statefulsetLabels: {} + +# Configuration for secrets that should be created +secrets: {} + # mysecret: + # type: {} + # annotations: {} + # labels: {} + # stringData: {} + # data: {} + +service: + # Annotations for HTTP service + annotations: {} + # Additional labels for headless and HTTP Services + labels: {} + # key: value + # The Service type + type: ClusterIP + # Optional IP for the load balancer. Used for services of type LoadBalancer only + loadBalancerIP: "" + # The http Service port + httpPort: 80 + # The HTTP Service node port if type is NodePort + httpNodePort: null + # The HTTPS Service port + httpsPort: 8443 + # The HTTPS Service node port if type is NodePort + httpsNodePort: null + # Additional Service ports, e. g. for custom admin console + extraPorts: [] + # When using Service type LoadBalancer, you can restrict source ranges allowed + # to connect to the LoadBalancer, e. g. will result in Security Groups + # (or equivalent) with inbound source ranges allowed to connect + loadBalancerSourceRanges: [] + # When using Service type LoadBalancer, you can preserve the source IP seen in the container + # by changing the default (Cluster) to be Local. + # See https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + externalTrafficPolicy: "Cluster" + # Session affinity + # See https://kubernetes.io/docs/concepts/services-networking/service/#proxy-mode-userspace + sessionAffinity: "" + # Session affinity config + sessionAffinityConfig: {} + +serviceHeadless: + # Annotations for headless service + annotations: {} + +ingress: + # If `true`, an Ingress is created + enabled: false + # The name of the Ingress Class associated with this ingress + ingressClassName: "" + # The Service port targeted by the Ingress + servicePort: http + # Ingress annotations + annotations: {} + ## Resolve HTTP 502 error using ingress-nginx: + ## See https://www.ibm.com/support/pages/502-error-ingress-keycloak-response + # nginx.ingress.kubernetes.io/proxy-buffer-size: 128k + + # Additional Ingress labels + labels: {} + # List of rules for the Ingress + rules: + - + # Ingress host + host: '{{ .Release.Name }}.keycloak.example.com' + # Paths for the host + paths: + - path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/' + pathType: Prefix + # TLS configuration + tls: + - hosts: + - keycloak.example.com + secretName: "" + + # ingress for console only (/auth/admin) + console: + # If `true`, an Ingress is created for console path only + enabled: false + # The name of Ingress Class associated with the console ingress only + ingressClassName: "" + # Ingress annotations for console ingress only + # Useful to set nginx.ingress.kubernetes.io/whitelist-source-range particularly + annotations: {} + rules: + - + # Ingress host + host: '{{ .Release.Name }}.keycloak.example.com' + # Paths for the host + paths: + - path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/admin' + pathType: Prefix + + # Console TLS configuration + tls: [] +# - hosts: +# - console.keycloak.example.com +# secretName: "" + +## Network policy configuration +# https://kubernetes.io/docs/concepts/services-networking/network-policies/ +networkPolicy: + # If true, the Network policies are deployed + enabled: false + + # Additional Network policy labels + labels: {} + + # Define all other external allowed source + # See https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#networkpolicypeer-v1-networking-k8s-io + extraFrom: [] + + # Define egress networkpolicies for the Keycloak pods (external database for example) + # See https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#networkpolicyegressrule-v1-networking-k8s-io + # egress: + # - to: + # - ipBlock: + # cidr: 192.168.1.30/32 + # ports: + # - protocol: TCP + # port: 3306 + egress: [] + +route: + # If `true`, an OpenShift Route is created + enabled: false + # Path for the Route + path: / + # Route annotations + annotations: {} + # Additional Route labels + labels: {} + # Host name for the Route + host: "" + # TLS configuration + tls: + # If `true`, TLS is enabled for the Route + enabled: true + # Insecure edge termination policy of the Route. Can be `None`, `Redirect`, or `Allow` + insecureEdgeTerminationPolicy: Redirect + # TLS termination of the route. Can be `edge`, `passthrough`, or `reencrypt` + termination: edge + +dbchecker: + enabled: false + image: + # Docker image used to check Database readiness at startup + repository: docker.io/busybox + # Image tag for the dbchecker image + tag: 1.32 + # Image pull policy for the dbchecker image + pullPolicy: IfNotPresent + # SecurityContext for the dbchecker container + securityContext: + allowPrivilegeEscalation: false + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + # Resource requests and limits for the dbchecker container + resources: + requests: + cpu: "20m" + memory: "32Mi" + limits: + cpu: "20m" + memory: "32Mi" + +database: + # don't create secret for db password. Instead use existing k8s secret + # existingSecret: "my-existent-dbpass-secret" + # existingSecretKey: "password" + existingSecret: "" + existingSecretKey: "" + # E.g. dev-file, dev-mem, mariadb, mssql, mysql, oracle or postgres + vendor: + hostname: + port: + database: + username: + password: + +cache: + # Use "custom" to disable automatic cache configuration + stack: default + +proxy: + enabled: true + mode: forwarded + http: + enabled: true + +metrics: + enabled: true + +health: + enabled: true + +http: + # For backwards compatibility reasons we set this to the value used by previous Keycloak versions. + relativePath: "/auth" + internalPort: http-internal + internalScheme: HTTP + +serviceMonitor: + # If `true`, a ServiceMonitor resource for the prometheus-operator is created + enabled: false + # Optionally sets a target namespace in which to deploy the ServiceMonitor resource + namespace: "" + # Optionally sets a namespace for the ServiceMonitor + namespaceSelector: {} + # Annotations for the ServiceMonitor + annotations: {} + # Additional labels for the ServiceMonitor + labels: {} + # Interval at which Prometheus scrapes metrics + interval: 10s + # Timeout for scraping + scrapeTimeout: 10s + # The path at which metrics are served + path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/metrics' + # The Service port at which metrics are served + port: '{{ .Values.http.internalPort }}' + +extraServiceMonitor: + # If `true`, a ServiceMonitor resource for the prometheus-operator is created + enabled: false + # Optionally sets a target namespace in which to deploy the ServiceMonitor resource + namespace: "" + # Optionally sets a namespace for the ServiceMonitor + namespaceSelector: {} + # Annotations for the ServiceMonitor + annotations: {} + # Additional labels for the ServiceMonitor + labels: {} + # Interval at which Prometheus scrapes metrics + interval: 10s + # Timeout for scraping + scrapeTimeout: 10s + # The path at which metrics are served + path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/metrics' + # The Service port at which metrics are served + port: '{{ .Values.http.internalPort }}' + +prometheusRule: + # If `true`, a PrometheusRule resource for the prometheus-operator is created + enabled: false + # Optionally sets a target namespace in which to deploy the ServiceMonitor resource + namespace: "" + # Annotations for the PrometheusRule + annotations: {} + # Additional labels for the PrometheusRule + labels: {} + # List of rules for Prometheus + rules: [] + # - alert: keycloak-IngressHigh5xxRate + # annotations: + # message: The percentage of 5xx errors for keycloak over the last 5 minutes is over 1%. + # expr: | + # ( + # sum( + # rate( + # nginx_ingress_controller_response_duration_seconds_count{exported_namespace="mynamespace",ingress="mynamespace-keycloak",status=~"5[0-9]{2}"}[1m] + # ) + # ) + # / + # sum( + # rate( + # nginx_ingress_controller_response_duration_seconds_count{exported_namespace="mynamespace",ingress="mynamespace-keycloak"}[1m] + # ) + # ) + # ) * 100 > 1 + # for: 5m + # labels: + # severity: warning + +autoscaling: + # If `true`, an autoscaling/v2 HorizontalPodAutoscaler resource is created (requires Kubernetes 1.23 or above) + # Autoscaling seems to be most reliable when using KUBE_PING service discovery (see README for details) + # This disables the `replicas` field in the StatefulSet + enabled: false + # Additional HorizontalPodAutoscaler labels + labels: {} + # The minimum and maximum number of replicas for the Keycloak StatefulSet + minReplicas: 3 + maxReplicas: 10 + # The metrics to use for scaling + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 80 + # The scaling policy to use. This will scale up quickly but only scale down a single Pod per 5 minutes. + # This is important because caches are usually only replicated to 2 Pods and if one of those Pods is terminated this will give the cluster time to recover. + behavior: + scaleDown: + stabilizationWindowSeconds: 300 + policies: + - type: Pods + value: 1 + periodSeconds: 300 + +test: + # If `true`, test resources are created + enabled: false + image: + # The image for the test Pod + repository: docker.io/seleniarm/standalone-chromium + # The tag for the test Pod image + tag: "117.0" + # The image pull policy for the test Pod image + pullPolicy: IfNotPresent + # SecurityContext for the entire test Pod + podSecurityContext: + fsGroup: 1000 + # SecurityContext for the test container + securityContext: + runAsUser: 1000 + runAsNonRoot: true + # See https://helm.sh/docs/topics/charts_hooks/#hook-deletion-policies + deletionPolicy: before-hook-creation diff --git a/charts/postgresql/.helmignore b/charts/postgresql/.helmignore new file mode 100644 index 0000000..207983f --- /dev/null +++ b/charts/postgresql/.helmignore @@ -0,0 +1,25 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +# img folder +img/ +# Changelog +CHANGELOG.md diff --git a/charts/postgresql/CHANGELOG.md b/charts/postgresql/CHANGELOG.md new file mode 100644 index 0000000..ed5ce19 --- /dev/null +++ b/charts/postgresql/CHANGELOG.md @@ -0,0 +1,2387 @@ +# Changelog + +## 16.5.0 (2025-03-10) + +* [bitnami/postgresql] Add secretAnnotation value ([#31984](https://github.com/bitnami/charts/pull/31984)) + +## 16.4.16 (2025-03-03) + +* [bitnami/postgresql] Release 16.4.16 (#32250) ([353c702](https://github.com/bitnami/charts/commit/353c702d65c42071ba93ae2d01286528fc8a0c9f)), closes [#32250](https://github.com/bitnami/charts/issues/32250) + +## 16.4.15 (2025-03-03) + +* [bitnami/postgresql] Release 16.4.15 (#32238) ([e55c589](https://github.com/bitnami/charts/commit/e55c589d64b918346a475d22578b90cab4f51c38)), closes [#32238](https://github.com/bitnami/charts/issues/32238) + +## 16.4.14 (2025-02-21) + +* [bitnami/postgresql] Release 16.4.14 (#32131) ([3fc13a0](https://github.com/bitnami/charts/commit/3fc13a01d65efa3d3f9624c8c01e7de286edfbad)), closes [#32131](https://github.com/bitnami/charts/issues/32131) + +## 16.4.13 (2025-02-21) + +* [bitnami/postgresql] Release 16.4.13 (#32097) ([9817d01](https://github.com/bitnami/charts/commit/9817d0155847035dc6c7edba6422ce9f56223909)), closes [#32097](https://github.com/bitnami/charts/issues/32097) + +## 16.4.12 (2025-02-20) + +* [bitnami/postgresql] Release 16.4.12 (#32086) ([3847abe](https://github.com/bitnami/charts/commit/3847abe0791e4d01718d221c215306b6a23a26b7)), closes [#32086](https://github.com/bitnami/charts/issues/32086) + +## 16.4.11 (2025-02-20) + +* [bitnami/*] Fix typo in named template name (#31858) ([b739b69](https://github.com/bitnami/charts/commit/b739b69532e637bd33b4a44eeb422c3e749eac77)), closes [#31858](https://github.com/bitnami/charts/issues/31858) +* [bitnami/postgresql] Release 16.4.11 (#32029) ([12c6e53](https://github.com/bitnami/charts/commit/12c6e531eafa7cfed5f78a98fec9062eaaa8c133)), closes [#32029](https://github.com/bitnami/charts/issues/32029) + +## 16.4.9 (2025-02-14) + +* [bitnami/postgresql] Release 16.4.9 (#31935) ([2a9fe24](https://github.com/bitnami/charts/commit/2a9fe2448aedccf5779c7f73ad45328edaa11156)), closes [#31935](https://github.com/bitnami/charts/issues/31935) + +## 16.4.8 (2025-02-13) + +* [bitnami/*] Use CDN url for the Bitnami Application Icons (#31881) ([d9bb11a](https://github.com/bitnami/charts/commit/d9bb11a9076b9bfdcc70ea022c25ef50e9713657)), closes [#31881](https://github.com/bitnami/charts/issues/31881) +* [bitnami/postgresql] Release 16.4.8 (#31919) ([3a013d5](https://github.com/bitnami/charts/commit/3a013d5224e3bf9db42a1540f66c5c1aa2eeecfd)), closes [#31919](https://github.com/bitnami/charts/issues/31919) + +## 16.4.7 (2025-02-10) + +* [bitnami/postgresql] use adminPassword for metrics user when custom user is not set on primary (#318 ([ca8f930](https://github.com/bitnami/charts/commit/ca8f9307b80e6a192b51d333fbe8b927b2949be1)), closes [#31840](https://github.com/bitnami/charts/issues/31840) + +## 16.4.6 (2025-02-03) + +* [bitnami/postgresql] Release 16.4.6 (#31702) ([0a0a5d3](https://github.com/bitnami/charts/commit/0a0a5d33825e523f8fa780bdec97b685fd74d0e3)), closes [#31702](https://github.com/bitnami/charts/issues/31702) +* Update copyright year (#31682) ([e9f02f5](https://github.com/bitnami/charts/commit/e9f02f5007068751f7eb2270fece811e685c99b6)), closes [#31682](https://github.com/bitnami/charts/issues/31682) + +## 16.4.5 (2025-01-20) + +* [bitnami/postgresql] Release 16.4.5 (#31484) ([b11637c](https://github.com/bitnami/charts/commit/b11637c36ab924cd764ead95e30838a0c4af8321)), closes [#31484](https://github.com/bitnami/charts/issues/31484) + +## 16.4.4 (2025-01-20) + +* [bitnami/postgresql] Release 16.4.4 (#31482) ([e784f18](https://github.com/bitnami/charts/commit/e784f187c01d6a2d7a1237ae5015bd5cb6e4e4b8)), closes [#31482](https://github.com/bitnami/charts/issues/31482) + +## 16.4.3 (2025-01-14) + +* bitnami/postgresql Fix missing dot in include statement for passwordUpdate job template (#31364) ([901b26c](https://github.com/bitnami/charts/commit/901b26c4b7be8935d9764d51df4b76d8dede0117)), closes [#31364](https://github.com/bitnami/charts/issues/31364) + +## 16.4.2 (2025-01-13) + +* [bitnami/postgresql] Release 16.4.2 (#31342) ([946b638](https://github.com/bitnami/charts/commit/946b638fd63e2d7e74865d591ef403b4dce229b3)), closes [#31342](https://github.com/bitnami/charts/issues/31342) + +## 16.4.1 (2025-01-13) + +* Dynamic assignment of custom schema name if defined in update-password job (#31146) ([364ac45](https://github.com/bitnami/charts/commit/364ac45ea6a20b693662b14a17122885f4e43364)), closes [#31146](https://github.com/bitnami/charts/issues/31146) + +## 16.3.5 (2025-01-03) + +* Revert "[bitnami/postgresql] Add Storage Class Configuration to Templates (#30858)" (#31204) ([c03fe0c](https://github.com/bitnami/charts/commit/c03fe0c3e359db15c2c096d52e6e28e480dfdbd6)), closes [#30858](https://github.com/bitnami/charts/issues/30858) [#31204](https://github.com/bitnami/charts/issues/31204) + +## 16.3.4 (2024-12-23) + +* [bitnami/postgresql] Release 16.3.4 (#31143) ([05a9583](https://github.com/bitnami/charts/commit/05a9583f949b49fab2673774a4f56ff686d959f4)), closes [#31143](https://github.com/bitnami/charts/issues/31143) + +## 16.3.3 (2024-12-20) + +* [bitnami/postgresql] Release 16.3.3 (#31133) ([41671f2](https://github.com/bitnami/charts/commit/41671f2e787863686079e1358054142d61d15982)), closes [#31133](https://github.com/bitnami/charts/issues/31133) + +## 16.3.2 (2024-12-16) + +* [bitnami/*] Fix typo in README (#31052) ([b41a51d](https://github.com/bitnami/charts/commit/b41a51d1bd04841fc108b78d3b8357a5292771c8)), closes [#31052](https://github.com/bitnami/charts/issues/31052) +* [bitnami/postgresql] Release 16.3.2 (#31060) ([1406ab1](https://github.com/bitnami/charts/commit/1406ab116e0fcfbb8fe2eaec1adc5fe494c0f329)), closes [#31060](https://github.com/bitnami/charts/issues/31060) + +## 16.3.1 (2024-12-13) + +* [bitnami/postgresql] Add Storage Class Configuration to Templates (#30858) ([b0d2c2e](https://github.com/bitnami/charts/commit/b0d2c2e53c9033d3827597c561931fbb331eb99b)), closes [#30858](https://github.com/bitnami/charts/issues/30858) + +## 16.3.0 (2024-12-10) + +* [bitnami/*] Add Bitnami Premium to NOTES.txt (#30854) ([3dfc003](https://github.com/bitnami/charts/commit/3dfc00376df6631f0ce54b8d440d477f6caa6186)), closes [#30854](https://github.com/bitnami/charts/issues/30854) +* [bitnami/postgresql] Detect non-standard images (#30936) ([ac96151](https://github.com/bitnami/charts/commit/ac96151bdbe5e99b00dcde62a4d72f1827fa46b2)), closes [#30936](https://github.com/bitnami/charts/issues/30936) + +## 16.2.5 (2024-12-03) + +* [bitnami/postgresql] Release 16.2.5 (#30733) ([34606c1](https://github.com/bitnami/charts/commit/34606c10dedd06431182d0563fb61703e691ddf1)), closes [#30733](https://github.com/bitnami/charts/issues/30733) + +## 16.2.4 (2024-12-03) + +* [bitnami/*] docs: :memo: Add "Backup & Restore" section (#30711) ([35ab536](https://github.com/bitnami/charts/commit/35ab5363741e7548f4076f04da6e62d10153c60c)), closes [#30711](https://github.com/bitnami/charts/issues/30711) +* [bitnami/*] docs: :memo: Add "Prometheus metrics" (batch 5) (#30674) ([ed2a546](https://github.com/bitnami/charts/commit/ed2a54617faf763169e6b01a89100b9db32e1000)), closes [#30674](https://github.com/bitnami/charts/issues/30674) +* [bitnami/postgresql] use adminPassword for metrics user when custom user is not set (#30720) ([8f4bc7b](https://github.com/bitnami/charts/commit/8f4bc7b46b0ce02286cc9973ff8f054a1f9c3fde)), closes [#30720](https://github.com/bitnami/charts/issues/30720) + +## 16.2.3 (2024-11-28) + +* [bitnami/postgresql] Release 16.2.3 (#30645) ([22a4c51](https://github.com/bitnami/charts/commit/22a4c51dc3b85e73b017cb6f6c73e15e6e4b811c)), closes [#30645](https://github.com/bitnami/charts/issues/30645) + +## 16.2.2 (2024-11-21) + +* [bitnami/postgresql] Release 16.2.2 (#30570) ([7b3a6d5](https://github.com/bitnami/charts/commit/7b3a6d5808e79d68a7c9edb6bca54aff262a6264)), closes [#30570](https://github.com/bitnami/charts/issues/30570) + +## 16.2.1 (2024-11-14) + +* [bitnami/postgresql] Release 16.2.1 (#30463) ([2360527](https://github.com/bitnami/charts/commit/236052763a4d81ca42d1068203ce5d6ee3f61b20)), closes [#30463](https://github.com/bitnami/charts/issues/30463) + +## 16.2.0 (2024-11-14) + +* [bitnami/postgresql] feat: :sparkles: Add password update job (#30444) ([ea896db](https://github.com/bitnami/charts/commit/ea896dbfbfaf7d386ca40c4072a61aa958cb7fb1)), closes [#30444](https://github.com/bitnami/charts/issues/30444) + +## 16.1.2 (2024-11-06) + +* [bitnami/postgresql] Release 16.1.2 (#30250) ([423c554](https://github.com/bitnami/charts/commit/423c55454743745dc486e426089141fa814fd401)), closes [#30250](https://github.com/bitnami/charts/issues/30250) + +## 16.1.1 (2024-11-04) + +* [bitnami/postgresql] metrics.collectors applies to read replicas (#30133) ([696f113](https://github.com/bitnami/charts/commit/696f113b68a7f541de7f073cf3efec5b25ccf10b)), closes [#30133](https://github.com/bitnami/charts/issues/30133) + +## 16.1.0 (2024-10-30) + +* [bitnami/*] Remove wrong comment about imagePullPolicy (#30107) ([a51f9e4](https://github.com/bitnami/charts/commit/a51f9e4bb0fbf77199512d35de7ac8abe055d026)), closes [#30107](https://github.com/bitnami/charts/issues/30107) +* [bitnami/postgresql] Added support for `namespaceOverride` (#30113) ([4253372](https://github.com/bitnami/charts/commit/4253372e0b770e941c4894cdd7a904d3fdabeb19)), closes [#30113](https://github.com/bitnami/charts/issues/30113) + +## 16.0.6 (2024-10-24) + +* [bitnami/postgresql] Release 16.0.6 (#30069) ([e431b4a](https://github.com/bitnami/charts/commit/e431b4a915cb29593faedff990bba9516dc25ef6)), closes [#30069](https://github.com/bitnami/charts/issues/30069) + +## 16.0.5 (2024-10-22) + +* [bitnami/postgresql] Release 16.0.5 (#30046) ([a825e37](https://github.com/bitnami/charts/commit/a825e37775f041dc3404f727ff33661364dbc8a3)), closes [#30046](https://github.com/bitnami/charts/issues/30046) + +## 16.0.4 (2024-10-21) + +* [bitnami/postgresql] Release 16.0.4 (#30013) ([8435f88](https://github.com/bitnami/charts/commit/8435f88ae01cc20203022eb97904ee3abeb96467)), closes [#30013](https://github.com/bitnami/charts/issues/30013) + +## 16.0.3 (2024-10-16) + +* [bitnami/postgresql] Release 16.0.3 (#29942) ([7b3f2bb](https://github.com/bitnami/charts/commit/7b3f2bb7a65a78cba10fe8dfe87fd47b55dd8ec0)), closes [#29942](https://github.com/bitnami/charts/issues/29942) + +## 16.0.2 (2024-10-16) + +* [bitnami/postgresql] Release 16.0.2 (#29938) ([766c157](https://github.com/bitnami/charts/commit/766c1577e867aea17e1e9b21cc25f9e27b299273)), closes [#29938](https://github.com/bitnami/charts/issues/29938) +* Update documentation links to techdocs.broadcom.com (#29931) ([f0d9ad7](https://github.com/bitnami/charts/commit/f0d9ad78f39f633d275fc576d32eae78ded4d0b8)), closes [#29931](https://github.com/bitnami/charts/issues/29931) + +## 16.0.1 (2024-10-04) + +* [bitnami/postgresql] Release 16.0.1 (#29776) ([9d7fcdc](https://github.com/bitnami/charts/commit/9d7fcdc44c4f0939fb0006fb04d4161080cb558a)), closes [#29776](https://github.com/bitnami/charts/issues/29776) + +## 16.0.0 (2024-10-02) + +* [bitnami/postgresql] Release 16.0.0 (#29723) ([aeedc0e](https://github.com/bitnami/charts/commit/aeedc0e67b1593191aa0c3cb2239864d0b3c9a58)), closes [#29723](https://github.com/bitnami/charts/issues/29723) + +## 15.5.38 (2024-10-01) + +* [bitnami/postgresql] Release 15.5.38 (#29681) ([105fcbb](https://github.com/bitnami/charts/commit/105fcbb5c090c6f0b10858cdcc33dfc255c0c7e4)), closes [#29681](https://github.com/bitnami/charts/issues/29681) + +## 15.5.37 (2024-09-30) + +* [bitnami/postgresql] Release 15.5.37 (#29660) ([45cada1](https://github.com/bitnami/charts/commit/45cada10883f6ac5ad4ecaadf3c0d6aa1d9912bb)), closes [#29660](https://github.com/bitnami/charts/issues/29660) + +## 15.5.36 (2024-09-26) + +* [bitnami/postgresql] Release 15.5.36 (#29640) ([074e377](https://github.com/bitnami/charts/commit/074e377c582055f6b7039c63d7d37db5f97b770d)), closes [#29640](https://github.com/bitnami/charts/issues/29640) + +## 15.5.35 (2024-09-26) + +* [bitnami/postgresql] Release 15.5.35 (#29610) ([1f3717a](https://github.com/bitnami/charts/commit/1f3717afe128dea9ff69598952245930b1e7ced6)), closes [#29610](https://github.com/bitnami/charts/issues/29610) + +## 15.5.34 (2024-09-23) + +* [bitnami/postgresql] Release 15.5.34 (#29580) ([1450838](https://github.com/bitnami/charts/commit/1450838c829ccf48edb386b459244bf59f9080fa)), closes [#29580](https://github.com/bitnami/charts/issues/29580) + +## 15.5.33 (2024-09-23) + +* [bitnami/postgresql] Release 15.5.33 (#29579) ([e081955](https://github.com/bitnami/charts/commit/e0819554cf864099182049333aa47f7fd3ba341b)), closes [#29579](https://github.com/bitnami/charts/issues/29579) + +## 15.5.32 (2024-09-17) + +* [bitnami/postgresql] test: :white_check_mark: Improve reliability of ginkgo tests (#29472) ([c43177e](https://github.com/bitnami/charts/commit/c43177e1b362f27319a215c7394bcb612bed4924)), closes [#29472](https://github.com/bitnami/charts/issues/29472) + +## 15.5.31 (2024-09-13) + +* [bitnami/postgresql] Release 15.5.31 (#29404) ([baf9a0f](https://github.com/bitnami/charts/commit/baf9a0facb2d1a659bf53d13c4088929bbf86400)), closes [#29404](https://github.com/bitnami/charts/issues/29404) + +## 15.5.30 (2024-09-13) + +* [bitnami/postgresql] collect metrics as postgres user (#29201) ([7240870](https://github.com/bitnami/charts/commit/72408702b553e51a2848ce061bf917934737c42e)), closes [#29201](https://github.com/bitnami/charts/issues/29201) + +## 15.5.29 (2024-09-10) + +* [bitnami/postgresql] Release 15.5.29 (#29330) ([3c161f7](https://github.com/bitnami/charts/commit/3c161f7033eff31b2f3d98879bcac07c7070c0d6)), closes [#29330](https://github.com/bitnami/charts/issues/29330) + +## 15.5.28 (2024-09-05) + +* [bitnami/postgresql] Release 15.5.28 (#29206) ([2b42eb7](https://github.com/bitnami/charts/commit/2b42eb7ab7d9d5376ec44b36ca92fb22c52085af)), closes [#29206](https://github.com/bitnami/charts/issues/29206) + +## 15.5.27 (2024-08-30) + +* [bitnami/postgresql] Release 15.5.27 (#29122) ([08dfd32](https://github.com/bitnami/charts/commit/08dfd32dc50004050b6aca1d6c3418062b65402f)), closes [#29122](https://github.com/bitnami/charts/issues/29122) + +## 15.5.26 (2024-08-27) + +* [bitnami/postgresql] Release 15.5.26 (#29040) ([fd112fb](https://github.com/bitnami/charts/commit/fd112fb348a6f68686d863684e38e03e61f2e1a3)), closes [#29040](https://github.com/bitnami/charts/issues/29040) + +## 15.5.25 (2024-08-27) + +* [bitnami/postgresql] Release 15.5.25 (#29037) ([8267ba0](https://github.com/bitnami/charts/commit/8267ba0828c6325d96b0c18fba40906c1718db26)), closes [#29037](https://github.com/bitnami/charts/issues/29037) + +## 15.5.24 (2024-08-23) + +* [bitnami/postgresql] eval. certificatesSecret as template (#28831) ([05c09db](https://github.com/bitnami/charts/commit/05c09dbb8e60cde19c44ee6d795e31a48f9f77ba)), closes [#28831](https://github.com/bitnami/charts/issues/28831) + +## 15.5.23 (2024-08-19) + +* [bitnami/postgresql] Release 15.5.23 (#28922) ([d60e431](https://github.com/bitnami/charts/commit/d60e4314329df6fd2490237ce13395cb391aaa7e)), closes [#28922](https://github.com/bitnami/charts/issues/28922) + +## 15.5.22 (2024-08-16) + +* [bitnami/postgresql] Release 15.5.22 (#28905) ([9666e6a](https://github.com/bitnami/charts/commit/9666e6a662dfb6985b537794e8617949c51178fe)), closes [#28905](https://github.com/bitnami/charts/issues/28905) + +## 15.5.21 (2024-08-09) + +* [bitnami/postgresql] Release 15.5.21 (#28800) ([da5f1c5](https://github.com/bitnami/charts/commit/da5f1c5478a8033a7a3cfa44a7ed6618952509af)), closes [#28800](https://github.com/bitnami/charts/issues/28800) + +## 15.5.20 (2024-07-25) + +* [bitnami/postgresql] Release 15.5.20 (#28489) ([89f10d4](https://github.com/bitnami/charts/commit/89f10d4d1b7c4e88015f9f4c3c9002dc1d749860)), closes [#28489](https://github.com/bitnami/charts/issues/28489) + +## 15.5.19 (2024-07-24) + +* [bitnami/postgresql] Release 15.5.19 (#28352) ([59696e9](https://github.com/bitnami/charts/commit/59696e992ceec9b12255560d346e59f2f62b543e)), closes [#28352](https://github.com/bitnami/charts/issues/28352) + +## 15.5.18 (2024-07-23) + +* [bitnami/postgresql] Release 15.5.18 (#28221) ([8976498](https://github.com/bitnami/charts/commit/8976498507646c6a690381a38d690aa32b25a2f7)), closes [#28221](https://github.com/bitnami/charts/issues/28221) + +## 15.5.17 (2024-07-16) + +* [bitnami/postgresql] Global StorageClass as default value (#28082) ([6267bb7](https://github.com/bitnami/charts/commit/6267bb792f70eb0b67800132f5fbd488087e347b)), closes [#28082](https://github.com/bitnami/charts/issues/28082) + +## 15.5.16 (2024-07-11) + +* [bitnami/postgresql] Move comments inside conditionals (#27627) ([7d3b0f0](https://github.com/bitnami/charts/commit/7d3b0f0f13b79e75ee38ce1f5b59911c0cedb187)), closes [#27627](https://github.com/bitnami/charts/issues/27627) + +## 15.5.15 (2024-07-09) + +* Postgres exporter URI fix (#27734) ([d8d0dfe](https://github.com/bitnami/charts/commit/d8d0dfe79932c19f1b9b66bc5ac1addf0643da21)), closes [#27734](https://github.com/bitnami/charts/issues/27734) + +## 15.5.14 (2024-07-05) + +* [bitnami/postgresql] Release 15.5.14 (#27819) ([a4baae5](https://github.com/bitnami/charts/commit/a4baae5538d74b732fca029ad6ee5783279c4d54)), closes [#27819](https://github.com/bitnami/charts/issues/27819) + +## 15.5.13 (2024-07-03) + +* [bitnami/postgresql] Release 15.5.13 (#27733) ([e51f4a8](https://github.com/bitnami/charts/commit/e51f4a8818f15e6c0b636294d50d223140cc43d5)), closes [#27733](https://github.com/bitnami/charts/issues/27733) + +## 15.5.12 (2024-07-02) + +* postgres exporter monitor all databases (#27586) ([4feb56d](https://github.com/bitnami/charts/commit/4feb56d610de6e958fd0d7052958b88bcb21e1ab)), closes [#27586](https://github.com/bitnami/charts/issues/27586) + +## 15.5.11 (2024-06-26) + +* [bitnami/*] Update README changing TAC wording (#27530) ([52dfed6](https://github.com/bitnami/charts/commit/52dfed6bac44d791efabfaf06f15daddc4fefb0c)), closes [#27530](https://github.com/bitnami/charts/issues/27530) +* [bitnami/postgresql] Release 15.5.11 (#27548) ([0fe73e3](https://github.com/bitnami/charts/commit/0fe73e31c5dad97c86b9db11af28388d0324aea8)), closes [#27548](https://github.com/bitnami/charts/issues/27548) + +## 15.5.10 (2024-06-25) + +* [bitnami/postgresql] Release 15.5.10 (#27521) ([59f0aa2](https://github.com/bitnami/charts/commit/59f0aa2b948cdcd5a30f3f9111b2d422e0a8b81b)), closes [#27521](https://github.com/bitnami/charts/issues/27521) + +## 15.5.9 (2024-06-20) + +* [bitnami/postgresql] Remove deprecated (and removed) annotation (#27463) ([2907ba0](https://github.com/bitnami/charts/commit/2907ba00566e8cc3675865fbf3e43b43702d4998)), closes [#27463](https://github.com/bitnami/charts/issues/27463) + +## 15.5.8 (2024-06-20) + +* [bitnami/postgresql] Add pre-init scripts (#26467) ([0cdafb8](https://github.com/bitnami/charts/commit/0cdafb8a29c7bfe22c1781ef10154e11e3a7bd09)), closes [#26467](https://github.com/bitnami/charts/issues/26467) + +## 15.5.7 (2024-06-18) + +* [bitnami/postgresql] Release 15.5.7 (#27401) ([2fff79d](https://github.com/bitnami/charts/commit/2fff79d0d54da3680cb8dac3652884c82c314e74)), closes [#27401](https://github.com/bitnami/charts/issues/27401) + +## 15.5.6 (2024-06-17) + +* [bitnami/postgresql] Release 15.5.6 (#27293) ([d36be80](https://github.com/bitnami/charts/commit/d36be805cdc81aaa34d197072c112360a7ce99f5)), closes [#27293](https://github.com/bitnami/charts/issues/27293) + +## 15.5.5 (2024-06-11) + +* [bitnami/postgresql] Release 15.5.5 (#27096) ([c84850a](https://github.com/bitnami/charts/commit/c84850a09c75ce557f87d33fe9c400f66d3a8d1e)), closes [#27096](https://github.com/bitnami/charts/issues/27096) + +## 15.5.4 (2024-06-06) + +* [bitnami/postgresql] Release 15.5.4 (#27006) ([613a7a4](https://github.com/bitnami/charts/commit/613a7a431aa8752cb28ee634c4db0c83ef98e827)), closes [#27006](https://github.com/bitnami/charts/issues/27006) + +## 15.5.3 (2024-06-06) + +* [bitnami/postgresql] Release 15.5.3 (#26914) ([f7df496](https://github.com/bitnami/charts/commit/f7df496fce1cb33658e68af08d382287487e5b0b)), closes [#26914](https://github.com/bitnami/charts/issues/26914) + +## 15.5.2 (2024-06-04) + +* [bitnami/postgresql] Bump chart version (#26660) ([4269aa0](https://github.com/bitnami/charts/commit/4269aa0ee711838c59430d48825c58f34fbe674d)), closes [#26660](https://github.com/bitnami/charts/issues/26660) + +## 15.5.1 (2024-05-29) + +* [bitnami/postgresql] Release 15.5.1 (#26546) ([99f0841](https://github.com/bitnami/charts/commit/99f08414ce828db081402ba37cf48c0ad2624fee)), closes [#26546](https://github.com/bitnami/charts/issues/26546) + +## 15.5.0 (2024-05-29) + +* [bitnami/postgresql] Enable PodDisruptionBudgets (#26530) ([c6b2f1c](https://github.com/bitnami/charts/commit/c6b2f1cc32e0b9a8d884b61e8dc17f1089366d06)), closes [#26530](https://github.com/bitnami/charts/issues/26530) + +## 15.4.2 (2024-05-28) + +* [bitnami/postgresql] Release 15.4.2 (#26475) ([748b515](https://github.com/bitnami/charts/commit/748b51516a41ff8af151a530a0e5e0d9a62808e4)), closes [#26475](https://github.com/bitnami/charts/issues/26475) + +## 15.4.1 (2024-05-27) + +* [bitnami/postgresql] Release 15.4.1 (#26451) ([8852396](https://github.com/bitnami/charts/commit/8852396da928e9834a1e4d14c9d1aeb9f61b3b73)), closes [#26451](https://github.com/bitnami/charts/issues/26451) + +## 15.4.0 (2024-05-21) + +* [bitnami/*] ci: :construction_worker: Add tag and changelog support (#25359) ([91c707c](https://github.com/bitnami/charts/commit/91c707c9e4e574725a09505d2d313fb93f1b4c0a)), closes [#25359](https://github.com/bitnami/charts/issues/25359) +* [bitnami/postgresql] feat: :sparkles: :lock: Add warning when original images are replaced (#26264) ([53777c8](https://github.com/bitnami/charts/commit/53777c8e5104e447deb800e88b68bfc8fd3f494b)), closes [#26264](https://github.com/bitnami/charts/issues/26264) + +## 15.3.5 (2024-05-20) + +* [bitnami/postgresql] Release 15.3.5 updating components versions (#26147) ([0bafcd7](https://github.com/bitnami/charts/commit/0bafcd70c0b04d3e1147ed82c2b1d992c552ef35)), closes [#26147](https://github.com/bitnami/charts/issues/26147) + +## 15.3.4 (2024-05-20) + +* [bitnami/postgresql] Release 15.3.4 updating components versions (#26142) ([231e25b](https://github.com/bitnami/charts/commit/231e25baf23367f31f1e52a89a2cf2636c516247)), closes [#26142](https://github.com/bitnami/charts/issues/26142) + +## 15.3.3 (2024-05-18) + +* [bitnami/postgresql] Release 15.3.3 updating components versions (#26066) ([21f932c](https://github.com/bitnami/charts/commit/21f932c438a019828908268ae04703e50b1d7f3d)), closes [#26066](https://github.com/bitnami/charts/issues/26066) + +## 15.3.2 (2024-05-14) + +* [bitnami/postgresql] Release 15.3.2 updating components versions (#25812) ([3f7c2cb](https://github.com/bitnami/charts/commit/3f7c2cbbe905e1e992445194cd5fce48eb3bb87c)), closes [#25812](https://github.com/bitnami/charts/issues/25812) + +## 15.3.1 (2024-05-13) + +* [bitnami/postgresql] Release 15.3.1 updating components versions (#25723) ([031d2cf](https://github.com/bitnami/charts/commit/031d2cf9ee9aacb9d92eecade873f1377953b813)), closes [#25723](https://github.com/bitnami/charts/issues/25723) + +## 15.3.0 (2024-05-13) + +* [bitnami/postgresql] Allow loadBalancerClass to be customized (#25569) ([e6fecf9](https://github.com/bitnami/charts/commit/e6fecf9c391077ae43889342a88febeea6eb88cd)), closes [#25569](https://github.com/bitnami/charts/issues/25569) + +## 15.2.13 (2024-05-13) + +* [bitnami/postgresql] Allow backup pod to use DNS (#25534) ([960550a](https://github.com/bitnami/charts/commit/960550afa50fa58649997e89f67cf5b3d3fd0e7d)), closes [#25534](https://github.com/bitnami/charts/issues/25534) + +## 15.2.12 (2024-05-10) + +* [bitnami/postgresql] Release 15.2.12 updating components versions (#25678) ([0fd1557](https://github.com/bitnami/charts/commit/0fd15577a18c135b71ada7ebcd4db2bee16f3aa7)), closes [#25678](https://github.com/bitnami/charts/issues/25678) + +## 15.2.11 (2024-05-10) + +* [bitnami/postgresql] Release 15.2.11 updating components versions (#25672) ([9b809c6](https://github.com/bitnami/charts/commit/9b809c6ba398109c8c3f5402363e4ee1c7c33b46)), closes [#25672](https://github.com/bitnami/charts/issues/25672) + +## 15.2.10 (2024-05-10) + +* [bitnami/*] Change non-root and rolling-tags doc URLs (#25628) ([b067c94](https://github.com/bitnami/charts/commit/b067c94f6bcde427863c197fd355f0b5ba12ff5b)), closes [#25628](https://github.com/bitnami/charts/issues/25628) +* [bitnami/*] Set new header/owner (#25558) ([8d1dc11](https://github.com/bitnami/charts/commit/8d1dc11f5fb30db6fba50c43d7af59d2f79deed3)), closes [#25558](https://github.com/bitnami/charts/issues/25558) +* [bitnami/postgresql] add backup.cronjob.tolerations options (#25664) ([4a798ec](https://github.com/bitnami/charts/commit/4a798ecc98067f6af6012381da0c83068d366074)), closes [#25664](https://github.com/bitnami/charts/issues/25664) + +## 15.2.9 (2024-05-06) + +* [bitnami/postgresql] Remove unicode characters (#25546) ([219d22f](https://github.com/bitnami/charts/commit/219d22f67782538a891ded326417fce8c6641577)), closes [#25546](https://github.com/bitnami/charts/issues/25546) + +## 15.2.8 (2024-05-01) + +* [bitnami/postgresql] Release 15.2.8 updating components versions (#25484) ([d3084fc](https://github.com/bitnami/charts/commit/d3084fcaee1bfbc02f2564e7794944b781a31706)), closes [#25484](https://github.com/bitnami/charts/issues/25484) + +## 15.2.7 (2024-04-25) + +* [bitnami/postgresql] Release 15.2.7 updating components versions (#25391) ([0db34f6](https://github.com/bitnami/charts/commit/0db34f643131878ec6d1e9e84a91272b300dd0c5)), closes [#25391](https://github.com/bitnami/charts/issues/25391) + +## 15.2.6 (2024-04-25) + +* [bitnami/multiple charts] Fix typo: "NetworkPolice" vs "NetworkPolicy" (#25348) ([6970c1b](https://github.com/bitnami/charts/commit/6970c1ba245873506e73d459c6eac1e4919b778f)), closes [#25348](https://github.com/bitnami/charts/issues/25348) +* [bitnami/postgresql] Remove RW emptyDir for postgresql logs (#25206) ([8bae0c5](https://github.com/bitnami/charts/commit/8bae0c591364e80bd3ae7ae5e053a4c52be5b78f)), closes [#25206](https://github.com/bitnami/charts/issues/25206) +* Replace VMware by Broadcom copyright text (#25306) ([a5e4bd0](https://github.com/bitnami/charts/commit/a5e4bd0e35e419203793976a78d9d0a13de92c76)), closes [#25306](https://github.com/bitnami/charts/issues/25306) + +## 15.2.5 (2024-04-10) + +* [bitnami/postgresql] Release 15.2.5 updating components versions (#25099) ([eba61bd](https://github.com/bitnami/charts/commit/eba61bd31721b220163f799a5694d234f677ae1b)), closes [#25099](https://github.com/bitnami/charts/issues/25099) + +## 15.2.4 (2024-04-05) + +* [bitnami/postgresql] Release 15.2.4 updating components versions (#24972) ([62e4683](https://github.com/bitnami/charts/commit/62e46834f798b69bcb8efcc1209bb1305eea2643)), closes [#24972](https://github.com/bitnami/charts/issues/24972) + +## 15.2.3 (2024-04-05) + +* [bitnami/postgresql] Release 15.2.3 (#24924) ([1f68239](https://github.com/bitnami/charts/commit/1f682398e96a9663d366e1ff0e74b97fbbbc858b)), closes [#24924](https://github.com/bitnami/charts/issues/24924) +* Update resourcesPreset comments (#24467) ([92e3e8a](https://github.com/bitnami/charts/commit/92e3e8a507326d2a20a8f10ab3e7746a2ec5c554)), closes [#24467](https://github.com/bitnami/charts/issues/24467) + +## 15.2.2 (2024-04-02) + +* [bitnami/postgresql] Release 15.2.2 updating components versions (#24840) ([34f94f3](https://github.com/bitnami/charts/commit/34f94f3412659c884e0f1358a38b3efc392887a9)), closes [#24840](https://github.com/bitnami/charts/issues/24840) + +## 15.2.1 (2024-04-02) + +* [bitnami/postgresql] fix: :bug: Always mount data directory (#24667) ([85f7422](https://github.com/bitnami/charts/commit/85f7422ad7489ad6f14a50021fe7f1eb910b5d7b)), closes [#24667](https://github.com/bitnami/charts/issues/24667) + +## 15.2.0 (2024-04-01) + +* [bitnami/postgresql] Allow customizing primary persistence volume/claim (#24625) ([79b5845](https://github.com/bitnami/charts/commit/79b584590e90fc8f1be7bbffd1706e762b520f9a)), closes [#24625](https://github.com/bitnami/charts/issues/24625) + +## 15.1.4 (2024-03-25) + +* [bitnami/postgresql] Release 15.1.4 updating components versions (#24641) ([9fea6e0](https://github.com/bitnami/charts/commit/9fea6e050249771a0e81b9415f8f7de496749a57)), closes [#24641](https://github.com/bitnami/charts/issues/24641) + +## 15.1.3 (2024-03-25) + +* [bitnami/postgresql] Release 15.1.3 updating components versions (#24640) ([a318638](https://github.com/bitnami/charts/commit/a318638310d74d34d71f82d0df115f8f2f15841a)), closes [#24640](https://github.com/bitnami/charts/issues/24640) + +## 15.1.2 (2024-03-21) + +* [bitnami/postgresql] feat: add parameter backup.cronjob.storage.existingVolume (#23979) ([0a3ebd5](https://github.com/bitnami/charts/commit/0a3ebd57a2315d4e0cd99948fdc6ef944d39673e)), closes [#23979](https://github.com/bitnami/charts/issues/23979) +* [bitnami/postgresql] fixing tls for cronjobs (#24468) ([5e7f4e1](https://github.com/bitnami/charts/commit/5e7f4e1401c96562c12b4161599ba21e6cbeb04b)), closes [#24468](https://github.com/bitnami/charts/issues/24468) + +## 15.1.1 (2024-03-21) + +* [bitnami/postgres] don't include backup netpol when backup aren't enabled (#24572) ([10584d1](https://github.com/bitnami/charts/commit/10584d11404dc2871092d2a2fabd1cab55058a14)), closes [#24572](https://github.com/bitnami/charts/issues/24572) + +## 15.1.0 (2024-03-20) + +* [bitnami/postgresql] Add a NetworkPolicy to allow backup pods to access primary nodes (#24363) ([dc93455](https://github.com/bitnami/charts/commit/dc9345576e47210f8f176a31369abe460a4cf3f9)), closes [#24363](https://github.com/bitnami/charts/issues/24363) + +## 15.0.0 (2024-03-18) + +* [bitnami/*] Reorder Chart sections (#24455) ([0cf4048](https://github.com/bitnami/charts/commit/0cf4048e8743f70a9753d460655bd030cbff6824)), closes [#24455](https://github.com/bitnami/charts/issues/24455) +* [bitnami/postgresql] feat!: :lock: :boom: Improve security defaults (#24171) ([3911a57](https://github.com/bitnami/charts/commit/3911a570a329b23dc808d0e1cfe8b27bdf9b33a7)), closes [#24171](https://github.com/bitnami/charts/issues/24171) + +## 14.3.3 (2024-03-11) + +* [bitnami/postgresql] Release 14.3.3 updating components versions (#24358) ([239ba28](https://github.com/bitnami/charts/commit/239ba28cd0d6ecfcbf035dd8269676026fed0998)), closes [#24358](https://github.com/bitnami/charts/issues/24358) + +## 14.3.2 (2024-03-11) + +* [bitnami/postgresql] Fix TLS by removing faulty white trimming in cronjob.yaml (#24239) ([1a67326](https://github.com/bitnami/charts/commit/1a6732655b99d4a0cf75437db3651cfa1f49133a)), closes [#24239](https://github.com/bitnami/charts/issues/24239) +* [bitnami/postgresql] Release 14.3.2 updating components versions (#24357) ([17bcbcb](https://github.com/bitnami/charts/commit/17bcbcbc7033692d51a13395beb0b606f7826784)), closes [#24357](https://github.com/bitnami/charts/issues/24357) + +## 14.3.1 (2024-03-07) + +* [bitnami/postgresql] Release 14.3.1 updating components versions (#24237) ([33b8e70](https://github.com/bitnami/charts/commit/33b8e700bdecedd8e2130d442adc4593bb76816c)), closes [#24237](https://github.com/bitnami/charts/issues/24237) + +## 14.3.0 (2024-03-05) + +* [bitnami/postgresql] postgresql backup container adds resources parameter (#23955) ([8da2a95](https://github.com/bitnami/charts/commit/8da2a95d6f21b42215058299cf9ca35b4d2f0c0b)), closes [#23955](https://github.com/bitnami/charts/issues/23955) +* [bitnami/postgresql] feat: :sparkles: :lock: Add automatic adaptation for Openshift restricted-v2 SC ([1a2217f](https://github.com/bitnami/charts/commit/1a2217f8087e90a49fde1bd0de7713f32c223aff)), closes [#24141](https://github.com/bitnami/charts/issues/24141) + +## 14.2.4 (2024-03-04) + +* [bitnami/postgresql] Set allowExternalEgress=true by default (#24036) ([cfa4d49](https://github.com/bitnami/charts/commit/cfa4d4951d9bd72209c77c786efe3267cd5ba070)), closes [#24036](https://github.com/bitnami/charts/issues/24036) + +## 14.2.3 (2024-02-23) + +* Add missing version, kind to volumeClaimTemplates (#23862) ([50b25b8](https://github.com/bitnami/charts/commit/50b25b83cb85112731676f61024d033964808120)), closes [#23862](https://github.com/bitnami/charts/issues/23862) + +## 14.2.2 (2024-02-22) + +* [bitnami/postgresql] Release 14.2.2 updating components versions (#23820) ([2da202b](https://github.com/bitnami/charts/commit/2da202b8f0f0bdf733da4cd1ef23f3b32fde3931)), closes [#23820](https://github.com/bitnami/charts/issues/23820) + +## 14.2.1 (2024-02-21) + +* [bitnami/postgresql] feat: :sparkles: :lock: Add readOnlyRootFilesystem support (#23565) ([d96a96f](https://github.com/bitnami/charts/commit/d96a96f3e29d7df6b8fdbc54be853161299b8734)), closes [#23565](https://github.com/bitnami/charts/issues/23565) +* [bitnami/postgresql] Release 14.2.1 updating components versions (#23682) ([60d8d72](https://github.com/bitnami/charts/commit/60d8d729982d4db88b6e0cc8955b6f7381c0623e)), closes [#23682](https://github.com/bitnami/charts/issues/23682) + +## 14.2.0 (2024-02-20) + +* [bitnami/*] Bump all versions (#23602) ([b70ee2a](https://github.com/bitnami/charts/commit/b70ee2a30e4dc256bf0ac52928fb2fa7a70f049b)), closes [#23602](https://github.com/bitnami/charts/issues/23602) + +## 14.1.3 (2024-02-19) + +* [bitnami/postgresql] Release 14.1.3 updating components versions (#23587) ([0c94e7a](https://github.com/bitnami/charts/commit/0c94e7a8e21b9c91f79bf30d5b697d6a764d6e55)), closes [#23587](https://github.com/bitnami/charts/issues/23587) + +## 14.1.2 (2024-02-18) + +* [bitnami/postgresql] Release 14.1.2 updating components versions (#23585) ([0f5b808](https://github.com/bitnami/charts/commit/0f5b8086977a59738cfdb67f545739c8fd73e734)), closes [#23585](https://github.com/bitnami/charts/issues/23585) + +## 14.1.1 (2024-02-16) + +* [bitnami/postgresql] Do not create a NetworkPolicy for "read" instance when "standalone" (#23392) ([7ef876c](https://github.com/bitnami/charts/commit/7ef876ceb4e94d8d48d8b1f756608b05a8f14f80)), closes [#23392](https://github.com/bitnami/charts/issues/23392) + +## 14.1.0 (2024-02-15) + +* [bitnami/postgresql] feat: :sparkles: :lock: Add resource preset support (#23509) ([0c94e15](https://github.com/bitnami/charts/commit/0c94e1516891a7aacd5b2e44f7ee0d421cf05ddc)), closes [#23509](https://github.com/bitnami/charts/issues/23509) + +## 14.0.5 (2024-02-12) + +* [bitnami/postgresql] fix: :bug: Set correct references in network policy (#23328) ([e8c2230](https://github.com/bitnami/charts/commit/e8c2230b05620e2049a30048122cdc3ac2c5fdaf)), closes [#23328](https://github.com/bitnami/charts/issues/23328) + +## 14.0.4 (2024-02-08) + +* [bitnami/postgresql] Release 14.0.4 updating components versions (#23354) ([81e3d65](https://github.com/bitnami/charts/commit/81e3d65d94881275fef258f5208bf3174dd5b908)), closes [#23354](https://github.com/bitnami/charts/issues/23354) + +## 14.0.3 (2024-02-08) + +* [bitnami/postgresql] Release 14.0.3 updating components versions (#23350) ([60ea843](https://github.com/bitnami/charts/commit/60ea84363857fe523d805de75f59ef172e00b1a2)), closes [#23350](https://github.com/bitnami/charts/issues/23350) + +## 14.0.2 (2024-02-08) + +* [bitnami/postgresql] Release 14.0.2 updating components versions (#23333) ([7f5a8e6](https://github.com/bitnami/charts/commit/7f5a8e60bf2deb3722ddfeadefb67e087c92a5e9)), closes [#23333](https://github.com/bitnami/charts/issues/23333) + +## 14.0.1 (2024-02-03) + +* [bitnami/postgresql] Release 14.0.1 updating components versions (#23129) ([e81bc0c](https://github.com/bitnami/charts/commit/e81bc0c8d51ea35baeaf5e3fca88b80da73fb003)), closes [#23129](https://github.com/bitnami/charts/issues/23129) + +## 14.0.0 (2024-02-01) + +* [bitnami/postgresql] feat!: :lock: :recycle: Refactor and enable networkPolicy (#22750) ([2508c4b](https://github.com/bitnami/charts/commit/2508c4b3de023afed4645746cff2b548ad68c48e)), closes [#22750](https://github.com/bitnami/charts/issues/22750) + +## 13.4.4 (2024-02-01) + +* [bitnami/postgresql] Release 13.4.4 updating components versions (#23002) ([a87898d](https://github.com/bitnami/charts/commit/a87898d5d5d33a60a1ccab904532ef62b6b57171)), closes [#23002](https://github.com/bitnami/charts/issues/23002) + +## 13.4.3 (2024-01-29) + +* [bitnami/postgresql] Release 13.4.3 updating components versions (#22811) ([fdc3ad4](https://github.com/bitnami/charts/commit/fdc3ad42b565d457a063ab240dcd08b860a53741)), closes [#22811](https://github.com/bitnami/charts/issues/22811) + +## 13.4.2 (2024-01-27) + +* [bitnami/*] Move documentation sections from docs.bitnami.com back to the README (#22203) ([7564f36](https://github.com/bitnami/charts/commit/7564f36ca1e95ff30ee686652b7ab8690561a707)), closes [#22203](https://github.com/bitnami/charts/issues/22203) +* [bitnami/postgresql] fix: :bug: Set seLinuxOptions to null for Openshift compatibility (#22646) ([b119bec](https://github.com/bitnami/charts/commit/b119bec99913bfe3a782b70abafd80fe4d29f525)), closes [#22646](https://github.com/bitnami/charts/issues/22646) +* [bitnami/postgresql] Release 13.4.2 updating components versions (#22785) ([6682e9c](https://github.com/bitnami/charts/commit/6682e9cfcf31d3b42010b35d47c25eea5d29f05c)), closes [#22785](https://github.com/bitnami/charts/issues/22785) + +## 13.4.1 (2024-01-23) + +* [bitnami/postgresql] Release 13.4.1 updating components versions (#22677) ([0bb8b48](https://github.com/bitnami/charts/commit/0bb8b48aaeeac00ed421269393965ef3428bbe4a)), closes [#22677](https://github.com/bitnami/charts/issues/22677) + +## 13.4.0 (2024-01-22) + +* [bitnami/postgresql] fix: :lock: Move service-account token auto-mount to pod declaration (#22450) ([002c752](https://github.com/bitnami/charts/commit/002c752f871c8fa068a770dc80fec4cf798798ab)), closes [#22450](https://github.com/bitnami/charts/issues/22450) + +## 13.3.1 (2024-01-18) + +* [bitnami/postgresql] Release 13.3.1 updating components versions (#22359) ([361f7ab](https://github.com/bitnami/charts/commit/361f7ab0122fab9016a08505be10436f0bae2584)), closes [#22359](https://github.com/bitnami/charts/issues/22359) + +## 13.3.0 (2024-01-17) + +* [bitnami/postgresql] fix: :lock: Improve podSecurityContext and containerSecurityContext with essent ([fe72f51](https://github.com/bitnami/charts/commit/fe72f51910c589e767b79ec6f2aefe8b11c2c683)), closes [#22177](https://github.com/bitnami/charts/issues/22177) + +## 13.2.30 (2024-01-15) + +* [bitnami/*] Fix ref links (in comments) (#21822) ([e4fa296](https://github.com/bitnami/charts/commit/e4fa296106b225cf8c82445727c675c7c725e380)), closes [#21822](https://github.com/bitnami/charts/issues/21822) +* [bitnami/postgresql] fix: :lock: Do not use the default service account (#22026) ([1b20745](https://github.com/bitnami/charts/commit/1b20745ae73b9a3c85473bda08d54ba2b7dda5d2)), closes [#22026](https://github.com/bitnami/charts/issues/22026) + +## 13.2.29 (2024-01-10) + +* [bitnami/*] Fix docs.bitnami.com broken links (#21901) ([f35506d](https://github.com/bitnami/charts/commit/f35506d2dadee4f097986e7792df1f53ab215b5d)), closes [#21901](https://github.com/bitnami/charts/issues/21901) +* [bitnami/postgresql] Release 13.2.29 updating components versions (#21970) ([dcfb216](https://github.com/bitnami/charts/commit/dcfb2164d6075edb5336ddafce939d067d6c8810)), closes [#21970](https://github.com/bitnami/charts/issues/21970) +* fixed backup with autogenerated cert (#21888) ([2d25138](https://github.com/bitnami/charts/commit/2d25138ccdf2f19ce32255722d83d908bdd1cb14)), closes [#21888](https://github.com/bitnami/charts/issues/21888) + +## 13.2.28 (2024-01-09) + +* [bitnami/*] Update copyright: Year and company (#21815) ([6c4bf75](https://github.com/bitnami/charts/commit/6c4bf75dec58fc7c9aee9f089777b1a858c17d5b)), closes [#21815](https://github.com/bitnami/charts/issues/21815) +* [bitnami/postgresql] Release 13.2.28 updating components versions (#21902) ([d0f6b90](https://github.com/bitnami/charts/commit/d0f6b90b97537391b6c3cbbc8f8f0da2c9818f2f)), closes [#21902](https://github.com/bitnami/charts/issues/21902) + +## 13.2.27 (2023-12-31) + +* [bitnami/postgresql] Release 13.2.27 updating components versions (#21795) ([26711f8](https://github.com/bitnami/charts/commit/26711f8fd8d3aab5700e8267d3c0597034274b3d)), closes [#21795](https://github.com/bitnami/charts/issues/21795) + +## 13.2.26 (2023-12-27) + +* [bitnami/postgresql] Release 13.2.26 updating components versions (#21774) ([0f0f93b](https://github.com/bitnami/charts/commit/0f0f93b14978c839a51f244a8ce5f9878287fac8)), closes [#21774](https://github.com/bitnami/charts/issues/21774) + +## 13.2.25 (2023-12-20) + +* [bitnami/postgresql] Release 13.2.25 updating components versions (#21710) ([813da6b](https://github.com/bitnami/charts/commit/813da6b9098ed399551f387ad7c1b3f9fd0dc44e)), closes [#21710](https://github.com/bitnami/charts/issues/21710) + +## 13.2.24 (2023-12-05) + +* [bitnami/postgresql] Replace deprecated pull secret partial (#21392) ([cee371d](https://github.com/bitnami/charts/commit/cee371d10674dc61de5adda4a79f4c9a1e8f85d0)), closes [#21392](https://github.com/bitnami/charts/issues/21392) + +## 13.2.23 (2023-11-30) + +* [bitnami/postgresql] Release 13.2.23 updating components versions (#21336) ([c3dc56f](https://github.com/bitnami/charts/commit/c3dc56f3679650f1012e497b8a5e71d94dac163e)), closes [#21336](https://github.com/bitnami/charts/issues/21336) + +## 13.2.22 (2023-11-30) + +* [bitnami/postgresql] Release 13.2.22 updating components versions (#21335) ([f759303](https://github.com/bitnami/charts/commit/f7593033f47e7c8f777913373e4ad79cf4845176)), closes [#21335](https://github.com/bitnami/charts/issues/21335) + +## 13.2.21 (2023-11-27) + +* [bitnami/postgresql] Release 13.2.21 updating components versions (#21276) ([46a4f54](https://github.com/bitnami/charts/commit/46a4f54495d95276785a3b2cd37962ebd0a9be1e)), closes [#21276](https://github.com/bitnami/charts/issues/21276) + +## 13.2.20 (2023-11-27) + +* [bitnami/postgresql] Release 13.2.20 updating components versions (#21272) ([6de0ade](https://github.com/bitnami/charts/commit/6de0ade26a13c2aba94103e8132d277a81224bb7)), closes [#21272](https://github.com/bitnami/charts/issues/21272) + +## 13.2.19 (2023-11-27) + +* [bitnami/postgresql] Fix PostgreSQL password in metrics container (#21202) ([a7b72aa](https://github.com/bitnami/charts/commit/a7b72aa0f5f3630750c76c5fc0b83ca8bcfdcd26)), closes [#21202](https://github.com/bitnami/charts/issues/21202) + +## 13.2.18 (2023-11-26) + +* [bitnami/postgresql] Release 13.2.18 updating components versions (#21256) ([f4a4548](https://github.com/bitnami/charts/commit/f4a4548120a4bdd005f4e35787de9af65376c04d)), closes [#21256](https://github.com/bitnami/charts/issues/21256) + +## 13.2.17 (2023-11-26) + +* [bitnami/postgresql] Release 13.2.17 updating components versions (#21255) ([e395fd8](https://github.com/bitnami/charts/commit/e395fd838385ad716cc877d280af797f77146751)), closes [#21255](https://github.com/bitnami/charts/issues/21255) + +## 13.2.16 (2023-11-23) + +* [bitnami/postgresql] value to configure posgres_exporter collectors (#21162) ([0ba581c](https://github.com/bitnami/charts/commit/0ba581cc113264bb252e4c873217732a316ba71f)), closes [#21162](https://github.com/bitnami/charts/issues/21162) +* Update configmap.yaml (#21020) ([b91e518](https://github.com/bitnami/charts/commit/b91e518041dc4fe76b422801406efe7f9a4e4b49)), closes [#21020](https://github.com/bitnami/charts/issues/21020) + +## 13.2.15 (2023-11-21) + +* [bitnami/*] Rename solutions to "Bitnami package for ..." (#21038) ([b82f979](https://github.com/bitnami/charts/commit/b82f979e4fb63423fe6e2192c946d09d79c944fc)), closes [#21038](https://github.com/bitnami/charts/issues/21038) +* [bitnami/postgresql] Release 13.2.15 updating components versions (#21160) ([e6ec2c2](https://github.com/bitnami/charts/commit/e6ec2c2982653c0ae1ec8a25d3e6bf24a92bb215)), closes [#21160](https://github.com/bitnami/charts/issues/21160) + +## 13.2.14 (2023-11-20) + +* [bitnami/postgresql] Release 13.2.14 updating components versions (#21068) ([576be48](https://github.com/bitnami/charts/commit/576be48d9fd20b645b789312348f6956ca979489)), closes [#21068](https://github.com/bitnami/charts/issues/21068) + +## 13.2.13 (2023-11-20) + +* [bitnami/postgresql] Release 13.2.13 updating components versions (#21066) ([54a372f](https://github.com/bitnami/charts/commit/54a372fca8edd8316df8979a6f05d3c9722e6361)), closes [#21066](https://github.com/bitnami/charts/issues/21066) + +## 13.2.12 (2023-11-20) + +* [bitnami/postgresql] Release 13.2.12 updating components versions (#21057) ([0cffbfe](https://github.com/bitnami/charts/commit/0cffbfeb281a6c42d507f78f6e53c637527230ac)), closes [#21057](https://github.com/bitnami/charts/issues/21057) + +## 13.2.11 (2023-11-17) + +* [bitnami/postgresql] Release 13.2.11 updating components versions (#21044) ([17e4ada](https://github.com/bitnami/charts/commit/17e4adac62f77d314ebdaf722944b9191aea0a62)), closes [#21044](https://github.com/bitnami/charts/issues/21044) + +## 13.2.10 (2023-11-17) + +* [bitnami/*] Remove relative links to non-README sections, add verification for that and update TL;DR ([1103633](https://github.com/bitnami/charts/commit/11036334d82df0490aa4abdb591543cab6cf7d7f)), closes [#20967](https://github.com/bitnami/charts/issues/20967) +* [bitnami/postgresql] Release 13.2.10 updating components versions (#21039) ([2b176c0](https://github.com/bitnami/charts/commit/2b176c0ad026223c86cbd88bfe1fba8895519c51)), closes [#21039](https://github.com/bitnami/charts/issues/21039) + +## 13.2.9 (2023-11-13) + +* [bitnami/postgresql] Release 13.2.9 updating components versions (#20930) ([02dc5ff](https://github.com/bitnami/charts/commit/02dc5ff8c09a4f232152d4a62a628008866a397c)), closes [#20930](https://github.com/bitnami/charts/issues/20930) + +## 13.2.8 (2023-11-13) + +* [bitnami/postgresql] Release 13.2.8 updating components versions (#20929) ([129cbf1](https://github.com/bitnami/charts/commit/129cbf14077eb53393b08d1ae7a22f2fc6201323)), closes [#20929](https://github.com/bitnami/charts/issues/20929) + +## 13.2.7 (2023-11-13) + +* [bitnami/postgresql] Release 13.2.7 updating components versions (#20918) ([860eb62](https://github.com/bitnami/charts/commit/860eb627ff273acea6a48316f779df4ca6436b8a)), closes [#20918](https://github.com/bitnami/charts/issues/20918) + +## 13.2.6 (2023-11-13) + +* [bitnami/postgresql] Release 13.2.6 updating components versions (#20908) ([a942587](https://github.com/bitnami/charts/commit/a942587d48f1ac368c6d9dd4b3842a7a8f59d699)), closes [#20908](https://github.com/bitnami/charts/issues/20908) + +## 13.2.5 (2023-11-10) + +* [bitnami/postgresql] Release 13.2.5 updating components versions (#20889) ([ca3f6a7](https://github.com/bitnami/charts/commit/ca3f6a70982ee387dfd6c782a8dbefa0ad4ebebc)), closes [#20889](https://github.com/bitnami/charts/issues/20889) + +## 13.2.4 (2023-11-09) + +* [bitnami/postgresql] Release 13.2.4 updating components versions (#20876) ([435c8af](https://github.com/bitnami/charts/commit/435c8afe568f0dbeda81cf1a4219874b8d670e89)), closes [#20876](https://github.com/bitnami/charts/issues/20876) + +## 13.2.3 (2023-11-08) + +* [bitnami/postgresql] Release 13.2.3 updating components versions (#20772) ([0ed5ebf](https://github.com/bitnami/charts/commit/0ed5ebfb6b1384f71d667f8fd5e25defa234a9b6)), closes [#20772](https://github.com/bitnami/charts/issues/20772) + +## 13.2.2 (2023-11-06) + +* [bitnami/postgresql] Release 13.2.2 updating components versions (#20639) ([9b846d9](https://github.com/bitnami/charts/commit/9b846d924d7e92f09507df205278a9c8c78a637c)), closes [#20639](https://github.com/bitnami/charts/issues/20639) + +## 13.2.1 (2023-11-03) + +* [bitnami/postgresql] Release 13.2.1 updating components versions (#20614) ([68bad25](https://github.com/bitnami/charts/commit/68bad258cdd695a80e95acdc796dd78b36f4b060)), closes [#20614](https://github.com/bitnami/charts/issues/20614) + +## 13.2.0 (2023-10-31) + +* [bitnami/*] Rename VMware Application Catalog (#20361) ([3acc734](https://github.com/bitnami/charts/commit/3acc73472beb6fb56c4d99f929061001205bc57e)), closes [#20361](https://github.com/bitnami/charts/issues/20361) +* [bitnami/*] Skip image's tag in the README files of the Bitnami Charts (#19841) ([bb9a01b](https://github.com/bitnami/charts/commit/bb9a01b65911c87e48318db922cc05eb42785e42)), closes [#19841](https://github.com/bitnami/charts/issues/19841) +* [bitnami/*] Standardize documentation (#19835) ([af5f753](https://github.com/bitnami/charts/commit/af5f7530c1bc8c5ded53a6c4f7b8f384ac1804f2)), closes [#19835](https://github.com/bitnami/charts/issues/19835) +* [bitnami/postgresql] feat: :sparkles: Add support for PSA restricted policy (#20527) ([8da833a](https://github.com/bitnami/charts/commit/8da833aa06772fc456b71669770b66b3b9b46f9a)), closes [#20527](https://github.com/bitnami/charts/issues/20527) + +## 13.1.5 (2023-10-13) + +* [bitnami/postgresql] Release 13.1.5 (#20212) ([0272334](https://github.com/bitnami/charts/commit/0272334cc97897a11866dd07b631a54ba240fcb9)), closes [#20212](https://github.com/bitnami/charts/issues/20212) + +## 13.1.4 (2023-10-12) + +* [bitnami/postgresql] Release 13.1.4 (#20187) ([477cb86](https://github.com/bitnami/charts/commit/477cb8678f87eb34b154585907a9c03fd6be8535)), closes [#20187](https://github.com/bitnami/charts/issues/20187) + +## 13.1.3 (2023-10-09) + +* [bitnami/postgresql] Release 13.1.3 (#19931) ([2eb6312](https://github.com/bitnami/charts/commit/2eb63123658ba817d858ee83a2aa94e3133d75c1)), closes [#19931](https://github.com/bitnami/charts/issues/19931) + +## 13.1.2 (2023-10-09) + +* [bitnami/postgresql] Release 13.1.2 (#19882) ([5758fb2](https://github.com/bitnami/charts/commit/5758fb2b69f411e8ba87e71fd09af1029aa557d9)), closes [#19882](https://github.com/bitnami/charts/issues/19882) + +## 13.1.1 (2023-10-09) + +* [bitnami/*] Update Helm charts prerequisites (#19745) ([eb755dd](https://github.com/bitnami/charts/commit/eb755dd36a4dd3cf6635be8e0598f9a7f4c4a554)), closes [#19745](https://github.com/bitnami/charts/issues/19745) +* [bitnami/postgresql] Release 13.1.1 (#19775) ([f783262](https://github.com/bitnami/charts/commit/f783262472dff63aa58f0feaf8aa43de4cf17dcd)), closes [#19775](https://github.com/bitnami/charts/issues/19775) + +## 13.1.0 (2023-10-05) + +* [bitnami/postgresql] Add TimeZone to CronJob of backup (#19516) ([94d976d](https://github.com/bitnami/charts/commit/94d976d80446a4b5ff20825b5e6fadc8afe2b978)), closes [#19516](https://github.com/bitnami/charts/issues/19516) + +## 13.0.2 (2023-10-04) + +* [bitnami/postgresql] Support disabling backup cron containerSecurityContext (#19676) ([5ff8ad5](https://github.com/bitnami/charts/commit/5ff8ad5f3c754e3c2423d6abf46f522e8abe0410)), closes [#19676](https://github.com/bitnami/charts/issues/19676) + +## 13.0.1 (2023-09-29) + +* [bitnami/postgresql] Update README after major release (#19608) ([cd4442c](https://github.com/bitnami/charts/commit/cd4442ca2ac454b8fabf528631b9e5d910d3e847)), closes [#19608](https://github.com/bitnami/charts/issues/19608) +* [bitnami/postgresql] Use common capabilities for PSP (#19637) ([5593291](https://github.com/bitnami/charts/commit/5593291a4229e51c166dd63519c7c3d7cc61ca93)), closes [#19637](https://github.com/bitnami/charts/issues/19637) + +## 13.0.0 (2023-09-28) + +* [bitnami/postgresql] Release 13.0.0 (#19587) ([ed70b64](https://github.com/bitnami/charts/commit/ed70b64a2607bef3cc99bab2b2ac22999d07bdc2)), closes [#19587](https://github.com/bitnami/charts/issues/19587) + +## 12.12.10 (2023-09-27) + +* [bitnami/postgresql] Fix port used by backup's CronJob (#19517) ([d278c2b](https://github.com/bitnami/charts/commit/d278c2b6792e02c5f327e96df4f031cab7bc0819)), closes [#19517](https://github.com/bitnami/charts/issues/19517) + +## 12.12.9 (2023-09-26) + +* [bitnami/postgresql] Release 12.12.9 updating components versions (#19530) ([70ca410](https://github.com/bitnami/charts/commit/70ca4106446fec3f491dc5c87cacf85ece3f11af)), closes [#19530](https://github.com/bitnami/charts/issues/19530) +* bitnami/postgresql Added ImagePullSecrets and ImagePullPolicy to be passed through to backup-cronjo ([29dbf3a](https://github.com/bitnami/charts/commit/29dbf3a630c3666dc803900e353b558a6d78558c)), closes [#19509](https://github.com/bitnami/charts/issues/19509) + +## 12.12.8 (2023-09-26) + +* [bitnami/postgresql] Release 12.12.8 (#19521) ([ef790fa](https://github.com/bitnami/charts/commit/ef790faaa22c5bdd390341f069531719f6987af8)), closes [#19521](https://github.com/bitnami/charts/issues/19521) + +## 12.12.7 (2023-09-25) + +* [bitnami/postgresql] Release 12.12.7 (#19506) ([f8d9491](https://github.com/bitnami/charts/commit/f8d949156a8beccb9acb0fed17ed6e6cdec23f3f)), closes [#19506](https://github.com/bitnami/charts/issues/19506) + +## 12.12.6 (2023-09-22) + +* [bitnami/postgresql] Release 12.12.6 (#19481) ([acac1c2](https://github.com/bitnami/charts/commit/acac1c2f7d937fdef3c19ecb9c0acce279a2f320)), closes [#19481](https://github.com/bitnami/charts/issues/19481) + +## 12.12.5 (2023-09-22) + +* [bitnami/postgresql] Add SecurityContext to CronJob of backup (#19238) ([8edeb93](https://github.com/bitnami/charts/commit/8edeb93e6917915f6d1d81e745fec0a998e1454a)), closes [#19238](https://github.com/bitnami/charts/issues/19238) + +## 12.12.4 (2023-09-20) + +* [bitnami/postgresql] Release 12.12.4 (#19430) ([f8b45dc](https://github.com/bitnami/charts/commit/f8b45dc5d71d35d2f1822f7040ea4b8cdb3d00fd)), closes [#19430](https://github.com/bitnami/charts/issues/19430) + +## 12.12.3 (2023-09-19) + +* [bitnami/postgresql] Add nodeSelector to Backup Cronjob spec (#19398) ([7eea12f](https://github.com/bitnami/charts/commit/7eea12f052ceeb3c8bef32a18e3257bca16eb372)), closes [#19398](https://github.com/bitnami/charts/issues/19398) + +## 12.11.4 (2023-09-19) + +* [bitnami/postgresql] Release 12.11.4 (#19397) ([b6a06cc](https://github.com/bitnami/charts/commit/b6a06cc0c8acfe4fb47d1fe99e7ea6978d10718e)), closes [#19397](https://github.com/bitnami/charts/issues/19397) + +## 12.11.3 (2023-09-18) + +* [bitnami/postgresql] Release 12.11.3 (#19345) ([9407892](https://github.com/bitnami/charts/commit/9407892e59e1004bd702c03587fb4782c9949e48)), closes [#19345](https://github.com/bitnami/charts/issues/19345) +* Revert "Autogenerate schema files (#19194)" (#19335) ([73d80be](https://github.com/bitnami/charts/commit/73d80be525c88fb4b8a54451a55acd506e337062)), closes [#19194](https://github.com/bitnami/charts/issues/19194) [#19335](https://github.com/bitnami/charts/issues/19335) + +## 12.11.2 (2023-09-15) + +* Autogenerate schema files (#19194) ([a2c2090](https://github.com/bitnami/charts/commit/a2c2090b5ac97f47b745c8028c6452bf99739772)), closes [#19194](https://github.com/bitnami/charts/issues/19194) +* Fix global secretkeys usage (#19281) ([3c468cb](https://github.com/bitnami/charts/commit/3c468cb618180ac21dd6051324569ae8c1525ef3)), closes [#19281](https://github.com/bitnami/charts/issues/19281) + +## 12.11.1 (2023-09-08) + +* [bitnami/postgresql] chore: :bookmark: Bump version ([26ddfc4](https://github.com/bitnami/charts/commit/26ddfc4ef1f294267bce5013c374bf3f5301e70f)) + +## 12.11.0 (2023-09-07) + +* [bitnami/postgresql] Version the helper functions (#17847) ([c1a1349](https://github.com/bitnami/charts/commit/c1a1349e8bfa5c853798b3f26c470a8255374ecf)), closes [#17847](https://github.com/bitnami/charts/issues/17847) + +## 12.10.2 (2023-09-07) + +* [bitnami/postgresql] chore: :bookmark: Bump version ([b46e94e](https://github.com/bitnami/charts/commit/b46e94e5205bb3f2ec35afc024c34acf8a533afd)) + +## 12.10.1 (2023-09-06) + +* [bitnami/postgresql: Use merge helper]: (#19093) ([8eaef88](https://github.com/bitnami/charts/commit/8eaef88b982edabba62c4f4aca7ae5e61c152005)), closes [#19093](https://github.com/bitnami/charts/issues/19093) + +## 12.10.0 (2023-08-25) + +* [bitnami/postgresql] Add Persistent Volume Claim Retention Policy to Postgresql Statefulsets (#18276 ([85635f4](https://github.com/bitnami/charts/commit/85635f4e81edf49a2ba9baf301656a6e15ed261c)), closes [#18276](https://github.com/bitnami/charts/issues/18276) + +## 12.9.0 (2023-08-23) + +* [bitnami/postgresql] Support for customizing standard labels (#18408) ([bf18e4b](https://github.com/bitnami/charts/commit/bf18e4b271d2281b196c237ff4b3480b9f974426)), closes [#18408](https://github.com/bitnami/charts/issues/18408) + +## 12.8.5 (2023-08-22) + +* [bitnami/postgresql] Release 12.8.5 (#18771) ([85ffc53](https://github.com/bitnami/charts/commit/85ffc537f5a4979ae7f6c82c0c3a6cfbb3cc22a1)), closes [#18771](https://github.com/bitnami/charts/issues/18771) + +## 12.8.4 (2023-08-21) + +* [bitnami/postgresql] fix annotation typo (#18557) ([9748b69](https://github.com/bitnami/charts/commit/9748b6929f9297e669b8f53a2ea34fc1d6d86a58)), closes [#18557](https://github.com/bitnami/charts/issues/18557) + +## 12.8.3 (2023-08-17) + +* [bitnami/postgresql] Release 12.8.3 (#18576) ([6c950c1](https://github.com/bitnami/charts/commit/6c950c1345fb8023f2cc3287bdcbb1a5daade8f2)), closes [#18576](https://github.com/bitnami/charts/issues/18576) + +## 12.8.2 (2023-08-10) + +* [bitnami/postgresql] Release 12.8.2 (#18364) ([f34b599](https://github.com/bitnami/charts/commit/f34b599adba104713bb931dd69a8a328df116513)), closes [#18364](https://github.com/bitnami/charts/issues/18364) + +## 12.8.1 (2023-08-08) + +* [bitnami/postgresql] Release 12.8.1 (#18287) ([5887a90](https://github.com/bitnami/charts/commit/5887a907d3f84ed68760d87e41d0a343c84e12ed)), closes [#18287](https://github.com/bitnami/charts/issues/18287) + +## 12.8.0 (2023-08-01) + +* [bitnami/postgresql] Add trivial backup cronjob (#17852) ([56b223b](https://github.com/bitnami/charts/commit/56b223b24aea584d0ef8c58ba669baadedee0e75)), closes [#17852](https://github.com/bitnami/charts/issues/17852) + +## 12.7.3 (2023-07-31) + +* [bitnami/postgresql] Release 12.7.3 (#18068) ([0186212](https://github.com/bitnami/charts/commit/01862127c7e07b89b2f08bcad9cb593f6ea4dc41)), closes [#18068](https://github.com/bitnami/charts/issues/18068) + +## 12.7.2 (2023-07-31) + +* [bitnami/postgresql] Remove multi-line conditional (#17711) ([e7acf10](https://github.com/bitnami/charts/commit/e7acf10e9e9874dc1c9b26b849f47d39db1554d7)), closes [#17711](https://github.com/bitnami/charts/issues/17711) + +## 12.7.1 (2023-07-27) + +* [bitnami/postgresql] Release 12.7.1 (#17986) ([a071516](https://github.com/bitnami/charts/commit/a0715163ee9e1c554669783edbecd352e04be396)), closes [#17986](https://github.com/bitnami/charts/issues/17986) + +## 12.7.0 (2023-07-26) + +* [bitnami/postgresql] set some bits compatible with pss restricted (#17388) ([beb65fa](https://github.com/bitnami/charts/commit/beb65fae1f0aa7828d1d7773665e4cad8933062b)), closes [#17388](https://github.com/bitnami/charts/issues/17388) + +## 12.6.9 (2023-07-24) + +* [bitnami/postgresql] Release 12.6.9 (#17840) ([5141c42](https://github.com/bitnami/charts/commit/5141c42b918cf812393c29b4978d5330d0bf437f)), closes [#17840](https://github.com/bitnami/charts/issues/17840) + +## 12.6.8 (2023-07-20) + +* [bitnami/postgresl] Remove the password in text of the statefulset (#17780) ([3bfcc08](https://github.com/bitnami/charts/commit/3bfcc0812171abc52f11edc32c2d31650a1bbc8c)), closes [#17780](https://github.com/bitnami/charts/issues/17780) + +## 12.6.7 (2023-07-19) + +* Fixes usePasswordFiles (#17773) ([14d2b9a](https://github.com/bitnami/charts/commit/14d2b9aa78f3c1df413600e6a623215a827c2092)), closes [#17773](https://github.com/bitnami/charts/issues/17773) + +## 12.6.6 (2023-07-15) + +* [bitnami/postgresql] Release 12.6.6 (#17705) ([3e6c481](https://github.com/bitnami/charts/commit/3e6c4816902a5250fa97202590da88c65ffa2a94)), closes [#17705](https://github.com/bitnami/charts/issues/17705) + +## 12.6.5 (2023-07-11) + +* [bitnami/postgresql] fix invalid indentation for replica metrics extra envs (#17553) ([39b5188](https://github.com/bitnami/charts/commit/39b5188af308dc4d9ad777f20c8a4d7f6fb3a539)), closes [#17553](https://github.com/bitnami/charts/issues/17553) + +## 12.6.4 (2023-07-07) + +* [bitnami/postgresql] Fix postgres random password generation (#17502) ([afa4649](https://github.com/bitnami/charts/commit/afa4649ca1252dd82a250b3b9497575a9744dd0a)), closes [#17502](https://github.com/bitnami/charts/issues/17502) + +## 12.6.3 (2023-07-06) + +* [bitnami/postgresql] Fix multi-element array for primary.service.loadBalancerSourceRanges (#17461) ([dc59153](https://github.com/bitnami/charts/commit/dc59153da0c21373c83d9a6eb6b3a2e7373f9fe2)), closes [#17461](https://github.com/bitnami/charts/issues/17461) [#17450](https://github.com/bitnami/charts/issues/17450) + +## 12.6.2 (2023-07-04) + +* [bitnami/postgresql] Fix postgres password if customUser is empty (#17473) ([d6234d8](https://github.com/bitnami/charts/commit/d6234d8b8921470066e567832660164d84192975)), closes [#17473](https://github.com/bitnami/charts/issues/17473) + +## 12.6.1 (2023-07-04) + +* [bitnami/postgresql] Fix issues when using enablePostgresUser=false (#17398) ([262f4f1](https://github.com/bitnami/charts/commit/262f4f1d2906226cee8cabb49c8fedf97ecc30e4)), closes [#17398](https://github.com/bitnami/charts/issues/17398) + +## 12.6.0 (2023-06-29) + +* [bitnami/postgresql] checksum only data part of the ConfigMap (#17302) ([f5c4b4e](https://github.com/bitnami/charts/commit/f5c4b4e1e1dfc1ce898f3ceb4a9204a0ae78f59a)), closes [#17302](https://github.com/bitnami/charts/issues/17302) + +## 12.5.9 (2023-06-29) + +* [bitnami/postgresql] Release 12.5.9 (#17392) ([06ab2db](https://github.com/bitnami/charts/commit/06ab2db2211d173726ffbe90801481d0591dd7ed)), closes [#17392](https://github.com/bitnami/charts/issues/17392) +* Add copyright header (#17300) ([da68be8](https://github.com/bitnami/charts/commit/da68be8e951225133c7dfb572d5101ca3d61c5ae)), closes [#17300](https://github.com/bitnami/charts/issues/17300) +* Update charts readme (#17217) ([31b3c0a](https://github.com/bitnami/charts/commit/31b3c0afd968ff4429107e34101f7509e6a0e913)), closes [#17217](https://github.com/bitnami/charts/issues/17217) + +## 12.5.8 (2023-06-19) + +* [bitnami/PostgreSQL] Update statefulset to inlcude verbose PVC reference (#17140) ([ffa4eeb](https://github.com/bitnami/charts/commit/ffa4eeb0e853fd63fced31d1bd443c6587354f87)), closes [#17140](https://github.com/bitnami/charts/issues/17140) + +## 12.5.7 (2023-06-12) + +* [bitnami/*] Change copyright section in READMEs (#17006) ([ef986a1](https://github.com/bitnami/charts/commit/ef986a1605241102b3dcafe9fd8089e6fc1201ad)), closes [#17006](https://github.com/bitnami/charts/issues/17006) +* [bitnami/postgresql] Fix execution when enablePostgresUser is false (#17058) ([fc26fbd](https://github.com/bitnami/charts/commit/fc26fbd518a5bb0e546144d04e7178a138ccbd5b)), closes [#17058](https://github.com/bitnami/charts/issues/17058) +* [bitnami/several] Change copyright section in READMEs (#16989) ([5b6a5cf](https://github.com/bitnami/charts/commit/5b6a5cfb7625a751848a2e5cd796bd7278f406ca)), closes [#16989](https://github.com/bitnami/charts/issues/16989) + +## 12.5.6 (2023-05-30) + +* [bitnami/postgresql] Fix mountPath for extendedConfiguration (#16874) ([f5e2881](https://github.com/bitnami/charts/commit/f5e2881a6486cba5dada153af9ec1c2eef5b2607)), closes [#16874](https://github.com/bitnami/charts/issues/16874) +* [bitnami/postgresql] Release 12.5.6 (#16953) ([0448ae0](https://github.com/bitnami/charts/commit/0448ae0ee83f1aca2e4bc4eae484d57c32c053ea)), closes [#16953](https://github.com/bitnami/charts/issues/16953) + +## 12.5.5 (2023-05-23) + +* [bitnami/postgresql] Allow usePasswordFile when using existingSecret + custom keys (#16729) ([ff3a5e0](https://github.com/bitnami/charts/commit/ff3a5e09275e46e53e69ba3127fcd854f6131f31)), closes [#16729](https://github.com/bitnami/charts/issues/16729) + +## 12.5.4 (2023-05-22) + +* [bitnami/postgresql] Release 12.5.4 (#16861) ([d8aae34](https://github.com/bitnami/charts/commit/d8aae34620d86d9d7aa4a98d260cb8264ca3427e)), closes [#16861](https://github.com/bitnami/charts/issues/16861) + +## 12.5.3 (2023-05-21) + +* [bitnami/postgresql] Release 12.5.3 (#16838) ([de9b3a4](https://github.com/bitnami/charts/commit/de9b3a43a8f31a52cff599e46d6ac7db146ccb31)), closes [#16838](https://github.com/bitnami/charts/issues/16838) + +## 12.5.2 (2023-05-16) + +* [bitnami/postgresql] Bump the version (#16668) ([7addf44](https://github.com/bitnami/charts/commit/7addf44857481ba673384aa6ad8b5f95a02608ea)), closes [#16668](https://github.com/bitnami/charts/issues/16668) +* fix(postgres): use correct default value type for networkPolicy customRules (#16646) ([901f3b8](https://github.com/bitnami/charts/commit/901f3b82f4ecbf62ac968c7edfd061016036055a)), closes [#16646](https://github.com/bitnami/charts/issues/16646) + +## 12.5.1 (2023-05-12) + +* [bitnami/postgresql] Release 12.5.1 (#16621) ([7c233f3](https://github.com/bitnami/charts/commit/7c233f36112aed3567edf01f69017cd7a428be20)), closes [#16621](https://github.com/bitnami/charts/issues/16621) +* Add wording for enterprise page (#16560) ([8f22774](https://github.com/bitnami/charts/commit/8f2277440b976d52785ba9149762ad8620a73d1f)), closes [#16560](https://github.com/bitnami/charts/issues/16560) + +## 12.5.0 (2023-05-09) + +* [bitnami/several] Adapt Chart.yaml to set desired OCI annotations (#16546) ([fc9b18f](https://github.com/bitnami/charts/commit/fc9b18f2e98805d4df629acbcde696f44f973344)), closes [#16546](https://github.com/bitnami/charts/issues/16546) + +## 12.4.3 (2023-05-09) + +* [bitnami/postgresql] Release 12.4.3 (#16493) ([85c1bf6](https://github.com/bitnami/charts/commit/85c1bf652b5b423bc1e270ba3303f32adb52c368)), closes [#16493](https://github.com/bitnami/charts/issues/16493) + +## 12.4.2 (2023-04-27) + +* [bitnami/postgresql] Use username as key in the Service Binding secret (#16249) ([c6daf3d](https://github.com/bitnami/charts/commit/c6daf3d29502dca394284d0a4be1a91827d7f869)), closes [#16249](https://github.com/bitnami/charts/issues/16249) + +## 12.4.1 (2023-04-25) + +* [bitnami/postgresql] Release 12.4.1 (#16225) ([d6f37c5](https://github.com/bitnami/charts/commit/d6f37c5847c34bbbedb702c262df6dcd1c2f8b62)), closes [#16225](https://github.com/bitnami/charts/issues/16225) + +## 12.4.0 (2023-04-25) + +* [bitnami/several] Revert changes done by mistake in Chart.yaml repo (#16211) ([3a60f4b](https://github.com/bitnami/charts/commit/3a60f4b10d2e02dbf83fcf64906b43edb6725615)), closes [#16211](https://github.com/bitnami/charts/issues/16211) + +## 12.3.2 (2023-04-25) + +* [bitnami/postgresql] Release 12.3.2 (#16205) ([d1cbf66](https://github.com/bitnami/charts/commit/d1cbf66dbaebac3ffd5d92a69c88bb00146b280d)), closes [#16205](https://github.com/bitnami/charts/issues/16205) + +## 12.3.1 (2023-04-21) + +* [bitnami/postgresql] Release 12.3.1 (#16182) ([1426b53](https://github.com/bitnami/charts/commit/1426b53a4d6bb75d442df177f77daafe93e5b78b)), closes [#16182](https://github.com/bitnami/charts/issues/16182) + +## 12.3.0 (2023-04-20) + +* [bitnami/*] Make Helm charts 100% OCI (#15998) ([8841510](https://github.com/bitnami/charts/commit/884151035efcbf2e1b3206e7def85511073fb57d)), closes [#15998](https://github.com/bitnami/charts/issues/15998) + +## 12.2.8 (2023-04-14) + +* [bitnami/postgresql] Release 12.2.8 (#16072) ([8f03dec](https://github.com/bitnami/charts/commit/8f03decb1ff8c4bf5a7bf0ab40d3844474323d48)), closes [#16072](https://github.com/bitnami/charts/issues/16072) + +## 12.2.7 (2023-04-01) + +* [bitnami/postgresql] Release 12.2.7 (#15896) ([18e9565](https://github.com/bitnami/charts/commit/18e9565ed8d1fcc9cd072fc1c5fd2cc7ffbd0b3a)), closes [#15896](https://github.com/bitnami/charts/issues/15896) + +## 12.2.6 (2023-03-22) + +* [bitnami/postgresql] Release 12.2.6 (#15685) ([e42e0a1](https://github.com/bitnami/charts/commit/e42e0a158ee42c88a7fcd6cb67d50aa11a32e38e)), closes [#15685](https://github.com/bitnami/charts/issues/15685) + +## 12.2.5 (2023-03-20) + +* [bitnami/postgresql] Release 12.2.5 (#15632) ([71f1ab5](https://github.com/bitnami/charts/commit/71f1ab5bcf8e9fa7f0867b1104d3151bc3d0c662)), closes [#15632](https://github.com/bitnami/charts/issues/15632) + +## 12.2.4 (2023-03-19) + +* [bitnami/postgresql] Release 12.2.4 (#15600) ([2b7e88c](https://github.com/bitnami/charts/commit/2b7e88cecfc5d607a7d57c5519624a7d244e59eb)), closes [#15600](https://github.com/bitnami/charts/issues/15600) + +## 12.2.3 (2023-03-14) + +* [bitnami/charts] Apply linter to README files (#15357) ([0e29e60](https://github.com/bitnami/charts/commit/0e29e600d3adc8b1b46e506eccb3decfab3b4e63)), closes [#15357](https://github.com/bitnami/charts/issues/15357) +* [bitnami/postgresql] Release 12.2.3 (#15488) ([1b1ddca](https://github.com/bitnami/charts/commit/1b1ddcaac1815709423744fec139374165c6dc2b)), closes [#15488](https://github.com/bitnami/charts/issues/15488) + +## 12.2.2 (2023-03-01) + +* [bitnami/postgresql] Release 12.2.2 (#15233) ([ceb1e4f](https://github.com/bitnami/charts/commit/ceb1e4fefd2cd6363ec12190fe72f79f5252f78b)), closes [#15233](https://github.com/bitnami/charts/issues/15233) +* Fix postgres secret keys (#15023) ([eeb1faa](https://github.com/bitnami/charts/commit/eeb1faaa45e393f0bc10f2c9093f8c9720f0e6da)), closes [#15023](https://github.com/bitnami/charts/issues/15023) + +## 12.2.1 (2023-02-17) + +* [bitnami/*] Fix markdown linter issues 2 (#14890) ([aa96572](https://github.com/bitnami/charts/commit/aa9657237ee8df4a46db0d7fdf8a23230dd6902a)), closes [#14890](https://github.com/bitnami/charts/issues/14890) +* [bitnami/postgresql] Release 12.2.1 (#15025) ([727ecd8](https://github.com/bitnami/charts/commit/727ecd8f026c7752e9ecb8c3596820fc904182a4)), closes [#15025](https://github.com/bitnami/charts/issues/15025) + +## 12.2.0 (2023-02-16) + +* [bitnami/*] Fix markdown linter issues (#14874) ([a51e0e8](https://github.com/bitnami/charts/commit/a51e0e8d35495b907f3e70dd2f8e7c3bcbf4166a)), closes [#14874](https://github.com/bitnami/charts/issues/14874) +* [bitnami/*] Remove unexpected extra spaces (#14873) ([c97c714](https://github.com/bitnami/charts/commit/c97c714887380d47eae7bfeff316bf01595ecd1d)), closes [#14873](https://github.com/bitnami/charts/issues/14873) +* [bitnami/postgresql] feat: :sparkles: Add ServiceBinding-compatible secrets (#14893) ([68f6708](https://github.com/bitnami/charts/commit/68f67081020525f4b757a2f6f3132c8435b94673)), closes [#14893](https://github.com/bitnami/charts/issues/14893) + +## 12.1.15 (2023-02-09) + +* [bitnami/postgresql] Release 12.1.15 (#14821) ([9334f82](https://github.com/bitnami/charts/commit/9334f82858196b21a1c74c40deaf5a907119333f)), closes [#14821](https://github.com/bitnami/charts/issues/14821) + +## 12.1.14 (2023-02-02) + +* [bitnami/postgresql] Don't regenerate self-signed certs on upgrade (#14651) ([c9c6d20](https://github.com/bitnami/charts/commit/c9c6d2019c7e5f4e46622eddaa838e5983bb08d1)), closes [#14651](https://github.com/bitnami/charts/issues/14651) +* [bitnami/postgresql] Release 12.1.14 (#14717) ([02daab3](https://github.com/bitnami/charts/commit/02daab3ee027cf4271dfe16d6fa559383d4444d6)), closes [#14717](https://github.com/bitnami/charts/issues/14717) + +## 12.1.13 (2023-01-31) + +* [bitnami/*] Change copyright date (#14682) ([add4ec7](https://github.com/bitnami/charts/commit/add4ec701108ac36ed4de2dffbdf407a0d091067)), closes [#14682](https://github.com/bitnami/charts/issues/14682) +* [bitnami/postgresql] skip empty resources (#14602) ([5ee97f7](https://github.com/bitnami/charts/commit/5ee97f7cdb647606575d7f8aa0405ecad41ef48f)), closes [#14602](https://github.com/bitnami/charts/issues/14602) + +## 12.1.12 (2023-01-30) + +* [bitnami/postgresql] Release 12.1.12 (#14593) ([b55c70e](https://github.com/bitnami/charts/commit/b55c70ea72516611db13384a88142b085868584e)), closes [#14593](https://github.com/bitnami/charts/issues/14593) + +## 12.1.11 (2023-01-26) + +* [bitnami/postgresql] Release 12.1.11 (#14558) ([bab9d74](https://github.com/bitnami/charts/commit/bab9d741c5443f6dcb552a746ad7d07140d5cf55)), closes [#14558](https://github.com/bitnami/charts/issues/14558) + +## 12.1.10 (2023-01-26) + +* [bitnami/*] Add license annotation and remove obsolete engine parameter (#14293) ([da2a794](https://github.com/bitnami/charts/commit/da2a7943bae95b6e9b5b4ed972c15e990b69fdb0)), closes [#14293](https://github.com/bitnami/charts/issues/14293) +* [bitnami/*] Change licenses annotation format (#14377) ([0ab7608](https://github.com/bitnami/charts/commit/0ab760862c660fcc78cffadf8e1d8cdd70881473)), closes [#14377](https://github.com/bitnami/charts/issues/14377) +* [bitnami/*] Unify READMEs (#14472) ([2064fb8](https://github.com/bitnami/charts/commit/2064fb8dcc78a845cdede8211af8c3cc52551161)), closes [#14472](https://github.com/bitnami/charts/issues/14472) +* [bitnami/postgresql] Add note about password issue when reinstalling helm chart (#14547) ([8b8c516](https://github.com/bitnami/charts/commit/8b8c516e42712eb976463de8f9cd7146626e98b2)), closes [#14547](https://github.com/bitnami/charts/issues/14547) + +## 12.1.9 (2023-01-11) + +* [bitnami/postgresql] Release 12.1.9 (#14277) ([84b7a8a](https://github.com/bitnami/charts/commit/84b7a8ac34400d05e30d79ff91083eed4253659f)), closes [#14277](https://github.com/bitnami/charts/issues/14277) + +## 12.1.8 (2023-01-09) + +* [bitnami/postgresql] update chart version for conflict (#14240) ([9356608](https://github.com/bitnami/charts/commit/9356608e6a8aaec9adcff551b5287b08c4649ee4)), closes [#14240](https://github.com/bitnami/charts/issues/14240) +* feat(postgresql): allow auth.database to be templated (#14166) ([0a70ca9](https://github.com/bitnami/charts/commit/0a70ca94a8e0542bcf0889bb145703898b1e3734)), closes [#14166](https://github.com/bitnami/charts/issues/14166) + +## 12.1.7 (2023-01-05) + +* [bitnami/postgresql] Release 12.1.7 (#14194) ([6524f2c](https://github.com/bitnami/charts/commit/6524f2c5701b93e3f918ef433d1608339ef8b8e7)), closes [#14194](https://github.com/bitnami/charts/issues/14194) + +## 12.1.6 (2022-12-20) + +* [bitnami/postgresql] Renamed statefulset custom-metrics name to match metrics-configmap (#13953) ([1601a1b](https://github.com/bitnami/charts/commit/1601a1b831d4c45dbc285ed86c4b83ff52fbeb1f)), closes [#13953](https://github.com/bitnami/charts/issues/13953) + +## 12.1.5 (2022-12-16) + +* [bitnami/postgresql] Release 12.1.5 (#13987) ([a74a2cb](https://github.com/bitnami/charts/commit/a74a2cbaaec2dab3e9fba43b76c380c19d7b7ffd)), closes [#13987](https://github.com/bitnami/charts/issues/13987) + +## 12.1.4 (2022-12-14) + +* [bitnami/postgresql] Release 12.1.4 (#13964) ([c053dea](https://github.com/bitnami/charts/commit/c053dea48990418b5f143390ff00c540d4d80ebc)), closes [#13964](https://github.com/bitnami/charts/issues/13964) + +## 12.1.3 (2022-12-01) + +* [bitnami/postgresql] Release 12.1.3 (#13795) ([a327cfa](https://github.com/bitnami/charts/commit/a327cfaa92137e8504ffc3ecdbcbda5cc98dc997)), closes [#13795](https://github.com/bitnami/charts/issues/13795) + +## 12.1.2 (2022-11-11) + +* [bitnami/postgresql] Release 12.1.2 (#13470) ([4f6fd65](https://github.com/bitnami/charts/commit/4f6fd65db07d81f7d70c7573c7989688ae38d574)), closes [#13470](https://github.com/bitnami/charts/issues/13470) + +## 12.1.1 (2022-11-09) + +* [bitnami/postgresql] Release 12.1.1 (#13447) ([1ddbe4a](https://github.com/bitnami/charts/commit/1ddbe4a678046139e3ab3e44dba5212d12328c60)), closes [#13447](https://github.com/bitnami/charts/issues/13447) +* Update OpenShift specifc security settings (#13265) ([4ca827c](https://github.com/bitnami/charts/commit/4ca827c18c9a523eb753e223dca8e8d4e74c5226)), closes [#13265](https://github.com/bitnami/charts/issues/13265) + +## 12.1.0 (2022-11-03) + +* [bitnami/postgresql] Annotations for headless service (#13269) ([a4f111f](https://github.com/bitnami/charts/commit/a4f111f8678ad45f06eaf40d4c4e0463504f2482)), closes [#13269](https://github.com/bitnami/charts/issues/13269) + +## 12.0.1 (2022-11-01) + +* [bitnami/*] Update upgrading notes of PostgreSQL and PostgreSQL HA (#13226) ([a5a7d0e](https://github.com/bitnami/charts/commit/a5a7d0eb7592bcae2b59e63b3f13b5f1c925b536)), closes [#13226](https://github.com/bitnami/charts/issues/13226) +* [bitnami/postgresql] Release 12.0.1 (#13281) ([d839514](https://github.com/bitnami/charts/commit/d839514d4ea3072a816097493e74cf583d40e3cb)), closes [#13281](https://github.com/bitnami/charts/issues/13281) + +## 12.0.0 (2022-10-27) + +* [bitnami/postgresql] Release 12.0.0 (#13203) ([cc87b46](https://github.com/bitnami/charts/commit/cc87b46ad00d7fe06804f8c748a04e60a76361a5)), closes [#13203](https://github.com/bitnami/charts/issues/13203) + +## 11.9.13 (2022-10-26) + +* [bitnami/postgresql] Release 11.9.13 (#13168) ([c607694](https://github.com/bitnami/charts/commit/c6076945ecc47791d82e545a20ef690dd93ff662)), closes [#13168](https://github.com/bitnami/charts/issues/13168) + +## 11.9.12 (2022-10-25) + +* [bitnami/postgresql] Release 11.9.12 (#13146) ([b92ee13](https://github.com/bitnami/charts/commit/b92ee1340ec84aca8e49311ea53dee44cf1c9563)), closes [#13146](https://github.com/bitnami/charts/issues/13146) + +## 11.9.11 (2022-10-18) + +* [bitnami/postgresql] Release 11.9.11 (#13010) ([9ac77f4](https://github.com/bitnami/charts/commit/9ac77f4a3268fc56fee5dba39a0b91078d579214)), closes [#13010](https://github.com/bitnami/charts/issues/13010) + +## 11.9.10 (2022-10-17) + +* [bitnami/postgresql] Release 11.9.10 (#12993) ([e52f958](https://github.com/bitnami/charts/commit/e52f9583a965b5639fa4c6820945a9076d188e40)), closes [#12993](https://github.com/bitnami/charts/issues/12993) + +## 11.9.9 (2022-10-17) + +* [bitnami/*] Use new default branch name in links (#12943) ([a529e02](https://github.com/bitnami/charts/commit/a529e02597d49d944eba1eb0f190713293247176)), closes [#12943](https://github.com/bitnami/charts/issues/12943) +* [bitnami/postgresql] Release 11.9.9 (#12991) ([d58c9d6](https://github.com/bitnami/charts/commit/d58c9d67299088ceddab2db510826003e16694fc)), closes [#12991](https://github.com/bitnami/charts/issues/12991) + +## 11.9.8 (2022-10-07) + +* [bitnami/postgresql] Release 11.9.8 (#12837) ([d3ec8fa](https://github.com/bitnami/charts/commit/d3ec8fa952007380c6001c526b027a8bb064cbab)), closes [#12837](https://github.com/bitnami/charts/issues/12837) + +## 11.9.7 (2022-10-05) + +* [bitnami/postgresql] Update maintainers (#12818) ([8de3271](https://github.com/bitnami/charts/commit/8de3271bad9d9b8869771a37bb5f0667de01d120)), closes [#12818](https://github.com/bitnami/charts/issues/12818) +* Generic README instructions related to the repo (#12792) ([3cf6b10](https://github.com/bitnami/charts/commit/3cf6b10e10e60df4b3e191d6b99aa99a9f597755)), closes [#12792](https://github.com/bitnami/charts/issues/12792) + +## 11.9.6 (2022-10-03) + +* [bitnami/postgresql] Use plain connections from metrics sidecar (#12735) ([e07416d](https://github.com/bitnami/charts/commit/e07416d9247437744f957e279c78d797c7e11ad4)), closes [#12735](https://github.com/bitnami/charts/issues/12735) + +## 11.9.5 (2022-09-30) + +* [bitnami/postgresql] Release 11.9.5 (#12763) ([42ecc41](https://github.com/bitnami/charts/commit/42ecc41ddbed1696c253642e0606d560bb6e64f1)), closes [#12763](https://github.com/bitnami/charts/issues/12763) + +## 11.9.4 (2022-09-30) + +* [bitnami/postgresql] Release 11.9.4 (#12744) ([1fe59b8](https://github.com/bitnami/charts/commit/1fe59b85a2e68d4254e24060cdbd5e82e66d32cf)), closes [#12744](https://github.com/bitnami/charts/issues/12744) + +## 11.9.3 (2022-09-28) + +* [bitnami/postgresql] Release 11.9.3 (#12720) ([340dd2a](https://github.com/bitnami/charts/commit/340dd2a2d4171cd2ba6980f870543dbc63bf75e6)), closes [#12720](https://github.com/bitnami/charts/issues/12720) + +## 11.9.2 (2022-09-28) + +* [bitnami/postgresql] Use custom probes if given (#12548) ([99ea23d](https://github.com/bitnami/charts/commit/99ea23d43bfe872aa05d682f492b23379c96425e)), closes [#12548](https://github.com/bitnami/charts/issues/12548) [#12354](https://github.com/bitnami/charts/issues/12354) + +## 11.9.1 (2022-09-15) + +* [bitnami/postgresql] Release 11.9.1 (#12435) ([376814f](https://github.com/bitnami/charts/commit/376814f47edf504b324eb67b1e561516cd8da0f2)), closes [#12435](https://github.com/bitnami/charts/issues/12435) + +## 11.9.0 (2022-09-13) + +* [bitnami/postgresql] Add labels to volume claim template (#12353) ([7745b21](https://github.com/bitnami/charts/commit/7745b21d3ff34c01c74b3ea46639393461705b79)), closes [#12353](https://github.com/bitnami/charts/issues/12353) + +## 11.8.2 (2022-09-13) + +* [bitnami/postgresql] Release 11.8.2 (#12395) ([7dbfe5d](https://github.com/bitnami/charts/commit/7dbfe5dcdae9142ecb3be70f8716ac03a0ac2128)), closes [#12395](https://github.com/bitnami/charts/issues/12395) + +## 11.8.1 (2022-08-23) + +* [bitnami/postgresql] Update Chart.lock (#12073) ([b96782b](https://github.com/bitnami/charts/commit/b96782b1aa6256549fbb86fb1e4cb4502654c751)), closes [#12073](https://github.com/bitnami/charts/issues/12073) + +## 11.8.0 (2022-08-22) + +* [bitnami/postgresql] Add support for image digest apart from tag (#11942) ([65a637d](https://github.com/bitnami/charts/commit/65a637dbd26060b4db861fc7093b61d06a29acac)), closes [#11942](https://github.com/bitnami/charts/issues/11942) + +## 11.7.6 (2022-08-21) + +* [bitnami/postgresql] Release 11.7.6 (#11964) ([7e27b34](https://github.com/bitnami/charts/commit/7e27b348ffacbf5a99ab7c0c9df868c0fa5b6d21)), closes [#11964](https://github.com/bitnami/charts/issues/11964) + +## 11.7.5 (2022-08-20) + +* [bitnami/postgresql] Release 11.7.5 (#11868) ([bf274f7](https://github.com/bitnami/charts/commit/bf274f7dc230d87f313813f4241af7b60a95c4db)), closes [#11868](https://github.com/bitnami/charts/issues/11868) + +## 11.7.4 (2022-08-19) + +* [bitnami/postgresql] Release 11.7.4 (#11860) ([c7d6cc7](https://github.com/bitnami/charts/commit/c7d6cc718ebe974c0e64a47cfb7fb097bee69940)), closes [#11860](https://github.com/bitnami/charts/issues/11860) + +## 11.7.3 (2022-08-17) + +* [bitnami/postgresql] Release 11.7.3 (#11816) ([a3d2ec6](https://github.com/bitnami/charts/commit/a3d2ec6f971332d0b2fa98c396006f14a5966e5a)), closes [#11816](https://github.com/bitnami/charts/issues/11816) + +## 11.7.2 (2022-08-16) + +* [bitnami/postgresql] Release 11.7.2 (#11789) ([d255e13](https://github.com/bitnami/charts/commit/d255e13c728cfa9bf7a73673a690586ebea57fd2)), closes [#11789](https://github.com/bitnami/charts/issues/11789) + +## 11.7.1 (2022-08-11) + +* [bitnami/postgresql] Release 11.7.1 (#11735) ([5149dea](https://github.com/bitnami/charts/commit/5149dea3ba38dfd4ab2876619933fb1a5cd23d51)), closes [#11735](https://github.com/bitnami/charts/issues/11735) + +## 11.7.0 (2022-08-11) + +* [bitnami/postgresql] Allow custom role name for postgresql (#11626) ([110c42e](https://github.com/bitnami/charts/commit/110c42e9c140ca405f2068b89e31a732ae47dda1)), closes [#11626](https://github.com/bitnami/charts/issues/11626) + +## 11.6.26 (2022-08-09) + +* [bitnami/postgresql] Release 11.6.26 (#11662) ([5759dab](https://github.com/bitnami/charts/commit/5759dab11fd3ccebc4d9d4b10c1c4093caf7d7ef)), closes [#11662](https://github.com/bitnami/charts/issues/11662) + +## 11.6.25 (2022-08-05) + +* [bitnami/postgresql] extended configuration for read replicas (#11458) ([58137be](https://github.com/bitnami/charts/commit/58137be37febb030a08ce2cefdef4e3f49858ff4)), closes [#11458](https://github.com/bitnami/charts/issues/11458) [#11450](https://github.com/bitnami/charts/issues/11450) +* [bitnami/postgresql] replication documentation (#11421) ([4955d1d](https://github.com/bitnami/charts/commit/4955d1da56b91a686c67b2569324d7ddf9a9e77a)), closes [#11421](https://github.com/bitnami/charts/issues/11421) [#11394](https://github.com/bitnami/charts/issues/11394) + +## 11.6.24 (2022-08-04) + +* [bitnami/postgresql] Release 11.6.24 (#11585) ([44c6dd3](https://github.com/bitnami/charts/commit/44c6dd3ecff1ace208b47ecb89cd52f8e6d33f9d)), closes [#11585](https://github.com/bitnami/charts/issues/11585) + +## 11.6.23 (2022-08-04) + +* [bitnami/postgresql] extended configuration for read PVC (#11460) ([651b581](https://github.com/bitnami/charts/commit/651b5813347e670b04fe500e34818c96be1185c9)), closes [#11460](https://github.com/bitnami/charts/issues/11460) [#11449](https://github.com/bitnami/charts/issues/11449) + +## 11.6.22 (2022-08-03) + +* [bitnami/postgresql] Release 11.6.22 (#11548) ([52540e9](https://github.com/bitnami/charts/commit/52540e9eae6d5d16fa65cdfa31b34f6825e3d24c)), closes [#11548](https://github.com/bitnami/charts/issues/11548) + +## 11.6.21 (2022-08-01) + +* [bitnami/postgresql] Release 11.6.21 (#11441) ([21cc5f9](https://github.com/bitnami/charts/commit/21cc5f9ab8127da23f271f085a2e8bd916c2cc0f)), closes [#11441](https://github.com/bitnami/charts/issues/11441) + +## 11.6.20 (2022-07-30) + +* [bitnami/*] Update URLs to point to the new bitnami/containers monorepo (#11352) ([d665af0](https://github.com/bitnami/charts/commit/d665af0c708846192d8d5fb2f5f9ea65dd464ab0)), closes [#11352](https://github.com/bitnami/charts/issues/11352) +* [bitnami/postgresql] Release 11.6.20 (#11437) ([6d9e5c2](https://github.com/bitnami/charts/commit/6d9e5c2eb9834cc7e2a9553ac6b9d9bdae7995bf)), closes [#11437](https://github.com/bitnami/charts/issues/11437) + +## 11.6.19 (2022-07-24) + +* [bitnami/postgresql] Release 11.6.19 (#11323) ([9efa515](https://github.com/bitnami/charts/commit/9efa5151d7da98090c85f4ec621771434666c871)), closes [#11323](https://github.com/bitnami/charts/issues/11323) + +## 11.6.18 (2022-07-20) + +* [bitnami/postgresql] Release 11.6.18 (#11283) ([cdb4962](https://github.com/bitnami/charts/commit/cdb4962ff93a28e3aabd5e3bdc560b6e17f6a675)), closes [#11283](https://github.com/bitnami/charts/issues/11283) + +## 11.6.17 (2022-07-19) + +* [bitnami/postgresql] Release 11.6.17 (#11236) ([6de5828](https://github.com/bitnami/charts/commit/6de5828bcf59e8521739ff60b297f1d35fe99199)), closes [#11236](https://github.com/bitnami/charts/issues/11236) + +## 11.6.16 (2022-07-12) + +* [bitnami/postgresql] Release 11.6.16 (#11155) ([73e661a](https://github.com/bitnami/charts/commit/73e661a405fc092911e9a5e0fa11e77b7543be4f)), closes [#11155](https://github.com/bitnami/charts/issues/11155) + +## 11.6.15 (2022-07-06) + +* [bitnami/postgresql] Release 11.6.15 (#11065) ([c4033c8](https://github.com/bitnami/charts/commit/c4033c89bf65b75d85a263ec1c3683faacbdafde)), closes [#11065](https://github.com/bitnami/charts/issues/11065) + +## 11.6.14 (2022-07-05) + +* Fix postgresql read servicemonitor scraping metrics on primary pod (#11018) ([7ba5148](https://github.com/bitnami/charts/commit/7ba5148c8d5d4eaf542fe5277d45fff1a79bdf9d)), closes [#11018](https://github.com/bitnami/charts/issues/11018) + +## 11.6.13 (2022-07-04) + +* [bitnami/postgresql] add warning regarding setting the password (#10881) ([69de31e](https://github.com/bitnami/charts/commit/69de31ea674f606eae0e9492582007a14e0e13f2)), closes [#10881](https://github.com/bitnami/charts/issues/10881) + +## 11.6.12 (2022-06-30) + +* [bitnami/postgresql] Release 11.6.12 (#10971) ([e8f47f9](https://github.com/bitnami/charts/commit/e8f47f9832e77687a61f6c46b17b88a82bacac86)), closes [#10971](https://github.com/bitnami/charts/issues/10971) + +## 11.6.11 (2022-06-29) + +* [bitnami/postgresql] Typo (#10924) ([d379a39](https://github.com/bitnami/charts/commit/d379a39e6f09ab0f33c50c88f9ccabcbb44eac5c)), closes [#10924](https://github.com/bitnami/charts/issues/10924) + +## 11.6.10 (2022-06-25) + +* [bitnami/postgresql] Release 11.6.10 updating components versions ([2e145c8](https://github.com/bitnami/charts/commit/2e145c871000c33bcfd1106d88b867c1af29b9db)) + +## 11.6.9 (2022-06-24) + +* [bitnami/postgresql] Release 11.6.9 updating components versions ([9ce3859](https://github.com/bitnami/charts/commit/9ce3859b127e7e69a18313cc83ac4e719af28d73)) + +## 11.6.8 (2022-06-22) + +* [bitnami/postgresql] fix postgresql.replicationPasswordKey secret key logic (#10794) ([97cfeb4](https://github.com/bitnami/charts/commit/97cfeb4ad05d6f5425b5b6fd5e3c9b1ee779ec48)), closes [#10794](https://github.com/bitnami/charts/issues/10794) + +## 11.6.7 (2022-06-17) + +* [bitnami/postgresql] Release 11.6.7 updating components versions ([1012be6](https://github.com/bitnami/charts/commit/1012be6183d3a09defdb31d4d85cbaafac590dbe)) + +## 11.6.6 (2022-06-10) + +* [bitnami/postgresql] Release 11.6.6 updating components versions ([37b811c](https://github.com/bitnami/charts/commit/37b811c75cd5ae9e451fed3846f878efb1af1646)) + +## 11.6.5 (2022-06-08) + +* [bitnami/*] Replace Kubeapps URL in READMEs (and kubeapps Chart.yaml) and remove BKPR references (#1 ([c6a7914](https://github.com/bitnami/charts/commit/c6a7914361e5aea6016fb45bf4d621edfd111d32)), closes [#10600](https://github.com/bitnami/charts/issues/10600) +* [bitnami/postgresql] Fix topologySpreadConstraints default values (#10640) ([85ff7f5](https://github.com/bitnami/charts/commit/85ff7f5062a12852ddeea2359d9f61e2f6da6afd)), closes [#10640](https://github.com/bitnami/charts/issues/10640) + +## 11.6.4 (2022-06-07) + +* [bitnami/postgresql] Release 11.6.4 updating components versions ([aa2e023](https://github.com/bitnami/charts/commit/aa2e02363c04babe0527821292d9d91e9c407e16)) + +## 11.6.3 (2022-06-04) + +* [bitnami/postgresql] Release 11.6.3 updating components versions ([540669f](https://github.com/bitnami/charts/commit/540669fa16b4be8a23cdec1d854f2433f92b920f)) + +## 11.6.2 (2022-06-02) + +* [bitnami/postgresql] Ldap postgresql (#10528) ([af0ded6](https://github.com/bitnami/charts/commit/af0ded6edf41291cff72314754cba4d3afdf2fc5)), closes [#10528](https://github.com/bitnami/charts/issues/10528) + +## 11.6.1 (2022-06-01) + +* [bitnami/several] Replace maintainers email by url (#10523) ([ff3cf61](https://github.com/bitnami/charts/commit/ff3cf617a1680509b0f3855d17c4ccff7b29a0ff)), closes [#10523](https://github.com/bitnami/charts/issues/10523) + +## 11.6.0 (2022-05-31) + +* [bitnami/postgresql] LDAP standardisation (#10464) ([4bfda62](https://github.com/bitnami/charts/commit/4bfda622ef6492894cb216510658b6576050a364)), closes [#10464](https://github.com/bitnami/charts/issues/10464) + +## 11.5.2 (2022-05-30) + +* [bitnami/several] Replace base64 --decode with base64 -d (#10495) ([099286a](https://github.com/bitnami/charts/commit/099286ae7a87784cf809df0b64ab24f7ff0144c8)), closes [#10495](https://github.com/bitnami/charts/issues/10495) + +## 11.5.1 (2022-05-30) + +* [bitnami/postgresql] Fix issue with upgrade to 11.3.0 (#10452) ([38ecf5a](https://github.com/bitnami/charts/commit/38ecf5af1205a33e3bda7573a8ed90fdb17cddd7)), closes [#10452](https://github.com/bitnami/charts/issues/10452) + +## 11.5.0 (2022-05-27) + +* [bitnami/postgresql] Fix LDAP settings (#10449) ([3f94d34](https://github.com/bitnami/charts/commit/3f94d3460efef8006e86a44f6a9b892fdc292f12)), closes [#10449](https://github.com/bitnami/charts/issues/10449) + +## 11.4.0 (2022-05-26) + +* [bitnami/postgresql] Add missing service parameter (#10434) ([dae498b](https://github.com/bitnami/charts/commit/dae498ba73f2b2eb52f6ffed7dc51e7a4d5c4388)), closes [#10434](https://github.com/bitnami/charts/issues/10434) + +## 11.3.0 (2022-05-26) + +* [bitnami/postgresql] Make existing secret key names choosable (#10347) ([2c207c0](https://github.com/bitnami/charts/commit/2c207c0587d4deb73743cbe8b13629a7144964b9)), closes [#10347](https://github.com/bitnami/charts/issues/10347) + +## 11.2.6 (2022-05-21) + +* [bitnami/postgresql] Release 11.2.6 updating components versions ([7ab2181](https://github.com/bitnami/charts/commit/7ab21813ec1e5253ab49751b0ff6371c069a721d)) + +## 11.2.5 (2022-05-20) + +* [bitnami/postgresql] Release 11.2.5 updating components versions ([fbdd2c9](https://github.com/bitnami/charts/commit/fbdd2c9eaa6877468569c6244b389f5ca7033ac2)) + +## 11.2.4 (2022-05-18) + +* [bitnami/postgresql] Release 11.2.4 updating components versions ([9ae8afb](https://github.com/bitnami/charts/commit/9ae8afb635b3daf610f7bcf5374d761d8e7210bc)) + +## 11.2.3 (2022-05-16) + +* [bitnami/postgresql] Release 11.2.3 updating components versions ([8a35afa](https://github.com/bitnami/charts/commit/8a35afaf2185cf6890a6aec1a0dcbd3abfee204c)) + +## 11.2.2 (2022-05-16) + +* [bitnami/postgresql] Fix path to entrypoint.sh (#10056) ([b92c842](https://github.com/bitnami/charts/commit/b92c842d9e616c630576fb7ac2ed065a0919a62e)), closes [#10056](https://github.com/bitnami/charts/issues/10056) +* Fix error 'Error: ConfigMap in version v1 cannot be handled as a ConfigMap' (#10222) ([905260a](https://github.com/bitnami/charts/commit/905260a6f76c7a12db4f75d4da474f21ec0a0e95)), closes [#10222](https://github.com/bitnami/charts/issues/10222) + +## 11.2.1 (2022-05-13) + +* [bitnami/postgresql] Release 11.2.1 updating components versions ([8b0d74c](https://github.com/bitnami/charts/commit/8b0d74c90503332e5767bcf2dcfc16600ef89197)) + +## 11.2.0 (2022-05-13) + +* [bitnami/postgresql] Add metrics support to read replica (#9881) ([50bcacc](https://github.com/bitnami/charts/commit/50bcacc7d5c1b68ef87280a3387ad5dfe1a40285)), closes [#9881](https://github.com/bitnami/charts/issues/9881) + +## 11.1.29 (2022-05-13) + +* [bitnami/*] Remove old 'ci' files (#10171) ([5df30c4](https://github.com/bitnami/charts/commit/5df30c44dbd1812da8786579ce4a94917d46a6ad)), closes [#10171](https://github.com/bitnami/charts/issues/10171) +* [bitnami/postgresql] Release 11.1.29 updating components versions ([b42600d](https://github.com/bitnami/charts/commit/b42600d139517314f4ad2c5db89b66f9b5689373)) + +## 11.1.28 (2022-05-05) + +* [bitnami/postgresql] Release 11.1.28 updating components versions ([b955e3c](https://github.com/bitnami/charts/commit/b955e3c51f97240eace588e35d05fe7f0b437d68)) + +## 11.1.27 (2022-05-04) + +* [bitnami/postgresql] Release 11.1.27 updating components versions ([4cab988](https://github.com/bitnami/charts/commit/4cab988496de59012efd6760a3c86a50f1128b84)) + +## 11.1.26 (2022-05-02) + +* [bitnami/postgresql] Release 11.1.26 updating components versions ([35bc32d](https://github.com/bitnami/charts/commit/35bc32d88866727a75da8fb31a7c3c46e1e0b091)) + +## 11.1.25 (2022-04-26) + +* [bitnami/postgresql] Remove unnecessary quotes (#9841) ([1d2fc06](https://github.com/bitnami/charts/commit/1d2fc06106847a8e102e0c1ffb2e15acc967eb34)), closes [#9841](https://github.com/bitnami/charts/issues/9841) + +## 11.1.24 (2022-04-24) + +* [bitnami/postgresql] Release 11.1.24 updating components versions ([2fb5f5a](https://github.com/bitnami/charts/commit/2fb5f5a336aa7f4b95733765fe9f21da1dae3e0d)) + +## 11.1.23 (2022-04-22) + +* [bitnami/postgresql] Release 11.1.23 updating components versions ([8d9c25b](https://github.com/bitnami/charts/commit/8d9c25b73354573238317934e9698719a1b1e04f)) + +## 11.1.22 (2022-04-20) + +* [bitnami/postgresql] Release 11.1.22 updating components versions ([7d36205](https://github.com/bitnami/charts/commit/7d3620537e8d9febce9bb90e2b5d148a24ef999a)) + +## 11.1.21 (2022-04-19) + +* [bitnami/postgresql] Release 11.1.21 updating components versions ([634995a](https://github.com/bitnami/charts/commit/634995ace9e20015ea89521716b7f0555204e31e)) +* [bitnami/postgresql] Update README with documentation of required keys for auth secrets (#9670) ([2ffbdff](https://github.com/bitnami/charts/commit/2ffbdfffc8a09af43ddc4be3742e10b7df8719d9)), closes [#9670](https://github.com/bitnami/charts/issues/9670) + +## 11.1.20 (2022-04-16) + +* [bitnami/postgresql] Release 11.1.20 updating components versions ([f98daf3](https://github.com/bitnami/charts/commit/f98daf31566ae0feaedc02b433866645bff6ecf3)) + +## 11.1.19 (2022-04-07) + +* [bitnami/postgresql] Release 11.1.19 updating components versions ([ea7531a](https://github.com/bitnami/charts/commit/ea7531a64417d23c036f46ac14815fd3f7b13b08)) + +## 11.1.18 (2022-04-07) + +* [bitnami/postgresql] Add quote to namespace (#9691) ([515833f](https://github.com/bitnami/charts/commit/515833f739792e8cb32429f1e745cc824ac2d2a5)), closes [#9691](https://github.com/bitnami/charts/issues/9691) + +## 11.1.17 (2022-04-06) + +* [bitnami/postgresql] Release 11.1.17 updating components versions ([b933e90](https://github.com/bitnami/charts/commit/b933e9096cd8b9f7308365ee5c5cda32dc16febc)) + +## 11.1.16 (2022-04-05) + +* [bitnami/postgresql] Release 11.1.16 updating components versions ([b091550](https://github.com/bitnami/charts/commit/b0915507f92181ff47461b9fdf4fb09b2e2bc8db)) + +## 11.1.15 (2022-04-03) + +* [bitnami/postgresql] Release 11.1.15 updating components versions ([a1c6668](https://github.com/bitnami/charts/commit/a1c6668feb628ee2ca711dbf3a6c3e762953d184)) + +## 11.1.14 (2022-04-02) + +* [bitnami/postgresql] Release 11.1.14 updating components versions ([6a32408](https://github.com/bitnami/charts/commit/6a324084ddd16dcca4abcb41b1e88ab668b71360)) + +## 11.1.13 (2022-04-01) + +* Add missing quote in postgresql RBAC Role manifest (#9651) ([b87abf3](https://github.com/bitnami/charts/commit/b87abf31902fd1d47fbfec8f529628c28f7a33ca)), closes [#9651](https://github.com/bitnami/charts/issues/9651) + +## 11.1.12 (2022-03-28) + +* [bitnami/postgresql] Release 11.1.12 updating components versions ([44c70b3](https://github.com/bitnami/charts/commit/44c70b3f63b0245f898a8e0a47ba80d844ae6844)) + +## 11.1.11 (2022-03-27) + +* [bitnami/postgresql] Release 11.1.11 updating components versions ([f288cf2](https://github.com/bitnami/charts/commit/f288cf20f54457caff538bf8471e8b91d0f0ecc8)) + +## 11.1.10 (2022-03-26) + +* [bitnami/postgresql] Release 11.1.10 updating components versions ([077c6b3](https://github.com/bitnami/charts/commit/077c6b3ff633a5312042865aad46df8675a7f3fd)) + +## 11.1.9 (2022-03-18) + +* [bitnami/postgresql] Quote POSTGRESQL_INITSCRIPTS_PASSWORD (#9453) ([dcc33b4](https://github.com/bitnami/charts/commit/dcc33b44504923e31ddc37ad63416b37fb42be89)), closes [#9453](https://github.com/bitnami/charts/issues/9453) [#9445](https://github.com/bitnami/charts/issues/9445) + +## 11.1.8 (2022-03-16) + +* [bitnami/postgresql] Release 11.1.8 updating components versions ([bcfe8d0](https://github.com/bitnami/charts/commit/bcfe8d0ddcbf5ce68a0970937636fded5558076d)) + +## 11.1.7 (2022-03-14) + +* [bitnami/postgresql] Release 11.1.7 updating components versions ([027d9a0](https://github.com/bitnami/charts/commit/027d9a0d9dabc3d81606c75ab33682128a677614)) + +## 11.1.6 (2022-03-10) + +* fix missing namespace in network policies (#9369) ([d7fb427](https://github.com/bitnami/charts/commit/d7fb42751ab1a8d297151615d65b52c1d0435bb6)), closes [#9369](https://github.com/bitnami/charts/issues/9369) + +## 11.1.5 (2022-03-09) + +* [bitnami/postgresql] Release 11.1.5 updating components versions ([2e9e8bb](https://github.com/bitnami/charts/commit/2e9e8bb0651ec21975c8485c4e4bc74f356fee68)) + +## 11.1.4 (2022-03-06) + +* [bitnami/postgresql] Release 11.1.4 updating components versions ([8d9ca8b](https://github.com/bitnami/charts/commit/8d9ca8b28ed6bfa720ac67046b0fa919ecb2f6c9)) + +## 11.1.3 (2022-02-27) + +* [bitnami/postgresql] Release 11.1.3 updating components versions ([63264c9](https://github.com/bitnami/charts/commit/63264c97c4f9ae4f4628a5f3fb6078b225460731)) + +## 11.1.2 (2022-02-26) + +* [bitnami/postgresql] docs: :memo: Add note about using the container entrypoint (#9160) ([f547c0a](https://github.com/bitnami/charts/commit/f547c0a0394cd4fe64669eeb154b8ea9987bd394)), closes [#9160](https://github.com/bitnami/charts/issues/9160) +* [bitnami/postgresql] Release 11.1.2 updating components versions ([61501b4](https://github.com/bitnami/charts/commit/61501b4ecfd97ce7e7e40e82aeb2f4c7608b9ee8)) + +## 11.1.1 (2022-02-22) + +* [bitnami/postgresql] Release 11.1.1 updating components versions ([60388c2](https://github.com/bitnami/charts/commit/60388c2b2b8c15459d0437facb7b8b61d66468ab)) + +## 11.1.0 (2022-02-22) + +* Add hostIPC option for PostgreSQL StatefulSets (#9148) ([2f7d7dc](https://github.com/bitnami/charts/commit/2f7d7dce791fc810149d1bffb9fab66408d31a00)), closes [#9148](https://github.com/bitnami/charts/issues/9148) + +## 11.0.8 (2022-02-21) + +* [bitnami/postgresql] Add flag '-r' to xargs in volumePermissions init-container (#9137) ([49fcd78](https://github.com/bitnami/charts/commit/49fcd78c73f1723122a508c696983a6985129f28)), closes [#9137](https://github.com/bitnami/charts/issues/9137) +* Add hostNetwork option for PostgreSQL StatefulSets (#9064) ([a71f525](https://github.com/bitnami/charts/commit/a71f52577ec75aa76639317b9948915d7be0c7b5)), closes [#9064](https://github.com/bitnami/charts/issues/9064) + +## 11.0.7 (2022-02-21) + +* Fix Typo in README (#9031) ([b0c3bfd](https://github.com/bitnami/charts/commit/b0c3bfdf2ecd2ea00a43e7bbae649bdceed6a457)), closes [#9031](https://github.com/bitnami/charts/issues/9031) + +## 11.0.6 (2022-02-17) + +* [bitnami/postgresql] fix init-chmod-data resources value rendering (#9053) ([1b4eac8](https://github.com/bitnami/charts/commit/1b4eac8d71a917cb0016079a0760b52dc81fea3e)), closes [#9053](https://github.com/bitnami/charts/issues/9053) + +## 11.0.5 (2022-02-17) + +* [bitnami/postgresql] Allow enabling TLS without volume-permissions (#9016) ([6cb95db](https://github.com/bitnami/charts/commit/6cb95dbe1632086be534df37d0ed707108921007)), closes [#9016](https://github.com/bitnami/charts/issues/9016) + +## 11.0.4 (2022-02-14) + +* [bitnami/postgresql] Fix init scripts cm reference (#9000) ([6fd13e2](https://github.com/bitnami/charts/commit/6fd13e208b3d89006fe53b9d6a0199cce3bacff6)), closes [#9000](https://github.com/bitnami/charts/issues/9000) + +## 11.0.3 (2022-02-11) + +* Non utf8 chars (#8923) ([6ffd18f](https://github.com/bitnami/charts/commit/6ffd18fbbdf10e94ea1a90cf5b84ef610ac2a72d)), closes [#8923](https://github.com/bitnami/charts/issues/8923) +* Postgresql .Values.global.postgresql.auth.username should overwrite .Values.auth.username, (#8966) ([c75fef7](https://github.com/bitnami/charts/commit/c75fef792fbf53799c74094db0ae1f14f05bb6c7)), closes [#8966](https://github.com/bitnami/charts/issues/8966) + +## 11.0.2 (2022-02-04) + +* [bitnami/postgresql] Fix PostgreSLQ password in metrics container (#8901) ([86646ba](https://github.com/bitnami/charts/commit/86646ba72950ce27a37f279af86181e27ebb1602)), closes [#8901](https://github.com/bitnami/charts/issues/8901) + +## 11.0.1 (2022-02-03) + +* [bitnami/postgresql] Fix "postgresql.primary.extendedConfigmapName" named template (#8885) ([8dc8906](https://github.com/bitnami/charts/commit/8dc89066cfa0c09dd3c40d9c1d04af6935290e71)), closes [#8885](https://github.com/bitnami/charts/issues/8885) +* Fix typo in values.yaml ([7e84425](https://github.com/bitnami/charts/commit/7e844257efb97c38342b0609a1dfa22e4b425681)) + +## 11.0.0 (2022-02-02) + +* [bitnami/postgresql] Chart standardization (#8827) ([50946fd](https://github.com/bitnami/charts/commit/50946fdff3d90522d0b87012f8b9bb73c4b6f12c)), closes [#8827](https://github.com/bitnami/charts/issues/8827) + +## 10.16.3 (2022-02-02) + +* [bitnami/postgresql] Release 10.16.3 updating components versions ([2710bae](https://github.com/bitnami/charts/commit/2710baea1eb548209e9f97627f632987be5f5daf)) + +## 10.16.2 (2022-01-20) + +* [bitnami/*] Readme automation (#8579) ([78d1938](https://github.com/bitnami/charts/commit/78d193831c900d178198491ffd08fa2217a64ecd)), closes [#8579](https://github.com/bitnami/charts/issues/8579) +* [bitnami/*] Update READMEs (#8716) ([b9a9533](https://github.com/bitnami/charts/commit/b9a953337590eb2979453385874a267bacf50936)), closes [#8716](https://github.com/bitnami/charts/issues/8716) +* [bitnami/several] Change prerequisites (#8725) ([8d740c5](https://github.com/bitnami/charts/commit/8d740c566cfdb7e2d933c40128b4e919fce953a5)), closes [#8725](https://github.com/bitnami/charts/issues/8725) + +## 10.16.1 (2022-01-12) + +* [bitnami/postgresql]: Fix typo (#8632) ([c7ad959](https://github.com/bitnami/charts/commit/c7ad959e30d5408d6bffb1f7d910fcf9ad7bbf5c)), closes [#8632](https://github.com/bitnami/charts/issues/8632) + +## 10.16.0 (2022-01-11) + +* [bitnami/postgresql]: add snapshot recovery (#8618) ([e73f9a7](https://github.com/bitnami/charts/commit/e73f9a7fecd24cf1a3e729ae08dc84bf45a1c1b8)), closes [#8618](https://github.com/bitnami/charts/issues/8618) + +## 10.15.2 (2022-01-11) + +* [bitnami/postgresql] Release 10.15.2 updating components versions ([f5c23f6](https://github.com/bitnami/charts/commit/f5c23f6a5379f3e3932c8cdc2c93a73505b41bc9)) +* [bitnami/postgresql]: fix unique services template render (#8581) ([66f657d](https://github.com/bitnami/charts/commit/66f657dc3b707183265411e0014c823c7bd29a6a)), closes [#8581](https://github.com/bitnami/charts/issues/8581) + +## 10.15.1 (2022-01-06) + +* [bitnami/postgresql] Release 10.15.1 updating components versions ([2efb970](https://github.com/bitnami/charts/commit/2efb970db54f5beb2c3b7872b2a8120823bb94d8)) + +## 10.15.0 (2022-01-05) + +* [bitnami/several] Adapt templating format (#8562) ([8cad18a](https://github.com/bitnami/charts/commit/8cad18aed9966a6f0208e5ad6cee46cb217f47ab)), closes [#8562](https://github.com/bitnami/charts/issues/8562) + +## 10.14.4 (2022-01-04) + +* [bitnami/postgresql] Release 10.14.4 updating components versions ([ad7ac95](https://github.com/bitnami/charts/commit/ad7ac9598a7530aef274eafbd0e6215a8035d8bb)) + +## 10.14.3 (2022-01-04) + +* [bitnami/postgresql] Release 10.14.3 updating components versions ([9f7ac81](https://github.com/bitnami/charts/commit/9f7ac81da075932c057a406970154f73bbdd33cd)) +* [bitnami/several] Add license to the README ([05f7633](https://github.com/bitnami/charts/commit/05f763372501d596e57db713dd53ff4ff3027cc4)) +* [bitnami/several] Add license to the README ([32fb238](https://github.com/bitnami/charts/commit/32fb238e60a0affc6debd3142eaa3c3d9089ec2a)) +* [bitnami/several] Add license to the README ([b87c2f7](https://github.com/bitnami/charts/commit/b87c2f7899d48a8b02c506765e6ae82937e9ba3f)) + +## 10.14.2 (2021-12-31) + +* [bitnami/postgresql] Release 10.14.2 updating components versions ([4b05bb5](https://github.com/bitnami/charts/commit/4b05bb59f3f3bbd3d43cf24fee30669a1e839633)) + +## 10.14.1 (2021-12-31) + +* remove password empty validation (#8534) ([a6a4cd1](https://github.com/bitnami/charts/commit/a6a4cd17acc32cb27ba562b0b6da273e33e454db)), closes [#8534](https://github.com/bitnami/charts/issues/8534) + +## 10.14.0 (2021-12-28) + +* [bitnami/postgresql] feat: :sparkles: Allow separate container port and service port (#8506) ([9d6fbea](https://github.com/bitnami/charts/commit/9d6fbea190ce1e49a9f846485f73ca8f533d4a1e)), closes [#8506](https://github.com/bitnami/charts/issues/8506) + +## 10.13.15 (2021-12-22) + +* [bitnami/postgresql] lookup existing secrets before generating random secrets (#8320) ([00fbcf1](https://github.com/bitnami/charts/commit/00fbcf147124654d452de42235ac407830903f7e)), closes [#8320](https://github.com/bitnami/charts/issues/8320) + +## 10.13.14 (2021-12-10) + +* Render template values inside initDbScripts (#8368) ([73ae007](https://github.com/bitnami/charts/commit/73ae0077e72ed97fb3cb2d56a70cf79d3246d840)), closes [#8368](https://github.com/bitnami/charts/issues/8368) + +## 10.13.13 (2021-12-10) + +* [bitnami/postgresql] Add template render for extraVolumeMounts (#8355) ([b547831](https://github.com/bitnami/charts/commit/b547831b784a0ad6eff71113381eadcb3e3feada)), closes [#8355](https://github.com/bitnami/charts/issues/8355) + +## 10.13.12 (2021-12-09) + +* [bitnami/cassandra,etcd,influxdb,metallb,mysql,postgresql,postgresql-ha,redis] Align networkpolicy ([0404b1a](https://github.com/bitnami/charts/commit/0404b1aa52a4514eee06143a7ce85307f16af6d3)), closes [#8336](https://github.com/bitnami/charts/issues/8336) + +## 10.13.11 (2021-12-02) + +* [bitnami/*] Fix parameters for schema generation (#8297) ([d7d52ac](https://github.com/bitnami/charts/commit/d7d52acdbd1b0629e4e5295652fa6f5830daf2af)), closes [#8297](https://github.com/bitnami/charts/issues/8297) +* [bitnami/several] Regenerate README tables ([a7b2fde](https://github.com/bitnami/charts/commit/a7b2fde18677dc56ba5f88947d1356df448fb929)) + +## 10.13.10 (2021-11-30) + +* [bitnami/postgresql] Release 10.13.10 updating components versions ([197a5ba](https://github.com/bitnami/charts/commit/197a5ba6c8a24e3e55442fdeb2b0015820567887)) + +## 10.13.9 (2021-11-29) + +* [bitnami/several] Regenerate README tables ([e6f742c](https://github.com/bitnami/charts/commit/e6f742cb88c330952cb52da038db61537ec921e5)) +* [bitnami/several] Replace HTTP by HTTPS when possible (#8259) ([eafb5bd](https://github.com/bitnami/charts/commit/eafb5bd5a2cc3aaf04fc1e8ebedd73f420d76864)), closes [#8259](https://github.com/bitnami/charts/issues/8259) + +## 10.13.8 (2021-11-11) + +* [bitnami/postgresql] Release 10.13.8 updating components versions ([e732946](https://github.com/bitnami/charts/commit/e732946e9eb36b559a34b0e743b00428f787efa4)) +* [bitnami/several] Regenerate README tables ([14b89ea](https://github.com/bitnami/charts/commit/14b89eadad5eaf515b99c0392eb9461fff50f4a1)) + +## 10.13.7 (2021-11-09) + +* [bitnami/postgresql] Release 10.13.7 updating components versions ([2e175bd](https://github.com/bitnami/charts/commit/2e175bdba278bf66cc6289775bf99f1c0cbe5fd9)) +* [bitnami/several] Regenerate README tables ([94d0553](https://github.com/bitnami/charts/commit/94d0553d3c1bc1b75dfeba75860f9a89af08e1c3)) + +## 10.13.6 (2021-11-09) + +* [bitnami/postgresql] Release 10.13.6 updating components versions ([eec1fd2](https://github.com/bitnami/charts/commit/eec1fd278735575a08cec46b3d6e413600ee698a)) +* [bitnami/several] Regenerate README tables ([ef52074](https://github.com/bitnami/charts/commit/ef52074d5f3dd00218322cd201f83ee55f9dd1e6)) + +## 10.13.5 (2021-11-06) + +* [bitnami/postgresql] Release 10.13.5 updating components versions ([1829119](https://github.com/bitnami/charts/commit/1829119eceba799634b1a8fdf8ff1d204aeec6ac)) +* [bitnami/several] Regenerate README tables ([3cefed3](https://github.com/bitnami/charts/commit/3cefed3ef961fbd7596242b1165bcfa229a9cadb)) + +## 10.13.4 (2021-11-01) + +* [bitnami/postgresql] Release 10.13.4 updating components versions ([43ecac9](https://github.com/bitnami/charts/commit/43ecac9bd6181c9660dbc46d64ae4b29e1fd3fd3)) + +## 10.13.3 (2021-11-01) + +* [bitnami/postgresql] Release 10.13.3 updating components versions ([bae6820](https://github.com/bitnami/charts/commit/bae6820f1a8f66db0d4b3db41f9780d2559b5ef5)) + +## 10.13.2 (2021-10-30) + +* [bitnami/postgresql] Release 10.13.2 updating components versions ([dc5ec05](https://github.com/bitnami/charts/commit/dc5ec0562060f78a4235cacb0cc6a4836176cc1b)) + +## 10.13.1 (2021-10-29) + +* [bitnami/postgresql] Release 10.13.1 updating components versions ([b6fd8cd](https://github.com/bitnami/charts/commit/b6fd8cdd69feba13f6ab597a77ede336c71d0c6e)) + +## 10.13.0 (2021-10-28) + +* [bitnami/postgresql] add common labels (#7952) ([e2404c6](https://github.com/bitnami/charts/commit/e2404c63cc5e72d5dee91e50b4597fd9e0b1ab0c)), closes [#7952](https://github.com/bitnami/charts/issues/7952) + +## 10.12.9 (2021-10-28) + +* [bitnami/*] Mark PodSecurityPolicy resources as deprecated (#7951) ([035d926](https://github.com/bitnami/charts/commit/035d926d45526472dbf703ea285ebf491c442c8e)), closes [#7951](https://github.com/bitnami/charts/issues/7951) +* [bitnami/postgresql] Add template render for labels on primary and readreplicas (#7908) ([9a5a9f3](https://github.com/bitnami/charts/commit/9a5a9f3e1cbdf3dbe8579bd646f064dd13bca683)), closes [#7908](https://github.com/bitnami/charts/issues/7908) +* [bitnami/several] Regenerate README tables ([412cf6a](https://github.com/bitnami/charts/commit/412cf6a513cb0c03444a6e7811c6f27193239a10)) + +## 10.12.8 (2021-10-26) + +* [bitnami/postgresql] Release 10.12.8 updating components versions ([e2ce1a5](https://github.com/bitnami/charts/commit/e2ce1a5dde81b95aec31b4064ccc157a6317a53e)) + +## 10.12.7 (2021-10-22) + +* [bitnami/several] Add chart info to NOTES.txt (#7889) ([a6751cd](https://github.com/bitnami/charts/commit/a6751cdd33c461fabbc459fbea6f219ec64ab6b2)), closes [#7889](https://github.com/bitnami/charts/issues/7889) +* [bitnami/several] Regenerate README tables ([73cabea](https://github.com/bitnami/charts/commit/73cabea54a941d2239accd98e8df6cbfc9fa8d3c)) + +## 10.12.6 (2021-10-21) + +* [bitnami/postgresql] Release 10.12.6 updating components versions ([0c8b19d](https://github.com/bitnami/charts/commit/0c8b19d37f77555672d689fc661cb6a6a869b33c)) + +## 10.12.5 (2021-10-19) + +* [bitnami/several] Change pullPolicy for bitnami-shell image (#7852) ([9711a33](https://github.com/bitnami/charts/commit/9711a33c6eec72ea79143c4b7574dbe6a148d6b2)), closes [#7852](https://github.com/bitnami/charts/issues/7852) +* [bitnami/several] Regenerate README tables ([dd25873](https://github.com/bitnami/charts/commit/dd2587368d006bcca6149be74d846752a15344b9)) + +## 10.12.4 (2021-10-13) + +* [bitnami/postgresql] Release 10.12.4 updating components versions ([b30ed79](https://github.com/bitnami/charts/commit/b30ed79c67750b9d74de1fcb30ba0b51508d5035)) +* [bitnami/several] Regenerate README tables ([194a909](https://github.com/bitnami/charts/commit/194a909268377a6820d91f788c0380f427637ce6)) + +## 10.12.3 (2021-10-11) + +* [bitnami/postgresql] Release 10.12.3 updating components versions ([7671c64](https://github.com/bitnami/charts/commit/7671c64ad9e7553b5ec8ce5383e0d2c153e2692d)) + +## 10.12.2 (2021-10-05) + +* [bitnami/*] Revert changes in values.schemas.json (#7699) ([aaa314f](https://github.com/bitnami/charts/commit/aaa314fd3a7b8c7c94dc51fc96292b283cad084a)), closes [#7699](https://github.com/bitnami/charts/issues/7699) + +## 10.12.1 (2021-10-05) + +* [bitnami/postgresql] Fix README format (#7698) ([76ceb2c](https://github.com/bitnami/charts/commit/76ceb2c61edd1ba8f6531f8470a5a6ef5763b952)), closes [#7698](https://github.com/bitnami/charts/issues/7698) + +## 10.12.0 (2021-09-29) + +* [bitnami/apache,tomcat] add extraPodSpec (#7580) ([e3a8529](https://github.com/bitnami/charts/commit/e3a8529be0fb7b3269e0105f2571d3b850891aa5)), closes [#7580](https://github.com/bitnami/charts/issues/7580) + +## 10.11.0 (2021-09-27) + +* [bitnami/apache,postgresql,tomcat] add topologySpreadConstraints (#7598) ([557bfe9](https://github.com/bitnami/charts/commit/557bfe931aedaa14944c1a7805f76f83683ad448)), closes [#7598](https://github.com/bitnami/charts/issues/7598) + +## 10.10.3 (2021-09-24) + +* [bitnami/*] Generate READMEs with new generator version (#7614) ([e5ab2e6](https://github.com/bitnami/charts/commit/e5ab2e6ecdd6bce800863f154cda524ff9f6c117)), closes [#7614](https://github.com/bitnami/charts/issues/7614) +* [bitnami/postgresql, zookeeper] Modify extravolumes and integrate sidecars (#7555) ([c4c4082](https://github.com/bitnami/charts/commit/c4c408257cfad5bdfb394cb97d86ca23b02c04ec)), closes [#7555](https://github.com/bitnami/charts/issues/7555) +* [bitnami/several] Regenerate README tables ([79eac44](https://github.com/bitnami/charts/commit/79eac4490bf5d0abe582920d9662a892c9666870)) + +## 10.10.2 (2021-09-22) + +* [bitnami/postgresql] Release 10.10.2 updating components versions ([edba74c](https://github.com/bitnami/charts/commit/edba74c8eea45afef180aa513d220880d7646229)) +* [bitnami/several] Regenerate README tables ([003a0fb](https://github.com/bitnami/charts/commit/003a0fbaedeb775c546b8d8452b7a5ab0a63af52)) + +## 10.10.1 (2021-09-16) + +* Fix linting issue from PR7490 (#7506) ([ede16d7](https://github.com/bitnami/charts/commit/ede16d7ad0f6a797027eba3e2bf8a33e243c7451)), closes [#7506](https://github.com/bitnami/charts/issues/7506) + +## 10.10.0 (2021-09-16) + +* [bitnami/postgresql] add `externalTrafficPolicy` to service type `LoadBalancer` (#7490) ([553182e](https://github.com/bitnami/charts/commit/553182ee27e2a3c8eb20b1ebd641746ba1b4718f)), closes [#7490](https://github.com/bitnami/charts/issues/7490) + +## 10.9.6 (2021-09-15) + +* [bitnami/postgresql] Release 10.9.6 updating components versions ([c8142cd](https://github.com/bitnami/charts/commit/c8142cdfe0c2ff82344560572c69c894b51877ec)) +* [bitnami/several] Regenerate README tables ([c01cbe5](https://github.com/bitnami/charts/commit/c01cbe5e3bfe8a5f8545107f9c8d99a58d0e6832)) + +## 10.9.5 (2021-09-07) + +* [bitnami/postgresql] Release 10.9.5 updating components versions ([94b8fdc](https://github.com/bitnami/charts/commit/94b8fdceddb2eb89e7321c650b67bcb7e44bf31e)) +* [bitnami/several] Regenerate README tables ([da2513b](https://github.com/bitnami/charts/commit/da2513bf0a33819f3b1151d387c631a9ffdb03e2)) + +## 10.9.4 (2021-08-25) + +* [bitnami/postgresql] Release 10.9.4 updating components versions ([7cbc202](https://github.com/bitnami/charts/commit/7cbc202ea0e6be502fc3694aa9877c0ae5acef69)) +* [bitnami/several] Regenerate README tables ([6c9124f](https://github.com/bitnami/charts/commit/6c9124f79491aa65f53a87c1ed598b47ffa8b411)) + +## 10.9.3 (2021-08-18) + +* [multiple] Updated image.tag section (#7257) ([a133bed](https://github.com/bitnami/charts/commit/a133bed2b4524e3b0cdec19413e089e4fbb12013)), closes [#7257](https://github.com/bitnami/charts/issues/7257) + +## 10.9.2 (2021-08-12) + +* [bitnami/postgresql] Release 10.9.2 updating components versions ([c0cf478](https://github.com/bitnami/charts/commit/c0cf4780b0c7105bcc434cf8434c37f46aa79368)) +* [bitnami/several] Regenerate README tables ([6c107e8](https://github.com/bitnami/charts/commit/6c107e835d6caf8db2e8b17dcd48c5971637e013)) + +## 10.9.1 (2021-08-04) + +* [bitnami/postgresql] Release 10.9.1 updating components versions ([95fa5ae](https://github.com/bitnami/charts/commit/95fa5aecd4b9563ceffb4e360ff9ac317f7b3957)) + +## 10.9.0 (2021-08-02) + +* [bitnami/postgresql] Add relabelings / metricRelabelings to ServiceMonitor (#7082) ([481cc7e](https://github.com/bitnami/charts/commit/481cc7edf7b3f1fe9f1c6ccd8c83ee38fe72423a)), closes [#7082](https://github.com/bitnami/charts/issues/7082) +* [bitnami/several] Add diagnostic mode (#7012) ([f1344b0](https://github.com/bitnami/charts/commit/f1344b0361c5a93bf971d08f0fc64d3c8588cbf9)), closes [#7012](https://github.com/bitnami/charts/issues/7012) +* [bitnami/several] Upadte READMEs ([eb3c291](https://github.com/bitnami/charts/commit/eb3c2916be233280f2226d9cdceb57b08ab4a23b)) + +## 10.8.0 (2021-07-27) + +* [bitnami/postgresql] Add lifecycleHooks value to the postgresql chart (#7055) ([e631584](https://github.com/bitnami/charts/commit/e631584fe4bdb86682c758055935ff54960ea362)), closes [#7055](https://github.com/bitnami/charts/issues/7055) + +## 10.7.1 (2021-07-23) + +* [bitnami/postgresql] Change postgresqlExtendedConf default value from string to object (#7038) ([c55ff60](https://github.com/bitnami/charts/commit/c55ff60edaa98c170afa3c4d13cf766c42b4b27f)), closes [#7038](https://github.com/bitnami/charts/issues/7038) + +## 10.7.0 (2021-07-21) + +* [bitnami/postgresql] Add option to create services for each read replica (#6990) ([3d76ba7](https://github.com/bitnami/charts/commit/3d76ba751a693961a1054ffcecfa1ebe24e63927)), closes [#6990](https://github.com/bitnami/charts/issues/6990) [bitnami/charts#6954](https://github.com/bitnami/charts/issues/6954) + +## 10.6.1 (2021-07-20) + +* [bitnami/several] Fix default values and regenerate README (II) (#6994) ([d095793](https://github.com/bitnami/charts/commit/d0957937c764187307b924f600247c2b7afaf536)), closes [#6994](https://github.com/bitnami/charts/issues/6994) + +## 10.6.0 (2021-07-19) + +* [bitnami/postgresql] disable automounting of service account token (#6967) ([3a60437](https://github.com/bitnami/charts/commit/3a6043706e2a2bf0cd4101aac2b84392a221a910)), closes [#6967](https://github.com/bitnami/charts/issues/6967) + +## 10.5.3 (2021-07-14) + +* [bitnami/*] Adapt values.yaml of phpMyAdmin, PostgreSQL and PostgreSQL HA charts (#6933) ([49f0bed](https://github.com/bitnami/charts/commit/49f0bed317d6ed15dd2115327d74565ec6344b87)), closes [#6933](https://github.com/bitnami/charts/issues/6933) + +## 10.5.2 (2021-07-06) + +* [bitnami/postgresql] Release 10.5.2 updating components versions ([d7e126c](https://github.com/bitnami/charts/commit/d7e126c4531a880a1cbc69e408c02ef5774ed127)) + +## 10.5.1 (2021-06-29) + +* [bitnami/postgresql] Release 10.5.1 updating components versions ([859c5bf](https://github.com/bitnami/charts/commit/859c5bfbf1895d13604b12af9bd31f1190316b95)) + +## 10.5.0 (2021-06-14) + +* [bitnami/postgresql] Add support for autogenerated certs (#6609) ([112db1c](https://github.com/bitnami/charts/commit/112db1c509fcd74623fd8f25c61c660a5918564d)), closes [#6609](https://github.com/bitnami/charts/issues/6609) + +## 10.4.10 (2021-06-09) + +* [bitnami/postgresql] Release 10.4.10 updating components versions ([8671e25](https://github.com/bitnami/charts/commit/8671e25bde8a63aa8b940fa582a1d8bc7fc0a69c)) + +## 10.4.9 (2021-06-03) + +* [bitnami/postgresql] Release 10.4.9 updating components versions ([36ab336](https://github.com/bitnami/charts/commit/36ab336cfd41c5c9e240c9b0d4a762e805dacdbf)) + +## 10.4.8 (2021-05-27) + +* [bitnami/postgresql] Release 10.4.8 updating components versions ([bd13ba8](https://github.com/bitnami/charts/commit/bd13ba8ae4be246afe91fe20271fc870309cbd39)) + +## 10.4.7 (2021-05-25) + +* [bitnami/postgresql] Release 10.4.7 updating components versions ([86aeb2c](https://github.com/bitnami/charts/commit/86aeb2c8991b3d38d01ec8463c15d44140ba48d2)) + +## 10.4.6 (2021-05-19) + +* [bitnami/postgresql] Release 10.4.6 updating components versions ([14c777e](https://github.com/bitnami/charts/commit/14c777ec1cb990b73236584fb81f502fc6e7fc11)) + +## 10.4.5 (2021-05-14) + +* [bitnami/postgresql] Release 10.4.5 updating components versions ([091d4c9](https://github.com/bitnami/charts/commit/091d4c927a0cfa2d24a79096c0ec92165d348661)) + +## 10.4.4 (2021-05-14) + +* [bitnami/postgresql] Release 10.4.4 updating components versions ([ff6296d](https://github.com/bitnami/charts/commit/ff6296dd46149df3e8fe9373f8a827ee56ba4b8b)) + +## 10.4.3 (2021-05-07) + +* [bitnami/postgresql] Release 10.4.3 updating components versions ([03f8228](https://github.com/bitnami/charts/commit/03f82282ab4e85218b91773601f53b10643c6740)) + +## 10.4.2 (2021-05-04) + +* [bitnami/postgresql] Release 10.4.2 updating components versions ([b23c573](https://github.com/bitnami/charts/commit/b23c573bf9ae0a486378dbb96b6b0b0ac6765588)) + +## 10.4.1 (2021-05-02) + +* [bitnami/postgresql] Release 10.4.1 updating components versions ([157448a](https://github.com/bitnami/charts/commit/157448a146eacd26af48ace16142c5b13626f258)) + +## 10.4.0 (2021-04-29) + +* [bitnami/postgresql] SHM: remove size limit on the emptyDir. (#6232) ([1dbd2a2](https://github.com/bitnami/charts/commit/1dbd2a203831610986e4998f34e8149cc069bf9b)), closes [#6232](https://github.com/bitnami/charts/issues/6232) + +## 10.3.18 (2021-04-20) + +* [bitnami/postgresql] Release 10.3.18 updating components versions ([31a3bef](https://github.com/bitnami/charts/commit/31a3beff085d30c227bfce42b015446fc723dc3b)) + +## 10.3.17 (2021-04-11) + +* [bitnami/postgresql] Release 10.3.17 updating components versions ([4c72712](https://github.com/bitnami/charts/commit/4c72712f8d0c79ca3b573c87b993bfe80fc99b01)) + +## 10.3.16 (2021-04-09) + +* [bitnami/postgresql] Release 10.3.16 updating components versions ([0c80da7](https://github.com/bitnami/charts/commit/0c80da716f6bc1d8f849429fc79302d71bb70e93)) + +## 10.3.15 (2021-04-03) + +* [bitnami/postgresql] Fix postgresql.conf generation from values (#5865) ([c572e0b](https://github.com/bitnami/charts/commit/c572e0be84818e5949b8ab4f17839fb2c5b77818)), closes [#5865](https://github.com/bitnami/charts/issues/5865) +* [bitnami/postgresql] Release 10.3.15 updating components versions ([4085304](https://github.com/bitnami/charts/commit/4085304b25c78ac2d715a58245aa13be598915ac)) + +## 10.3.14 (2021-03-30) + +* [bitnami/postgresql] Release 10.3.14 updating components versions ([40075c7](https://github.com/bitnami/charts/commit/40075c7cee5651b2b845386e42cd2306ae625294)) + +## 10.3.13 (2021-03-12) + +* [bitnami/postgresql] Release 10.3.13 updating components versions ([0391090](https://github.com/bitnami/charts/commit/0391090fe16c1c9b80300bd5c24c76b52bcfc169)) + +## 10.3.12 (2021-03-11) + +* [bitnami/postgresql] Release 10.3.12 updating components versions ([daa0007](https://github.com/bitnami/charts/commit/daa0007ab28793e26cf52ca031a219d3eb0a27ad)) + +## 10.3.11 (2021-03-05) + +* [bitnami/postgresql] Release 10.3.11 updating components versions ([cb37a0e](https://github.com/bitnami/charts/commit/cb37a0ec21dc56a32fb7929b1a793a5047e4dc9c)) + +## 10.3.10 (2021-03-04) + +* [bitnami/*] Remove minideb mentions (#5677) ([870bc4d](https://github.com/bitnami/charts/commit/870bc4dba1fc3aa55dd157da6687b25e8d352206)), closes [#5677](https://github.com/bitnami/charts/issues/5677) + +## 10.3.9 (2021-03-04) + +* [bitnami/postgresql] Release 10.3.9 updating components versions ([99d7551](https://github.com/bitnami/charts/commit/99d7551caf71404931f5a2f56632d4ed98556528)) + +## 10.3.8 (2021-03-03) + +* [bitnami/postgresql] Don't put postgresql-postgres-password in secret when not needed (#5635) ([db08f68](https://github.com/bitnami/charts/commit/db08f68c1b39bb5cad3175ca99d9629c8d257541)), closes [#5635](https://github.com/bitnami/charts/issues/5635) [#4380](https://github.com/bitnami/charts/issues/4380) + +## 10.3.7 (2021-02-26) + +* [bitnami/postgresql] Release 10.3.7 updating components versions ([a69d08a](https://github.com/bitnami/charts/commit/a69d08a310d84d0fd7a2987147061f21aaf3a383)) + +## 10.3.6 (2021-02-24) + +* [bitnami/postgresql] Release 10.3.6 updating components versions ([078cc97](https://github.com/bitnami/charts/commit/078cc977304997a848e51cbc0b71140047e43dae)) + +## 10.3.5 (2021-02-22) + +* [bitnami/*] Use common macro to define RBAC apiVersion (#5585) ([71fb99f](https://github.com/bitnami/charts/commit/71fb99f541e971b1daafaa20ffb7d18b153b8d60)), closes [#5585](https://github.com/bitnami/charts/issues/5585) + +## 10.3.4 (2021-02-20) + +* [bitnami/postgresql] Release 10.3.4 updating components versions ([02d06a0](https://github.com/bitnami/charts/commit/02d06a07cd14368661fde88eecf54670c13860ae)) + +## 10.3.3 (2021-02-19) + +* [bitnami/postgresql] Release 10.3.3 updating components versions ([b10f2aa](https://github.com/bitnami/charts/commit/b10f2aa22c5bc495644a9ee33d61c43f08ffec41)) + +## 10.3.2 (2021-02-15) + +* add template postgresql.name (#5489) ([a334a13](https://github.com/bitnami/charts/commit/a334a133ba60a3536d33b2de1ecc3df466be07f4)), closes [#5489](https://github.com/bitnami/charts/issues/5489) + +## 10.3.1 (2021-02-11) + +* [bitnami/postgresql] Release 10.3.1 updating components versions ([c2bb81e](https://github.com/bitnami/charts/commit/c2bb81e86ad47c19c817f6c3d1102fd8e1712ac0)) +* Fix typo "sed" => "used" (#5461) ([4373a9a](https://github.com/bitnami/charts/commit/4373a9a42a16885b0057027055ba218d3519f92b)), closes [#5461](https://github.com/bitnami/charts/issues/5461) + +## 10.3.0 (2021-02-11) + +* [bitnami/*] Add notice regarding parameters immutability after chart installation (#4853) ([5f09573](https://github.com/bitnami/charts/commit/5f095734f92555dec7cd0e3ee961f315eac170ff)), closes [#4853](https://github.com/bitnami/charts/issues/4853) +* [bitnami/postgresql] add optional startup probe to postgresql (#5445) ([bc9ad41](https://github.com/bitnami/charts/commit/bc9ad41dfc5cf864c2f3d90a206c54c4268f0311)), closes [#5445](https://github.com/bitnami/charts/issues/5445) + +## 10.2.8 (2021-02-08) + +* [bitnami/postgresql] Release 10.2.8 updating components versions ([bc4c881](https://github.com/bitnami/charts/commit/bc4c881832c1bc4554bd50eac71c19653a77755b)) + +## 10.2.7 (2021-02-04) + +* [bitnami/postgresql] Release 10.2.7 updating components versions ([4383712](https://github.com/bitnami/charts/commit/43837127490b64aebde833fcc9f32854c0280195)) + +## 10.2.6 (2021-01-29) + +* [bitnami/Postgresql] Add explicit namespace field on resources (#5333) ([fc694c5](https://github.com/bitnami/charts/commit/fc694c50956582881cf176c1b9bbd733257d51b1)), closes [#5333](https://github.com/bitnami/charts/issues/5333) + +## 10.2.5 (2021-01-25) + +* [bitnami/*] Unify icons in Chart.yaml and add missing fields (#5206) ([0462921](https://github.com/bitnami/charts/commit/0462921418ca8d54308b7466197a6d53ffae4628)), closes [#5206](https://github.com/bitnami/charts/issues/5206) + +## 10.2.4 (2021-01-22) + +* [bitnami/postgresql] Fix value KeepalivesCount typo (#5171) ([09249d3](https://github.com/bitnami/charts/commit/09249d3ebf1ca5cd469c1a4e6bc638b0bd972669)), closes [#5171](https://github.com/bitnami/charts/issues/5171) + +## 10.2.3 (2021-01-19) + +* [bitnami/*] Change helm version in the prerequisites (#5090) ([c5e67a3](https://github.com/bitnami/charts/commit/c5e67a388743cbee28439d2cabca27884b9daf97)), closes [#5090](https://github.com/bitnami/charts/issues/5090) +* [bitnami/postgresql] Drop values-production.yaml support (#5125) ([131711c](https://github.com/bitnami/charts/commit/131711cfbe51c6f5e5458bcf48d6016580fa45c1)), closes [#5125](https://github.com/bitnami/charts/issues/5125) + +## 10.2.2 (2021-01-12) + +* [bitnami/postgresql] Release 10.2.2 updating components versions ([49f9f9f](https://github.com/bitnami/charts/commit/49f9f9f8599b9538eb6e10b6b094a33147ef5400)) +* Clarify sharedBuffers example in postgresql README (#4883) ([38c8044](https://github.com/bitnami/charts/commit/38c8044cbb9d0f018dbc387ea5a5c1db767fe5b6)), closes [#4883](https://github.com/bitnami/charts/issues/4883) + +## 10.2.1 (2021-01-04) + +* [bitnami/postgresql] Release 10.2.1 updating components versions ([ed749c0](https://github.com/bitnami/charts/commit/ed749c08894dd3bb76c3465a9e2c0d331c8f878d)) +* Fix REAMDE (#4816) ([2fe0b09](https://github.com/bitnami/charts/commit/2fe0b09089575626076f3c576107e4e647c5cdc5)), closes [#4816](https://github.com/bitnami/charts/issues/4816) +* Fixes some spacing in README.md (#4742) ([2c96f0c](https://github.com/bitnami/charts/commit/2c96f0c948ea540805c73d1c546962bbb332b41b)), closes [#4742](https://github.com/bitnami/charts/issues/4742) + +## 10.2.0 (2020-12-14) + +* [bitnami/*] Affinity based on common presets (vii) (#4701) ([52a2c99](https://github.com/bitnami/charts/commit/52a2c99a89018659f18b774585bb10954625a215)), closes [#4701](https://github.com/bitnami/charts/issues/4701) +* [bitnami/*] fix typos (#4699) ([49adc63](https://github.com/bitnami/charts/commit/49adc63b672da976c55af2e077aa5648a357b77f)), closes [#4699](https://github.com/bitnami/charts/issues/4699) + +## 10.1.4 (2020-12-11) + +* [bitnami/*] Update dependencies (#4694) ([2826c12](https://github.com/bitnami/charts/commit/2826c125b42505f28431301e3c1bbe5366e47a01)), closes [#4694](https://github.com/bitnami/charts/issues/4694) + +## 10.1.3 (2020-12-07) + +* [bitnami/postgresql] Release 10.1.3 updating components versions ([94676b3](https://github.com/bitnami/charts/commit/94676b392f4e69bde9035c96813b46c94519edcd)) + +## 10.1.2 (2020-12-04) + +* [bitnami/*] Add upgrade details to README (#4480) ([10bd8e1](https://github.com/bitnami/charts/commit/10bd8e1fbbe69461a5d90ba61562f72b526c9caf)), closes [#4480](https://github.com/bitnami/charts/issues/4480) +* [bitnami/postgresql] Release 10.1.2 updating components versions ([494e84e](https://github.com/bitnami/charts/commit/494e84ed462576b56b403c46895fdad0f7c49f3e)) + +## 10.1.1 (2020-11-25) + +* [bitnami/postgresql] `postgresql-postgres-password` doesn't work with `global.postgresqlUsername` an ([e0c026c](https://github.com/bitnami/charts/commit/e0c026c74b1efa60fa7b142be5e877e5b200c869)), closes [#3130](https://github.com/bitnami/charts/issues/3130) [#4380](https://github.com/bitnami/charts/issues/4380) [#3130](https://github.com/bitnami/charts/issues/3130) [#3130](https://github.com/bitnami/charts/issues/3130) + +## 10.1.0 (2020-11-20) + +* [bitnami/postgresql] Implement persistence selector (#4437) ([e383a6e](https://github.com/bitnami/charts/commit/e383a6e3286c6202f3a09618fb5584b69a8ee98d)), closes [#4437](https://github.com/bitnami/charts/issues/4437) + +## 10.0.2 (2020-11-18) + +* [bitnami/postgresql] Fix typo in values.yaml (#4399) ([cf49c8a](https://github.com/bitnami/charts/commit/cf49c8a184ef299e2b6b4587c2d6982a0c0aa9f3)), closes [#4399](https://github.com/bitnami/charts/issues/4399) +* Update README.md ([2006fdf](https://github.com/bitnami/charts/commit/2006fdf85007818b571f59271751b0b8ac2dab9c)) + +## 10.0.1 (2020-11-17) + +* [bitnami/postgresql] Release 10.0.1 updating components versions ([323a092](https://github.com/bitnami/charts/commit/323a092de78916e92cf3350439388f9efd5907b9)) + +## 10.0.0 (2020-11-17) + +* [bitnami/postgresql] Adapt to Helm v3 and change nomenclature (#4385) ([7eabc85](https://github.com/bitnami/charts/commit/7eabc85fd4fae43127228a22829c7ce3fe85c389)), closes [#4385](https://github.com/bitnami/charts/issues/4385) + +### Breaking change + +* removal of Master/Slave +* Some additional clean up post merge of terms +* [bitnami/postgresql] Major version. Adapt Chart to apiVersion: v2 +* Update Chart.yaml +* Delete empty section from README +Co-authored-by: W. Kavanaugh Latiolais +Co-authored-by: Carlos Rodríguez Hernández + +## 9.8.13 (2020-11-14) + +* [bitnami/postgresql] Release 9.8.13 updating components versions ([fd890aa](https://github.com/bitnami/charts/commit/fd890aad247b7ad54b4c2c29534c3d8565b0b7cf)) + +## 9.8.12 (2020-11-12) + +* [bitnami/postgresql] Release 9.8.12 updating components versions ([a13c592](https://github.com/bitnami/charts/commit/a13c592efc0a33ba2339668d5b262fa27d50754f)) + +## 9.8.11 (2020-11-04) + +* [bitnami/postgresql] fix: update values to avoid warnings (#4212) ([2eec409](https://github.com/bitnami/charts/commit/2eec409666ce1f855442931618386ab01bc6825e)), closes [#4212](https://github.com/bitnami/charts/issues/4212) + +## 9.8.10 (2020-11-04) + +* [bitnami/postgresql] Release 9.8.10 updating components versions ([3c992aa](https://github.com/bitnami/charts/commit/3c992aa1e4c7fb43d9cead2f35c69fe6cb4fbee0)) + +## 9.8.9 (2020-10-30) + +* [bitnami/postgresql] Fix secret logic for passwords (#4123) ([ea13243](https://github.com/bitnami/charts/commit/ea13243ea6c7f714573f3b3699851c8a648b964d)), closes [#4123](https://github.com/bitnami/charts/issues/4123) + +## 9.8.8 (2020-10-30) + +* [bitnami/*] Extra manifests should be top-level (#4161) ([b3a95b7](https://github.com/bitnami/charts/commit/b3a95b701b611ab51924ae5665bcc8cd5ac56898)), closes [#4161](https://github.com/bitnami/charts/issues/4161) +* [bitnami/*] Include link to Troubleshootin guide on README.md (#4136) ([c08a20e](https://github.com/bitnami/charts/commit/c08a20e3db004215383004ff023a73fcc2522e72)), closes [#4136](https://github.com/bitnami/charts/issues/4136) + +## 9.8.7 (2020-10-27) + +* [bitnami/postgresql] Fix slave.extraInitContainers value (#4124) ([a92fbbe](https://github.com/bitnami/charts/commit/a92fbbe145af870c421fb58b7d592453a215f075)), closes [#4124](https://github.com/bitnami/charts/issues/4124) + +## 9.8.6 (2020-10-23) + +* [bitnami/postgresql] Fix extraDeploy, customLivenessProbe and customReadinessProbe values (#4090) ([05eae06](https://github.com/bitnami/charts/commit/05eae0696de0032b2a8de103240044deec556367)), closes [#4090](https://github.com/bitnami/charts/issues/4090) + +## 9.8.5 (2020-10-22) + +* [bitnami/postgresql] Permit init-container start with root user. (#4072) ([6b8c191](https://github.com/bitnami/charts/commit/6b8c1910bf5ee28af62733a66f9940c518ff5599)), closes [#4072](https://github.com/bitnami/charts/issues/4072) + +## 9.8.4 (2020-10-13) + +* [bitnami/postgresql] Added `publishNotReadyAddresses: true` to svc-headless.yaml (#3990) ([46039b3](https://github.com/bitnami/charts/commit/46039b39746bbcb6703210e7d0a911fb00349403)), closes [#3990](https://github.com/bitnami/charts/issues/3990) + +## 9.8.3 (2020-10-08) + +* [bitnami/postgresql] Allow exporter port in network-policy if metrics enabled (#3944) ([b5c34a1](https://github.com/bitnami/charts/commit/b5c34a1ed8e223ddb2ce5cd8fb7a0a0a02a9bf11)), closes [#3944](https://github.com/bitnami/charts/issues/3944) + +## 9.8.2 (2020-10-06) + +* [bitnami/postgresql] Release 9.8.2 updating components versions ([64cb5fd](https://github.com/bitnami/charts/commit/64cb5fd8d5b6ca66e1e9e16e0463af4a1ace65c6)) + +## 9.8.1 (2020-09-29) + +* [bitnami/postgresql] Release 9.8.1 updating components versions ([cc9375d](https://github.com/bitnami/charts/commit/cc9375d7ff64a2e39504bd27aecc7c5ce86171dd)) + +## 9.8.0 (2020-09-29) + +* [bitnami/postgresql] Allow specifying different resource requests/limits on slaves (#3800) ([204d41d](https://github.com/bitnami/charts/commit/204d41df2b0afca494b7cc88bbcb5ba82c0772a8)), closes [#3800](https://github.com/bitnami/charts/issues/3800) + +## 9.7.4 (2020-09-29) + +* [bitnami/postgresql] Revert #3768 due to being a breaking change (#3808) ([a933a38](https://github.com/bitnami/charts/commit/a933a38ec1c6fe5e3d019037e1bc7a33566774de)), closes [#3768](https://github.com/bitnami/charts/issues/3768) [#3808](https://github.com/bitnami/charts/issues/3808) [#3768](https://github.com/bitnami/charts/issues/3768) + +## 9.7.3 (2020-09-25) + +* [bitnami/postgresql] Added labels for volumeClaimTemplates (#3768) ([03f324b](https://github.com/bitnami/charts/commit/03f324b9f565f779bb1519c1562c9a0cca546bc1)), closes [#3768](https://github.com/bitnami/charts/issues/3768) + +## 9.7.2 (2020-09-24) + +* [bitnami/postgresql] Release 9.7.2 updating components versions ([c45bc6f](https://github.com/bitnami/charts/commit/c45bc6fb26f348fd0a0530c13e4d9fb6d4ac0cc8)) +* [bitnami/postgresql] Use common functions for tplValues (#3730) ([af4ae62](https://github.com/bitnami/charts/commit/af4ae62ab7f8d0ce1c0380cdd86a0933265c1de0)), closes [#3730](https://github.com/bitnami/charts/issues/3730) + +## 9.7.1 (2020-09-23) + +* [bitnami/chart] postgre #3722: In exsistingSecret: Switched password keys (#3744) ([1517668](https://github.com/bitnami/charts/commit/15176687345d93632a1e16753b0cd2fb52c35868)), closes [#3722](https://github.com/bitnami/charts/issues/3722) [#3744](https://github.com/bitnami/charts/issues/3744) + +## 9.7.0 (2020-09-21) + +* [bitnami/postgresql] Add customLivenessProbe and customReadinessProbe (#3728) ([a729b97](https://github.com/bitnami/charts/commit/a729b97926033bb3efabd7094d7daf4af2f0caea)), closes [#3728](https://github.com/bitnami/charts/issues/3728) + +## 9.6.0 (2020-09-18) + +* [bitnami/postgresql] Add improvements to comply with STIG (#3712) ([f193e43](https://github.com/bitnami/charts/commit/f193e43f1e78ab3a161aacbda57cb329ff2b2d2e)), closes [#3712](https://github.com/bitnami/charts/issues/3712) + +## 9.5.0 (2020-09-17) + +* [bitnami/postgresql] Add arbitrary securityContext configuration to improve security (#3687) ([49a39d6](https://github.com/bitnami/charts/commit/49a39d6c6a051cfc13f92ee01980e25925b98207)), closes [#3687](https://github.com/bitnami/charts/issues/3687) + +## 9.4.1 (2020-09-08) + +* [bitnami/metrics-server] Add source repo (#3577) ([1ed12f9](https://github.com/bitnami/charts/commit/1ed12f96af75322b46afdb2b3d9907c11b13f765)), closes [#3577](https://github.com/bitnami/charts/issues/3577) +* [bitnami/postgresql] Release 9.4.1 updating components versions ([730e66f](https://github.com/bitnami/charts/commit/730e66f789ad7b05c856bbbab623bd4867c39c28)) + +## 9.4.0 (2020-09-02) + +* [bitnami/postgresql] - Add PostgreSQL cross cluster replication ability (#3574) ([b481f63](https://github.com/bitnami/charts/commit/b481f633efc8c879eacaf2b31b4136719f58baf1)), closes [#3574](https://github.com/bitnami/charts/issues/3574) + +## 9.3.4 (2020-09-01) + +* [bitnami/postgres] Add chown on .Values.persistence.mountPath (#3348) ([e7c2b1d](https://github.com/bitnami/charts/commit/e7c2b1d6238613de9d8e3c65863a2fb1b726db30)), closes [#3348](https://github.com/bitnami/charts/issues/3348) + +## 9.3.3 (2020-08-27) + +* [bitnami/postgresql] Fix slave' statefulset when persistence is disabled (#3527) ([3910de7](https://github.com/bitnami/charts/commit/3910de7325317b752e1c2e46456fbdaa765cb50b)), closes [#3527](https://github.com/bitnami/charts/issues/3527) + +## 9.3.2 (2020-08-18) + +* [bitnami/postgresql] Release 9.3.2 updating components versions ([4f8c352](https://github.com/bitnami/charts/commit/4f8c352b05cd73315d859563d496c13f9a636a3c)) + +## 9.3.1 (2020-08-18) + +* [bitnami/postgresql] Fix Postgres password with externalSecret (#3408) ([e64df12](https://github.com/bitnami/charts/commit/e64df12d1fdce559915900c1699f0ea6fbe51cf1)), closes [#3408](https://github.com/bitnami/charts/issues/3408) + +## 9.3.0 (2020-08-18) + +* [bitnami/postgresql] feat: add new value to enabled slave persistence (#3438) ([b27b99d](https://github.com/bitnami/charts/commit/b27b99d1f605720e14ac1daac429f42d84266cca)), closes [#3438](https://github.com/bitnami/charts/issues/3438) + +## 9.2.1 (2020-08-14) + +* [bitnami/postgresql] Release 9.2.1 updating components versions ([61e3273](https://github.com/bitnami/charts/commit/61e3273b0e0c1b69c32ae3080d209ecadeb4704b)) + +## 9.2.0 (2020-08-13) + +* [bitnami/*] Use common helps for upgrade password errors (#3335) ([079f5bd](https://github.com/bitnami/charts/commit/079f5bd6ec59bb058216d6a931449b895517c789)), closes [#3335](https://github.com/bitnami/charts/issues/3335) + +## 9.1.4 (2020-08-06) + +* [bitnami/postgresql] Release 9.1.4 updating components versions ([47b3f22](https://github.com/bitnami/charts/commit/47b3f22873a2e622442ae7962d19a07b74b5de91)) + +## 9.1.3 (2020-08-05) + +* [bitnami/*] Fix TL;DR typo in READMEs (#3280) ([3d7ab40](https://github.com/bitnami/charts/commit/3d7ab406fecd64f1af25f53e7d27f03ec95b29a4)), closes [#3280](https://github.com/bitnami/charts/issues/3280) +* [bitnami/postgresql] Add upgrade notes for 9.X.X (#3322) ([c093a61](https://github.com/bitnami/charts/commit/c093a61d8c9052aa8709c2172047768e41a1816d)), closes [#3322](https://github.com/bitnami/charts/issues/3322) +* [bitnami/postgresql] Release 9.1.3 updating components versions ([ffb6263](https://github.com/bitnami/charts/commit/ffb62639f26467adea44db70ca5d87f950079b00)) + +## 9.1.2 (2020-07-29) + +* [bitnami/postgresql] Release 9.1.2 updating components versions ([0f4eab3](https://github.com/bitnami/charts/commit/0f4eab37927f187cafee8cff85f23df250bdd9bf)) + +## 9.1.1 (2020-07-15) + +* [bitnami/postgresql] Release 9.1.1 updating components versions ([92ad3e7](https://github.com/bitnami/charts/commit/92ad3e746e1ff844c7e6fdd688ad08d13aeeb88a)) + +## 9.1.0 (2020-07-14) + +* [bitnami/postgresql] Postgresql TLS Support (#3057) ([6c855ff](https://github.com/bitnami/charts/commit/6c855ffb409f36c114f8ee680e10a130efc55906)), closes [#3057](https://github.com/bitnami/charts/issues/3057) + +## 9.0.0 (2020-07-14) + +* [bitnami/all] Add categories (#3075) ([63bde06](https://github.com/bitnami/charts/commit/63bde066b87a140fab52264d0522401ab3d63509)), closes [#3075](https://github.com/bitnami/charts/issues/3075) +* [bitnami/postgresql] Helm label best practices (#3021) ([693e765](https://github.com/bitnami/charts/commit/693e7656d1d204789f4b7dcf8b76bb13908a6d95)), closes [#3021](https://github.com/bitnami/charts/issues/3021) + +## 8.10.14 (2020-07-07) + +* [bitnami/postgresql] Release 8.10.14 updating components versions ([18f8014](https://github.com/bitnami/charts/commit/18f80142d0eb5783d8cbe38010bdc10ec9b3c77d)) + +## 8.10.13 (2020-07-02) + +* [bitnami/postgresql] Release 8.10.13 updating components versions ([8d6dcd5](https://github.com/bitnami/charts/commit/8d6dcd5cbd43c1cc8f338df14cbe2dc6da7c456d)) + +## 8.10.12 (2020-07-02) + +* [bitnami/postgresql] Fix typo on README.md (#2999) ([0d46f5d](https://github.com/bitnami/charts/commit/0d46f5d893e9f4b7cc358247de8b8ffd92c1815a)), closes [#2999](https://github.com/bitnami/charts/issues/2999) + +## 8.10.11 (2020-06-29) + +* [bitnami/postgresql] Release 8.10.11 updating components versions ([5c5bcf9](https://github.com/bitnami/charts/commit/5c5bcf9b5e05e3184d7db0a7c2d7ee8a8d81b091)) + +## 8.10.10 (2020-06-26) + +* [bitnami/postgresql] Release 8.10.10 updating components versions ([cbde80c](https://github.com/bitnami/charts/commit/cbde80c9146aedacbced192e51d702867965c3df)) + +## 8.10.9 (2020-06-26) + +* [bitnami/postgresql] Update readme with delete PVC details (#2926) ([d133baf](https://github.com/bitnami/charts/commit/d133baf1eee5a12518d8b1bf35c3ed1461d1cd47)), closes [#2926](https://github.com/bitnami/charts/issues/2926) + +## 8.10.8 (2020-06-24) + +* [bitnami/postgresql] Release 8.10.8 updating components versions ([a36d455](https://github.com/bitnami/charts/commit/a36d4559153e37acede590ec6d4edf82088714f2)) + +## 8.10.7 (2020-06-23) + +* Master StatefulSet annotations fix (#2899) ([abc14b5](https://github.com/bitnami/charts/commit/abc14b569ad564ff871b7a949a6e5d9857f51c7d)), closes [#2899](https://github.com/bitnami/charts/issues/2899) + +## 8.10.6 (2020-06-19) + +* [bitnami/postgresql] Release 8.10.6 updating components versions ([f9cb010](https://github.com/bitnami/charts/commit/f9cb0102f1e03d9ee7f09dbb65e9d7cdc25f84fe)) +* [bitnami/several] Add instructions about how to use different branches (#2785) ([c315cb0](https://github.com/bitnami/charts/commit/c315cb078a4cef97ff53cf2066b34add3f2926ba)), closes [#2785](https://github.com/bitnami/charts/issues/2785) +* [multiple charts] Update hidden properties in the different JSON schemas (#2871) ([4cff6ba](https://github.com/bitnami/charts/commit/4cff6ba8b0013b6dc368a1e7986c393e8447e75b)), closes [#2871](https://github.com/bitnami/charts/issues/2871) + +## 8.10.5 (2020-06-03) + +* [bitnami/postgresql] Release 8.10.5 updating components versions ([dac5aab](https://github.com/bitnami/charts/commit/dac5aab0c3fda86f54d43011a6b4df045c774406)) + +## 8.10.4 (2020-05-29) + +* [bitnami/postgresql] update readme regarding postgres username and password (#2661) ([1ca7dd4](https://github.com/bitnami/charts/commit/1ca7dd4cd044e13596a61e4b755d64c6579031e3)), closes [#2661](https://github.com/bitnami/charts/issues/2661) + +## 8.10.3 (2020-05-28) + +* [bitnami/postgresql] Fix extraInitContainers usage (#2689) ([56b036c](https://github.com/bitnami/charts/commit/56b036c389918d59ee046c5470aef3115043884d)), closes [#2689](https://github.com/bitnami/charts/issues/2689) + +## 8.10.2 (2020-05-27) + +* [bitnami/postgresql] Release 8.10.2 updating components versions ([b476dcd](https://github.com/bitnami/charts/commit/b476dcdb0c36e3f4add4e9056598c52f2ae54366)) + +## 8.10.1 (2020-05-26) + +* [bitnami/postgresql] Fix customMetrics example (#2552) ([97038a4](https://github.com/bitnami/charts/commit/97038a44b71dbc59b676d2c298275f4d5ce5d614)), closes [#2552](https://github.com/bitnami/charts/issues/2552) +* [bitnami/postgresql] fixed a typo in values files (#2649) ([98fb584](https://github.com/bitnami/charts/commit/98fb5841594bb1cc081d2b86de97bf36fd445e12)), closes [#2649](https://github.com/bitnami/charts/issues/2649) [#2649](https://github.com/bitnami/charts/issues/2649) + +## 8.10.0 (2020-05-21) + +* [bitnami/postgresql] Support all metrics env vars (#2620) ([0351483](https://github.com/bitnami/charts/commit/035148374bc9ed4df64cad0d5536fba14082caa1)), closes [#2620](https://github.com/bitnami/charts/issues/2620) + +## 8.9.9 (2020-05-21) + +* [bitnami/postgresql] Release 8.9.9 updating components versions ([90a6422](https://github.com/bitnami/charts/commit/90a6422006aee423dd765a27b2640b082d4648af)) +* update bitnami/common to be compatible with helm v2.12+ (#2615) ([c7751eb](https://github.com/bitnami/charts/commit/c7751eb5764e468e1854b58a1b8491d2b13e0a4a)), closes [#2615](https://github.com/bitnami/charts/issues/2615) + +## 8.9.8 (2020-05-18) + +* [bitnami/postgresql] Release 8.9.8 updating components versions ([33517f8](https://github.com/bitnami/charts/commit/33517f8cdd410b46a17d18810d79fdcfd7998ac7)) + +## 8.9.7 (2020-05-14) + +* [bitnami/postgresql] Release 8.9.7 updating components versions ([a78d819](https://github.com/bitnami/charts/commit/a78d81910a07a95bfd217c835afc0cf6f8b45842)) + +## 8.9.6 (2020-05-08) + +* [bitnami/postgresql] Release 8.9.6 updating components versions ([5888685](https://github.com/bitnami/charts/commit/588868581ccd4cfcbf988b15a37dc475625859ac)) + +## 8.9.5 (2020-05-08) + +* [bitnami/postgresql] Release 8.9.5 updating components versions ([3cfdf68](https://github.com/bitnami/charts/commit/3cfdf688400451e6b5b7b4e26d2368f0630f8a18)) + +## 8.9.4 (2020-05-01) + +* [bitnami/postgresql] Release 8.9.4 updating components versions ([09ba156](https://github.com/bitnami/charts/commit/09ba1564fed3df4f1d94518edcb58aab1f75c827)) + +## 8.9.3 (2020-04-28) + +* [bitnami/postgresql] Fix conf.d permissions with postgresqlextendedConf (#2383) ([d88de83](https://github.com/bitnami/charts/commit/d88de83e04f7dd3a1d1c99df54208439d9cc7913)), closes [#2383](https://github.com/bitnami/charts/issues/2383) +* [bitnami/postgresql] Release 8.9.3 updating components versions ([21f231d](https://github.com/bitnami/charts/commit/21f231dde5d27f6d4a5c554975a1da23c79e5dd6)) +* Update README.md ([3fa18e5](https://github.com/bitnami/charts/commit/3fa18e51e06028fe7e9d4d4298348993fb86a327)) + +## 8.9.2 (2020-04-23) + +* [bitnami/postgresql] Fix pod labels in master statefulservice (#2392) ([67e1008](https://github.com/bitnami/charts/commit/67e100899cd2bbad2c43d8aeede3129f853b71d9)), closes [#2392](https://github.com/bitnami/charts/issues/2392) + +## 8.9.1 (2020-04-22) + +* [bitnami/postgresql] Release 8.9.1 updating components versions ([3bec415](https://github.com/bitnami/charts/commit/3bec415f3b35b303e9dff4f0c634d164c2e55eb3)) + +## 8.9.0 (2020-04-20) + +* [bitnami/postgresql] Add option to add annotations to all generated resources (#2368) ([1765929](https://github.com/bitnami/charts/commit/1765929fa8cf37819309ff975ebf0a8dfcf7824d)), closes [#2368](https://github.com/bitnami/charts/issues/2368) + +## 8.8.0 (2020-04-17) + +* [bitnami/postgresql] Add PSP, Role and RoleBinding to chart (#2313) ([c60c746](https://github.com/bitnami/charts/commit/c60c74667980efe54672e4bbfd97bf5b081dde21)), closes [#2313](https://github.com/bitnami/charts/issues/2313) + +## 8.7.4 (2020-04-15) + +* [bitnami/postgresql] Release 8.7.4 updating components versions ([734e060](https://github.com/bitnami/charts/commit/734e060a346febea516fd815624b7dd852963e23)) + +## 8.7.3 (2020-04-09) + +* [bitnami/postgresql] Avoid using 'deepCopy' since it's not supported in Helm old versions (#2275) ([d128498](https://github.com/bitnami/charts/commit/d12849859960468f274290a3af10a57e6262754d)), closes [#2275](https://github.com/bitnami/charts/issues/2275) + +## 8.7.2 (2020-04-07) + +* [bitnami/postgresql] Fix svc-read.yaml error (#2241) ([25de34c](https://github.com/bitnami/charts/commit/25de34c95a3ba0c88ead7af9f4609f0c3f8cfc10)), closes [#2241](https://github.com/bitnami/charts/issues/2241) + +## 8.7.1 (2020-04-06) + +* [bitnami/postgresql] Release 8.7.1 updating components versions ([102f747](https://github.com/bitnami/charts/commit/102f747100ad8c789bd828937739738e5b9f355c)) + +## 8.7.0 (2020-04-06) + +* [bitnami/postgresql] fix replication with nodePort service type #2063 (#2192) ([fa546fc](https://github.com/bitnami/charts/commit/fa546fc21cde9a349b3729935265f59229af32e6)), closes [#2063](https://github.com/bitnami/charts/issues/2063) [#2192](https://github.com/bitnami/charts/issues/2192) + +## 8.6.13 (2020-04-03) + +* [bitnami/postgresql] Tpl usage in existing secret (#2211) ([27bf542](https://github.com/bitnami/charts/commit/27bf542764c9186195c117aa21d297f2d9bd85e7)), closes [#2211](https://github.com/bitnami/charts/issues/2211) + +## 8.6.12 (2020-03-31) + +* [bitnami/postgresql] Release 8.6.12 updating components versions ([1d9296f](https://github.com/bitnami/charts/commit/1d9296fe56cbccea315e4f39b529bfb7d2250ded)) + +## 8.6.11 (2020-03-30) + +* [bitnami/postgresql] Fix conf permissions with postgresql.extendedConf (#2141) ([8fce43b](https://github.com/bitnami/charts/commit/8fce43be843d06ffe1bd79471aa3a93c7ac6f0be)), closes [#2141](https://github.com/bitnami/charts/issues/2141) + +## 8.6.10 (2020-03-26) + +* [bitnami/postgresql] Release 8.6.10 updating components versions ([3306f53](https://github.com/bitnami/charts/commit/3306f535514a7476087a891b632c7047275f75cc)) + +## 8.6.9 (2020-03-23) + +* [bitnami/postgresql] Fix loadBalancerSourceRanges in svc-read (#2117) ([429df27](https://github.com/bitnami/charts/commit/429df27997fe2916f90463cbaa97484a7f5d7968)), closes [#2117](https://github.com/bitnami/charts/issues/2117) + +## 8.6.8 (2020-03-20) + +* [bitnami/postgresql] Release 8.6.8 updating components versions ([590c6b0](https://github.com/bitnami/charts/commit/590c6b0f4e07161614453b12efe71f22e0c00a46)) + +## 8.6.7 (2020-03-20) + +* [bitnami/postgresql] Update README.md + yamllint (#2097) ([0587893](https://github.com/bitnami/charts/commit/0587893a5b71805158f340b0134c2540ff90a4b6)), closes [#2097](https://github.com/bitnami/charts/issues/2097) + +## 8.6.6 (2020-03-20) + +* [bitnami/postgresql]fix credetials for initdbScripts (#2083) ([dc4a34b](https://github.com/bitnami/charts/commit/dc4a34bae5a3e04082799591b510e8cf635329b1)), closes [#2083](https://github.com/bitnami/charts/issues/2083) + +## 8.6.5 (2020-03-18) + +* [bitnami/postgresql] Evaluate extraEnvVarsCM as a template (#2059) ([730ef6c](https://github.com/bitnami/charts/commit/730ef6c3099c13cb88d3a1b2b66161a62cb02715)), closes [#2059](https://github.com/bitnami/charts/issues/2059) + +## 8.6.4 (2020-03-11) + +* [bitnami/postgresql] Release 8.6.4 updating components versions ([a4df45b](https://github.com/bitnami/charts/commit/a4df45b81a9d0a7862f043765bc13bc875bdad96)) + +## 8.6.3 (2020-03-11) + +* Move charts from upstreamed folder to bitnami (#2032) ([a0e44f7](https://github.com/bitnami/charts/commit/a0e44f7d6a10b8b5643186130ea420887cb72c7c)), closes [#2032](https://github.com/bitnami/charts/issues/2032) +* Remove PostgreSQL chart from Bitnami ([5e80f54](https://github.com/bitnami/charts/commit/5e80f54d4e0dc48d2e88e4d0edfc7a6e63af5fbb)) + +## 3.1.1 (2018-10-17) + +* Apply some suggestions ([24706a6](https://github.com/bitnami/charts/commit/24706a6163b75700c705f3021bb37790f95423c9)) +* Bump versions ([0cfd3f4](https://github.com/bitnami/charts/commit/0cfd3f421533a532c90438afa287bf46aa10413e)) +* Change logic to determine registry ([9ead294](https://github.com/bitnami/charts/commit/9ead294d5705f2646e8d3b70e14129d23c07bf8a)) +* Check if global is set ([dec26e5](https://github.com/bitnami/charts/commit/dec26e5d0b982905dde2a55fdf2285a7781a64cc)) +* Fix typo ([93170ac](https://github.com/bitnami/charts/commit/93170acc16e842e55aff7b7d944f7fbe025eee91)) +* Remove distro tags in charts ([427ac51](https://github.com/bitnami/charts/commit/427ac51cdf4de70f786563e1971a5d491d32ad54)) +* Reword and update kafka dependencies ([be6cbed](https://github.com/bitnami/charts/commit/be6cbedd27cea4c5c0e30ce70c9790c27ca1a0ec)) + +## 3.1.0 (2018-10-11) + +* Add global registry option to Bitnami charts ([395ba08](https://github.com/bitnami/charts/commit/395ba08e2bc14ef28a0cae1fada97ed6cf2e777d)) +* Bump chart version ([4010d13](https://github.com/bitnami/charts/commit/4010d13f5fb69c191e34fbfcbe3a6f57e3486236)) +* Change name truncation to 63 instead of 24 ([e42a923](https://github.com/bitnami/charts/commit/e42a9233eb18139d09d9f5fb0a010a10a29c4a1b)) + +## 3.0.2 (2018-10-05) + +* Add ) ([728466a](https://github.com/bitnami/charts/commit/728466ac178560c67f2ede913140f50dc5136fd3)) +* Add kubeapps text to charts READMEs ([2f6dc51](https://github.com/bitnami/charts/commit/2f6dc51ce6307d57bd8c20e929da23dd2adf22d5)) +* Fix go template inside go template ([a140313](https://github.com/bitnami/charts/commit/a140313f4910d1366170415f0300729c22eda073)) + +## 3.0.1 (2018-09-27) + +* Improve getting LoadBalancer address in Bitnami charts NOTES.txt ([a641728](https://github.com/bitnami/charts/commit/a64172812af8b11fac23be2fe7a66b1edb14c71f)) + +## 3.0.0 (2018-09-21) + +* [bitnami/postgresql] Fix chart not being upgradable ([65a1e5e](https://github.com/bitnami/charts/commit/65a1e5eaa7040c37ff4ad5dff28a3bb4ca216ff9)) + +## 2.1.3 (2018-08-13) + +* postgresql: bump chart appVersion to `10.5.0` ([7d98698](https://github.com/bitnami/charts/commit/7d986988626d57d5f91b9c4cb983a2cedf7b1071)) +* postgresql: bump chart version to `2.1.3` ([3192d7c](https://github.com/bitnami/charts/commit/3192d7c54e6b1f689d3f5bcfa61cb2428812f955)) +* postgresql: update to `10.5.0-debian-9` ([422a538](https://github.com/bitnami/charts/commit/422a53866afbeaf6f23eaca6dab1a5df8518e0dd)) + +## 2.1.2 (2018-08-06) + +* Improve notes to access deployed services ([0071eb5](https://github.com/bitnami/charts/commit/0071eb5545f7774eeab9ea335c660df644ad3e4c)) + +## 2.1.1 (2018-07-30) + +* Add missing release and charts labels in pods ([dfd13a2](https://github.com/bitnami/charts/commit/dfd13a2b76b83f558d9dbb1d942c66ecaa93c221)) + +## 2.1.0 (2018-07-27) + +* Allow using custom scripts to initialize PostgreSQL ([b92ea0d](https://github.com/bitnami/charts/commit/b92ea0d2c9075c79184d7658de12bc4ead0d96fc)) + +## 2.0.1 (2018-07-26) + +* Add documentation for custom postgresql.conf files ([58800b3](https://github.com/bitnami/charts/commit/58800b381eab45136afbc945c24fe38b2a7b1cca)) +* Update chart version. Use the main tag for the image ([2b0272b](https://github.com/bitnami/charts/commit/2b0272b9bbd519fc9764b9000b74d0c337b6f3d6)) + +## 2.0.0 (2018-07-25) + +* [Postgresql] add non-root support ([130f090](https://github.com/bitnami/charts/commit/130f0904b9bca9766de65a9b8ebffa18a03a14f2)) + +## 1.0.5 (2018-07-23) + +* Use env var instead of showing the password for the cli ([0125d8b](https://github.com/bitnami/charts/commit/0125d8b36749147835dfcf0686e6ec690540364e)) + +## 1.0.4 (2018-07-23) + +* Fix svc type for values-production.yaml ([24cd97d](https://github.com/bitnami/charts/commit/24cd97d1949348a6f32599135ccea26762989a37)) +* Fix svc type for values-production.yaml ([29abeb2](https://github.com/bitnami/charts/commit/29abeb22b95d0f81bfc906fea90fa02d4e516e70)) + +## 1.0.3 (2018-07-06) + +* postgresql: bump chart appVersion to `10.4.0-debian-9` ([4a13616](https://github.com/bitnami/charts/commit/4a136162d73841cfbcfa4405dc9223100d4eaa0d)) +* postgresql: bump chart version to `1.0.3` ([a3b1015](https://github.com/bitnami/charts/commit/a3b1015a483f2074382dc862fe6604d4b22b3408)) +* postgresql: update to `10.4.0-debian-9` ([80b8bf4](https://github.com/bitnami/charts/commit/80b8bf4f6067856dbae4632041d0b0422293dd8b)) + +## 1.0.2 (2018-06-07) + +* Fix capitalization of clusterIP parameter ([2d0656f](https://github.com/bitnami/charts/commit/2d0656f6ab19a4819fea68bae1a2710ee96e1807)) +* Fix consul, mysql and postgre helm chart testing issue using tag ([6f37eb7](https://github.com/bitnami/charts/commit/6f37eb71b1b7168517f0bb9d64252bd57548a4fc)) + +## 1.0.1 (2018-06-04) + +* Apply Juan comments ([7425941](https://github.com/bitnami/charts/commit/74259415261cd15cf6e2bde6d5ef7eb6e0d4d43b)) +* Delete unnecessaty file ([fbafc63](https://github.com/bitnami/charts/commit/fbafc631e35851b5cbad2d050df361a0790fb764)) +* Fix ES helm chart testing issue using tag ([657025b](https://github.com/bitnami/charts/commit/657025be216d5cccf4b46e225bcc0a45e9f0e9e1)) + +## 1.0.0 (2018-05-29) + +* Support replication for PostgreSQL chart ([7527ab5](https://github.com/bitnami/charts/commit/7527ab5b4c1c2af5ac219c4fb4a5c7dbf61dd63f)) + +## 0.4.25 (2018-05-15) + +* postgresql: bump chart appVersion to `10.4.0` ([70178ef](https://github.com/bitnami/charts/commit/70178efd2ca8becdb3b05371eccada273690a0bb)) +* postgresql: bump chart version to `0.4.25` ([7f48795](https://github.com/bitnami/charts/commit/7f48795b1d96a24f4a1e8617b9bae841b3b0d177)) +* postgresql: update to `10.4.0` ([590549a](https://github.com/bitnami/charts/commit/590549a15f8e676fc348313f4a11308029e6ab43)) + +## 0.4.24 (2018-04-13) + +* Documentation fixes ([fdbcc57](https://github.com/bitnami/charts/commit/fdbcc57a95af97bfa63c873432f7dc070c37f8c3)) + +## 0.4.23 (2018-04-13) + +* Rename charts folders ([5413120](https://github.com/bitnami/charts/commit/5413120bb281c0c531ed2cf431cb316dc356e977)) diff --git a/charts/postgresql/Chart.lock b/charts/postgresql/Chart.lock new file mode 100644 index 0000000..68e3e3e --- /dev/null +++ b/charts/postgresql/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: common + repository: oci://registry-1.docker.io/bitnamicharts + version: 2.30.0 +digest: sha256:46afdf79eae69065904d430f03f7e5b79a148afed20aa45ee83ba88adc036169 +generated: "2025-02-20T02:43:09.054508088Z" diff --git a/charts/postgresql/Chart.yaml b/charts/postgresql/Chart.yaml new file mode 100644 index 0000000..bf6c156 --- /dev/null +++ b/charts/postgresql/Chart.yaml @@ -0,0 +1,39 @@ +# Copyright Broadcom, Inc. All Rights Reserved. +# SPDX-License-Identifier: APACHE-2.0 + +annotations: + tanzuCategory: service + category: Database + licenses: Apache-2.0 + images: | + - name: os-shell + image: docker.io/bitnami/os-shell:12-debian-12-r39 + - name: postgres-exporter + image: docker.io/bitnami/postgres-exporter:0.17.1-debian-12-r0 + - name: postgresql + image: docker.io/bitnami/postgresql:17.4.0-debian-12-r4 +apiVersion: v2 +appVersion: 17.4.0 +dependencies: +- name: common + repository: oci://registry-1.docker.io/bitnamicharts + tags: + - bitnami-common + version: 2.x.x +description: PostgreSQL (Postgres) is an open source object-relational database known for reliability and data integrity. ACID-compliant, it supports foreign keys, joins, views, triggers and stored procedures. +home: https://bitnami.com +icon: https://dyltqmyl993wv.cloudfront.net/assets/stacks/postgresql/img/postgresql-stack-220x234.png +keywords: +- postgresql +- postgres +- database +- sql +- replication +- cluster +maintainers: +- name: Broadcom, Inc. All Rights Reserved. + url: https://github.com/bitnami/charts +name: postgresql +sources: +- https://github.com/bitnami/charts/tree/main/bitnami/postgresql +version: 16.5.0 diff --git a/charts/postgresql/README.md b/charts/postgresql/README.md new file mode 100644 index 0000000..bd6b8d6 --- /dev/null +++ b/charts/postgresql/README.md @@ -0,0 +1,1140 @@ + + +# Bitnami package for PostgreSQL + +PostgreSQL (Postgres) is an open source object-relational database known for reliability and data integrity. ACID-compliant, it supports foreign keys, joins, views, triggers and stored procedures. + +[Overview of PostgreSQL](http://www.postgresql.org) + +Trademarks: This software listing is packaged by Bitnami. The respective trademarks mentioned in the offering are owned by the respective companies, and use of them does not imply any affiliation or endorsement. + +## TL;DR + +```console +helm install my-release oci://registry-1.docker.io/bitnamicharts/postgresql +``` + +Looking to use PostgreSQL in production? Try [VMware Tanzu Application Catalog](https://bitnami.com/enterprise), the commercial edition of the Bitnami catalog. + +## Introduction + +This chart bootstraps a [PostgreSQL](https://github.com/bitnami/containers/tree/main/bitnami/postgresql) deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +For HA, please see [this repo](https://github.com/bitnami/charts/tree/main/bitnami/postgresql-ha) + +Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters. + +## Prerequisites + +- Kubernetes 1.23+ +- Helm 3.8.0+ +- PV provisioner support in the underlying infrastructure + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +helm install my-release oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql +``` + +> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. + +The command deploys PostgreSQL on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation. + +> **Tip**: List all releases using `helm list` + +## Configuration and installation details + +### Resource requests and limits + +Bitnami charts allow setting resource requests and limits for all containers inside the chart deployment. These are inside the `resources` value (check parameter table). Setting requests is essential for production workloads and these should be adapted to your specific use case. + +To make this process easier, the chart contains the `resourcesPreset` values, which automatically sets the `resources` section according to different presets. Check these presets in [the bitnami/common chart](https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15). However, in production workloads using `resourcesPreset` is discouraged as it may not fully adapt to your specific needs. Find more information on container resource management in the [official Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/). + +### Prometheus metrics + +This chart can be integrated with Prometheus by setting `metrics.enabled` to `true`. This will deploy a sidecar container with [postgres_exporter](https://github.com/prometheus-community/postgres_exporter) in all pods. It will also create `metrics` services that can be configured under the `metrics.service` section. These services will be have the necessary annotations to be automatically scraped by Prometheus. + +#### Prometheus requirements + +It is necessary to have a working installation of Prometheus or Prometheus Operator for the integration to work. Install the [Bitnami Prometheus helm chart](https://github.com/bitnami/charts/tree/main/bitnami/prometheus) or the [Bitnami Kube Prometheus helm chart](https://github.com/bitnami/charts/tree/main/bitnami/kube-prometheus) to easily have a working Prometheus in your cluster. + +#### Integration with Prometheus Operator + +The chart can deploy `ServiceMonitor` objects for integration with Prometheus Operator installations. To do so, set the value `metrics.serviceMonitor.enabled=true`. Ensure that the Prometheus Operator `CustomResourceDefinitions` are installed in the cluster or it will fail with the following error: + +```text +no matches for kind "ServiceMonitor" in version "monitoring.coreos.com/v1" +``` + +Install the [Bitnami Kube Prometheus helm chart](https://github.com/bitnami/charts/tree/main/bitnami/kube-prometheus) for having the necessary CRDs and the Prometheus Operator. + +### [Rolling VS Immutable tags](https://techdocs.broadcom.com/us/en/vmware-tanzu/application-catalog/tanzu-application-catalog/services/tac-doc/apps-tutorials-understand-rolling-tags-containers-index.html) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + +### Customizing primary and read replica services in a replicated configuration + +At the top level, there is a service object which defines the services for both primary and readReplicas. For deeper customization, there are service objects for both the primary and read types individually. This allows you to override the values in the top level service object so that the primary and read can be of different service types and with different clusterIPs / nodePorts. Also in the case you want the primary and read to be of type nodePort, you will need to set the nodePorts to different values to prevent a collision. The values that are deeper in the primary.service or readReplicas.service objects will take precedence over the top level service object. + +### Use a different PostgreSQL version + +To modify the application version used in this chart, specify a different version of the image using the `image.tag` parameter and/or a different repository using the `image.repository` parameter. + +### LDAP + +LDAP support can be enabled in the chart by specifying the `ldap.` parameters while creating a release. The following parameters should be configured to properly enable the LDAP support in the chart. + +- **ldap.enabled**: Enable LDAP support. Defaults to `false`. +- **ldap.uri**: LDAP URL beginning in the form `ldap[s]://:`. No defaults. +- **ldap.base**: LDAP base DN. No defaults. +- **ldap.binddn**: LDAP bind DN. No defaults. +- **ldap.bindpw**: LDAP bind password. No defaults. +- **ldap.bslookup**: LDAP base lookup. No defaults. +- **ldap.nss_initgroups_ignoreusers**: LDAP ignored users. `root,nslcd`. +- **ldap.scope**: LDAP search scope. No defaults. +- **ldap.tls_reqcert**: LDAP TLS check on server certificates. No defaults. + +For example: + +```text +ldap.enabled="true" +ldap.uri="ldap://my_ldap_server" +ldap.base="dc=example\,dc=org" +ldap.binddn="cn=admin\,dc=example\,dc=org" +ldap.bindpw="admin" +ldap.bslookup="ou=group-ok\,dc=example\,dc=org" +ldap.nss_initgroups_ignoreusers="root\,nslcd" +ldap.scope="sub" +ldap.tls_reqcert="demand" +``` + +Next, login to the PostgreSQL server using the `psql` client and add the PAM authenticated LDAP users. + +> Note: Parameters including commas must be escaped as shown in the above example. + +### Update credentials + +Bitnami charts, with its default settings, configure credentials at first boot. Any further change in the secrets or credentials can be done using one of the following methods: + +### Manual update of the passwords and secrets + +- Update the user password following [the upstream documentation](https://www.postgresql.org/docs/current/sql-alteruser.html) +- Update the password secret with the new values (replace the SECRET_NAME, PASSWORD and POSTGRES_PASSWORD placeholders) + +```shell +kubectl create secret generic SECRET_NAME --from-literal=password=PASSWORD --from-literal=postgres-password=POSTGRES_PASSWORD --dry-run -o yaml | kubectl apply -f - +``` + +### Automated update using a password update job + +The Bitnami PostgreSQL provides a password update job that will automatically change the PostgreSQL passwords when running helm upgrade. To enable the job set `passwordUpdateJob.enabled=true`. This job requires: + +- The new passwords: this is configured using either `auth.postgresPassword`, `auth.password` and `auth.replicationPassword` (if applicable) or setting `auth.existingSecret`. +- The previous passwords: This value is taken automatically from already deployed secret object. If you are using `auth.existingSecret` or `helm template` instead of `helm upgrade`, then set either `passwordUpdate.job.previousPasswords.postgresPassword`, `passwordUpdate.job.previousPasswords.password`, `passwordUpdate.job.previousPasswords.replicationPassword` (when applicable), or setting `passwordUpdateJob,previousPasswords.existingSecret`. + +In the following example we update the password via values.yaml in a PostgreSQL installation with replication + +```yaml +architecture: "replication" + +auth: + user: "user" + postgresPassword: "newPostgresPassword123" + password: "newUserPassword123" + replicationPassword: "newReplicationPassword123" + +passwordUpdateJob: + enabled: true +``` + +In this example we use two existing secrets (`new-password-secret` and `previous-password-secret`) to update the passwords: + +```yaml +auth: + existingSecret: new-password-secret + +passwordUpdateJob: + enabled: true + previousPasswords: + existingSecret: previous-password-secret +``` + +You can add extra update commands using the `passwordUpdateJob.extraCommands` value. + +### postgresql.conf / pg_hba.conf files as configMap + +This helm chart also supports to customize the PostgreSQL configuration file. You can add additional PostgreSQL configuration parameters using the `primary.extendedConfiguration`/`readReplicas.extendedConfiguration` parameters as a string. Alternatively, to replace the entire default configuration use `primary.configuration`. + +You can also add a custom pg_hba.conf using the `primary.pgHbaConfiguration` parameter. + +In addition to these options, you can also set an external ConfigMap with all the configuration files. This is done by setting the `primary.existingConfigmap` parameter. Note that this will override the two previous options. + +### Initialize a fresh instance + +The [Bitnami PostgreSQL](https://github.com/bitnami/containers/tree/main/bitnami/postgresql) image allows you to use your custom scripts to initialize a fresh instance. In order to execute the scripts, you can specify custom scripts using the `primary.initdb.scripts` parameter as a string. + +In addition, you can also set an external ConfigMap with all the initialization scripts. This is done by setting the `primary.initdb.scriptsConfigMap` parameter. Note that this will override the two previous options. If your initialization scripts contain sensitive information such as credentials or passwords, you can use the `primary.initdb.scriptsSecret` parameter. + +The allowed extensions are `.sh`, `.sql` and `.sql.gz`. + +### Securing traffic using TLS + +TLS support can be enabled in the chart by specifying the `tls.` parameters while creating a release. The following parameters should be configured to properly enable the TLS support in the chart: + +- `tls.enabled`: Enable TLS support. Defaults to `false` +- `tls.certificatesSecret`: Name of an existing secret that contains the certificates. No defaults. +- `tls.certFilename`: Certificate filename. No defaults. +- `tls.certKeyFilename`: Certificate key filename. No defaults. + +For example: + +- First, create the secret with the cetificates files: + + ```console + kubectl create secret generic certificates-tls-secret --from-file=./cert.crt --from-file=./cert.key --from-file=./ca.crt + ``` + +- Then, use the following parameters: + + ```console + volumePermissions.enabled=true + tls.enabled=true + tls.certificatesSecret="certificates-tls-secret" + tls.certFilename="cert.crt" + tls.certKeyFilename="cert.key" + ``` + + > Note TLS and VolumePermissions: PostgreSQL requires certain permissions on sensitive files (such as certificate keys) to start up. Due to an on-going [issue](https://github.com/kubernetes/kubernetes/issues/57923) regarding kubernetes permissions and the use of `containerSecurityContext.runAsUser`, you must enable `volumePermissions` to ensure everything works as expected. + +### Sidecars + +If you need additional containers to run within the same pod as PostgreSQL (e.g. an additional metrics or logging exporter), you can do so via the `sidecars` config parameter. Simply define your container according to the Kubernetes container spec. + +```yaml +# For the PostgreSQL primary +primary: + sidecars: + - name: your-image-name + image: your-image + imagePullPolicy: Always + ports: + - name: portname + containerPort: 1234 +# For the PostgreSQL replicas +readReplicas: + sidecars: + - name: your-image-name + image: your-image + imagePullPolicy: Always + ports: + - name: portname + containerPort: 1234 +``` + +### Metrics + +The chart optionally can start a metrics exporter for [prometheus](https://prometheus.io). The metrics endpoint (port 9187) is not exposed and it is expected that the metrics are collected from inside the k8s cluster using something similar as the described in the [example Prometheus scrape configuration](https://github.com/prometheus/prometheus/blob/master/documentation/examples/prometheus-kubernetes.yml). + +The exporter allows to create custom metrics from additional SQL queries. See the Chart's `values.yaml` for an example and consult the [exporters documentation](https://github.com/wrouesnel/postgres_exporter#adding-new-metrics-via-a-config-file) for more details. + +### Use of global variables + +In more complex scenarios, we may have the following tree of dependencies + +```text + +--------------+ + | | + +------------+ Chart 1 +-----------+ + | | | | + | --------+------+ | + | | | + | | | + | | | + | | | + v v v ++-------+------+ +--------+------+ +--------+------+ +| | | | | | +| PostgreSQL | | Sub-chart 1 | | Sub-chart 2 | +| | | | | | ++--------------+ +---------------+ +---------------+ +``` + +The three charts below depend on the parent chart Chart 1. However, subcharts 1 and 2 may need to connect to PostgreSQL as well. In order to do so, subcharts 1 and 2 need to know the PostgreSQL credentials, so one option for deploying could be deploy Chart 1 with the following parameters: + +```text +postgresql.auth.username=testuser +subchart1.postgresql.auth.username=testuser +subchart2.postgresql.auth.username=testuser +postgresql.auth.password=testpass +subchart1.postgresql.auth.password=testpass +subchart2.postgresql.auth.password=testpass +postgresql.auth.database=testdb +subchart1.postgresql.auth.database=testdb +subchart2.postgresql.auth.database=testdb +``` + +If the number of dependent sub-charts increases, installing the chart with parameters can become increasingly difficult. An alternative would be to set the credentials using global variables as follows: + +```text +global.postgresql.auth.username=testuser +global.postgresql.auth.password=testpass +global.postgresql.auth.database=testdb +``` + +This way, the credentials will be available in all of the subcharts. + +### Backup and restore + +To back up and restore Bitnami PostgreSQL Helm chart deployments on Kubernetes, you need to back up the persistent volumes from the source deployment and attach them to a new deployment using [Velero](https://velero.io/), a Kubernetes backup/restore tool. + +These are the steps you will usually follow to back up and restore your PostgreSQL cluster data: + +- Install Velero on the source and destination clusters. +- Use Velero to back up the PersistentVolumes (PVs) used by the deployment on the source cluster. +- Use Velero to restore the backed-up PVs on the destination cluster. +- Create a new deployment on the destination cluster with the same chart, deployment name, credentials and other parameters as the original. This new deployment will use the restored PVs and hence the original data. + +Refer to our detailed [tutorial on backing up and restoring PostgreSQL deployments on Kubernetes](https://techdocs.broadcom.com/us/en/vmware-tanzu/application-catalog/tanzu-application-catalog/services/tac-doc/apps-tutorials-migrate-data-tac-velero-index.html) for more information. + +### NetworkPolicy + +To enable network policy for PostgreSQL, install [a networking plugin that implements the Kubernetes NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), and set `networkPolicy.enabled` to `true`. + +For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting the DefaultDeny namespace annotation. Note: this will enforce policy for _all_ pods in the namespace: + +```console +kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" +``` + +With NetworkPolicy enabled, traffic will be limited to just port 5432. + +For more precise policy, set `networkPolicy.allowExternal=false`. This will only allow pods with the generated client label to connect to PostgreSQL. +This label will be displayed in the output of a successful install. + +### Differences between Bitnami PostgreSQL image and [Docker Official](https://hub.docker.com/_/postgres) image + +- The Docker Official PostgreSQL image does not support replication. If you pass any replication environment variable, this would be ignored. The only environment variables supported by the Docker Official image are POSTGRES_USER, POSTGRES_DB, POSTGRES_PASSWORD, POSTGRES_INITDB_ARGS, POSTGRES_INITDB_WALDIR and PGDATA. All the remaining environment variables are specific to the Bitnami PostgreSQL image. +- The Bitnami PostgreSQL image is non-root by default. This requires that you run the pod with `securityContext` and updates the permissions of the volume with an `initContainer`. A key benefit of this configuration is that the pod follows security best practices and is prepared to run on Kubernetes distributions with hard security constraints like OpenShift. +- For OpenShift up to 4.10, let set the volume permissions, security context, runAsUser and fsGroup automatically by OpenShift and disable the predefined settings of the helm chart: primary.securityContext.enabled=false,primary.containerSecurityContext.enabled=false,volumePermissions.enabled=false,shmVolume.enabled=false +- For OpenShift 4.11 and higher, let set OpenShift the runAsUser and fsGroup automatically. Configure the pod and container security context to restrictive defaults and disable the volume permissions setup: primary. + podSecurityContext.fsGroup=null,primary.podSecurityContext.seccompProfile.type=RuntimeDefault,primary.containerSecurityContext.runAsUser=null,primary.containerSecurityContext.allowPrivilegeEscalation=false,primary.containerSecurityContext.runAsNonRoot=true,primary.containerSecurityContext.seccompProfile.type=RuntimeDefault,primary.containerSecurityContext.capabilities.drop=['ALL'],volumePermissions.enabled=false,shmVolume.enabled=false + +### Setting Pod's affinity + +This chart allows you to set your custom affinity using the `XXX.affinity` parameter(s). Find more information about Pod's affinity in the [kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity). + +As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/main/bitnami/common#affinities) chart. To do so, set the `XXX.podAffinityPreset`, `XXX.podAntiAffinityPreset`, or `XXX.nodeAffinityPreset` parameters. + +## Persistence + +The [Bitnami PostgreSQL](https://github.com/bitnami/containers/tree/main/bitnami/postgresql) image stores the PostgreSQL data and configurations at the `/bitnami/postgresql` path of the container. + +Persistent Volume Claims are used to keep the data across deployments. This is known to work in GCE, AWS, and minikube. +See the [Parameters](#parameters) section to configure the PVC or to disable persistence. + +If you already have data in it, you will fail to sync to standby nodes for all commits, details can refer to the [code present in the container repository](https://github.com/bitnami/containers/tree/main/bitnami/postgresql). If you need to use those data, please covert them to sql and import after `helm install` finished. + +## Parameters + +### Global parameters + +| Name | Description | Value | +| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | +| `global.imageRegistry` | Global Docker image registry | `""` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | +| `global.defaultStorageClass` | Global default StorageClass for Persistent Volume(s) | `""` | +| `global.storageClass` | DEPRECATED: use global.defaultStorageClass instead | `""` | +| `global.security.allowInsecureImages` | Allows skipping image verification | `false` | +| `global.postgresql.auth.postgresPassword` | Password for the "postgres" admin user (overrides `auth.postgresPassword`) | `""` | +| `global.postgresql.auth.username` | Name for a custom user to create (overrides `auth.username`) | `""` | +| `global.postgresql.auth.password` | Password for the custom user to create (overrides `auth.password`) | `""` | +| `global.postgresql.auth.database` | Name for a custom database to create (overrides `auth.database`) | `""` | +| `global.postgresql.auth.existingSecret` | Name of existing secret to use for PostgreSQL credentials (overrides `auth.existingSecret`). | `""` | +| `global.postgresql.auth.secretKeys.adminPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.adminPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. | `""` | +| `global.postgresql.auth.secretKeys.userPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.userPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. | `""` | +| `global.postgresql.auth.secretKeys.replicationPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.replicationPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. | `""` | +| `global.postgresql.service.ports.postgresql` | PostgreSQL service port (overrides `service.ports.postgresql`) | `""` | +| `global.compatibility.openshift.adaptSecurityContext` | Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) | `auto` | + +### Common parameters + +| Name | Description | Value | +| ------------------------ | -------------------------------------------------------------------------------------------- | --------------- | +| `kubeVersion` | Override Kubernetes version | `""` | +| `nameOverride` | String to partially override common.names.fullname template (will maintain the release name) | `""` | +| `fullnameOverride` | String to fully override common.names.fullname template | `""` | +| `namespaceOverride` | String to fully override common.names.namespace | `""` | +| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` | +| `extraDeploy` | Array of extra objects to deploy with the release (evaluated as a template) | `[]` | +| `commonLabels` | Add labels to all the deployed resources | `{}` | +| `commonAnnotations` | Add annotations to all the deployed resources | `{}` | +| `secretAnnotations` | Add annotations to the secrets | `{}` | +| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | +| `diagnosticMode.command` | Command to override all containers in the statefulset | `["sleep"]` | +| `diagnosticMode.args` | Args to override all containers in the statefulset | `["infinity"]` | + +### PostgreSQL common parameters + +| Name | Description | Value | +| ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | +| `image.registry` | PostgreSQL image registry | `REGISTRY_NAME` | +| `image.repository` | PostgreSQL image repository | `REPOSITORY_NAME/postgresql` | +| `image.digest` | PostgreSQL image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `image.pullPolicy` | PostgreSQL image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify image pull secrets | `[]` | +| `image.debug` | Specify if debug values should be set | `false` | +| `auth.enablePostgresUser` | Assign a password to the "postgres" admin user. Otherwise, remote access will be blocked for this user | `true` | +| `auth.postgresPassword` | Password for the "postgres" admin user. Ignored if `auth.existingSecret` is provided | `""` | +| `auth.username` | Name for a custom user to create | `""` | +| `auth.password` | Password for the custom user to create. Ignored if `auth.existingSecret` is provided | `""` | +| `auth.database` | Name for a custom database to create | `""` | +| `auth.replicationUsername` | Name of the replication user | `repl_user` | +| `auth.replicationPassword` | Password for the replication user. Ignored if `auth.existingSecret` is provided | `""` | +| `auth.existingSecret` | Name of existing secret to use for PostgreSQL credentials. `auth.postgresPassword`, `auth.password`, and `auth.replicationPassword` will be ignored and picked up from this secret. The secret might also contains the key `ldap-password` if LDAP is enabled. `ldap.bind_password` will be ignored and picked from this secret in this case. | `""` | +| `auth.secretKeys.adminPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. | `postgres-password` | +| `auth.secretKeys.userPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. | `password` | +| `auth.secretKeys.replicationPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. | `replication-password` | +| `auth.usePasswordFiles` | Mount credentials as a files instead of using an environment variable | `false` | +| `architecture` | PostgreSQL architecture (`standalone` or `replication`) | `standalone` | +| `replication.synchronousCommit` | Set synchronous commit mode. Allowed values: `on`, `remote_apply`, `remote_write`, `local` and `off` | `off` | +| `replication.numSynchronousReplicas` | Number of replicas that will have synchronous replication. Note: Cannot be greater than `readReplicas.replicaCount`. | `0` | +| `replication.applicationName` | Cluster application name. Useful for advanced replication settings | `my_application` | +| `containerPorts.postgresql` | PostgreSQL container port | `5432` | +| `audit.logHostname` | Log client hostnames | `false` | +| `audit.logConnections` | Add client log-in operations to the log file | `false` | +| `audit.logDisconnections` | Add client log-outs operations to the log file | `false` | +| `audit.pgAuditLog` | Add operations to log using the pgAudit extension | `""` | +| `audit.pgAuditLogCatalog` | Log catalog using pgAudit | `off` | +| `audit.clientMinMessages` | Message log level to share with the user | `error` | +| `audit.logLinePrefix` | Template for log line prefix (default if not set) | `""` | +| `audit.logTimezone` | Timezone for the log timestamps | `""` | +| `ldap.enabled` | Enable LDAP support | `false` | +| `ldap.server` | IP address or name of the LDAP server. | `""` | +| `ldap.port` | Port number on the LDAP server to connect to | `""` | +| `ldap.prefix` | String to prepend to the user name when forming the DN to bind | `""` | +| `ldap.suffix` | String to append to the user name when forming the DN to bind | `""` | +| `ldap.basedn` | Root DN to begin the search for the user in | `""` | +| `ldap.binddn` | DN of user to bind to LDAP | `""` | +| `ldap.bindpw` | Password for the user to bind to LDAP | `""` | +| `ldap.searchAttribute` | Attribute to match against the user name in the search | `""` | +| `ldap.searchFilter` | The search filter to use when doing search+bind authentication | `""` | +| `ldap.scheme` | Set to `ldaps` to use LDAPS | `""` | +| `ldap.tls.enabled` | Se to true to enable TLS encryption | `false` | +| `ldap.uri` | LDAP URL beginning in the form `ldap[s]://host[:port]/basedn`. If provided, all the other LDAP parameters will be ignored. | `""` | +| `postgresqlDataDir` | PostgreSQL data dir folder | `/bitnami/postgresql/data` | +| `postgresqlSharedPreloadLibraries` | Shared preload libraries (comma-separated list) | `pgaudit` | +| `shmVolume.enabled` | Enable emptyDir volume for /dev/shm for PostgreSQL pod(s) | `true` | +| `shmVolume.sizeLimit` | Set this to enable a size limit on the shm tmpfs | `""` | +| `tls.enabled` | Enable TLS traffic support | `false` | +| `tls.autoGenerated` | Generate automatically self-signed TLS certificates | `false` | +| `tls.preferServerCiphers` | Whether to use the server's TLS cipher preferences rather than the client's | `true` | +| `tls.certificatesSecret` | Name of an existing secret that contains the certificates | `""` | +| `tls.certFilename` | Certificate filename | `""` | +| `tls.certKeyFilename` | Certificate key filename | `""` | +| `tls.certCAFilename` | CA Certificate filename | `""` | +| `tls.crlFilename` | File containing a Certificate Revocation List | `""` | + +### PostgreSQL Primary parameters + +| Name | Description | Value | +| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- | +| `primary.name` | Name of the primary database (eg primary, master, leader, ...) | `primary` | +| `primary.configuration` | PostgreSQL Primary main configuration to be injected as ConfigMap | `""` | +| `primary.pgHbaConfiguration` | PostgreSQL Primary client authentication configuration | `""` | +| `primary.existingConfigmap` | Name of an existing ConfigMap with PostgreSQL Primary configuration | `""` | +| `primary.extendedConfiguration` | Extended PostgreSQL Primary configuration (appended to main or default configuration) | `""` | +| `primary.existingExtendedConfigmap` | Name of an existing ConfigMap with PostgreSQL Primary extended configuration | `""` | +| `primary.initdb.args` | PostgreSQL initdb extra arguments | `""` | +| `primary.initdb.postgresqlWalDir` | Specify a custom location for the PostgreSQL transaction log | `""` | +| `primary.initdb.scripts` | Dictionary of initdb scripts | `{}` | +| `primary.initdb.scriptsConfigMap` | ConfigMap with scripts to be run at first boot | `""` | +| `primary.initdb.scriptsSecret` | Secret with scripts to be run at first boot (in case it contains sensitive information) | `""` | +| `primary.initdb.user` | Specify the PostgreSQL username to execute the initdb scripts | `""` | +| `primary.initdb.password` | Specify the PostgreSQL password to execute the initdb scripts | `""` | +| `primary.preInitDb.scripts` | Dictionary of pre-init scripts | `{}` | +| `primary.preInitDb.scriptsConfigMap` | ConfigMap with pre-init scripts to be run | `""` | +| `primary.preInitDb.scriptsSecret` | Secret with pre-init scripts to be run | `""` | +| `primary.standby.enabled` | Whether to enable current cluster's primary as standby server of another cluster or not | `false` | +| `primary.standby.primaryHost` | The Host of replication primary in the other cluster | `""` | +| `primary.standby.primaryPort` | The Port of replication primary in the other cluster | `""` | +| `primary.extraEnvVars` | Array with extra environment variables to add to PostgreSQL Primary nodes | `[]` | +| `primary.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for PostgreSQL Primary nodes | `""` | +| `primary.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for PostgreSQL Primary nodes | `""` | +| `primary.command` | Override default container command (useful when using custom images) | `[]` | +| `primary.args` | Override default container args (useful when using custom images) | `[]` | +| `primary.livenessProbe.enabled` | Enable livenessProbe on PostgreSQL Primary containers | `true` | +| `primary.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | +| `primary.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `primary.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `primary.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `primary.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `primary.readinessProbe.enabled` | Enable readinessProbe on PostgreSQL Primary containers | `true` | +| `primary.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `primary.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `primary.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `primary.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `primary.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `primary.startupProbe.enabled` | Enable startupProbe on PostgreSQL Primary containers | `false` | +| `primary.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `30` | +| `primary.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `primary.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `primary.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `primary.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `primary.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `primary.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `primary.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `primary.lifecycleHooks` | for the PostgreSQL Primary container to automate configuration before or after startup | `{}` | +| `primary.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if primary.resources is set (primary.resources is recommended for production). | `nano` | +| `primary.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `primary.podSecurityContext.enabled` | Enable security context | `true` | +| `primary.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | +| `primary.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | +| `primary.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | +| `primary.podSecurityContext.fsGroup` | Group ID for the pod | `1001` | +| `primary.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | +| `primary.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `primary.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | +| `primary.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | +| `primary.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | +| `primary.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | +| `primary.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | +| `primary.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | +| `primary.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | +| `primary.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `primary.automountServiceAccountToken` | Mount Service Account token in pod | `false` | +| `primary.hostAliases` | PostgreSQL primary pods host aliases | `[]` | +| `primary.hostNetwork` | Specify if host network should be enabled for PostgreSQL pod (postgresql primary) | `false` | +| `primary.hostIPC` | Specify if host IPC should be enabled for PostgreSQL pod (postgresql primary) | `false` | +| `primary.labels` | Map of labels to add to the statefulset (postgresql primary) | `{}` | +| `primary.annotations` | Annotations for PostgreSQL primary pods | `{}` | +| `primary.podLabels` | Map of labels to add to the pods (postgresql primary) | `{}` | +| `primary.podAnnotations` | Map of annotations to add to the pods (postgresql primary) | `{}` | +| `primary.podAffinityPreset` | PostgreSQL primary pod affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `primary.podAntiAffinityPreset` | PostgreSQL primary pod anti-affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `primary.nodeAffinityPreset.type` | PostgreSQL primary node affinity preset type. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `primary.nodeAffinityPreset.key` | PostgreSQL primary node label key to match Ignored if `primary.affinity` is set. | `""` | +| `primary.nodeAffinityPreset.values` | PostgreSQL primary node label values to match. Ignored if `primary.affinity` is set. | `[]` | +| `primary.affinity` | Affinity for PostgreSQL primary pods assignment | `{}` | +| `primary.nodeSelector` | Node labels for PostgreSQL primary pods assignment | `{}` | +| `primary.tolerations` | Tolerations for PostgreSQL primary pods assignment | `[]` | +| `primary.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `[]` | +| `primary.priorityClassName` | Priority Class to use for each pod (postgresql primary) | `""` | +| `primary.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | +| `primary.terminationGracePeriodSeconds` | Seconds PostgreSQL primary pod needs to terminate gracefully | `""` | +| `primary.updateStrategy.type` | PostgreSQL Primary statefulset strategy type | `RollingUpdate` | +| `primary.updateStrategy.rollingUpdate` | PostgreSQL Primary statefulset rolling update configuration parameters | `{}` | +| `primary.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the PostgreSQL Primary container(s) | `[]` | +| `primary.extraVolumes` | Optionally specify extra list of additional volumes for the PostgreSQL Primary pod(s) | `[]` | +| `primary.sidecars` | Add additional sidecar containers to the PostgreSQL Primary pod(s) | `[]` | +| `primary.initContainers` | Add additional init containers to the PostgreSQL Primary pod(s) | `[]` | +| `primary.pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` | +| `primary.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` | +| `primary.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `primary.pdb.minAvailable` and `primary.pdb.maxUnavailable` are empty. | `""` | +| `primary.extraPodSpec` | Optionally specify extra PodSpec for the PostgreSQL Primary pod(s) | `{}` | +| `primary.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | +| `primary.networkPolicy.allowExternal` | Don't require server label for connections | `true` | +| `primary.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | +| `primary.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `primary.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `primary.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` | +| `primary.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` | +| `primary.service.type` | Kubernetes Service type | `ClusterIP` | +| `primary.service.ports.postgresql` | PostgreSQL service port | `5432` | +| `primary.service.nodePorts.postgresql` | Node port for PostgreSQL | `""` | +| `primary.service.clusterIP` | Static clusterIP or None for headless services | `""` | +| `primary.service.annotations` | Annotations for PostgreSQL primary service | `{}` | +| `primary.service.loadBalancerClass` | Load balancer class if service type is `LoadBalancer` | `""` | +| `primary.service.loadBalancerIP` | Load balancer IP if service type is `LoadBalancer` | `""` | +| `primary.service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | +| `primary.service.loadBalancerSourceRanges` | Addresses that are allowed when service is LoadBalancer | `[]` | +| `primary.service.extraPorts` | Extra ports to expose in the PostgreSQL primary service | `[]` | +| `primary.service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | +| `primary.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | +| `primary.service.headless.annotations` | Additional custom annotations for headless PostgreSQL primary service | `{}` | +| `primary.persistence.enabled` | Enable PostgreSQL Primary data persistence using PVC | `true` | +| `primary.persistence.volumeName` | Name to assign the volume | `data` | +| `primary.persistence.existingClaim` | Name of an existing PVC to use | `""` | +| `primary.persistence.mountPath` | The path the volume will be mounted at | `/bitnami/postgresql` | +| `primary.persistence.subPath` | The subdirectory of the volume to mount to | `""` | +| `primary.persistence.storageClass` | PVC Storage Class for PostgreSQL Primary data volume | `""` | +| `primary.persistence.accessModes` | PVC Access Mode for PostgreSQL volume | `["ReadWriteOnce"]` | +| `primary.persistence.size` | PVC Storage Request for PostgreSQL volume | `8Gi` | +| `primary.persistence.annotations` | Annotations for the PVC | `{}` | +| `primary.persistence.labels` | Labels for the PVC | `{}` | +| `primary.persistence.selector` | Selector to match an existing Persistent Volume (this value is evaluated as a template) | `{}` | +| `primary.persistence.dataSource` | Custom PVC data source | `{}` | +| `primary.persistentVolumeClaimRetentionPolicy.enabled` | Enable Persistent volume retention policy for Primary Statefulset | `false` | +| `primary.persistentVolumeClaimRetentionPolicy.whenScaled` | Volume retention behavior when the replica count of the StatefulSet is reduced | `Retain` | +| `primary.persistentVolumeClaimRetentionPolicy.whenDeleted` | Volume retention behavior that applies when the StatefulSet is deleted | `Retain` | + +### PostgreSQL read only replica parameters (only used when `architecture` is set to `replication`) + +| Name | Description | Value | +| ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- | +| `readReplicas.name` | Name of the read replicas database (eg secondary, slave, ...) | `read` | +| `readReplicas.replicaCount` | Number of PostgreSQL read only replicas | `1` | +| `readReplicas.extendedConfiguration` | Extended PostgreSQL read only replicas configuration (appended to main or default configuration) | `""` | +| `readReplicas.extraEnvVars` | Array with extra environment variables to add to PostgreSQL read only nodes | `[]` | +| `readReplicas.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for PostgreSQL read only nodes | `""` | +| `readReplicas.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for PostgreSQL read only nodes | `""` | +| `readReplicas.command` | Override default container command (useful when using custom images) | `[]` | +| `readReplicas.args` | Override default container args (useful when using custom images) | `[]` | +| `readReplicas.livenessProbe.enabled` | Enable livenessProbe on PostgreSQL read only containers | `true` | +| `readReplicas.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | +| `readReplicas.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `readReplicas.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `readReplicas.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `readReplicas.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `readReplicas.readinessProbe.enabled` | Enable readinessProbe on PostgreSQL read only containers | `true` | +| `readReplicas.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `readReplicas.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `readReplicas.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `readReplicas.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `readReplicas.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `readReplicas.startupProbe.enabled` | Enable startupProbe on PostgreSQL read only containers | `false` | +| `readReplicas.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `30` | +| `readReplicas.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `readReplicas.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `readReplicas.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `readReplicas.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `readReplicas.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `readReplicas.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `readReplicas.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `readReplicas.lifecycleHooks` | for the PostgreSQL read only container to automate configuration before or after startup | `{}` | +| `readReplicas.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if readReplicas.resources is set (readReplicas.resources is recommended for production). | `nano` | +| `readReplicas.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `readReplicas.podSecurityContext.enabled` | Enable security context | `true` | +| `readReplicas.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | +| `readReplicas.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | +| `readReplicas.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | +| `readReplicas.podSecurityContext.fsGroup` | Group ID for the pod | `1001` | +| `readReplicas.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | +| `readReplicas.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `readReplicas.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | +| `readReplicas.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | +| `readReplicas.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | +| `readReplicas.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | +| `readReplicas.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | +| `readReplicas.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | +| `readReplicas.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | +| `readReplicas.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `readReplicas.automountServiceAccountToken` | Mount Service Account token in pod | `false` | +| `readReplicas.hostAliases` | PostgreSQL read only pods host aliases | `[]` | +| `readReplicas.hostNetwork` | Specify if host network should be enabled for PostgreSQL pod (PostgreSQL read only) | `false` | +| `readReplicas.hostIPC` | Specify if host IPC should be enabled for PostgreSQL pod (postgresql primary) | `false` | +| `readReplicas.labels` | Map of labels to add to the statefulset (PostgreSQL read only) | `{}` | +| `readReplicas.annotations` | Annotations for PostgreSQL read only pods | `{}` | +| `readReplicas.podLabels` | Map of labels to add to the pods (PostgreSQL read only) | `{}` | +| `readReplicas.podAnnotations` | Map of annotations to add to the pods (PostgreSQL read only) | `{}` | +| `readReplicas.podAffinityPreset` | PostgreSQL read only pod affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `readReplicas.podAntiAffinityPreset` | PostgreSQL read only pod anti-affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `readReplicas.nodeAffinityPreset.type` | PostgreSQL read only node affinity preset type. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `readReplicas.nodeAffinityPreset.key` | PostgreSQL read only node label key to match Ignored if `primary.affinity` is set. | `""` | +| `readReplicas.nodeAffinityPreset.values` | PostgreSQL read only node label values to match. Ignored if `primary.affinity` is set. | `[]` | +| `readReplicas.affinity` | Affinity for PostgreSQL read only pods assignment | `{}` | +| `readReplicas.nodeSelector` | Node labels for PostgreSQL read only pods assignment | `{}` | +| `readReplicas.tolerations` | Tolerations for PostgreSQL read only pods assignment | `[]` | +| `readReplicas.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `[]` | +| `readReplicas.priorityClassName` | Priority Class to use for each pod (PostgreSQL read only) | `""` | +| `readReplicas.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | +| `readReplicas.terminationGracePeriodSeconds` | Seconds PostgreSQL read only pod needs to terminate gracefully | `""` | +| `readReplicas.updateStrategy.type` | PostgreSQL read only statefulset strategy type | `RollingUpdate` | +| `readReplicas.updateStrategy.rollingUpdate` | PostgreSQL read only statefulset rolling update configuration parameters | `{}` | +| `readReplicas.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the PostgreSQL read only container(s) | `[]` | +| `readReplicas.extraVolumes` | Optionally specify extra list of additional volumes for the PostgreSQL read only pod(s) | `[]` | +| `readReplicas.sidecars` | Add additional sidecar containers to the PostgreSQL read only pod(s) | `[]` | +| `readReplicas.initContainers` | Add additional init containers to the PostgreSQL read only pod(s) | `[]` | +| `readReplicas.pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` | +| `readReplicas.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` | +| `readReplicas.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `readReplicas.pdb.minAvailable` and `readReplicas.pdb.maxUnavailable` are empty. | `""` | +| `readReplicas.extraPodSpec` | Optionally specify extra PodSpec for the PostgreSQL read only pod(s) | `{}` | +| `readReplicas.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | +| `readReplicas.networkPolicy.allowExternal` | Don't require server label for connections | `true` | +| `readReplicas.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | +| `readReplicas.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `readReplicas.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `readReplicas.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` | +| `readReplicas.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` | +| `readReplicas.service.type` | Kubernetes Service type | `ClusterIP` | +| `readReplicas.service.ports.postgresql` | PostgreSQL service port | `5432` | +| `readReplicas.service.nodePorts.postgresql` | Node port for PostgreSQL | `""` | +| `readReplicas.service.clusterIP` | Static clusterIP or None for headless services | `""` | +| `readReplicas.service.annotations` | Annotations for PostgreSQL read only service | `{}` | +| `readReplicas.service.loadBalancerClass` | Load balancer class if service type is `LoadBalancer` | `""` | +| `readReplicas.service.loadBalancerIP` | Load balancer IP if service type is `LoadBalancer` | `""` | +| `readReplicas.service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | +| `readReplicas.service.loadBalancerSourceRanges` | Addresses that are allowed when service is LoadBalancer | `[]` | +| `readReplicas.service.extraPorts` | Extra ports to expose in the PostgreSQL read only service | `[]` | +| `readReplicas.service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | +| `readReplicas.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | +| `readReplicas.service.headless.annotations` | Additional custom annotations for headless PostgreSQL read only service | `{}` | +| `readReplicas.persistence.enabled` | Enable PostgreSQL read only data persistence using PVC | `true` | +| `readReplicas.persistence.existingClaim` | Name of an existing PVC to use | `""` | +| `readReplicas.persistence.mountPath` | The path the volume will be mounted at | `/bitnami/postgresql` | +| `readReplicas.persistence.subPath` | The subdirectory of the volume to mount to | `""` | +| `readReplicas.persistence.storageClass` | PVC Storage Class for PostgreSQL read only data volume | `""` | +| `readReplicas.persistence.accessModes` | PVC Access Mode for PostgreSQL volume | `["ReadWriteOnce"]` | +| `readReplicas.persistence.size` | PVC Storage Request for PostgreSQL volume | `8Gi` | +| `readReplicas.persistence.annotations` | Annotations for the PVC | `{}` | +| `readReplicas.persistence.labels` | Labels for the PVC | `{}` | +| `readReplicas.persistence.selector` | Selector to match an existing Persistent Volume (this value is evaluated as a template) | `{}` | +| `readReplicas.persistence.dataSource` | Custom PVC data source | `{}` | +| `readReplicas.persistentVolumeClaimRetentionPolicy.enabled` | Enable Persistent volume retention policy for read only Statefulset | `false` | +| `readReplicas.persistentVolumeClaimRetentionPolicy.whenScaled` | Volume retention behavior when the replica count of the StatefulSet is reduced | `Retain` | +| `readReplicas.persistentVolumeClaimRetentionPolicy.whenDeleted` | Volume retention behavior that applies when the StatefulSet is deleted | `Retain` | + +### Backup parameters + +| Name | Description | Value | +| ------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| `backup.enabled` | Enable the logical dump of the database "regularly" | `false` | +| `backup.cronjob.schedule` | Set the cronjob parameter schedule | `@daily` | +| `backup.cronjob.timeZone` | Set the cronjob parameter timeZone | `""` | +| `backup.cronjob.concurrencyPolicy` | Set the cronjob parameter concurrencyPolicy | `Allow` | +| `backup.cronjob.failedJobsHistoryLimit` | Set the cronjob parameter failedJobsHistoryLimit | `1` | +| `backup.cronjob.successfulJobsHistoryLimit` | Set the cronjob parameter successfulJobsHistoryLimit | `3` | +| `backup.cronjob.startingDeadlineSeconds` | Set the cronjob parameter startingDeadlineSeconds | `""` | +| `backup.cronjob.ttlSecondsAfterFinished` | Set the cronjob parameter ttlSecondsAfterFinished | `""` | +| `backup.cronjob.restartPolicy` | Set the cronjob parameter restartPolicy | `OnFailure` | +| `backup.cronjob.podSecurityContext.enabled` | Enable PodSecurityContext for CronJob/Backup | `true` | +| `backup.cronjob.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | +| `backup.cronjob.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | +| `backup.cronjob.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | +| `backup.cronjob.podSecurityContext.fsGroup` | Group ID for the CronJob | `1001` | +| `backup.cronjob.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | +| `backup.cronjob.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `backup.cronjob.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | +| `backup.cronjob.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | +| `backup.cronjob.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | +| `backup.cronjob.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | +| `backup.cronjob.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | +| `backup.cronjob.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | +| `backup.cronjob.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | +| `backup.cronjob.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `backup.cronjob.command` | Set backup container's command to run | `["/bin/sh","-c","pg_dumpall --clean --if-exists --load-via-partition-root --quote-all-identifiers --no-password --file=${PGDUMP_DIR}/pg_dumpall-$(date '+%Y-%m-%d-%H-%M').pgdump"]` | +| `backup.cronjob.labels` | Set the cronjob labels | `{}` | +| `backup.cronjob.annotations` | Set the cronjob annotations | `{}` | +| `backup.cronjob.nodeSelector` | Node labels for PostgreSQL backup CronJob pod assignment | `{}` | +| `backup.cronjob.tolerations` | Tolerations for PostgreSQL backup CronJob pods assignment | `[]` | +| `backup.cronjob.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if backup.cronjob.resources is set (backup.cronjob.resources is recommended for production). | `nano` | +| `backup.cronjob.resources` | Set container requests and limits for different resources like CPU or memory | `{}` | +| `backup.cronjob.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | +| `backup.cronjob.storage.enabled` | Enable using a `PersistentVolumeClaim` as backup data volume | `true` | +| `backup.cronjob.storage.existingClaim` | Provide an existing `PersistentVolumeClaim` (only when `architecture=standalone`) | `""` | +| `backup.cronjob.storage.resourcePolicy` | Setting it to "keep" to avoid removing PVCs during a helm delete operation. Leaving it empty will delete PVCs after the chart deleted | `""` | +| `backup.cronjob.storage.storageClass` | PVC Storage Class for the backup data volume | `""` | +| `backup.cronjob.storage.accessModes` | PV Access Mode | `["ReadWriteOnce"]` | +| `backup.cronjob.storage.size` | PVC Storage Request for the backup data volume | `8Gi` | +| `backup.cronjob.storage.annotations` | PVC annotations | `{}` | +| `backup.cronjob.storage.mountPath` | Path to mount the volume at | `/backup/pgdump` | +| `backup.cronjob.storage.subPath` | Subdirectory of the volume to mount at | `""` | +| `backup.cronjob.storage.volumeClaimTemplates.selector` | A label query over volumes to consider for binding (e.g. when using local volumes) | `{}` | +| `backup.cronjob.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the backup container | `[]` | +| `backup.cronjob.extraVolumes` | Optionally specify extra list of additional volumes for the backup container | `[]` | + +### Password update job + +| Name | Description | Value | +| --------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- | +| `passwordUpdateJob.enabled` | Enable password update job | `false` | +| `passwordUpdateJob.backoffLimit` | set backoff limit of the job | `10` | +| `passwordUpdateJob.command` | Override default container command on mysql Primary container(s) (useful when using custom images) | `[]` | +| `passwordUpdateJob.args` | Override default container args on mysql Primary container(s) (useful when using custom images) | `[]` | +| `passwordUpdateJob.extraCommands` | Extra commands to pass to the generation job | `""` | +| `passwordUpdateJob.previousPasswords.postgresPassword` | Previous postgres password (set if the password secret was already changed) | `""` | +| `passwordUpdateJob.previousPasswords.password` | Previous password (set if the password secret was already changed) | `""` | +| `passwordUpdateJob.previousPasswords.replicationPassword` | Previous replication password (set if the password secret was already changed) | `""` | +| `passwordUpdateJob.previousPasswords.existingSecret` | Name of a secret containing the previous passwords (set if the password secret was already changed) | `""` | +| `passwordUpdateJob.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | +| `passwordUpdateJob.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `passwordUpdateJob.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | +| `passwordUpdateJob.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | +| `passwordUpdateJob.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | +| `passwordUpdateJob.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | +| `passwordUpdateJob.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | +| `passwordUpdateJob.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | +| `passwordUpdateJob.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | +| `passwordUpdateJob.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `passwordUpdateJob.podSecurityContext.enabled` | Enabled credential init job pods' Security Context | `true` | +| `passwordUpdateJob.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | +| `passwordUpdateJob.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | +| `passwordUpdateJob.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | +| `passwordUpdateJob.podSecurityContext.fsGroup` | Set credential init job pod's Security Context fsGroup | `1001` | +| `passwordUpdateJob.extraEnvVars` | Array containing extra env vars to configure the credential init job | `[]` | +| `passwordUpdateJob.extraEnvVarsCM` | ConfigMap containing extra env vars to configure the credential init job | `""` | +| `passwordUpdateJob.extraEnvVarsSecret` | Secret containing extra env vars to configure the credential init job (in case of sensitive data) | `""` | +| `passwordUpdateJob.extraVolumes` | Optionally specify extra list of additional volumes for the credential init job | `[]` | +| `passwordUpdateJob.extraVolumeMounts` | Array of extra volume mounts to be added to the jwt Container (evaluated as template). Normally used with `extraVolumes`. | `[]` | +| `passwordUpdateJob.initContainers` | Add additional init containers for the mysql Primary pod(s) | `[]` | +| `passwordUpdateJob.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if passwordUpdateJob.resources is set (passwordUpdateJob.resources is recommended for production). | `micro` | +| `passwordUpdateJob.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `passwordUpdateJob.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `passwordUpdateJob.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `passwordUpdateJob.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `passwordUpdateJob.automountServiceAccountToken` | Mount Service Account token in pod | `false` | +| `passwordUpdateJob.hostAliases` | Add deployment host aliases | `[]` | +| `passwordUpdateJob.annotations` | Add annotations to the job | `{}` | +| `passwordUpdateJob.podLabels` | Additional pod labels | `{}` | +| `passwordUpdateJob.podAnnotations` | Additional pod annotations | `{}` | + +### Volume Permissions parameters + +| Name | Description | Value | +| ---------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | +| `volumePermissions.enabled` | Enable init container that changes the owner and group of the persistent volume | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `REGISTRY_NAME` | +| `volumePermissions.image.repository` | Init container volume-permissions image repository | `REPOSITORY_NAME/os-shell` | +| `volumePermissions.image.digest` | Init container volume-permissions image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` | +| `volumePermissions.image.pullSecrets` | Init container volume-permissions image pull secrets | `[]` | +| `volumePermissions.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` | +| `volumePermissions.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `volumePermissions.containerSecurityContext.runAsUser` | User ID for the init container | `0` | +| `volumePermissions.containerSecurityContext.runAsGroup` | Group ID for the init container | `0` | +| `volumePermissions.containerSecurityContext.runAsNonRoot` | runAsNonRoot for the init container | `false` | +| `volumePermissions.containerSecurityContext.seccompProfile.type` | seccompProfile.type for the init container | `RuntimeDefault` | + +### Other Parameters + +| Name | Description | Value | +| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ------- | +| `serviceBindings.enabled` | Create secret for service binding (Experimental) | `false` | +| `serviceAccount.create` | Enable creation of ServiceAccount for PostgreSQL pod | `true` | +| `serviceAccount.name` | The name of the ServiceAccount to use. | `""` | +| `serviceAccount.automountServiceAccountToken` | Allows auto mount of ServiceAccountToken on the serviceAccount created | `false` | +| `serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` | +| `rbac.create` | Create Role and RoleBinding (required for PSP to work) | `false` | +| `rbac.rules` | Custom RBAC rules to set | `[]` | +| `psp.create` | Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later | `false` | + +### Metrics Parameters + +| Name | Description | Value | +| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- | +| `metrics.enabled` | Start a prometheus exporter | `false` | +| `metrics.image.registry` | PostgreSQL Prometheus Exporter image registry | `REGISTRY_NAME` | +| `metrics.image.repository` | PostgreSQL Prometheus Exporter image repository | `REPOSITORY_NAME/postgres-exporter` | +| `metrics.image.digest` | PostgreSQL image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `metrics.image.pullPolicy` | PostgreSQL Prometheus Exporter image pull policy | `IfNotPresent` | +| `metrics.image.pullSecrets` | Specify image pull secrets | `[]` | +| `metrics.collectors` | Control enabled collectors | `{}` | +| `metrics.customMetrics` | Define additional custom metrics | `{}` | +| `metrics.extraEnvVars` | Extra environment variables to add to PostgreSQL Prometheus exporter | `[]` | +| `metrics.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | +| `metrics.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `metrics.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | +| `metrics.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | +| `metrics.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | +| `metrics.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | +| `metrics.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | +| `metrics.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | +| `metrics.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | +| `metrics.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `metrics.livenessProbe.enabled` | Enable livenessProbe on PostgreSQL Prometheus exporter containers | `true` | +| `metrics.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | +| `metrics.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `metrics.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `metrics.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `metrics.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `metrics.readinessProbe.enabled` | Enable readinessProbe on PostgreSQL Prometheus exporter containers | `true` | +| `metrics.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `metrics.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `metrics.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `metrics.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `metrics.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `metrics.startupProbe.enabled` | Enable startupProbe on PostgreSQL Prometheus exporter containers | `false` | +| `metrics.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `10` | +| `metrics.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `metrics.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `metrics.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `metrics.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `metrics.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `metrics.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `metrics.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `metrics.containerPorts.metrics` | PostgreSQL Prometheus exporter metrics container port | `9187` | +| `metrics.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production). | `nano` | +| `metrics.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `metrics.service.ports.metrics` | PostgreSQL Prometheus Exporter service port | `9187` | +| `metrics.service.clusterIP` | Static clusterIP or None for headless services | `""` | +| `metrics.service.sessionAffinity` | Control where client requests go, to the same pod or round-robin | `None` | +| `metrics.service.annotations` | Annotations for Prometheus to auto-discover the metrics endpoint | `{}` | +| `metrics.serviceMonitor.enabled` | Create ServiceMonitor Resource for scraping metrics using Prometheus Operator | `false` | +| `metrics.serviceMonitor.namespace` | Namespace for the ServiceMonitor Resource (defaults to the Release Namespace) | `""` | +| `metrics.serviceMonitor.interval` | Interval at which metrics should be scraped. | `""` | +| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` | +| `metrics.serviceMonitor.labels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | `{}` | +| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `{}` | +| `metrics.serviceMonitor.relabelings` | RelabelConfigs to apply to samples before scraping | `[]` | +| `metrics.serviceMonitor.metricRelabelings` | MetricRelabelConfigs to apply to samples before ingestion | `[]` | +| `metrics.serviceMonitor.honorLabels` | Specify honorLabels parameter to add the scrape endpoint | `false` | +| `metrics.serviceMonitor.jobLabel` | The name of the label on the target service to use as the job name in prometheus. | `""` | +| `metrics.prometheusRule.enabled` | Create a PrometheusRule for Prometheus Operator | `false` | +| `metrics.prometheusRule.namespace` | Namespace for the PrometheusRule Resource (defaults to the Release Namespace) | `""` | +| `metrics.prometheusRule.labels` | Additional labels that can be used so PrometheusRule will be discovered by Prometheus | `{}` | +| `metrics.prometheusRule.rules` | PrometheusRule definitions | `[]` | + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```console +helm install my-release \ + --set auth.postgresPassword=secretpassword + oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql +``` + +> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. + +The above command sets the PostgreSQL `postgres` account password to `secretpassword`. + +> NOTE: Once this chart is deployed, it is not possible to change the application's access credentials, such as usernames or passwords, using Helm. To change these application credentials after deployment, delete any persistent volumes (PVs) used by the chart and re-deploy it, or use the application's built-in administrative tools if available. +> **Warning** Setting a password will be ignored on new installation in case when previous PostgreSQL release was deleted through the helm command. In that case, old PVC will have an old password, and setting it through helm won't take effect. Deleting persistent volumes (PVs) will solve the issue. Refer to [issue 2061](https://github.com/bitnami/charts/issues/2061) for more details + +Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, + +```console +helm install my-release -f values.yaml oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql +``` + +> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. +> **Tip**: You can use the default [values.yaml](https://github.com/bitnami/charts/tree/main/bitnami/postgresql/values.yaml) + +## Troubleshooting + +Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). + +## Upgrading + +### To 16.3.0 + +This version introduces image verification for security purposes. To disable it, set `global.security.allowInsecureImages` to `true`. More details at [GitHub issue](https://github.com/bitnami/charts/issues/30850). + +### To 15.0.0 + +This major bump changes the following security defaults: + +- `runAsGroup` is changed from `0` to `1001` +- `readOnlyRootFilesystem` is set to `true` +- `resourcesPreset` is changed from `none` to the minimum size working in our test suites (NOTE: `resourcesPreset` is not meant for production usage, but `resources` adapted to your use case). +- `global.compatibility.openshift.adaptSecurityContext` is changed from `disabled` to `auto`. + +This could potentially break any customization or init scripts used in your deployment. If this is the case, change the default values to the previous ones. + +### To 14.0.0 + +This major version adapts the NetworkPolicy objects to the most recent Bitnami standards. Now there is a separate object for `primary` and for `readReplicas`, being located in their corresponding sections. It is also enabled by default in other to comply with the best security standards. + +Check the parameter section for the new value structure. + +### To 13.0.0 + +This major version changes the default PostgreSQL image from 15.x to 16.x. Follow the [official instructions](https://www.postgresql.org/docs/16/upgrading.html) to upgrade to 16.x. + +### To 12.0.0 + +This major version changes the default PostgreSQL image from 14.x to 15.x. Follow the [official instructions](https://www.postgresql.org/docs/15/upgrading.html) to upgrade to 15.x. + +### To 11.0.0 + +In this version the application version was bumped to _14.x_ series. Also, this major release renames several values in this chart and adds missing features, in order to be inline with the rest of assets in the Bitnami charts repository. + +- _replication.enabled_ parameter is deprecated in favor of _architecture_ parameter that accepts two values: _standalone_ and _replication_. +- _replication.singleService_ and _replication.uniqueServices_ parameters are deprecated. When using replication, each statefulset (primary and read-only) has its own headless service & service allowing to connect to read-only replicas through the service (round-robin) or individually. +- _postgresqlPostgresPassword_, _postgresqlUsername_, _postgresqlPassword_, _postgresqlDatabase_, _replication.user_, _replication.password_, and _existingSecret_ parameters have been regrouped under the _auth_ map. The _auth_ map uses a new perspective to configure authentication, so please read carefully each sub-parameter description. +- _extraEnv_ has been deprecated in favor of _primary.extraEnvVars_ and _readReplicas.extraEnvVars_. +- _postgresqlConfiguration_, _pgHbaConfiguration_, _configurationConfigMap_, _postgresqlExtendedConf_, and _extendedConfConfigMap_ have been deprecated in favor of _primary.configuration_, _primary.pgHbaConfiguration_, _primary.existingConfigmap_, _primary.extendedConfiguration_, and _primary.existingExtendedConfigmap_. +- _postgresqlInitdbArgs_, _postgresqlInitdbWalDir_, _initdbScripts_, _initdbScriptsConfigMap_, _initdbScriptsSecret_, _initdbUser_ and _initdbPassword_ have been regrouped under the _primary.initdb_ map. +- _postgresqlMaxConnections_, _postgresqlPostgresConnectionLimit_, _postgresqlDbUserConnectionLimit_, _postgresqlTcpKeepalivesInterval_, _postgresqlTcpKeepalivesIdle_, _postgresqlTcpKeepalivesCount_, _postgresqlStatementTimeout_ and _postgresqlPghbaRemoveFilters_ parameters are deprecated. Use _XXX.extraEnvVars_ instead. +- _primaryAsStandBy_ has been deprecated in favor of _primary.standby_. +- _securityContext_ and _containerSecurityContext_ have been deprecated in favor of _primary.podSecurityContext_, _primary.containerSecurityContext_, _readReplicas.podSecurityContext_, and _readReplicas.containerSecurityContext_. +- _livenessProbe_ and _readinessProbe_ maps have been deprecated in favor of _primary.livenessProbe_, _primary.readinessProbe_, _readReplicas.livenessProbe_ and _readReplicas.readinessProbe_ maps. +- _persistence_ map has been deprecated in favor of _primary.persistence_ and _readReplicas.persistence_ maps. +- _networkPolicy_ map has been completely refactored. +- _service_ map has been deprecated in favor of _primary.service_ and _readReplicas.service_ maps. +- _metrics.service.port_ has been regrouped under the _metrics.service.ports_ map. +- _serviceAccount.enabled_ and _serviceAccount.autoMount_ have been deprecated in favor of _serviceAccount.create_ and _serviceAccount.automountServiceAccountToken_. + +#### How to upgrade to version 11.0.0 + +To upgrade to _11.0.0_ from _10.x_, it should be done reusing the PVC(s) used to hold the PostgreSQL data on your previous release. To do so, follow the instructions below (the following example assumes that the release name is _postgresql_): + +> NOTE: Please, create a backup of your database before running any of these actions. + +1. Obtain the credentials and the names of the PVCs used to hold the PostgreSQL data on your current release: + +```console +export POSTGRESQL_PASSWORD=$(kubectl get secret --namespace default postgresql -o jsonpath="{.data.postgresql-password}" | base64 --decode) +export POSTGRESQL_PVC=$(kubectl get pvc -l app.kubernetes.io/instance=postgresql,role=primary -o jsonpath="{.items[0].metadata.name}") +``` + +1. Delete the PostgreSQL statefulset (notice the option _--cascade=false_) and secret: + +```console +kubectl delete statefulsets.apps postgresql-postgresql --namespace default --cascade=false +kubectl delete secret postgresql --namespace default +``` + +1. Upgrade your release using the same PostgreSQL version: + +```console +CURRENT_VERSION=$(kubectl exec postgresql-postgresql-0 -- bash -c 'echo $BITNAMI_IMAGE_VERSION') +helm upgrade postgresql bitnami/postgresql \ + --set auth.postgresPassword=$POSTGRESQL_PASSWORD \ + --set primary.persistence.existingClaim=$POSTGRESQL_PVC \ + --set image.tag=$CURRENT_VERSION +``` + +1. You will have to delete the existing PostgreSQL pod and the new statefulset is going to create a new one + +```console +kubectl delete pod postgresql-postgresql-0 +``` + +1. Finally, you should see the lines below in PostgreSQL container logs: + +```text +$ kubectl logs $(kubectl get pods -l app.kubernetes.io/instance=postgresql,app.kubernetes.io/name=postgresql,app.kubernetes.io/component=primary -o jsonpath="{.items[0].metadata.name}") +... +postgresql 08:05:12.59 INFO ==> Deploying PostgreSQL with persisted data... +... +``` + +> NOTE: the instructions above reuse the same PostgreSQL version you were using in your chart release. Otherwise, you will find an error such as the one below when upgrading since the new chart major version also bumps the application version. To workaround this issue you need to upgrade database, please refer to the [official PostgreSQL documentation](https://www.postgresql.org/docs/current/upgrading.html) for more information about this. + +```console +$ kubectl logs $(kubectl get pods -l app.kubernetes.io/instance=postgresql,app.kubernetes.io/name=postgresql,app.kubernetes.io/component=primary -o jsonpath="{.items[0].metadata.name}") + ... +postgresql 08:10:14.72 INFO ==> ** Starting PostgreSQL ** +2022-02-01 08:10:14.734 GMT [1] FATAL: database files are incompatible with server +2022-02-01 08:10:14.734 GMT [1] DETAIL: The data directory was initialized by PostgreSQL version 11, which is not compatible with this version 14.1. +``` + +### To 10.0.0 + +[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. + +- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. +- Move dependency information from the _requirements.yaml_ to the _Chart.yaml_ +- After running _helm dependency update_, a _Chart.lock_ file is generated containing the same structure used in the previous _requirements.lock_ +- The different fields present in the _Chart.yaml_ file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Chart. +- The term _master_ has been replaced with _primary_ and _slave_ with _readReplicas_ throughout the chart. Role names have changed from _master_ and _slave_ to _primary_ and _read_. + +#### Considerations when upgrading to this version + +- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version does not support Helm v2 anymore. +- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3. + +#### Useful links + +- [Bitnami Tutorial](https://techdocs.broadcom.com/us/en/vmware-tanzu/application-catalog/tanzu-application-catalog/services/tac-doc/apps-tutorials-resolve-helm2-helm3-post-migration-issues-index.html) +- [Helm docs](https://helm.sh/docs/topics/v2_v3_migration) +- [Helm Blog](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3) + +#### How to upgrade to version 10.0.0 + +To upgrade to _10.0.0_ from _9.x_, it should be done reusing the PVC(s) used to hold the PostgreSQL data on your previous release. To do so, follow the instructions below (the following example assumes that the release name is _postgresql_): + +> NOTE: Please, create a backup of your database before running any of those actions. + +1. Obtain the credentials and the names of the PVCs used to hold the PostgreSQL data on your current release: + +```console +export POSTGRESQL_PASSWORD=$(kubectl get secret --namespace default postgresql -o jsonpath="{.data.postgresql-password}" | base64 --decode) +export POSTGRESQL_PVC=$(kubectl get pvc -l app.kubernetes.io/instance=postgresql,role=primary -o jsonpath="{.items[0].metadata.name}") +``` + +1. Delete the PostgreSQL statefulset (notice the option _--cascade=false_): + +```console +kubectl delete statefulsets.apps postgresql-postgresql --namespace default --cascade=false +``` + +1. Upgrade your release using the same PostgreSQL version: + +```console +helm upgrade postgresql bitnami/postgresql \ + --set postgresqlPassword=$POSTGRESQL_PASSWORD \ + --set persistence.existingClaim=$POSTGRESQL_PVC +``` + +1. Delete the existing PostgreSQL pod and the new statefulset will create a new one: + +```console +kubectl delete pod postgresql-postgresql-0 +``` + +1. Finally, you should see the lines below in PostgreSQL container logs: + +```text +$ kubectl logs $(kubectl get pods -l app.kubernetes.io/instance=postgresql,app.kubernetes.io/name=postgresql,role=primary -o jsonpath="{.items[0].metadata.name}") +... +postgresql 08:05:12.59 INFO ==> Deploying PostgreSQL with persisted data... +... +``` + +### To 9.0.0 + +In this version the chart was adapted to follow the [Helm standard labels](https://helm.sh/docs/chart_best_practices/labels/#standard-labels). + +- Some inmutable objects were modified to adopt Helm standard labels introducing backward incompatibilities. + +#### How to upgrade to version 9.0.0 + +To upgrade to _9.0.0_ from _8.x_, it should be done reusing the PVC(s) used to hold the PostgreSQL data on your previous release. To do so, follow the instructions below (the following example assumes that the release name is _postgresql_): + +> NOTE: Please, create a backup of your database before running any of those actions. + +1. Obtain the credentials and the names of the PVCs used to hold the PostgreSQL data on your current release: + +```console +export POSTGRESQL_PASSWORD=$(kubectl get secret --namespace default postgresql -o jsonpath="{.data.postgresql-password}" | base64 --decode) +export POSTGRESQL_PVC=$(kubectl get pvc -l app=postgresql,role=master -o jsonpath="{.items[0].metadata.name}") +``` + +1. Delete the PostgreSQL statefulset (notice the option _--cascade=false_): + +```console +kubectl delete statefulsets.apps postgresql-postgresql --namespace default --cascade=false +``` + +1. Upgrade your release using the same PostgreSQL version: + +```console +helm upgrade postgresql bitnami/postgresql \ + --set postgresqlPassword=$POSTGRESQL_PASSWORD \ + --set persistence.existingClaim=$POSTGRESQL_PVC +``` + +1. Delete the existing PostgreSQL pod and the new statefulset will create a new one: + +```console +kubectl delete pod postgresql-postgresql-0 +``` + +1. Finally, you should see the lines below in PostgreSQL container logs: + +```text +$ kubectl logs $(kubectl get pods -l app.kubernetes.io/instance=postgresql,app.kubernetes.io/name=postgresql,role=master -o jsonpath="{.items[0].metadata.name}") +... +postgresql 08:05:12.59 INFO ==> Deploying PostgreSQL with persisted data... +... +``` + +## License + +Copyright © 2025 Broadcom. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. \ No newline at end of file diff --git a/charts/postgresql/charts/common/.helmignore b/charts/postgresql/charts/common/.helmignore new file mode 100644 index 0000000..d0e1084 --- /dev/null +++ b/charts/postgresql/charts/common/.helmignore @@ -0,0 +1,26 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# img folder +img/ +# Changelog +CHANGELOG.md diff --git a/charts/postgresql/charts/common/CHANGELOG.md b/charts/postgresql/charts/common/CHANGELOG.md new file mode 100644 index 0000000..ffd0870 --- /dev/null +++ b/charts/postgresql/charts/common/CHANGELOG.md @@ -0,0 +1,639 @@ +# Changelog + +## 2.30.0 (2025-02-19) + +* [bitnami/common] Add helper to check API versions ([#31969](https://github.com/bitnami/charts/pull/31969)) + +## 2.29.1 (2025-01-23) + +* [bitnami/common] Removing seLinuxOptions from omission (#31279) ([e7cb168](https://github.com/bitnami/charts/commit/e7cb168ca2bccd57e28bb985e099953a4f7e3b38)), closes [#31279](https://github.com/bitnami/charts/issues/31279) [#31278](https://github.com/bitnami/charts/issues/31278) + +## 2.29.0 (2025-01-03) + +* [bitnami/common] Add "common.capabilities.job.apiVersion" template (#31164) ([2ca979a](https://github.com/bitnami/charts/commit/2ca979a6add279384d60e6b35199eaf13553cefa)), closes [#31164](https://github.com/bitnami/charts/issues/31164) + +## 2.28.0 (2024-12-10) + +* [bitnami/common] New helper to detect non-standard images (#30851) ([ae33d01](https://github.com/bitnami/charts/commit/ae33d01968e8a353a569785f9867827153c797dc)), closes [#30851](https://github.com/bitnami/charts/issues/30851) + +## 2.27.2 (2024-11-27) + +* [bitnami/common] Fix appVersion (#30628) ([b87d39e](https://github.com/bitnami/charts/commit/b87d39e27a0889c74b20c3d2fe5ae0c4a2417bfd)), closes [#30628](https://github.com/bitnami/charts/issues/30628) +* [bitnami/common]: bump patch version (#30639) ([623e584](https://github.com/bitnami/charts/commit/623e5846ff827b7ecbcffa2dc51e2e94b14ef8fd)), closes [#30639](https://github.com/bitnami/charts/issues/30639) + +## 2.27.1 (2024-11-26) + +* [bitnami/common] Fix VPA apiVersion (#30625) ([8c24438](https://github.com/bitnami/charts/commit/8c24438a2f6e8ec646cad9901ed82d71d4196e3e)), closes [#30625](https://github.com/bitnami/charts/issues/30625) + +## 2.27.0 (2024-11-07) + +* [bitnami/*] Remove wrong comment about imagePullPolicy (#30107) ([a51f9e4](https://github.com/bitnami/charts/commit/a51f9e4bb0fbf77199512d35de7ac8abe055d026)), closes [#30107](https://github.com/bitnami/charts/issues/30107) +* [bitnami/common] feat: :sparkles: Add honorProvidedValues in common.secrets.manage (#30243) ([3d76a49](https://github.com/bitnami/charts/commit/3d76a4955c11fa4d2464da2c4d2096e1e3c6fa37)), closes [#30243](https://github.com/bitnami/charts/issues/30243) +* Update documentation links to techdocs.broadcom.com (#29931) ([f0d9ad7](https://github.com/bitnami/charts/commit/f0d9ad78f39f633d275fc576d32eae78ded4d0b8)), closes [#29931](https://github.com/bitnami/charts/issues/29931) + +## 2.26.0 (2024-10-14) + +* [bitnami/common] Drop unused custom empty password validators (#29432) ([5fb0e97](https://github.com/bitnami/charts/commit/5fb0e97d9336d40d86c3295637d4233218b8afea)), closes [#29432](https://github.com/bitnami/charts/issues/29432) + +## 2.25.0 (2024-10-11) + +* [bitnami/common] Add the ability to specify namespaces for affinity (#29479) ([005e0d6](https://github.com/bitnami/charts/commit/005e0d696004dd972915f290b7caffb2bc332400)), closes [#29479](https://github.com/bitnami/charts/issues/29479) + +## 2.24.0 (2024-10-03) + +* [bitnami/common] Add common.tplvalues.merge-overwrite helper (#29668) ([611b2a5](https://github.com/bitnami/charts/commit/611b2a59e06feaac878b3b218fd848a687216158)), closes [#29668](https://github.com/bitnami/charts/issues/29668) + +## 2.23.0 (2024-09-13) + +* [bitnami/common] Add option to remove empty seLinuxOptions from securityContext in non OpenShift env ([7e44e64](https://github.com/bitnami/charts/commit/7e44e64626f5b1fc6d56889cdfdeadc1f62c7cf1)), closes [#28945](https://github.com/bitnami/charts/issues/28945) + +## 2.22.0 (2024-08-08) + +* [bitnami/common] Fallback to chart appVersion in common.images.image (#28764) ([b4aa0a6](https://github.com/bitnami/charts/commit/b4aa0a685a21c50ca10e41e3eb2023bbd4282cf7)), closes [#28764](https://github.com/bitnami/charts/issues/28764) + +## 2.21.0 (2024-08-05) + +* [bitnami/common] Allow handling of new secrets after initial installation (#28581) ([07062ee](https://github.com/bitnami/charts/commit/07062ee01382e24b8204b27083ff3e8102110c2f)), closes [#28581](https://github.com/bitnami/charts/issues/28581) + +## 2.20.5 (2024-07-16) + +* [bitnami/common] [bitnami/wordpress] Use global.storageClass for fallback, not override (#24863) ([2b78e13](https://github.com/bitnami/charts/commit/2b78e137ac278cdf9d54523e8d37833a4ff0cd5b)), closes [#24863](https://github.com/bitnami/charts/issues/24863) + +## 2.20.4 (2024-07-11) + +* [bitnami/*] Update README changing TAC wording (#27530) ([52dfed6](https://github.com/bitnami/charts/commit/52dfed6bac44d791efabfaf06f15daddc4fefb0c)), closes [#27530](https://github.com/bitnami/charts/issues/27530) +* [bitnami/common] Increase ephemeral-storage default limits (#27902) ([dc0000d](https://github.com/bitnami/charts/commit/dc0000d7b56f68991bb8d8fff473103ed9026f5f)), closes [#27902](https://github.com/bitnami/charts/issues/27902) + +## 2.20.3 (2024-06-17) + +* [bitnami/common] chore: :wrench: Relax large and xlarge presets resource requests (#27312) ([6ca69f6](https://github.com/bitnami/charts/commit/6ca69f6769d0f65acc850fa0bcc08506de50cc41)), closes [#27312](https://github.com/bitnami/charts/issues/27312) + +## 2.20.2 (2024-06-10) + +* [bitnami/common] remove trailing spaces from imagePullSecrets rendering (#26882) ([362d4ac](https://github.com/bitnami/charts/commit/362d4ac94dd69be1b607fc531ceac4d67d8d57ef)), closes [#26882](https://github.com/bitnami/charts/issues/26882) + +## 2.20.1 (2024-06-10) + +* [bitnami/common] improve renderSecurityContext (#27053) ([5f0bdde](https://github.com/bitnami/charts/commit/5f0bdde77cf05afa20cb4a800090748a8d102d02)), closes [#27053](https://github.com/bitnami/charts/issues/27053) + +## 2.20.0 (2024-06-05) + +* [bitnami/*] ci: :construction_worker: Add tag and changelog support (#25359) ([91c707c](https://github.com/bitnami/charts/commit/91c707c9e4e574725a09505d2d313fb93f1b4c0a)), closes [#25359](https://github.com/bitnami/charts/issues/25359) +* [bitnami/common] Capabilities to return latest apiVersion if kubeVersion is undefined (#26758) ([6582c32](https://github.com/bitnami/charts/commit/6582c3237b772af9cb379f7eaceddb2d64b507f0)), closes [#26758](https://github.com/bitnami/charts/issues/26758) +* [bitnami/common] docs: :memo: Add changelog ([23349c9](https://github.com/bitnami/charts/commit/23349c99b70313f3e19ebcf9d3e0c154836b2cc0)) + +## 2.19.3 (2024-05-20) + +* [bitnami/*] Change non-root and rolling-tags doc URLs (#25628) ([b067c94](https://github.com/bitnami/charts/commit/b067c94f6bcde427863c197fd355f0b5ba12ff5b)), closes [#25628](https://github.com/bitnami/charts/issues/25628) +* [bitnami/*] Set new header/owner (#25558) ([8d1dc11](https://github.com/bitnami/charts/commit/8d1dc11f5fb30db6fba50c43d7af59d2f79deed3)), closes [#25558](https://github.com/bitnami/charts/issues/25558) +* [bitnami/common] feat: :sparkles: Show warning when original images are replaced (#25952) ([855045a](https://github.com/bitnami/charts/commit/855045a1a62618154c1216e8da31a4d2c14c7586)), closes [#25952](https://github.com/bitnami/charts/issues/25952) + +## 2.19.2 (2024-04-29) + +* [bitnami/common] Simplify syntax to deal with nullable objects (#25446) ([7dcea6a](https://github.com/bitnami/charts/commit/7dcea6aeb7c45d56bd6175b457bb8a2cddf8defc)), closes [#25446](https://github.com/bitnami/charts/issues/25446) +* Replace VMware by Broadcom copyright text (#25306) ([a5e4bd0](https://github.com/bitnami/charts/commit/a5e4bd0e35e419203793976a78d9d0a13de92c76)), closes [#25306](https://github.com/bitnami/charts/issues/25306) + +## 2.19.1 (2024-03-27) + +* [bitnami/common] chore: :wrench: Relax preset resource requests xlarge and 2xlarge instances (#24713 ([fdd93bb](https://github.com/bitnami/charts/commit/fdd93bb2a2f73a7df3e498b5072736a54610a908)), closes [#24713](https://github.com/bitnami/charts/issues/24713) + +## 2.19.0 (2024-03-08) + +* [bitnami/common] feat: :sparkles: Remove empty seLinuxOptions in adapted Openshift rendered security ([1f2f5ef](https://github.com/bitnami/charts/commit/1f2f5ef476efba7f284df0c36c265216325ffda9)), closes [#24268](https://github.com/bitnami/charts/issues/24268) + +## 2.18.0 (2024-03-04) + +* [bitnami/common] feat: :sparkles: :lock: Add compatibility support for securityContext in Openshift ([8fb0dd4](https://github.com/bitnami/charts/commit/8fb0dd48b6d7ec69bb59db2376365f6d76b26d97)), closes [#24040](https://github.com/bitnami/charts/issues/24040) + +## 2.17.0 (2024-02-20) + +* [bitnami/*] Bump all versions (#23602) ([b70ee2a](https://github.com/bitnami/charts/commit/b70ee2a30e4dc256bf0ac52928fb2fa7a70f049b)), closes [#23602](https://github.com/bitnami/charts/issues/23602) + +## 2.16.1 (2024-02-19) + +* [bitnami/common] chore: :wrench: Bump ephemeral storage limits (#23564) ([18c4d88](https://github.com/bitnami/charts/commit/18c4d88f7d4ae93f36d0896fa66dbe872bba1c48)), closes [#23564](https://github.com/bitnami/charts/issues/23564) + +## 2.16.0 (2024-02-15) + +* [bitnami/common] feat: :sparkles: Add ephemeral-storage to resources preset (#23544) ([23b6856](https://github.com/bitnami/charts/commit/23b68563a0e2e721aa07864cff1b877e1d074388)), closes [#23544](https://github.com/bitnami/charts/issues/23544) + +## 2.15.3 (2024-02-14) + +* [bitnami/common] chore: :pencil2: Fix typo in comment ([d07fb32](https://github.com/bitnami/charts/commit/d07fb324bd6455bf8607f66c642ff346443199ba)) + +## 2.15.2 (2024-02-14) + +* [bitnami/common] fix: :children_crossing: Improve resource warning message (#23425) ([7593e4f](https://github.com/bitnami/charts/commit/7593e4fc69fb8c50f7d626cc305c5adc56d23f48)), closes [#23425](https://github.com/bitnami/charts/issues/23425) + +## 2.15.1 (2024-02-13) + +* [bitnami/common] fix: :bug: Check if section is enabled before printing resource warning ([262b6ee](https://github.com/bitnami/charts/commit/262b6ee64c57a5293333879ec423ad41c44f162c)) + +## 2.15.0 (2024-02-13) + +* [bitnami/*] Fix docs.bitnami.com broken links (#21901) ([f35506d](https://github.com/bitnami/charts/commit/f35506d2dadee4f097986e7792df1f53ab215b5d)), closes [#21901](https://github.com/bitnami/charts/issues/21901) +* [bitnami/*] Move documentation sections from docs.bitnami.com back to the README (#22203) ([7564f36](https://github.com/bitnami/charts/commit/7564f36ca1e95ff30ee686652b7ab8690561a707)), closes [#22203](https://github.com/bitnami/charts/issues/22203) +* [bitnami/*] Update copyright: Year and company (#21815) ([6c4bf75](https://github.com/bitnami/charts/commit/6c4bf75dec58fc7c9aee9f089777b1a858c17d5b)), closes [#21815](https://github.com/bitnami/charts/issues/21815) +* [bitnami/common] feat: :sparkles: Add support for resource presets (#23410) ([310d9f9](https://github.com/bitnami/charts/commit/310d9f9e44cb913a2e482f57107970ed5bde9a69)), closes [#23410](https://github.com/bitnami/charts/issues/23410) + +## 2.14.1 (2023-12-19) + +* [bitnami/common] Fix typo with new line in common.secrets.passwords.manage (#21653) ([7e70463](https://github.com/bitnami/charts/commit/7e704634ef564adac330f1e0a67feb2a40a271dc)), closes [#21653](https://github.com/bitnami/charts/issues/21653) + +## 2.14.0 (2023-12-19) + +* [bitnami/common] add params skipB64enc and skipQuote to common.secrets.passwords.manage (#21595) ([2070eeb](https://github.com/bitnami/charts/commit/2070eeb30bbf48639e0177a42f65a1d13f42a180)), closes [#21595](https://github.com/bitnami/charts/issues/21595) + +## 2.13.4 (2023-12-15) + +* [bitnami/*] Remove relative links to non-README sections, add verification for that and update TL;DR ([1103633](https://github.com/bitnami/charts/commit/11036334d82df0490aa4abdb591543cab6cf7d7f)), closes [#20967](https://github.com/bitnami/charts/issues/20967) +* [bitnami/*] Rename VMware Application Catalog (#20361) ([3acc734](https://github.com/bitnami/charts/commit/3acc73472beb6fb56c4d99f929061001205bc57e)), closes [#20361](https://github.com/bitnami/charts/issues/20361) +* [bitnami/common] fix failOnNew implementation in common.secrets.passwords.manage (#21342) ([76a5f24](https://github.com/bitnami/charts/commit/76a5f248fbceb3d1d948c7e60fbba74fd7eb3200)), closes [#21342](https://github.com/bitnami/charts/issues/21342) +* [bitnami/common] Standardize documentation (#20334) ([3af2426](https://github.com/bitnami/charts/commit/3af242606877aea25c623b4185e6fcd285b7308d)), closes [#20334](https://github.com/bitnami/charts/issues/20334) + +## 2.13.3 (2023-10-17) + +* [bitnami/*] Update Helm charts prerequisites (#19745) ([eb755dd](https://github.com/bitnami/charts/commit/eb755dd36a4dd3cf6635be8e0598f9a7f4c4a554)), closes [#19745](https://github.com/bitnami/charts/issues/19745) +* [bitnami/common]: Address admission configuration typo (#19840) ([9a936f1](https://github.com/bitnami/charts/commit/9a936f158646e101c2507421fdcb85b787bbaf64)), closes [#19840](https://github.com/bitnami/charts/issues/19840) + +## 2.13.2 (2023-10-05) + +* [bitnami/common] update imagePullSecrets to handle map and list format (#19702) ([1d30563](https://github.com/bitnami/charts/commit/1d30563bf53d4c0ac898cf1070af57aa28a039f1)), closes [#19702](https://github.com/bitnami/charts/issues/19702) + +## 2.13.1 (2023-10-04) + +* [bitnami/common] render labels correctly when they contains templates (#19680) ([3cb44e3](https://github.com/bitnami/charts/commit/3cb44e376a472ca6721866b09f6d0ab412338cbc)), closes [#19680](https://github.com/bitnami/charts/issues/19680) + +## 2.13.0 (2023-09-29) + +* [bitnami/common]: Add capabilities macros to manage Pod Security Standard objects (#19428) ([322b76d](https://github.com/bitnami/charts/commit/322b76d6450840f08d53ecfddb5e151cac5c9e88)), closes [#19428](https://github.com/bitnami/charts/issues/19428) + +## 2.12.1 (2023-09-29) + +* [bitnami/common] allow for empty appVersion (#19467) ([8b46a33](https://github.com/bitnami/charts/commit/8b46a3366abc7d216d16ace89675f3fc42691e8f)), closes [#19467](https://github.com/bitnami/charts/issues/19467) + +## 2.12.0 (2023-09-22) + +* [bitnami/common] new macro to checksum config resources (#19261) ([73945fe](https://github.com/bitnami/charts/commit/73945fedfa2acff03fe172430fcc4b8bcf55282f)), closes [#19261](https://github.com/bitnami/charts/issues/19261) +* Revert "Autogenerate schema files (#19194)" (#19335) ([73d80be](https://github.com/bitnami/charts/commit/73d80be525c88fb4b8a54451a55acd506e337062)), closes [#19194](https://github.com/bitnami/charts/issues/19194) [#19335](https://github.com/bitnami/charts/issues/19335) + +## 2.11.1 (2023-09-15) + +* Common - Adding app.kubernetes.io/version to common labels (#17201) ([9c497be](https://github.com/bitnami/charts/commit/9c497be9d99a98a20cd01e5858014e097ebe0eaa)), closes [#17201](https://github.com/bitnami/charts/issues/17201) + +## 2.11.0 (2023-09-12) + +* [bitnami/common] New helper to return image version (#19223) ([db46696](https://github.com/bitnami/charts/commit/db466964c6cfb3368ab87be6bb4d16f74d5c6fd0)), closes [#19223](https://github.com/bitnami/charts/issues/19223) +* Autogenerate schema files (#19194) ([a2c2090](https://github.com/bitnami/charts/commit/a2c2090b5ac97f47b745c8028c6452bf99739772)), closes [#19194](https://github.com/bitnami/charts/issues/19194) + +## 2.10.1 (2023-09-08) + +* [bitnami/common]: Compatiblity with Helm 3.2.0+ (#19177) ([e4fc03d](https://github.com/bitnami/charts/commit/e4fc03d96bef6ab0318d642fb65ba508c49844f1)), closes [#19177](https://github.com/bitnami/charts/issues/19177) + +## 2.10.0 (2023-09-04) + +* [bitnami/common] new macro to merge a list of values with rendering (#18889) ([0fb66f2](https://github.com/bitnami/charts/commit/0fb66f2c6f6828a240a0c1e6857c337bf9f4202a)), closes [#18889](https://github.com/bitnami/charts/issues/18889) + +## 2.9.2 (2023-08-31) + +* Avoid using a tpl when there is no template (#18792) ([134924a](https://github.com/bitnami/charts/commit/134924a260fe2cd758a954f34e89ccb14012f348)), closes [#18792](https://github.com/bitnami/charts/issues/18792) + +## 2.9.1 (2023-08-29) + +* [bitnami/common] Add extraLabelSelectors to affinities templates (#18127) ([b9ecfdb](https://github.com/bitnami/charts/commit/b9ecfdb3421a057b76e6f35f58c26e631c74e686)), closes [#18127](https://github.com/bitnami/charts/issues/18127) + +## 2.9.0 (2023-08-22) + +* [bitnami/common] Add support for customizing standard labels (#18154) ([9a20483](https://github.com/bitnami/charts/commit/9a20483cfd1daa6bfe08fd8116516a9bb5cd9754)), closes [#18154](https://github.com/bitnami/charts/issues/18154) + +## 2.8.0 (2023-08-07) + +* [bitnami/common] Delete app kubernetes version field (#18240) ([5fe3ee4](https://github.com/bitnami/charts/commit/5fe3ee44eed88e9b6843c70cbeb6378194b2276b)), closes [#18240](https://github.com/bitnami/charts/issues/18240) + +## 2.7.0 (2023-08-07) + +* Add app.kubernetes.io/version based on AppVersion (#18194) ([4f698f8](https://github.com/bitnami/charts/commit/4f698f8ac54fc68cd8dab433b7c2d8ffb77a4067)), closes [#18194](https://github.com/bitnami/charts/issues/18194) + +## 2.6.0 (2023-07-04) + +* [bitnami/common] Add scope for common.tplvalues.render (#17033) ([daf1b54](https://github.com/bitnami/charts/commit/daf1b5445a5e1c961ab78673899dd8007b4f1000)), closes [#17033](https://github.com/bitnami/charts/issues/17033) + +## 2.5.0 (2023-06-30) + +* [bitnami/*] Change copyright section in READMEs (#17006) ([ef986a1](https://github.com/bitnami/charts/commit/ef986a1605241102b3dcafe9fd8089e6fc1201ad)), closes [#17006](https://github.com/bitnami/charts/issues/17006) +* [bitnami/common] Update common.secrets.passwords.manage and common.secrets.lookup (#17397) ([5a73cf1](https://github.com/bitnami/charts/commit/5a73cf19f92b93d88ee766669a947375135db903)), closes [#17397](https://github.com/bitnami/charts/issues/17397) +* [bitnami/several] Change copyright section in READMEs (#16989) ([5b6a5cf](https://github.com/bitnami/charts/commit/5b6a5cfb7625a751848a2e5cd796bd7278f406ca)), closes [#16989](https://github.com/bitnami/charts/issues/16989) +* Add copyright header (#17300) ([da68be8](https://github.com/bitnami/charts/commit/da68be8e951225133c7dfb572d5101ca3d61c5ae)), closes [#17300](https://github.com/bitnami/charts/issues/17300) +* Update charts readme (#17217) ([31b3c0a](https://github.com/bitnami/charts/commit/31b3c0afd968ff4429107e34101f7509e6a0e913)), closes [#17217](https://github.com/bitnami/charts/issues/17217) + +## 2.4.0 (2023-05-18) + +* [bitnami/common] feat: :sparkles: Add apiVersions for DaemonSet and VPA ([a86cfaf](https://github.com/bitnami/charts/commit/a86cfaf0acb7cc26a7a91256f4b76db8f31797ef)) + +## 2.3.0 (2023-05-12) + +* Add wording for enterprise page (#16560) ([8f22774](https://github.com/bitnami/charts/commit/8f2277440b976d52785ba9149762ad8620a73d1f)), closes [#16560](https://github.com/bitnami/charts/issues/16560) +* Remove duplicate in image pull secrets (#16529) ([ddfea70](https://github.com/bitnami/charts/commit/ddfea70831875639cb298a555ad6dd5e68f059e4)), closes [#16529](https://github.com/bitnami/charts/issues/16529) + +## 2.2.6 (2023-05-09) + +* [bitnami/several] Adapt Chart.yaml to set desired OCI annotations (#16546) ([fc9b18f](https://github.com/bitnami/charts/commit/fc9b18f2e98805d4df629acbcde696f44f973344)), closes [#16546](https://github.com/bitnami/charts/issues/16546) + +## 2.2.5 (2023-05-02) + +* [bitnami/*] Make Helm charts 100% OCI (#15998) ([8841510](https://github.com/bitnami/charts/commit/884151035efcbf2e1b3206e7def85511073fb57d)), closes [#15998](https://github.com/bitnami/charts/issues/15998) +* [bitnami/common] Fix typo in README.md to test chart publishing from GitHub (#16143) ([5b05ec3](https://github.com/bitnami/charts/commit/5b05ec32caa73240d38135e19501ab2658397d2e)), closes [#16143](https://github.com/bitnami/charts/issues/16143) + +## 2.2.4 (2023-03-07) + +* [bitnami/*] Fix markdown linter issues (#14874) ([a51e0e8](https://github.com/bitnami/charts/commit/a51e0e8d35495b907f3e70dd2f8e7c3bcbf4166a)), closes [#14874](https://github.com/bitnami/charts/issues/14874) +* [bitnami/*] Fix markdown linter issues 2 (#14890) ([aa96572](https://github.com/bitnami/charts/commit/aa9657237ee8df4a46db0d7fdf8a23230dd6902a)), closes [#14890](https://github.com/bitnami/charts/issues/14890) +* [bitnami/common] Allow empty registry name (#15296) ([f13df7b](https://github.com/bitnami/charts/commit/f13df7b00f38e5fce67eab7a1b78afb0b064344e)), closes [#15296](https://github.com/bitnami/charts/issues/15296) + +## 2.2.3 (2023-02-03) + +* [bitnami/*] Add license annotation and remove obsolete engine parameter (#14293) ([da2a794](https://github.com/bitnami/charts/commit/da2a7943bae95b6e9b5b4ed972c15e990b69fdb0)), closes [#14293](https://github.com/bitnami/charts/issues/14293) +* [bitnami/*] Change copyright date (#14682) ([add4ec7](https://github.com/bitnami/charts/commit/add4ec701108ac36ed4de2dffbdf407a0d091067)), closes [#14682](https://github.com/bitnami/charts/issues/14682) +* [bitnami/*] Change licenses annotation format (#14377) ([0ab7608](https://github.com/bitnami/charts/commit/0ab760862c660fcc78cffadf8e1d8cdd70881473)), closes [#14377](https://github.com/bitnami/charts/issues/14377) +* [bitnami/*] Unify READMEs (#14472) ([2064fb8](https://github.com/bitnami/charts/commit/2064fb8dcc78a845cdede8211af8c3cc52551161)), closes [#14472](https://github.com/bitnami/charts/issues/14472) +* [bitnami/common] chore: Correct common.images.image global in example (#14735) ([69ada7d](https://github.com/bitnami/charts/commit/69ada7da0c9c6b7ce718faef6920c61e3632fd02)), closes [#14735](https://github.com/bitnami/charts/issues/14735) + +## 2.2.2 (2022-12-12) + +* [bitnami/common] resolve namespace using common.names.namespace macro (#13481) ([35b84e8](https://github.com/bitnami/charts/commit/35b84e8ba209681d4f160ca102188af61307fccf)), closes [#13481](https://github.com/bitnami/charts/issues/13481) + +## 2.2.1 (2022-11-25) + +* [bitnami/common] fix common topology key affinity function (#13593) ([f95dec8](https://github.com/bitnami/charts/commit/f95dec803bd138b76d67a296545974c5a644d63e)), closes [#13593](https://github.com/bitnami/charts/issues/13593) + +## 2.2.0 (2022-11-14) + +* [bitnami/common] affinity topologyKey override (#13435) ([624c14e](https://github.com/bitnami/charts/commit/624c14e7121557e6a29ff0e814cb800c2f3cf619)), closes [#13435](https://github.com/bitnami/charts/issues/13435) +* [bitnami/common] Fixed naming of common.secrets.passwords.manage function in README (#13250) ([39a8bcb](https://github.com/bitnami/charts/commit/39a8bcbb1b606cc165643ae4ddcdc15f05e91583)), closes [#13250](https://github.com/bitnami/charts/issues/13250) + +## 2.1.2 (2022-10-31) + +* [bitnami/common] Do not explicitly specify namespace in affinity term. (#12932) ([638a48e](https://github.com/bitnami/charts/commit/638a48e4d3ec7b5d160f4b525ec40218512c464b)), closes [#12932](https://github.com/bitnami/charts/issues/12932) [#12668](https://github.com/bitnami/charts/issues/12668) + +## 2.1.1 (2022-10-27) + +* [bitnami/common] Fix appVersion mismatch (#13189) ([42b3b3e](https://github.com/bitnami/charts/commit/42b3b3e6c68e6af8ba19f7ec42be0d71b4c21852)), closes [#13189](https://github.com/bitnami/charts/issues/13189) + +## 2.1.0 (2022-10-27) + +* [bitnami/common] Add new function 'common.secrets.lookup' (#13150) ([e848934](https://github.com/bitnami/charts/commit/e84893410321b88adbd7d2e40b891685a15ce640)), closes [#13150](https://github.com/bitnami/charts/issues/13150) + +## 2.0.4 (2022-10-24) + +* [bitnami/*] Use new default branch name in links (#12943) ([a529e02](https://github.com/bitnami/charts/commit/a529e02597d49d944eba1eb0f190713293247176)), closes [#12943](https://github.com/bitnami/charts/issues/12943) +* [bitnami/common] kubernetes.io/tls-acme Ingress annotation triggers IngressTLS array (#13054) ([2008857](https://github.com/bitnami/charts/commit/200885790b34afd6fd04ea45949c887a907b6b38)), closes [#13054](https://github.com/bitnami/charts/issues/13054) +* [bitnami/common] quote secret value when lookup (#11276) ([c8e3019](https://github.com/bitnami/charts/commit/c8e301965f05996a2ae18e0fc8dbfcbe64428356)), closes [#11276](https://github.com/bitnami/charts/issues/11276) + +## 2.0.3 (2022-09-12) + +* [bitnami/common] Revert changes in HPA context from #12282 (#12372) ([55fdc3a](https://github.com/bitnami/charts/commit/55fdc3aff3e32502abfd8f0607ac2be54e585744)), closes [#12282](https://github.com/bitnami/charts/issues/12282) [#12372](https://github.com/bitnami/charts/issues/12372) + +## 2.0.2 (2022-09-05) + +* fix context for HPA util (#12282) ([ccd54a0](https://github.com/bitnami/charts/commit/ccd54a0d47a96903f499fbcdb52a336863020efe)), closes [#12282](https://github.com/bitnami/charts/issues/12282) + +## 2.0.1 (2022-08-23) + +* [bitnami/common] Digest/Tag new approach backward compatible (#12029) ([f1c27dc](https://github.com/bitnami/charts/commit/f1c27dc5d9540c2ea192abf1245da67f5b4f8916)), closes [#12029](https://github.com/bitnami/charts/issues/12029) + +## 2.0.0 (2022-08-18) + +* [bitnami/common] MAJOR: Add support for image digest apart from tag (#11830) ([e3fee4e](https://github.com/bitnami/charts/commit/e3fee4e41d34a6584660c3b77b8521922603ccab)), closes [#11830](https://github.com/bitnami/charts/issues/11830) + +## 1.17.1 (2022-08-18) + +* Revert changes from #11797 (#11829) ([22bb033](https://github.com/bitnami/charts/commit/22bb033224176c498920596c8d8b25b5f60a277d)), closes [#11797](https://github.com/bitnami/charts/issues/11797) [#11829](https://github.com/bitnami/charts/issues/11829) + +## 1.17.0 (2022-08-18) + +* [bitnami/common] Add support for image digest apart from tag (#11797) ([b069345](https://github.com/bitnami/charts/commit/b0693450f653318ac7da64575dac389d7041b69f)), closes [#11797](https://github.com/bitnami/charts/issues/11797) + +## 1.16.1 (2022-07-13) + +* [bitnami/*] Replace Kubeapps URL in READMEs (and kubeapps Chart.yaml) and remove BKPR references (#1 ([c6a7914](https://github.com/bitnami/charts/commit/c6a7914361e5aea6016fb45bf4d621edfd111d32)), closes [#10600](https://github.com/bitnami/charts/issues/10600) +* [bitnami/common] Affinities section does not use common.names.namespace (#11137) ([b70c24c](https://github.com/bitnami/charts/commit/b70c24c82c7a9112a4288441ad1fa8c035bb68b4)), closes [#11137](https://github.com/bitnami/charts/issues/11137) + +## 1.16.0 (2022-06-03) + +* [bitnami/common] Add mysql validation (#10565) ([75ae79a](https://github.com/bitnami/charts/commit/75ae79a434137694fd82198abe1f861d6e5a04ba)), closes [#10565](https://github.com/bitnami/charts/issues/10565) + +## 1.15.2 (2022-06-02) + +* Update Redis trademark references ([2cada87](https://github.com/bitnami/charts/commit/2cada87ed4967d5cb578b0409a0bb1edee79029a)) + +## 1.15.1 (2022-06-01) + +* [bitnami/several] Replace maintainers email by url (#10523) ([ff3cf61](https://github.com/bitnami/charts/commit/ff3cf617a1680509b0f3855d17c4ccff7b29a0ff)), closes [#10523](https://github.com/bitnami/charts/issues/10523) + +## 1.15.0 (2022-06-01) + +* Add common function common.names.fullname.namespace (#10462) ([96f447c](https://github.com/bitnami/charts/commit/96f447cd8654b6db51d9301c841bacb3a13089b3)), closes [#10462](https://github.com/bitnami/charts/issues/10462) + +## 1.14.2 (2022-05-30) + +* [bitnami/common] use -d flag for base64 (#10491) ([ca8d588](https://github.com/bitnami/charts/commit/ca8d5886a1bc0fb37d1bc770ad2333acdffd7996)), closes [#10491](https://github.com/bitnami/charts/issues/10491) [#10486](https://github.com/bitnami/charts/issues/10486) + +## 1.14.1 (2022-05-20) + +* Differentiate between autoscaling v1beta1 and v1beta2 (#10331) ([16d8a4e](https://github.com/bitnami/charts/commit/16d8a4ee73705ee6db2191d84e03a2ba3ea95deb)), closes [#10331](https://github.com/bitnami/charts/issues/10331) + +## 1.14.0 (2022-05-13) + +* [bitnami/common] Add common function for HPA api version (#10174) ([4379ab5](https://github.com/bitnami/charts/commit/4379ab56bd8f4d7f7b7817bf302c683bf9087e81)), closes [#10174](https://github.com/bitnami/charts/issues/10174) + +## 1.13.1 (2022-04-19) + +* Fix affinities identifier in README.md for common chart (#9821) ([fe95640](https://github.com/bitnami/charts/commit/fe95640ce3f5ddfb0458f440959ceda3a849a3a4)), closes [#9821](https://github.com/bitnami/charts/issues/9821) + +## 1.13.0 (2022-03-24) + +* [bitnami/common] Add apiService.apiVersion function to common.capabilities (#9562) ([bba2272](https://github.com/bitnami/charts/commit/bba227223e15937bb1f29f77425f6bd7d9238c02)), closes [#9562](https://github.com/bitnami/charts/issues/9562) + +## 1.12.0 (2022-03-16) + +* [bitnami/common] Helper to allow overriding namespace name (#9396) ([794fecb](https://github.com/bitnami/charts/commit/794fecb8cb112e8e5e9d55420451752e8bd21431)), closes [#9396](https://github.com/bitnami/charts/issues/9396) + +## 1.11.3 (2022-03-03) + +* [bitnami/common] Improve docs for passwords.manage (#9269) ([0d06114](https://github.com/bitnami/charts/commit/0d061147a5b7c7cf2bf44d2b61603ffeb48a0b51)), closes [#9269](https://github.com/bitnami/charts/issues/9269) + +## 1.11.2 (2022-02-28) + +* [bitnami/common] README: Fixed the desscription for `common.labels.matchLabels` (#9062) ([7f17db7](https://github.com/bitnami/charts/commit/7f17db7e9bcdd7918bde322b3b76a62c6a86e752)), closes [#9062](https://github.com/bitnami/charts/issues/9062) [bitnami/charts#9060](https://github.com/bitnami/charts/issues/9060) [bitnami/charts#9060](https://github.com/bitnami/charts/issues/9060) + +## 1.11.1 (2022-02-02) + +* [bitnami/common] Improve "common.secrets.passwords.manage" helper (#8861) ([01477b4](https://github.com/bitnami/charts/commit/01477b42f2be362388d69da913879c52f2250ac1)), closes [#8861](https://github.com/bitnami/charts/issues/8861) + +## 1.11.0 (2022-02-01) + +* [bitnami/common] Add ingress helper to detect cert-manager annotations (#8857) ([c0c986f](https://github.com/bitnami/charts/commit/c0c986f8d5c911c09dc84d289d2993ae1779a6ca)), closes [#8857](https://github.com/bitnami/charts/issues/8857) + +## 1.10.4 (2022-01-20) + +* [bitnami/several] Add license to the README ([05f7633](https://github.com/bitnami/charts/commit/05f763372501d596e57db713dd53ff4ff3027cc4)) +* [bitnami/several] Add license to the README ([32fb238](https://github.com/bitnami/charts/commit/32fb238e60a0affc6debd3142eaa3c3d9089ec2a)) +* [bitnami/several] Add license to the README ([b87c2f7](https://github.com/bitnami/charts/commit/b87c2f7899d48a8b02c506765e6ae82937e9ba3f)) +* [bitnami/several] Change prerequisites (#8725) ([8d740c5](https://github.com/bitnami/charts/commit/8d740c566cfdb7e2d933c40128b4e919fce953a5)), closes [#8725](https://github.com/bitnami/charts/issues/8725) + +## 1.10.3 (2021-11-29) + +* [bitnami/common] fix: :bug: Add extra check for "\"\"" values in existing secrets (#8266) ([de27be6](https://github.com/bitnami/charts/commit/de27be6e649472608f076a04a36be3674fe3b84e)), closes [#8266](https://github.com/bitnami/charts/issues/8266) + +## 1.10.2 (2021-11-29) + +* [bitnami/several] Replace HTTP by HTTPS when possible (#8259) ([eafb5bd](https://github.com/bitnami/charts/commit/eafb5bd5a2cc3aaf04fc1e8ebedd73f420d76864)), closes [#8259](https://github.com/bitnami/charts/issues/8259) + +## 1.10.1 (2021-10-27) + +* [bitnami/*] Mark PodSecurityPolicy resources as deprecated (#7948) ([5cac753](https://github.com/bitnami/charts/commit/5cac7539dcb6c3baef06ed6676bfa99c16fdb5fe)), closes [#7948](https://github.com/bitnami/charts/issues/7948) + +## 1.10.0 (2021-09-30) + +* [bitnami/common] Add new capability helper for Network Policies (#7658) ([3efb1ca](https://github.com/bitnami/charts/commit/3efb1cac924409cbda3216a2300cce031c56a1f5)), closes [#7658](https://github.com/bitnami/charts/issues/7658) + +## 1.9.1 (2021-09-22) + +* [bitnami/common] fix readme for common chart (#7577) ([3f06bdd](https://github.com/bitnami/charts/commit/3f06bdd8df1c00dbdf27230bcdf925c337826abb)), closes [#7577](https://github.com/bitnami/charts/issues/7577) +* Fix typo in bitname/common README (#7529) ([fccffb3](https://github.com/bitnami/charts/commit/fccffb33391751a1bf84c53184cffe0dcac83fd6)), closes [#7529](https://github.com/bitnami/charts/issues/7529) + +## 1.9.0 (2021-09-13) + +* [bitnami/common] Add new dependency fullname template (#7471) ([7ca2a4b](https://github.com/bitnami/charts/commit/7ca2a4bb917ac6a276a6b30be12538f4c7c3a63d)), closes [#7471](https://github.com/bitnami/charts/issues/7471) + +## 1.8.0 (2021-08-04) + +* Add cronjob apiVersion capability (#7122) ([7b84a67](https://github.com/bitnami/charts/commit/7b84a674ae99fd8ddac3b5b3c859c816b87aaf51)), closes [#7122](https://github.com/bitnami/charts/issues/7122) + +## 1.7.1 (2021-07-27) + +* [bitnami/*] Adapt values.yaml of common library, Tomcat, Wavefront and ZooKeeper charts (#6970) ([fb2693b](https://github.com/bitnami/charts/commit/fb2693bfe67a154b159d3998232cc613e1706c70)), closes [#6970](https://github.com/bitnami/charts/issues/6970) +* [bitnami/several] Bump version and update READMEs (#7069) ([6340bff](https://github.com/bitnami/charts/commit/6340bff66f93c8c797bda3ca0842e4bf770059f1)), closes [#7069](https://github.com/bitnami/charts/issues/7069) +* Replace strings with ™ in the README files (#7066) ([d298b49](https://github.com/bitnami/charts/commit/d298b4996da33c9580c2594e6dc8ad665dd0ebab)), closes [#7066](https://github.com/bitnami/charts/issues/7066) + +## 1.7.0 (2021-07-02) + +* [bitnami/common] Add supportIngressClassname (#6828) ([0c8a455](https://github.com/bitnami/charts/commit/0c8a45546a219b4b4cd370daf0643543c92739b0)), closes [#6828](https://github.com/bitnami/charts/issues/6828) + +## 1.6.1 (2021-06-16) + +* [bitnami/common] extend common.labels.matchLabels with .Values.extraMatchLabels (#6589) ([66edf04](https://github.com/bitnami/charts/commit/66edf04e3e244c343a845f9c684edf4c8ea04406)), closes [#6589](https://github.com/bitnami/charts/issues/6589) + +## 1.6.0 (2021-06-15) + +* bitnami/common: add version detection for policy api (#6662) ([dcacf06](https://github.com/bitnami/charts/commit/dcacf06f6f2b6d622e2226935db22d5b8efa20b3)), closes [#6662](https://github.com/bitnami/charts/issues/6662) + +## 1.5.2 (2021-05-21) + +* [bitnami/common] Update _ingress.tpl (#6437) ([9048150](https://github.com/bitnami/charts/commit/90481508542c4da588e0d71944592e6c4e8d36e4)), closes [#6437](https://github.com/bitnami/charts/issues/6437) + +## 1.5.1 (2021-05-14) + +* Node affinity values must be quoted. (#6348) ([f73efbe](https://github.com/bitnami/charts/commit/f73efbe074436eda6276bbf32c781fa913c6a17a)), closes [#6348](https://github.com/bitnami/charts/issues/6348) + +## 1.5.0 (2021-05-13) + +* [bitnami/common] pull secrets rendering (#6286) ([dfffe74](https://github.com/bitnami/charts/commit/dfffe74c212a28e27f537dbee54c3b5a81c7d572)), closes [#6286](https://github.com/bitnami/charts/issues/6286) + +## 1.4.3 (2021-04-26) + +* [bitnami/common] Update Redis validation's helper (#6192) ([1e3bf03](https://github.com/bitnami/charts/commit/1e3bf03e3aad56fd4dc159744626e25ec24c5772)), closes [#6192](https://github.com/bitnami/charts/issues/6192) + +## 1.4.2 (2021-03-25) + +* [bitnami/common] Common credential error (#5884) ([328ca86](https://github.com/bitnami/charts/commit/328ca863515f6ef9fe188c71110be7b951719d66)), closes [#5884](https://github.com/bitnami/charts/issues/5884) + +## 1.4.1 (2021-02-23) + +* [bitnami/common] Add possibility to pull images without giving registry name (#5582) ([15ca275](https://github.com/bitnami/charts/commit/15ca27520a16b590101fa39195f55017e2935a90)), closes [#5582](https://github.com/bitnami/charts/issues/5582) + +## 1.4.0 (2021-02-22) + +* [bitnami/common] Add RBAC/CRD apiVersion support for versions 1.22+ (#5583) ([fda87aa](https://github.com/bitnami/charts/commit/fda87aabcd004f9a67549f5d22d273dd9fff6836)), closes [#5583](https://github.com/bitnami/charts/issues/5583) + +## 1.3.9 (2021-02-09) + +* Add registered icon to all the MongoDB references (#5426) ([56f2088](https://github.com/bitnami/charts/commit/56f20884267e56175695b2917f7704b9510f4ba6)), closes [#5426](https://github.com/bitnami/charts/issues/5426) + +## 1.3.8 (2021-02-03) + +* fix(common): quote namespace name (#5363) ([d27fb5e](https://github.com/bitnami/charts/commit/d27fb5e0b327728bb4304503376aaa4d2ab50619)), closes [#5363](https://github.com/bitnami/charts/issues/5363) + +## 1.3.7 (2021-01-20) + +* [bitnami/*] Change helm version in the prerequisites (#5090) ([c5e67a3](https://github.com/bitnami/charts/commit/c5e67a388743cbee28439d2cabca27884b9daf97)), closes [#5090](https://github.com/bitnami/charts/issues/5090) +* [bitnami/common] Remove helm version checker from secret helper (#5156) ([20231b1](https://github.com/bitnami/charts/commit/20231b138fae524371e6b29504acd4cbd19ce697)), closes [#5156](https://github.com/bitnami/charts/issues/5156) + +## 1.3.6 (2021-01-18) + +* [bitnami/common] same behavior with empty string when the secret obje… (#5057) ([0bae2bb](https://github.com/bitnami/charts/commit/0bae2bbb9b42c5a8dd2b8a144ffa55ace1c8a936)), closes [#5057](https://github.com/bitnami/charts/issues/5057) + +## 1.3.5 (2021-01-17) + +* [bitnami/common] fix wrong include reference (#5056) ([11efd59](https://github.com/bitnami/charts/commit/11efd59177419d4177e59800f04b4f26ab7243f8)), closes [#5056](https://github.com/bitnami/charts/issues/5056) + +## 1.3.4 (2021-01-15) + +* [bitnami/common] Fix lookup function backward compatibility and README (#5018) ([14a0042](https://github.com/bitnami/charts/commit/14a0042dc90c01fd38f814e1e43559384a3baa9f)), closes [#5018](https://github.com/bitnami/charts/issues/5018) + +## 1.3.3 (2021-01-14) + +* [bitnami/several] Add Redis trademark (#5023) ([dfa89b8](https://github.com/bitnami/charts/commit/dfa89b865989da26a3c73f397fd3c402dd56ebe8)), closes [#5023](https://github.com/bitnami/charts/issues/5023) + +## 1.3.2 (2021-01-13) + +* [bitnami/common] Add missing else statement to ingress apiversion ([22ab07a](https://github.com/bitnami/charts/commit/22ab07ac7d39d4153cc839de2b714086e99cfc04)) + +## 1.3.1 (2021-01-13) + +* [bitnami/common] Fix cases where ingress is not at the root (#4984) ([e447d9d](https://github.com/bitnami/charts/commit/e447d9d2205fc3f2f6cd990386a691fd9204b214)), closes [#4984](https://github.com/bitnami/charts/issues/4984) + +## 1.3.0 (2021-01-13) + +* [bitnami/*] POC Lookup function implementation (#4831) ([240dc1b](https://github.com/bitnami/charts/commit/240dc1bea80a3e121fd595636496d7941bdbc5e0)), closes [#4831](https://github.com/bitnami/charts/issues/4831) + +## 1.2.3 (2020-12-31) + +* [bitnami/common] Fix incorrect backend calculation for networking/v1beta1 ([c59b869](https://github.com/bitnami/charts/commit/c59b86919f47504bc8fd06f75a024f55e58ace77)) + +## 1.2.2 (2020-12-30) + +* [bitnami/common] Fix typo in common.capabilities.kubeVersion ([a371b73](https://github.com/bitnami/charts/commit/a371b734b854aa81a7dec16c40d061f5e9a14875)) + +## 1.2.1 (2020-12-30) + +* [bitnami/common] Fix issue with global kubeversion calculation ([0bbb339](https://github.com/bitnami/charts/commit/0bbb339d60b41ab978e759863709ebb1451d07a4)) + +## 1.2.0 (2020-12-30) + +* [bitnami/common] Make ingress rules compatible with all Kubernetes versions (#4859) ([2b22a21](https://github.com/bitnami/charts/commit/2b22a217020fe3d16ef98fdcdd4a562c43f9824a)), closes [#4859](https://github.com/bitnami/charts/issues/4859) + +## 1.1.4 (2020-12-23) + +* [bitnami/common] fix: moving kube version comparison (#4804) ([cdb6ae8](https://github.com/bitnami/charts/commit/cdb6ae8f00d114f0998c604416b79f62dc27f19d)), closes [#4804](https://github.com/bitnami/charts/issues/4804) + +## 1.1.3 (2020-12-18) + +* [bitnami/*] fix typos (#4699) ([49adc63](https://github.com/bitnami/charts/commit/49adc63b672da976c55af2e077aa5648a357b77f)), closes [#4699](https://github.com/bitnami/charts/issues/4699) +* [bitnami/common] Adding networking apiVersion support for versions 1.19+ (#4776) ([5ed8c54](https://github.com/bitnami/charts/commit/5ed8c54f5e0a905effc4c1ae5c4931e6669cec30)), closes [#4776](https://github.com/bitnami/charts/issues/4776) + +## 1.1.2 (2020-12-11) + +* [bitnami/common] Fix node affinity templates (#4692) ([5b51a5c](https://github.com/bitnami/charts/commit/5b51a5c004b062282849a4abaaffd6840bb6c95f)), closes [#4692](https://github.com/bitnami/charts/issues/4692) + +## 1.1.1 (2020-11-26) + +* fix: mongodb validation auth (#4506) ([ca3fdfb](https://github.com/bitnami/charts/commit/ca3fdfbeebeba5bd7dfa4805e1ca2411e5950b09)), closes [#4506](https://github.com/bitnami/charts/issues/4506) + +## 1.1.0 (2020-11-26) + +* [bitnami/common] Add mongodb validation template (#4497) ([14ece96](https://github.com/bitnami/charts/commit/14ece96c801a7326935b6269423d8854fed3a49e)), closes [#4497](https://github.com/bitnami/charts/issues/4497) + +## 1.0.1 (2020-11-19) + +* [bitnami/common] existingSecret is in auth map (#4389) ([de9b217](https://github.com/bitnami/charts/commit/de9b2177465e1c56ca2aa1c4c486bd37a7104d7a)), closes [#4389](https://github.com/bitnami/charts/issues/4389) + +## 1.0.0 (2020-11-10) + +* bitnami/common Major version. Adapt Chart to apiVersion: v2 (#4258) ([09dbc45](https://github.com/bitnami/charts/commit/09dbc45d11c5e8fe65d6eb64dbf51571ad2c7464)), closes [#4258](https://github.com/bitnami/charts/issues/4258) + +## 0.10.0 (2020-10-27) + +* [bitnami/common] feat: add cassandra passwords validations (#4110) ([b4923d4](https://github.com/bitnami/charts/commit/b4923d48018dff1673a32eefcc0d62eb484b36da)), closes [#4110](https://github.com/bitnami/charts/issues/4110) + +## 0.9.0 (2020-10-21) + +* [bitnami/common] feat: add redis passwords validations (#4070) ([0daa8d5](https://github.com/bitnami/charts/commit/0daa8d580c06e18d94dbc0e88467347a34418596)), closes [#4070](https://github.com/bitnami/charts/issues/4070) + +## 0.8.2 (2020-10-14) + +* [bitnami/common] Allow backward compatibility for existingSecret (#4006) ([aa2b3a1](https://github.com/bitnami/charts/commit/aa2b3a18610c69b2f5c76b839483db43fa3c093c)), closes [#4006](https://github.com/bitnami/charts/issues/4006) + +## 0.8.1 (2020-10-05) + +* [bitnami/common] Fix secret name bug with defaulNameSuffix. (#3888) ([d114d44](https://github.com/bitnami/charts/commit/d114d446ef86cb6e7a72de6542905ec3b07d3684)) + +## 0.8.0 (2020-10-02) + +* [bitnami/common] Add statefulset capabilities and prepare MariaDB passwords validation for new forma ([1eb4436](https://github.com/bitnami/charts/commit/1eb44366a72e39e84e33bed1a4940c1b2c6025fc)), closes [#3859](https://github.com/bitnami/charts/issues/3859) + +## 0.7.1 (2020-09-22) + +* [bitnami/common] fix: evaluate enabled as string (#3733) ([048cdae](https://github.com/bitnami/charts/commit/048cdae5488cfcfe83ec698afaa8318aa3b1d0ca)), closes [#3733](https://github.com/bitnami/charts/issues/3733) + +## 0.7.0 (2020-09-22) + +* [bitnami/metrics-server] Add source repo (#3577) ([1ed12f9](https://github.com/bitnami/charts/commit/1ed12f96af75322b46afdb2b3d9907c11b13f765)), closes [#3577](https://github.com/bitnami/charts/issues/3577) +* PoC for pods' affinity (#3713) ([9e6a915](https://github.com/bitnami/charts/commit/9e6a915392979f0c0148875f34cca1c27e399b59)), closes [#3713](https://github.com/bitnami/charts/issues/3713) + +## 0.6.2 (2020-09-01) + +* [bitnami/common] fix: wrong use of append function (#3566) ([c912fd0](https://github.com/bitnami/charts/commit/c912fd0b7378bf2d5d56182e6d2fa6bbd74df46f)), closes [#3566](https://github.com/bitnami/charts/issues/3566) + +## 0.6.1 (2020-08-31) + +* [bitnami/common] fix: mariadb checks secret fields after check enabled (#3565) ([498056a](https://github.com/bitnami/charts/commit/498056ad16a6e89aa3b7cc231da7467ab5bd3986)), closes [#3565](https://github.com/bitnami/charts/issues/3565) + +## 0.6.0 (2020-08-19) + +* [bitnami/mariadb] Require password option at secret resource (#3411) ([a8d2464](https://github.com/bitnami/charts/commit/a8d24643756470d0280fc585b01397358c1c242d)), closes [#3411](https://github.com/bitnami/charts/issues/3411) + +## 0.5.2 (2020-08-19) + +* [bitnami/common] fix: add global parameters to postgres validation (#3460) ([1c52a2a](https://github.com/bitnami/charts/commit/1c52a2a48ea65024a753eb5b32deadd46650fb18)), closes [#3460](https://github.com/bitnami/charts/issues/3460) + +## 0.5.1 (2020-08-10) + +* fix(common): missing $ in required values helpers (#3376) ([c972152](https://github.com/bitnami/charts/commit/c972152762c14c5ab5e3847a4870f4f4f2a31224)), closes [#3376](https://github.com/bitnami/charts/issues/3376) + +## 0.5.0 (2020-08-10) + +* [bitnami/common] add psql and mysql required password validations (#3374) ([1a4419e](https://github.com/bitnami/charts/commit/1a4419e15d985f67413beff98c9fc9b9f69108fb)), closes [#3374](https://github.com/bitnami/charts/issues/3374) + +## 0.4.0 (2020-08-04) + +* [bitnami/*] Fix TL;DR typo in READMEs (#3280) ([3d7ab40](https://github.com/bitnami/charts/commit/3d7ab406fecd64f1af25f53e7d27f03ec95b29a4)), closes [#3280](https://github.com/bitnami/charts/issues/3280) +* [bitnami/all] Add categories (#3075) ([63bde06](https://github.com/bitnami/charts/commit/63bde066b87a140fab52264d0522401ab3d63509)), closes [#3075](https://github.com/bitnami/charts/issues/3075) +* Add common helpers to check secrets when upgrade (#3150) ([5a5807c](https://github.com/bitnami/charts/commit/5a5807c1b1db1f2337f6aa5308d3ff73a4329e6a)), closes [#3150](https://github.com/bitnami/charts/issues/3150) + +## 0.3.1 (2020-06-05) + +* [bitnami/several] Fix table rendering in some hubs (#2770) ([fe9fd8c](https://github.com/bitnami/charts/commit/fe9fd8c261195385aae73e165ac6c1a666fef08e)), closes [#2770](https://github.com/bitnami/charts/issues/2770) + +## 0.3.0 (2020-06-02) + +* [bitnami/common]: add template function for ingress apiVersion (#2732) ([a968a50](https://github.com/bitnami/charts/commit/a968a50916ed9fa6f823a5a3ef6e4b98d615322f)), closes [#2732](https://github.com/bitnami/charts/issues/2732) + +## 0.2.4 (2020-05-29) + +* [bitnami/common] Bump chart version (#2707) ([ff2c37a](https://github.com/bitnami/charts/commit/ff2c37a576191f4523c7f69504aea669ab68aba8)), closes [#2707](https://github.com/bitnami/charts/issues/2707) +* [bitnami/several] Fix trailing spaces to make helm lint work on all of them (#2705) ([bafba3f](https://github.com/bitnami/charts/commit/bafba3fc8b8949897ad2d99d437bd8fc975223e4)), closes [#2705](https://github.com/bitnami/charts/issues/2705) + +## 0.2.3 (2020-05-26) + +* fix(common): add name attribute to imagePullSecrets helper (#2664) ([1ea21a9](https://github.com/bitnami/charts/commit/1ea21a92a8f44bd0d82d0fd4ed30108a89cf5b34)), closes [#2664](https://github.com/bitnami/charts/issues/2664) + +## 0.2.2 (2020-05-19) + +* update bitnami/common to be compatible with helm v2.12+ (#2615) ([c7751eb](https://github.com/bitnami/charts/commit/c7751eb5764e468e1854b58a1b8491d2b13e0a4a)), closes [#2615](https://github.com/bitnami/charts/issues/2615) + +## 0.2.1 (2020-05-13) + +* bump bitnami/common version number (#2580) ([1bd1e7b](https://github.com/bitnami/charts/commit/1bd1e7bc776614b6ae10f21e9c8b23fe15db5ff4)), closes [#2580](https://github.com/bitnami/charts/issues/2580) + +## 0.2.0 (2020-04-17) + +* [bitnami/common] add secrets and warnings helpers (#2347) ([a748ff8](https://github.com/bitnami/charts/commit/a748ff82259d6553a0d4ca56ca6d7d050de859f4)), closes [#2347](https://github.com/bitnami/charts/issues/2347) + +## 0.1.1 (2020-04-08) + +* [bitnami/common] bitnami common add values yaml (#2267) ([a88c902](https://github.com/bitnami/charts/commit/a88c90212021771eacc562dd38c04381e2f63d6f)), closes [#2267](https://github.com/bitnami/charts/issues/2267) + +## 0.1.0 (2020-04-03) + +* [bitnami/common]: add initial functions (#2188) ([9401e13](https://github.com/bitnami/charts/commit/9401e13316992c36b0e33de75d5f249645a2924e)), closes [#2188](https://github.com/bitnami/charts/issues/2188) diff --git a/charts/postgresql/charts/common/Chart.yaml b/charts/postgresql/charts/common/Chart.yaml new file mode 100644 index 0000000..0959857 --- /dev/null +++ b/charts/postgresql/charts/common/Chart.yaml @@ -0,0 +1,26 @@ +# Copyright Broadcom, Inc. All Rights Reserved. +# SPDX-License-Identifier: APACHE-2.0 + +annotations: + category: Infrastructure + licenses: Apache-2.0 +apiVersion: v2 +# Please make sure that version and appVersion are always the same. +appVersion: 2.30.0 +description: A Library Helm Chart for grouping common logic between bitnami charts. This chart is not deployable by itself. +home: https://bitnami.com +icon: https://dyltqmyl993wv.cloudfront.net/downloads/logos/bitnami-mark.png +keywords: + - common + - helper + - template + - function + - bitnami +maintainers: + - name: Broadcom, Inc. All Rights Reserved. + url: https://github.com/bitnami/charts +name: common +sources: + - https://github.com/bitnami/charts/tree/main/bitnami/common +type: library +version: 2.30.0 diff --git a/charts/postgresql/charts/common/README.md b/charts/postgresql/charts/common/README.md new file mode 100644 index 0000000..0e5f649 --- /dev/null +++ b/charts/postgresql/charts/common/README.md @@ -0,0 +1,235 @@ +# Bitnami Common Library Chart + +A [Helm Library Chart](https://helm.sh/docs/topics/library_charts/#helm) for grouping common logic between Bitnami charts. + +## TL;DR + +```yaml +dependencies: + - name: common + version: 2.x.x + repository: oci://registry-1.docker.io/bitnamicharts +``` + +```console +helm dependency update +``` + +```yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "common.names.fullname" . }} +data: + myvalue: "Hello World" +``` + +Looking to use our applications in production? Try [VMware Tanzu Application Catalog](https://bitnami.com/enterprise), the commercial edition of the Bitnami catalog. + +## Introduction + +This chart provides a common template helpers which can be used to develop new charts using [Helm](https://helm.sh) package manager. + +Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters. + +## Prerequisites + +- Kubernetes 1.23+ +- Helm 3.8.0+ + +## Parameters + +## Special input schemas + +### ImageRoot + +```yaml +registry: + type: string + description: Docker registry where the image is located + example: docker.io + +repository: + type: string + description: Repository and image name + example: bitnami/nginx + +tag: + type: string + description: image tag + example: 1.16.1-debian-10-r63 + +pullPolicy: + type: string + description: Specify a imagePullPolicy.' + +pullSecrets: + type: array + items: + type: string + description: Optionally specify an array of imagePullSecrets (evaluated as templates). + +debug: + type: boolean + description: Set to true if you would like to see extra information on logs + example: false + +## An instance would be: +# registry: docker.io +# repository: bitnami/nginx +# tag: 1.16.1-debian-10-r63 +# pullPolicy: IfNotPresent +# debug: false +``` + +### Persistence + +```yaml +enabled: + type: boolean + description: Whether enable persistence. + example: true + +storageClass: + type: string + description: Ghost data Persistent Volume Storage Class, If set to "-", storageClassName: "" which disables dynamic provisioning. + example: "-" + +accessMode: + type: string + description: Access mode for the Persistent Volume Storage. + example: ReadWriteOnce + +size: + type: string + description: Size the Persistent Volume Storage. + example: 8Gi + +path: + type: string + description: Path to be persisted. + example: /bitnami + +## An instance would be: +# enabled: true +# storageClass: "-" +# accessMode: ReadWriteOnce +# size: 8Gi +# path: /bitnami +``` + +### ExistingSecret + +```yaml +name: + type: string + description: Name of the existing secret. + example: mySecret +keyMapping: + description: Mapping between the expected key name and the name of the key in the existing secret. + type: object + +## An instance would be: +# name: mySecret +# keyMapping: +# password: myPasswordKey +``` + +#### Example of use + +When we store sensitive data for a deployment in a secret, some times we want to give to users the possibility of using theirs existing secrets. + +```yaml +# templates/secret.yaml +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.names.fullname" . }} + labels: + app: {{ include "common.names.fullname" . }} +type: Opaque +data: + password: {{ .Values.password | b64enc | quote }} + +# templates/dpl.yaml +--- +... + env: + - name: PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "common.secrets.name" (dict "existingSecret" .Values.existingSecret "context" $) }} + key: {{ include "common.secrets.key" (dict "existingSecret" .Values.existingSecret "key" "password") }} +... + +# values.yaml +--- +name: mySecret +keyMapping: + password: myPasswordKey +``` + +### ValidateValue + +#### NOTES.txt + +```console +{{- $validateValueConf00 := (dict "valueKey" "path.to.value00" "secret" "secretName" "field" "password-00") -}} +{{- $validateValueConf01 := (dict "valueKey" "path.to.value01" "secret" "secretName" "field" "password-01") -}} + +{{ include "common.validations.values.multiple.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} +``` + +If we force those values to be empty we will see some alerts + +```console +helm install test mychart --set path.to.value00="",path.to.value01="" + 'path.to.value00' must not be empty, please add '--set path.to.value00=$PASSWORD_00' to the command. To get the current value: + + export PASSWORD_00=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-00}" | base64 -d) + + 'path.to.value01' must not be empty, please add '--set path.to.value01=$PASSWORD_01' to the command. To get the current value: + + export PASSWORD_01=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-01}" | base64 -d) +``` + +## Upgrading + +### To 1.0.0 + +[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. + +#### What changes were introduced in this major version? + +- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. +- Use `type: library`. [Here](https://v3.helm.sh/docs/faq/#library-chart-support) you can find more information. +- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts + +#### Considerations when upgrading to this version + +- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues +- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore +- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 + +#### Useful links + +- +- +- + +## License + +Copyright © 2025 Broadcom. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/charts/postgresql/charts/common/templates/_affinities.tpl b/charts/postgresql/charts/common/templates/_affinities.tpl new file mode 100644 index 0000000..d387dbe --- /dev/null +++ b/charts/postgresql/charts/common/templates/_affinities.tpl @@ -0,0 +1,155 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} + +{{/* +Return a soft nodeAffinity definition +{{ include "common.affinities.nodes.soft" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes.soft" -}} +preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: {{ .key }} + operator: In + values: + {{- range .values }} + - {{ . | quote }} + {{- end }} + weight: 1 +{{- end -}} + +{{/* +Return a hard nodeAffinity definition +{{ include "common.affinities.nodes.hard" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes.hard" -}} +requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: {{ .key }} + operator: In + values: + {{- range .values }} + - {{ . | quote }} + {{- end }} +{{- end -}} + +{{/* +Return a nodeAffinity definition +{{ include "common.affinities.nodes" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes" -}} + {{- if eq .type "soft" }} + {{- include "common.affinities.nodes.soft" . -}} + {{- else if eq .type "hard" }} + {{- include "common.affinities.nodes.hard" . -}} + {{- end -}} +{{- end -}} + +{{/* +Return a topologyKey definition +{{ include "common.affinities.topologyKey" (dict "topologyKey" "BAR") -}} +*/}} +{{- define "common.affinities.topologyKey" -}} +{{ .topologyKey | default "kubernetes.io/hostname" -}} +{{- end -}} + +{{/* +Return a soft podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods.soft" (dict "component" "FOO" "customLabels" .Values.podLabels "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "extraPodAffinityTerms" .Values.extraPodAffinityTerms "extraNamespaces" (list "namespace1" "namespace2") "context" $) -}} +*/}} +{{- define "common.affinities.pods.soft" -}} +{{- $component := default "" .component -}} +{{- $customLabels := default (dict) .customLabels -}} +{{- $extraMatchLabels := default (dict) .extraMatchLabels -}} +{{- $extraPodAffinityTerms := default (list) .extraPodAffinityTerms -}} +{{- $extraNamespaces := default (list) .extraNamespaces -}} +preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" .context )) | nindent 10 }} + {{- if not (empty $component) }} + {{ printf "app.kubernetes.io/component: %s" $component }} + {{- end }} + {{- range $key, $value := $extraMatchLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- if $extraNamespaces }} + namespaces: + - {{ .context.Release.Namespace }} + {{- with $extraNamespaces }} + {{ include "common.tplvalues.render" (dict "value" . "context" $) | nindent 8 }} + {{- end }} + {{- end }} + topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }} + weight: 1 + {{- range $extraPodAffinityTerms }} + - podAffinityTerm: + labelSelector: + matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" $.context )) | nindent 10 }} + {{- if not (empty $component) }} + {{ printf "app.kubernetes.io/component: %s" $component }} + {{- end }} + {{- range $key, $value := .extraMatchLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }} + weight: {{ .weight | default 1 -}} + {{- end -}} +{{- end -}} + +{{/* +Return a hard podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods.hard" (dict "component" "FOO" "customLabels" .Values.podLabels "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "extraPodAffinityTerms" .Values.extraPodAffinityTerms "extraNamespaces" (list "namespace1" "namespace2") "context" $) -}} +*/}} +{{- define "common.affinities.pods.hard" -}} +{{- $component := default "" .component -}} +{{- $customLabels := default (dict) .customLabels -}} +{{- $extraMatchLabels := default (dict) .extraMatchLabels -}} +{{- $extraPodAffinityTerms := default (list) .extraPodAffinityTerms -}} +{{- $extraNamespaces := default (list) .extraNamespaces -}} +requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" .context )) | nindent 8 }} + {{- if not (empty $component) }} + {{ printf "app.kubernetes.io/component: %s" $component }} + {{- end }} + {{- range $key, $value := $extraMatchLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- if $extraNamespaces }} + namespaces: + - {{ .context.Release.Namespace }} + {{- with $extraNamespaces }} + {{ include "common.tplvalues.render" (dict "value" . "context" $) | nindent 8 }} + {{- end }} + {{- end }} + topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }} + {{- range $extraPodAffinityTerms }} + - labelSelector: + matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" $.context )) | nindent 8 }} + {{- if not (empty $component) }} + {{ printf "app.kubernetes.io/component: %s" $component }} + {{- end }} + {{- range $key, $value := .extraMatchLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }} + {{- end -}} +{{- end -}} + +{{/* +Return a podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.pods" -}} + {{- if eq .type "soft" }} + {{- include "common.affinities.pods.soft" . -}} + {{- else if eq .type "hard" }} + {{- include "common.affinities.pods.hard" . -}} + {{- end -}} +{{- end -}} diff --git a/charts/postgresql/charts/common/templates/_capabilities.tpl b/charts/postgresql/charts/common/templates/_capabilities.tpl new file mode 100644 index 0000000..6423fb1 --- /dev/null +++ b/charts/postgresql/charts/common/templates/_capabilities.tpl @@ -0,0 +1,253 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} + +{{/* +Return the target Kubernetes version +*/}} +{{- define "common.capabilities.kubeVersion" -}} +{{- default (default .Capabilities.KubeVersion.Version .Values.kubeVersion) ((.Values.global).kubeVersion) -}} +{{- end -}} + +{{/* +Return true if the apiVersion is supported +Usage: +{{ include "common.capabilities.apiVersions.has" (dict "version" "batch/v1" "context" $) }} +*/}} +{{- define "common.capabilities.apiVersions.has" -}} +{{- $providedAPIVersions := default .context.Values.apiVersions ((.context.Values.global).apiVersions) -}} +{{- if and (empty $providedAPIVersions) (.context.Capabilities.APIVersions.Has .version) -}} + {{- true -}} +{{- else if has .version $providedAPIVersions -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for poddisruptionbudget. +*/}} +{{- define "common.capabilities.policy.apiVersion" -}} +{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}} +{{- if and (not (empty $kubeVersion)) (semverCompare "<1.21-0" $kubeVersion) -}} +{{- print "policy/v1beta1" -}} +{{- else -}} +{{- print "policy/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for networkpolicy. +*/}} +{{- define "common.capabilities.networkPolicy.apiVersion" -}} +{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}} +{{- if and (not (empty $kubeVersion)) (semverCompare "<1.7-0" $kubeVersion) -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for job. +*/}} +{{- define "common.capabilities.job.apiVersion" -}} +{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}} +{{- if and (not (empty $kubeVersion)) (semverCompare "<1.21-0" $kubeVersion) -}} +{{- print "batch/v1beta1" -}} +{{- else -}} +{{- print "batch/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for cronjob. +*/}} +{{- define "common.capabilities.cronjob.apiVersion" -}} +{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}} +{{- if and (not (empty $kubeVersion)) (semverCompare "<1.21-0" $kubeVersion) -}} +{{- print "batch/v1beta1" -}} +{{- else -}} +{{- print "batch/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for daemonset. +*/}} +{{- define "common.capabilities.daemonset.apiVersion" -}} +{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}} +{{- if and (not (empty $kubeVersion)) (semverCompare "<1.14-0" $kubeVersion) -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for deployment. +*/}} +{{- define "common.capabilities.deployment.apiVersion" -}} +{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}} +{{- if and (not (empty $kubeVersion)) (semverCompare "<1.14-0" $kubeVersion) -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for statefulset. +*/}} +{{- define "common.capabilities.statefulset.apiVersion" -}} +{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}} +{{- if and (not (empty $kubeVersion)) (semverCompare "<1.14-0" $kubeVersion) -}} +{{- print "apps/v1beta1" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for ingress. +*/}} +{{- define "common.capabilities.ingress.apiVersion" -}} +{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}} +{{- if (.Values.ingress).apiVersion -}} +{{- .Values.ingress.apiVersion -}} +{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.14-0" $kubeVersion) -}} +{{- print "extensions/v1beta1" -}} +{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.19-0" $kubeVersion) -}} +{{- print "networking.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end }} +{{- end -}} + +{{/* +Return the appropriate apiVersion for RBAC resources. +*/}} +{{- define "common.capabilities.rbac.apiVersion" -}} +{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}} +{{- if and (not (empty $kubeVersion)) (semverCompare "<1.17-0" $kubeVersion) -}} +{{- print "rbac.authorization.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "rbac.authorization.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for CRDs. +*/}} +{{- define "common.capabilities.crd.apiVersion" -}} +{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}} +{{- if and (not (empty $kubeVersion)) (semverCompare "<1.19-0" $kubeVersion) -}} +{{- print "apiextensions.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "apiextensions.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for APIService. +*/}} +{{- define "common.capabilities.apiService.apiVersion" -}} +{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}} +{{- if and (not (empty $kubeVersion)) (semverCompare "<1.10-0" $kubeVersion) -}} +{{- print "apiregistration.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "apiregistration.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for Horizontal Pod Autoscaler. +*/}} +{{- define "common.capabilities.hpa.apiVersion" -}} +{{- $kubeVersion := include "common.capabilities.kubeVersion" .context -}} +{{- if and (not (empty $kubeVersion)) (semverCompare "<1.23-0" $kubeVersion) -}} +{{- if .beta2 -}} +{{- print "autoscaling/v2beta2" -}} +{{- else -}} +{{- print "autoscaling/v2beta1" -}} +{{- end -}} +{{- else -}} +{{- print "autoscaling/v2" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for Vertical Pod Autoscaler. +*/}} +{{- define "common.capabilities.vpa.apiVersion" -}} +{{- $kubeVersion := include "common.capabilities.kubeVersion" .context -}} +{{- if and (not (empty $kubeVersion)) (semverCompare "<1.11-0" $kubeVersion) -}} +{{- print "autoscaling/v1beta1" -}} +{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.25-0" $kubeVersion) -}} +{{- print "autoscaling/v1beta2" -}} +{{- else -}} +{{- print "autoscaling/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if PodSecurityPolicy is supported +*/}} +{{- define "common.capabilities.psp.supported" -}} +{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}} +{{- if or (empty $kubeVersion) (semverCompare "<1.25-0" $kubeVersion) -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if AdmissionConfiguration is supported +*/}} +{{- define "common.capabilities.admissionConfiguration.supported" -}} +{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}} +{{- if or (empty $kubeVersion) (not (semverCompare "<1.23-0" $kubeVersion)) -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for AdmissionConfiguration. +*/}} +{{- define "common.capabilities.admissionConfiguration.apiVersion" -}} +{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}} +{{- if and (not (empty $kubeVersion)) (semverCompare "<1.23-0" $kubeVersion) -}} +{{- print "apiserver.config.k8s.io/v1alpha1" -}} +{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.25-0" $kubeVersion) -}} +{{- print "apiserver.config.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "apiserver.config.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for PodSecurityConfiguration. +*/}} +{{- define "common.capabilities.podSecurityConfiguration.apiVersion" -}} +{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}} +{{- if and (not (empty $kubeVersion)) (semverCompare "<1.23-0" $kubeVersion) -}} +{{- print "pod-security.admission.config.k8s.io/v1alpha1" -}} +{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.25-0" $kubeVersion) -}} +{{- print "pod-security.admission.config.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "pod-security.admission.config.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if the used Helm version is 3.3+. +A way to check the used Helm version was not introduced until version 3.3.0 with .Capabilities.HelmVersion, which contains an additional "{}}" structure. +This check is introduced as a regexMatch instead of {{ if .Capabilities.HelmVersion }} because checking for the key HelmVersion in <3.3 results in a "interface not found" error. +**To be removed when the catalog's minimun Helm version is 3.3** +*/}} +{{- define "common.capabilities.supportsHelmVersion" -}} +{{- if regexMatch "{(v[0-9])*[^}]*}}$" (.Capabilities | toString ) }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/charts/postgresql/charts/common/templates/_compatibility.tpl b/charts/postgresql/charts/common/templates/_compatibility.tpl new file mode 100644 index 0000000..19c26db --- /dev/null +++ b/charts/postgresql/charts/common/templates/_compatibility.tpl @@ -0,0 +1,46 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} + +{{/* +Return true if the detected platform is Openshift +Usage: +{{- include "common.compatibility.isOpenshift" . -}} +*/}} +{{- define "common.compatibility.isOpenshift" -}} +{{- if .Capabilities.APIVersions.Has "security.openshift.io/v1" -}} +{{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Render a compatible securityContext depending on the platform. By default it is maintained as it is. In other platforms like Openshift we remove default user/group values that do not work out of the box with the restricted-v1 SCC +Usage: +{{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) -}} +*/}} +{{- define "common.compatibility.renderSecurityContext" -}} +{{- $adaptedContext := .secContext -}} + +{{- if (((.context.Values.global).compatibility).openshift) -}} + {{- if or (eq .context.Values.global.compatibility.openshift.adaptSecurityContext "force") (and (eq .context.Values.global.compatibility.openshift.adaptSecurityContext "auto") (include "common.compatibility.isOpenshift" .context)) -}} + {{/* Remove incompatible user/group values that do not work in Openshift out of the box */}} + {{- $adaptedContext = omit $adaptedContext "fsGroup" "runAsUser" "runAsGroup" -}} + {{- if not .secContext.seLinuxOptions -}} + {{/* If it is an empty object, we remove it from the resulting context because it causes validation issues */}} + {{- $adaptedContext = omit $adaptedContext "seLinuxOptions" -}} + {{- end -}} + {{- end -}} +{{- end -}} +{{/* Remove empty seLinuxOptions object if global.compatibility.omitEmptySeLinuxOptions is set to true */}} +{{- if and (((.context.Values.global).compatibility).omitEmptySeLinuxOptions) (not .secContext.seLinuxOptions) -}} + {{- $adaptedContext = omit $adaptedContext "seLinuxOptions" -}} +{{- end -}} +{{/* Remove fields that are disregarded when running the container in privileged mode */}} +{{- if $adaptedContext.privileged -}} + {{- $adaptedContext = omit $adaptedContext "capabilities" -}} +{{- end -}} +{{- omit $adaptedContext "enabled" | toYaml -}} +{{- end -}} diff --git a/charts/postgresql/charts/common/templates/_errors.tpl b/charts/postgresql/charts/common/templates/_errors.tpl new file mode 100644 index 0000000..93f3ffc --- /dev/null +++ b/charts/postgresql/charts/common/templates/_errors.tpl @@ -0,0 +1,85 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Throw error when upgrading using empty passwords values that must not be empty. + +Usage: +{{- $validationError00 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password00" "secret" "secretName" "field" "password-00") -}} +{{- $validationError01 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password01" "secret" "secretName" "field" "password-01") -}} +{{ include "common.errors.upgrade.passwords.empty" (dict "validationErrors" (list $validationError00 $validationError01) "context" $) }} + +Required password params: + - validationErrors - String - Required. List of validation strings to be return, if it is empty it won't throw error. + - context - Context - Required. Parent context. +*/}} +{{- define "common.errors.upgrade.passwords.empty" -}} + {{- $validationErrors := join "" .validationErrors -}} + {{- if and $validationErrors .context.Release.IsUpgrade -}} + {{- $errorString := "\nPASSWORDS ERROR: You must provide your current passwords when upgrading the release." -}} + {{- $errorString = print $errorString "\n Note that even after reinstallation, old credentials may be needed as they may be kept in persistent volume claims." -}} + {{- $errorString = print $errorString "\n Further information can be obtained at https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues/#credential-errors-while-upgrading-chart-releases" -}} + {{- $errorString = print $errorString "\n%s" -}} + {{- printf $errorString $validationErrors | fail -}} + {{- end -}} +{{- end -}} + +{{/* +Throw error when original container images are replaced. +The error can be bypassed by setting the "global.security.allowInsecureImages" to true. In this case, +a warning message will be shown instead. + +Usage: +{{ include "common.errors.insecureImages" (dict "images" (list .Values.path.to.the.imageRoot) "context" $) }} +*/}} +{{- define "common.errors.insecureImages" -}} +{{- $relocatedImages := list -}} +{{- $replacedImages := list -}} +{{- $retaggedImages := list -}} +{{- $globalRegistry := ((.context.Values.global).imageRegistry) -}} +{{- $originalImages := .context.Chart.Annotations.images -}} +{{- range .images -}} + {{- $registryName := default .registry $globalRegistry -}} + {{- $fullImageNameNoTag := printf "%s/%s" $registryName .repository -}} + {{- $fullImageName := printf "%s:%s" $fullImageNameNoTag .tag -}} + {{- if not (contains $fullImageNameNoTag $originalImages) -}} + {{- if not (contains $registryName $originalImages) -}} + {{- $relocatedImages = append $relocatedImages $fullImageName -}} + {{- else if not (contains .repository $originalImages) -}} + {{- $replacedImages = append $replacedImages $fullImageName -}} + {{- end -}} + {{- end -}} + {{- if not (contains (printf "%s:%s" .repository .tag) $originalImages) -}} + {{- $retaggedImages = append $retaggedImages $fullImageName -}} + {{- end -}} +{{- end -}} + +{{- if and (or (gt (len $relocatedImages) 0) (gt (len $replacedImages) 0)) (((.context.Values.global).security).allowInsecureImages) -}} + {{- print "\n\n⚠ SECURITY WARNING: Verifying original container images was skipped. Please note this Helm chart was designed, tested, and validated on multiple platforms using a specific set of Bitnami and Tanzu Application Catalog containers. Substituting other containers is likely to cause degraded security and performance, broken chart features, and missing environment variables.\n" -}} +{{- else if (or (gt (len $relocatedImages) 0) (gt (len $replacedImages) 0)) -}} + {{- $errorString := "Original containers have been substituted for unrecognized ones. Deploying this chart with non-standard containers is likely to cause degraded security and performance, broken chart features, and missing environment variables." -}} + {{- $errorString = print $errorString "\n\nUnrecognized images:" -}} + {{- range (concat $relocatedImages $replacedImages) -}} + {{- $errorString = print $errorString "\n - " . -}} + {{- end -}} + {{- if or (contains "docker.io/bitnami/" $originalImages) (contains "docker.io/bitnamiprem/" $originalImages) -}} + {{- $errorString = print "\n\n⚠ ERROR: " $errorString -}} + {{- $errorString = print $errorString "\n\nIf you are sure you want to proceed with non-standard containers, you can skip container image verification by setting the global parameter 'global.security.allowInsecureImages' to true." -}} + {{- $errorString = print $errorString "\nFurther information can be obtained at https://github.com/bitnami/charts/issues/30850" -}} + {{- print $errorString | fail -}} + {{- else if gt (len $replacedImages) 0 -}} + {{- $errorString = print "\n\n⚠ WARNING: " $errorString -}} + {{- print $errorString -}} + {{- end -}} +{{- else if gt (len $retaggedImages) 0 -}} + {{- $warnString := "\n\n⚠ WARNING: Original containers have been retagged. Please note this Helm chart was tested, and validated on multiple platforms using a specific set of Tanzu Application Catalog containers. Substituting original image tags could cause unexpected behavior." -}} + {{- $warnString = print $warnString "\n\nRetagged images:" -}} + {{- range $retaggedImages -}} + {{- $warnString = print $warnString "\n - " . -}} + {{- end -}} + {{- print $warnString -}} +{{- end -}} +{{- end -}} \ No newline at end of file diff --git a/charts/postgresql/charts/common/templates/_images.tpl b/charts/postgresql/charts/common/templates/_images.tpl new file mode 100644 index 0000000..76bb7ce --- /dev/null +++ b/charts/postgresql/charts/common/templates/_images.tpl @@ -0,0 +1,115 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Return the proper image name. +If image tag and digest are not defined, termination fallbacks to chart appVersion. +{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" .Values.global "chart" .Chart ) }} +*/}} +{{- define "common.images.image" -}} +{{- $registryName := default .imageRoot.registry ((.global).imageRegistry) -}} +{{- $repositoryName := .imageRoot.repository -}} +{{- $separator := ":" -}} +{{- $termination := .imageRoot.tag | toString -}} + +{{- if not .imageRoot.tag }} + {{- if .chart }} + {{- $termination = .chart.AppVersion | toString -}} + {{- end -}} +{{- end -}} +{{- if .imageRoot.digest }} + {{- $separator = "@" -}} + {{- $termination = .imageRoot.digest | toString -}} +{{- end -}} +{{- if $registryName }} + {{- printf "%s/%s%s%s" $registryName $repositoryName $separator $termination -}} +{{- else -}} + {{- printf "%s%s%s" $repositoryName $separator $termination -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead) +{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }} +*/}} +{{- define "common.images.pullSecrets" -}} + {{- $pullSecrets := list }} + + {{- range ((.global).imagePullSecrets) -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets .name -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets . -}} + {{- end }} + {{- end -}} + + {{- range .images -}} + {{- range .pullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets .name -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets . -}} + {{- end -}} + {{- end -}} + {{- end -}} + + {{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: + {{- range $pullSecrets | uniq }} + - name: {{ . }} + {{- end }} + {{- end }} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names evaluating values as templates +{{ include "common.images.renderPullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $) }} +*/}} +{{- define "common.images.renderPullSecrets" -}} + {{- $pullSecrets := list }} + {{- $context := .context }} + + {{- range (($context.Values.global).imagePullSecrets) -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" $context)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}} + {{- end -}} + {{- end -}} + + {{- range .images -}} + {{- range .pullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" $context)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}} + {{- end -}} + {{- end -}} + {{- end -}} + + {{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: + {{- range $pullSecrets | uniq }} + - name: {{ . }} + {{- end }} + {{- end }} +{{- end -}} + +{{/* +Return the proper image version (ingores image revision/prerelease info & fallbacks to chart appVersion) +{{ include "common.images.version" ( dict "imageRoot" .Values.path.to.the.image "chart" .Chart ) }} +*/}} +{{- define "common.images.version" -}} +{{- $imageTag := .imageRoot.tag | toString -}} +{{/* regexp from https://github.com/Masterminds/semver/blob/23f51de38a0866c5ef0bfc42b3f735c73107b700/version.go#L41-L44 */}} +{{- if regexMatch `^([0-9]+)(\.[0-9]+)?(\.[0-9]+)?(-([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?(\+([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?$` $imageTag -}} + {{- $version := semver $imageTag -}} + {{- printf "%d.%d.%d" $version.Major $version.Minor $version.Patch -}} +{{- else -}} + {{- print .chart.AppVersion -}} +{{- end -}} +{{- end -}} + diff --git a/charts/postgresql/charts/common/templates/_ingress.tpl b/charts/postgresql/charts/common/templates/_ingress.tpl new file mode 100644 index 0000000..7d2b879 --- /dev/null +++ b/charts/postgresql/charts/common/templates/_ingress.tpl @@ -0,0 +1,73 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} + +{{/* +Generate backend entry that is compatible with all Kubernetes API versions. + +Usage: +{{ include "common.ingress.backend" (dict "serviceName" "backendName" "servicePort" "backendPort" "context" $) }} + +Params: + - serviceName - String. Name of an existing service backend + - servicePort - String/Int. Port name (or number) of the service. It will be translated to different yaml depending if it is a string or an integer. + - context - Dict - Required. The context for the template evaluation. +*/}} +{{- define "common.ingress.backend" -}} +{{- $apiVersion := (include "common.capabilities.ingress.apiVersion" .context) -}} +{{- if or (eq $apiVersion "extensions/v1beta1") (eq $apiVersion "networking.k8s.io/v1beta1") -}} +serviceName: {{ .serviceName }} +servicePort: {{ .servicePort }} +{{- else -}} +service: + name: {{ .serviceName }} + port: + {{- if typeIs "string" .servicePort }} + name: {{ .servicePort }} + {{- else if or (typeIs "int" .servicePort) (typeIs "float64" .servicePort) }} + number: {{ .servicePort | int }} + {{- end }} +{{- end -}} +{{- end -}} + +{{/* +Print "true" if the API pathType field is supported +Usage: +{{ include "common.ingress.supportsPathType" . }} +*/}} +{{- define "common.ingress.supportsPathType" -}} +{{- if (semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .)) -}} +{{- print "false" -}} +{{- else -}} +{{- print "true" -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if the ingressClassname field is supported +Usage: +{{ include "common.ingress.supportsIngressClassname" . }} +*/}} +{{- define "common.ingress.supportsIngressClassname" -}} +{{- if semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "false" -}} +{{- else -}} +{{- print "true" -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if cert-manager required annotations for TLS signed +certificates are set in the Ingress annotations +Ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations +Usage: +{{ include "common.ingress.certManagerRequest" ( dict "annotations" .Values.path.to.the.ingress.annotations ) }} +*/}} +{{- define "common.ingress.certManagerRequest" -}} +{{ if or (hasKey .annotations "cert-manager.io/cluster-issuer") (hasKey .annotations "cert-manager.io/issuer") (hasKey .annotations "kubernetes.io/tls-acme") }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/charts/postgresql/charts/common/templates/_labels.tpl b/charts/postgresql/charts/common/templates/_labels.tpl new file mode 100644 index 0000000..0a0cc54 --- /dev/null +++ b/charts/postgresql/charts/common/templates/_labels.tpl @@ -0,0 +1,46 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} + +{{/* +Kubernetes standard labels +{{ include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" $) -}} +*/}} +{{- define "common.labels.standard" -}} +{{- if and (hasKey . "customLabels") (hasKey . "context") -}} +{{- $default := dict "app.kubernetes.io/name" (include "common.names.name" .context) "helm.sh/chart" (include "common.names.chart" .context) "app.kubernetes.io/instance" .context.Release.Name "app.kubernetes.io/managed-by" .context.Release.Service -}} +{{- with .context.Chart.AppVersion -}} +{{- $_ := set $default "app.kubernetes.io/version" . -}} +{{- end -}} +{{ template "common.tplvalues.merge" (dict "values" (list .customLabels $default) "context" .context) }} +{{- else -}} +app.kubernetes.io/name: {{ include "common.names.name" . }} +helm.sh/chart: {{ include "common.names.chart" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- with .Chart.AppVersion }} +app.kubernetes.io/version: {{ . | quote }} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Labels used on immutable fields such as deploy.spec.selector.matchLabels or svc.spec.selector +{{ include "common.labels.matchLabels" (dict "customLabels" .Values.podLabels "context" $) -}} + +We don't want to loop over custom labels appending them to the selector +since it's very likely that it will break deployments, services, etc. +However, it's important to overwrite the standard labels if the user +overwrote them on metadata.labels fields. +*/}} +{{- define "common.labels.matchLabels" -}} +{{- if and (hasKey . "customLabels") (hasKey . "context") -}} +{{ merge (pick (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) "app.kubernetes.io/name" "app.kubernetes.io/instance") (dict "app.kubernetes.io/name" (include "common.names.name" .context) "app.kubernetes.io/instance" .context.Release.Name ) | toYaml }} +{{- else -}} +app.kubernetes.io/name: {{ include "common.names.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end -}} +{{- end -}} diff --git a/charts/postgresql/charts/common/templates/_names.tpl b/charts/postgresql/charts/common/templates/_names.tpl new file mode 100644 index 0000000..ba83956 --- /dev/null +++ b/charts/postgresql/charts/common/templates/_names.tpl @@ -0,0 +1,71 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "common.names.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "common.names.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "common.names.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create a default fully qualified dependency name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +Usage: +{{ include "common.names.dependency.fullname" (dict "chartName" "dependency-chart-name" "chartValues" .Values.dependency-chart "context" $) }} +*/}} +{{- define "common.names.dependency.fullname" -}} +{{- if .chartValues.fullnameOverride -}} +{{- .chartValues.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .chartName .chartValues.nameOverride -}} +{{- if contains $name .context.Release.Name -}} +{{- .context.Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .context.Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Allow the release namespace to be overridden for multi-namespace deployments in combined charts. +*/}} +{{- define "common.names.namespace" -}} +{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a fully qualified app name adding the installation's namespace. +*/}} +{{- define "common.names.fullname.namespace" -}} +{{- printf "%s-%s" (include "common.names.fullname" .) (include "common.names.namespace" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/charts/postgresql/charts/common/templates/_resources.tpl b/charts/postgresql/charts/common/templates/_resources.tpl new file mode 100644 index 0000000..d8a43e1 --- /dev/null +++ b/charts/postgresql/charts/common/templates/_resources.tpl @@ -0,0 +1,50 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} + +{{/* +Return a resource request/limit object based on a given preset. +These presets are for basic testing and not meant to be used in production +{{ include "common.resources.preset" (dict "type" "nano") -}} +*/}} +{{- define "common.resources.preset" -}} +{{/* The limits are the requests increased by 50% (except ephemeral-storage and xlarge/2xlarge sizes)*/}} +{{- $presets := dict + "nano" (dict + "requests" (dict "cpu" "100m" "memory" "128Mi" "ephemeral-storage" "50Mi") + "limits" (dict "cpu" "150m" "memory" "192Mi" "ephemeral-storage" "2Gi") + ) + "micro" (dict + "requests" (dict "cpu" "250m" "memory" "256Mi" "ephemeral-storage" "50Mi") + "limits" (dict "cpu" "375m" "memory" "384Mi" "ephemeral-storage" "2Gi") + ) + "small" (dict + "requests" (dict "cpu" "500m" "memory" "512Mi" "ephemeral-storage" "50Mi") + "limits" (dict "cpu" "750m" "memory" "768Mi" "ephemeral-storage" "2Gi") + ) + "medium" (dict + "requests" (dict "cpu" "500m" "memory" "1024Mi" "ephemeral-storage" "50Mi") + "limits" (dict "cpu" "750m" "memory" "1536Mi" "ephemeral-storage" "2Gi") + ) + "large" (dict + "requests" (dict "cpu" "1.0" "memory" "2048Mi" "ephemeral-storage" "50Mi") + "limits" (dict "cpu" "1.5" "memory" "3072Mi" "ephemeral-storage" "2Gi") + ) + "xlarge" (dict + "requests" (dict "cpu" "1.0" "memory" "3072Mi" "ephemeral-storage" "50Mi") + "limits" (dict "cpu" "3.0" "memory" "6144Mi" "ephemeral-storage" "2Gi") + ) + "2xlarge" (dict + "requests" (dict "cpu" "1.0" "memory" "3072Mi" "ephemeral-storage" "50Mi") + "limits" (dict "cpu" "6.0" "memory" "12288Mi" "ephemeral-storage" "2Gi") + ) + }} +{{- if hasKey $presets .type -}} +{{- index $presets .type | toYaml -}} +{{- else -}} +{{- printf "ERROR: Preset key '%s' invalid. Allowed values are %s" .type (join "," (keys $presets)) | fail -}} +{{- end -}} +{{- end -}} diff --git a/charts/postgresql/charts/common/templates/_secrets.tpl b/charts/postgresql/charts/common/templates/_secrets.tpl new file mode 100644 index 0000000..bfef469 --- /dev/null +++ b/charts/postgresql/charts/common/templates/_secrets.tpl @@ -0,0 +1,192 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Generate secret name. + +Usage: +{{ include "common.secrets.name" (dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $) }} + +Params: + - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user + to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility. + +info: https://github.com/bitnami/charts/tree/main/bitnami/common#existingsecret + - defaultNameSuffix - String - Optional. It is used only if we have several secrets in the same deployment. + - context - Dict - Required. The context for the template evaluation. +*/}} +{{- define "common.secrets.name" -}} +{{- $name := (include "common.names.fullname" .context) -}} + +{{- if .defaultNameSuffix -}} +{{- $name = printf "%s-%s" $name .defaultNameSuffix | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- with .existingSecret -}} +{{- if not (typeIs "string" .) -}} +{{- with .name -}} +{{- $name = . -}} +{{- end -}} +{{- else -}} +{{- $name = . -}} +{{- end -}} +{{- end -}} + +{{- printf "%s" $name -}} +{{- end -}} + +{{/* +Generate secret key. + +Usage: +{{ include "common.secrets.key" (dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName") }} + +Params: + - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user + to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility. + +info: https://github.com/bitnami/charts/tree/main/bitnami/common#existingsecret + - key - String - Required. Name of the key in the secret. +*/}} +{{- define "common.secrets.key" -}} +{{- $key := .key -}} + +{{- if .existingSecret -}} + {{- if not (typeIs "string" .existingSecret) -}} + {{- if .existingSecret.keyMapping -}} + {{- $key = index .existingSecret.keyMapping $.key -}} + {{- end -}} + {{- end }} +{{- end -}} + +{{- printf "%s" $key -}} +{{- end -}} + +{{/* +Generate secret password or retrieve one if already created. + +Usage: +{{ include "common.secrets.passwords.manage" (dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "honorProvidedValues" false "context" $) }} + +Params: + - secret - String - Required - Name of the 'Secret' resource where the password is stored. + - key - String - Required - Name of the key in the secret. + - providedValues - List - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value. + - length - int - Optional - Length of the generated random password. + - strong - Boolean - Optional - Whether to add symbols to the generated random password. + - chartName - String - Optional - Name of the chart used when said chart is deployed as a subchart. + - context - Context - Required - Parent context. + - failOnNew - Boolean - Optional - Default to true. If set to false, skip errors adding new keys to existing secrets. + - skipB64enc - Boolean - Optional - Default to false. If set to true, no the secret will not be base64 encrypted. + - skipQuote - Boolean - Optional - Default to false. If set to true, no quotes will be added around the secret. + - honorProvidedValues - Boolean - Optional - Default to false. If set to true, the values in providedValues have higher priority than an existing secret +The order in which this function returns a secret password: + 1. Password provided via the values.yaml if honorProvidedValues = true + (If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned) + 2. Already existing 'Secret' resource + (If a 'Secret' resource is found under the name provided to the 'secret' parameter to this function and that 'Secret' resource contains a key with the name passed as the 'key' parameter to this function then the value of this existing secret password will be returned) + 3. Password provided via the values.yaml if honorProvidedValues = false + (If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned) + 4. Randomly generated secret password + (A new random secret password with the length specified in the 'length' parameter will be generated and returned) + +*/}} +{{- define "common.secrets.passwords.manage" -}} + +{{- $password := "" }} +{{- $subchart := "" }} +{{- $chartName := default "" .chartName }} +{{- $passwordLength := default 10 .length }} +{{- $providedPasswordKey := include "common.utils.getKeyFromList" (dict "keys" .providedValues "context" $.context) }} +{{- $providedPasswordValue := include "common.utils.getValueFromKey" (dict "key" $providedPasswordKey "context" $.context) }} +{{- $secretData := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret).data }} +{{- if $secretData }} + {{- if hasKey $secretData .key }} + {{- $password = index $secretData .key | b64dec }} + {{- else if not (eq .failOnNew false) }} + {{- printf "\nPASSWORDS ERROR: The secret \"%s\" does not contain the key \"%s\"\n" .secret .key | fail -}} + {{- end -}} +{{- end }} + +{{- if and $providedPasswordValue .honorProvidedValues }} + {{- $password = $providedPasswordValue | toString }} +{{- end }} + +{{- if not $password }} + {{- if $providedPasswordValue }} + {{- $password = $providedPasswordValue | toString }} + {{- else }} + {{- if .context.Values.enabled }} + {{- $subchart = $chartName }} + {{- end -}} + + {{- if not (eq .failOnNew false) }} + {{- $requiredPassword := dict "valueKey" $providedPasswordKey "secret" .secret "field" .key "subchart" $subchart "context" $.context -}} + {{- $requiredPasswordError := include "common.validations.values.single.empty" $requiredPassword -}} + {{- $passwordValidationErrors := list $requiredPasswordError -}} + {{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $.context) -}} + {{- end }} + + {{- if .strong }} + {{- $subStr := list (lower (randAlpha 1)) (randNumeric 1) (upper (randAlpha 1)) | join "_" }} + {{- $password = randAscii $passwordLength }} + {{- $password = regexReplaceAllLiteral "\\W" $password "@" | substr 5 $passwordLength }} + {{- $password = printf "%s%s" $subStr $password | toString | shuffle }} + {{- else }} + {{- $password = randAlphaNum $passwordLength }} + {{- end }} + {{- end -}} +{{- end -}} +{{- if not .skipB64enc }} +{{- $password = $password | b64enc }} +{{- end -}} +{{- if .skipQuote -}} +{{- printf "%s" $password -}} +{{- else -}} +{{- printf "%s" $password | quote -}} +{{- end -}} +{{- end -}} + +{{/* +Reuses the value from an existing secret, otherwise sets its value to a default value. + +Usage: +{{ include "common.secrets.lookup" (dict "secret" "secret-name" "key" "keyName" "defaultValue" .Values.myValue "context" $) }} + +Params: + - secret - String - Required - Name of the 'Secret' resource where the password is stored. + - key - String - Required - Name of the key in the secret. + - defaultValue - String - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value. + - context - Context - Required - Parent context. + +*/}} +{{- define "common.secrets.lookup" -}} +{{- $value := "" -}} +{{- $secretData := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret).data -}} +{{- if and $secretData (hasKey $secretData .key) -}} + {{- $value = index $secretData .key -}} +{{- else if .defaultValue -}} + {{- $value = .defaultValue | toString | b64enc -}} +{{- end -}} +{{- if $value -}} +{{- printf "%s" $value -}} +{{- end -}} +{{- end -}} + +{{/* +Returns whether a previous generated secret already exists + +Usage: +{{ include "common.secrets.exists" (dict "secret" "secret-name" "context" $) }} + +Params: + - secret - String - Required - Name of the 'Secret' resource where the password is stored. + - context - Context - Required - Parent context. +*/}} +{{- define "common.secrets.exists" -}} +{{- $secret := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret) }} +{{- if $secret }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/charts/postgresql/charts/common/templates/_storage.tpl b/charts/postgresql/charts/common/templates/_storage.tpl new file mode 100644 index 0000000..aa75856 --- /dev/null +++ b/charts/postgresql/charts/common/templates/_storage.tpl @@ -0,0 +1,21 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} + +{{/* +Return the proper Storage Class +{{ include "common.storage.class" ( dict "persistence" .Values.path.to.the.persistence "global" $) }} +*/}} +{{- define "common.storage.class" -}} +{{- $storageClass := (.global).storageClass | default .persistence.storageClass | default (.global).defaultStorageClass | default "" -}} +{{- if $storageClass -}} + {{- if (eq "-" $storageClass) -}} + {{- printf "storageClassName: \"\"" -}} + {{- else -}} + {{- printf "storageClassName: %s" $storageClass -}} + {{- end -}} +{{- end -}} +{{- end -}} diff --git a/charts/postgresql/charts/common/templates/_tplvalues.tpl b/charts/postgresql/charts/common/templates/_tplvalues.tpl new file mode 100644 index 0000000..a04f4c1 --- /dev/null +++ b/charts/postgresql/charts/common/templates/_tplvalues.tpl @@ -0,0 +1,52 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Renders a value that contains template perhaps with scope if the scope is present. +Usage: +{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ ) }} +{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ "scope" $app ) }} +*/}} +{{- define "common.tplvalues.render" -}} +{{- $value := typeIs "string" .value | ternary .value (.value | toYaml) }} +{{- if contains "{{" (toJson .value) }} + {{- if .scope }} + {{- tpl (cat "{{- with $.RelativeScope -}}" $value "{{- end }}") (merge (dict "RelativeScope" .scope) .context) }} + {{- else }} + {{- tpl $value .context }} + {{- end }} +{{- else }} + {{- $value }} +{{- end }} +{{- end -}} + +{{/* +Merge a list of values that contains template after rendering them. +Merge precedence is consistent with http://masterminds.github.io/sprig/dicts.html#merge-mustmerge +Usage: +{{ include "common.tplvalues.merge" ( dict "values" (list .Values.path.to.the.Value1 .Values.path.to.the.Value2) "context" $ ) }} +*/}} +{{- define "common.tplvalues.merge" -}} +{{- $dst := dict -}} +{{- range .values -}} +{{- $dst = include "common.tplvalues.render" (dict "value" . "context" $.context "scope" $.scope) | fromYaml | merge $dst -}} +{{- end -}} +{{ $dst | toYaml }} +{{- end -}} + +{{/* +Merge a list of values that contains template after rendering them. +Merge precedence is consistent with https://masterminds.github.io/sprig/dicts.html#mergeoverwrite-mustmergeoverwrite +Usage: +{{ include "common.tplvalues.merge-overwrite" ( dict "values" (list .Values.path.to.the.Value1 .Values.path.to.the.Value2) "context" $ ) }} +*/}} +{{- define "common.tplvalues.merge-overwrite" -}} +{{- $dst := dict -}} +{{- range .values -}} +{{- $dst = include "common.tplvalues.render" (dict "value" . "context" $.context "scope" $.scope) | fromYaml | mergeOverwrite $dst -}} +{{- end -}} +{{ $dst | toYaml }} +{{- end -}} diff --git a/charts/postgresql/charts/common/templates/_utils.tpl b/charts/postgresql/charts/common/templates/_utils.tpl new file mode 100644 index 0000000..d53c74a --- /dev/null +++ b/charts/postgresql/charts/common/templates/_utils.tpl @@ -0,0 +1,77 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Print instructions to get a secret value. +Usage: +{{ include "common.utils.secret.getvalue" (dict "secret" "secret-name" "field" "secret-value-field" "context" $) }} +*/}} +{{- define "common.utils.secret.getvalue" -}} +{{- $varname := include "common.utils.fieldToEnvVar" . -}} +export {{ $varname }}=$(kubectl get secret --namespace {{ include "common.names.namespace" .context | quote }} {{ .secret }} -o jsonpath="{.data.{{ .field }}}" | base64 -d) +{{- end -}} + +{{/* +Build env var name given a field +Usage: +{{ include "common.utils.fieldToEnvVar" dict "field" "my-password" }} +*/}} +{{- define "common.utils.fieldToEnvVar" -}} + {{- $fieldNameSplit := splitList "-" .field -}} + {{- $upperCaseFieldNameSplit := list -}} + + {{- range $fieldNameSplit -}} + {{- $upperCaseFieldNameSplit = append $upperCaseFieldNameSplit ( upper . ) -}} + {{- end -}} + + {{ join "_" $upperCaseFieldNameSplit }} +{{- end -}} + +{{/* +Gets a value from .Values given +Usage: +{{ include "common.utils.getValueFromKey" (dict "key" "path.to.key" "context" $) }} +*/}} +{{- define "common.utils.getValueFromKey" -}} +{{- $splitKey := splitList "." .key -}} +{{- $value := "" -}} +{{- $latestObj := $.context.Values -}} +{{- range $splitKey -}} + {{- if not $latestObj -}} + {{- printf "please review the entire path of '%s' exists in values" $.key | fail -}} + {{- end -}} + {{- $value = ( index $latestObj . ) -}} + {{- $latestObj = $value -}} +{{- end -}} +{{- printf "%v" (default "" $value) -}} +{{- end -}} + +{{/* +Returns first .Values key with a defined value or first of the list if all non-defined +Usage: +{{ include "common.utils.getKeyFromList" (dict "keys" (list "path.to.key1" "path.to.key2") "context" $) }} +*/}} +{{- define "common.utils.getKeyFromList" -}} +{{- $key := first .keys -}} +{{- $reverseKeys := reverse .keys }} +{{- range $reverseKeys }} + {{- $value := include "common.utils.getValueFromKey" (dict "key" . "context" $.context ) }} + {{- if $value -}} + {{- $key = . }} + {{- end -}} +{{- end -}} +{{- printf "%s" $key -}} +{{- end -}} + +{{/* +Checksum a template at "path" containing a *single* resource (ConfigMap,Secret) for use in pod annotations, excluding the metadata (see #18376). +Usage: +{{ include "common.utils.checksumTemplate" (dict "path" "/configmap.yaml" "context" $) }} +*/}} +{{- define "common.utils.checksumTemplate" -}} +{{- $obj := include (print .context.Template.BasePath .path) .context | fromYaml -}} +{{ omit $obj "apiVersion" "kind" "metadata" | toYaml | sha256sum }} +{{- end -}} diff --git a/charts/postgresql/charts/common/templates/_warnings.tpl b/charts/postgresql/charts/common/templates/_warnings.tpl new file mode 100644 index 0000000..62c44df --- /dev/null +++ b/charts/postgresql/charts/common/templates/_warnings.tpl @@ -0,0 +1,109 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Warning about using rolling tag. +Usage: +{{ include "common.warnings.rollingTag" .Values.path.to.the.imageRoot }} +*/}} +{{- define "common.warnings.rollingTag" -}} + +{{- if and (contains "bitnami/" .repository) (not (.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://techdocs.broadcom.com/us/en/vmware-tanzu/application-catalog/tanzu-application-catalog/services/tac-doc/apps-tutorials-understand-rolling-tags-containers-index.html +{{- end }} +{{- end -}} + +{{/* +Warning about replaced images from the original. +Usage: +{{ include "common.warnings.modifiedImages" (dict "images" (list .Values.path.to.the.imageRoot) "context" $) }} +*/}} +{{- define "common.warnings.modifiedImages" -}} +{{- $affectedImages := list -}} +{{- $printMessage := false -}} +{{- $originalImages := .context.Chart.Annotations.images -}} +{{- range .images -}} + {{- $fullImageName := printf (printf "%s/%s:%s" .registry .repository .tag) -}} + {{- if not (contains $fullImageName $originalImages) }} + {{- $affectedImages = append $affectedImages (printf "%s/%s:%s" .registry .repository .tag) -}} + {{- $printMessage = true -}} + {{- end -}} +{{- end -}} +{{- if $printMessage }} + +⚠ SECURITY WARNING: Original containers have been substituted. This Helm chart was designed, tested, and validated on multiple platforms using a specific set of Bitnami and Tanzu Application Catalog containers. Substituting other containers is likely to cause degraded security and performance, broken chart features, and missing environment variables. + +Substituted images detected: +{{- range $affectedImages }} + - {{ . }} +{{- end }} +{{- end -}} +{{- end -}} + +{{/* +Warning about not setting the resource object in all deployments. +Usage: +{{ include "common.warnings.resources" (dict "sections" (list "path1" "path2") context $) }} +Example: +{{- include "common.warnings.resources" (dict "sections" (list "csiProvider.provider" "server" "volumePermissions" "") "context" $) }} +The list in the example assumes that the following values exist: + - csiProvider.provider.resources + - server.resources + - volumePermissions.resources + - resources +*/}} +{{- define "common.warnings.resources" -}} +{{- $values := .context.Values -}} +{{- $printMessage := false -}} +{{ $affectedSections := list -}} +{{- range .sections -}} + {{- if eq . "" -}} + {{/* Case where the resources section is at the root (one main deployment in the chart) */}} + {{- if not (index $values "resources") -}} + {{- $affectedSections = append $affectedSections "resources" -}} + {{- $printMessage = true -}} + {{- end -}} + {{- else -}} + {{/* Case where the are multiple resources sections (more than one main deployment in the chart) */}} + {{- $keys := split "." . -}} + {{/* We iterate through the different levels until arriving to the resource section. Example: a.b.c.resources */}} + {{- $section := $values -}} + {{- range $keys -}} + {{- $section = index $section . -}} + {{- end -}} + {{- if not (index $section "resources") -}} + {{/* If the section has enabled=false or replicaCount=0, do not include it */}} + {{- if and (hasKey $section "enabled") -}} + {{- if index $section "enabled" -}} + {{/* enabled=true */}} + {{- $affectedSections = append $affectedSections (printf "%s.resources" .) -}} + {{- $printMessage = true -}} + {{- end -}} + {{- else if and (hasKey $section "replicaCount") -}} + {{/* We need a casting to int because number 0 is not treated as an int by default */}} + {{- if (gt (index $section "replicaCount" | int) 0) -}} + {{/* replicaCount > 0 */}} + {{- $affectedSections = append $affectedSections (printf "%s.resources" .) -}} + {{- $printMessage = true -}} + {{- end -}} + {{- else -}} + {{/* Default case, add it to the affected sections */}} + {{- $affectedSections = append $affectedSections (printf "%s.resources" .) -}} + {{- $printMessage = true -}} + {{- end -}} + {{- end -}} + {{- end -}} +{{- end -}} +{{- if $printMessage }} + +WARNING: There are "resources" sections in the chart not set. Using "resourcesPreset" is not recommended for production. For production installations, please set the following values according to your workload needs: +{{- range $affectedSections }} + - {{ . }} +{{- end }} ++info https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +{{- end -}} +{{- end -}} diff --git a/charts/postgresql/charts/common/templates/validations/_cassandra.tpl b/charts/postgresql/charts/common/templates/validations/_cassandra.tpl new file mode 100644 index 0000000..f8fd213 --- /dev/null +++ b/charts/postgresql/charts/common/templates/validations/_cassandra.tpl @@ -0,0 +1,51 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.cassandra.values.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.cassandra.values.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.cassandra.dbUser.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.dbUser.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled cassandra. + +Usage: +{{ include "common.cassandra.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.cassandra.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.cassandra.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key dbUser + +Usage: +{{ include "common.cassandra.values.key.dbUser" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.cassandra.values.key.dbUser" -}} + {{- if .subchart -}} + cassandra.dbUser + {{- else -}} + dbUser + {{- end -}} +{{- end -}} diff --git a/charts/postgresql/charts/common/templates/validations/_mariadb.tpl b/charts/postgresql/charts/common/templates/validations/_mariadb.tpl new file mode 100644 index 0000000..6ea8c0f --- /dev/null +++ b/charts/postgresql/charts/common/templates/validations/_mariadb.tpl @@ -0,0 +1,108 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Validate MariaDB required passwords are not empty. + +Usage: +{{ include "common.validations.values.mariadb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where MariaDB values are stored, e.g: "mysql-passwords-secret" + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.mariadb.passwords" -}} + {{- $existingSecret := include "common.mariadb.values.auth.existingSecret" . -}} + {{- $enabled := include "common.mariadb.values.enabled" . -}} + {{- $architecture := include "common.mariadb.values.architecture" . -}} + {{- $authPrefix := include "common.mariadb.values.key.auth" . -}} + {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} + {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} + {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} + {{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mariadb-root-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} + + {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} + {{- if not (empty $valueUsername) -}} + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mariadb-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + {{- end -}} + + {{- if (eq $architecture "replication") -}} + {{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mariadb-replication-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.mariadb.values.auth.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.auth.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.mariadb.auth.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.auth.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled mariadb. + +Usage: +{{ include "common.mariadb.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.mariadb.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.mariadb.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for architecture + +Usage: +{{ include "common.mariadb.values.architecture" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.architecture" -}} + {{- if .subchart -}} + {{- .context.Values.mariadb.architecture -}} + {{- else -}} + {{- .context.Values.architecture -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key auth + +Usage: +{{ include "common.mariadb.values.key.auth" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.key.auth" -}} + {{- if .subchart -}} + mariadb.auth + {{- else -}} + auth + {{- end -}} +{{- end -}} diff --git a/charts/postgresql/charts/common/templates/validations/_mongodb.tpl b/charts/postgresql/charts/common/templates/validations/_mongodb.tpl new file mode 100644 index 0000000..e678a6d --- /dev/null +++ b/charts/postgresql/charts/common/templates/validations/_mongodb.tpl @@ -0,0 +1,67 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.mongodb.values.auth.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MongoDb is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.auth.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.mongodb.auth.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.auth.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled mongodb. + +Usage: +{{ include "common.mongodb.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.mongodb.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.mongodb.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key auth + +Usage: +{{ include "common.mongodb.values.key.auth" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.key.auth" -}} + {{- if .subchart -}} + mongodb.auth + {{- else -}} + auth + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for architecture + +Usage: +{{ include "common.mongodb.values.architecture" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.architecture" -}} + {{- if .subchart -}} + {{- .context.Values.mongodb.architecture -}} + {{- else -}} + {{- .context.Values.architecture -}} + {{- end -}} +{{- end -}} diff --git a/charts/postgresql/charts/common/templates/validations/_mysql.tpl b/charts/postgresql/charts/common/templates/validations/_mysql.tpl new file mode 100644 index 0000000..fbb65c3 --- /dev/null +++ b/charts/postgresql/charts/common/templates/validations/_mysql.tpl @@ -0,0 +1,67 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.mysql.values.auth.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false +*/}} +{{- define "common.mysql.values.auth.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.mysql.auth.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.auth.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled mysql. + +Usage: +{{ include "common.mysql.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.mysql.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.mysql.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for architecture + +Usage: +{{ include "common.mysql.values.architecture" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false +*/}} +{{- define "common.mysql.values.architecture" -}} + {{- if .subchart -}} + {{- .context.Values.mysql.architecture -}} + {{- else -}} + {{- .context.Values.architecture -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key auth + +Usage: +{{ include "common.mysql.values.key.auth" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false +*/}} +{{- define "common.mysql.values.key.auth" -}} + {{- if .subchart -}} + mysql.auth + {{- else -}} + auth + {{- end -}} +{{- end -}} diff --git a/charts/postgresql/charts/common/templates/validations/_postgresql.tpl b/charts/postgresql/charts/common/templates/validations/_postgresql.tpl new file mode 100644 index 0000000..51d4716 --- /dev/null +++ b/charts/postgresql/charts/common/templates/validations/_postgresql.tpl @@ -0,0 +1,105 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Auxiliary function to decide whether evaluate global values. + +Usage: +{{ include "common.postgresql.values.use.global" (dict "key" "key-of-global" "context" $) }} +Params: + - key - String - Required. Field to be evaluated within global, e.g: "existingSecret" +*/}} +{{- define "common.postgresql.values.use.global" -}} + {{- if .context.Values.global -}} + {{- if .context.Values.global.postgresql -}} + {{- index .context.Values.global.postgresql .key | quote -}} + {{- end -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.postgresql.values.existingSecret" (dict "context" $) }} +*/}} +{{- define "common.postgresql.values.existingSecret" -}} + {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "existingSecret" "context" .context) -}} + + {{- if .subchart -}} + {{- default (.context.Values.postgresql.existingSecret | quote) $globalValue -}} + {{- else -}} + {{- default (.context.Values.existingSecret | quote) $globalValue -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled postgresql. + +Usage: +{{ include "common.postgresql.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.postgresql.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.postgresql.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key postgressPassword. + +Usage: +{{ include "common.postgresql.values.key.postgressPassword" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.key.postgressPassword" -}} + {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "postgresqlUsername" "context" .context) -}} + + {{- if not $globalValue -}} + {{- if .subchart -}} + postgresql.postgresqlPassword + {{- else -}} + postgresqlPassword + {{- end -}} + {{- else -}} + global.postgresql.postgresqlPassword + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled.replication. + +Usage: +{{ include "common.postgresql.values.enabled.replication" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.enabled.replication" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.postgresql.replication.enabled -}} + {{- else -}} + {{- printf "%v" .context.Values.replication.enabled -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key replication.password. + +Usage: +{{ include "common.postgresql.values.key.replicationPassword" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.key.replicationPassword" -}} + {{- if .subchart -}} + postgresql.replication.password + {{- else -}} + replication.password + {{- end -}} +{{- end -}} diff --git a/charts/postgresql/charts/common/templates/validations/_redis.tpl b/charts/postgresql/charts/common/templates/validations/_redis.tpl new file mode 100644 index 0000000..9fedfef --- /dev/null +++ b/charts/postgresql/charts/common/templates/validations/_redis.tpl @@ -0,0 +1,48 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + + +{{/* vim: set filetype=mustache: */}} +{{/* +Auxiliary function to get the right value for enabled redis. + +Usage: +{{ include "common.redis.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.redis.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.redis.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right prefix path for the values + +Usage: +{{ include "common.redis.values.key.prefix" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false +*/}} +{{- define "common.redis.values.keys.prefix" -}} + {{- if .subchart -}}redis.{{- else -}}{{- end -}} +{{- end -}} + +{{/* +Checks whether the redis chart's includes the standarizations (version >= 14) + +Usage: +{{ include "common.redis.values.standarized.version" (dict "context" $) }} +*/}} +{{- define "common.redis.values.standarized.version" -}} + + {{- $standarizedAuth := printf "%s%s" (include "common.redis.values.keys.prefix" .) "auth" -}} + {{- $standarizedAuthValues := include "common.utils.getValueFromKey" (dict "key" $standarizedAuth "context" .context) }} + + {{- if $standarizedAuthValues -}} + {{- true -}} + {{- end -}} +{{- end -}} diff --git a/charts/postgresql/charts/common/templates/validations/_validations.tpl b/charts/postgresql/charts/common/templates/validations/_validations.tpl new file mode 100644 index 0000000..7cdee61 --- /dev/null +++ b/charts/postgresql/charts/common/templates/validations/_validations.tpl @@ -0,0 +1,51 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Validate values must not be empty. + +Usage: +{{- $validateValueConf00 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-00") -}} +{{- $validateValueConf01 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-01") -}} +{{ include "common.validations.values.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} + +Validate value params: + - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" + - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" + - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" +*/}} +{{- define "common.validations.values.multiple.empty" -}} + {{- range .required -}} + {{- include "common.validations.values.single.empty" (dict "valueKey" .valueKey "secret" .secret "field" .field "context" $.context) -}} + {{- end -}} +{{- end -}} + +{{/* +Validate a value must not be empty. + +Usage: +{{ include "common.validations.value.empty" (dict "valueKey" "mariadb.password" "secret" "secretName" "field" "my-password" "subchart" "subchart" "context" $) }} + +Validate value params: + - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" + - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" + - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" + - subchart - String - Optional - Name of the subchart that the validated password is part of. +*/}} +{{- define "common.validations.values.single.empty" -}} + {{- $value := include "common.utils.getValueFromKey" (dict "key" .valueKey "context" .context) }} + {{- $subchart := ternary "" (printf "%s." .subchart) (empty .subchart) }} + + {{- if not $value -}} + {{- $varname := "my-value" -}} + {{- $getCurrentValue := "" -}} + {{- if and .secret .field -}} + {{- $varname = include "common.utils.fieldToEnvVar" . -}} + {{- $getCurrentValue = printf " To get the current value:\n\n %s\n" (include "common.utils.secret.getvalue" .) -}} + {{- end -}} + {{- printf "\n '%s' must not be empty, please add '--set %s%s=$%s' to the command.%s" .valueKey $subchart .valueKey $varname $getCurrentValue -}} + {{- end -}} +{{- end -}} diff --git a/charts/postgresql/charts/common/values.yaml b/charts/postgresql/charts/common/values.yaml new file mode 100644 index 0000000..de2cac5 --- /dev/null +++ b/charts/postgresql/charts/common/values.yaml @@ -0,0 +1,8 @@ +# Copyright Broadcom, Inc. All Rights Reserved. +# SPDX-License-Identifier: APACHE-2.0 + +## bitnami/common +## It is required by CI/CD tools and processes. +## @skip exampleValue +## +exampleValue: common-chart diff --git a/charts/postgresql/templates/NOTES.txt b/charts/postgresql/templates/NOTES.txt new file mode 100644 index 0000000..61c5c78 --- /dev/null +++ b/charts/postgresql/templates/NOTES.txt @@ -0,0 +1,121 @@ +{{- $releaseNamespace := include "common.names.namespace" . }} +CHART NAME: {{ .Chart.Name }} +CHART VERSION: {{ .Chart.Version }} +APP VERSION: {{ .Chart.AppVersion }} + +Did you know there are enterprise versions of the Bitnami catalog? For enhanced secure software supply chain features, unlimited pulls from Docker, LTS support, or application customization, see Bitnami Premium or Tanzu Application Catalog. See https://www.arrow.com/globalecs/na/vendors/bitnami for more information. + +** Please be patient while the chart is being deployed ** + +{{- if .Values.diagnosticMode.enabled }} +The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with: + + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }} + +Get the list of pods by executing: + + kubectl get pods --namespace {{ $releaseNamespace }} -l app.kubernetes.io/instance={{ .Release.Name }} + +Access the pod you want to debug by executing + + kubectl exec --namespace {{ $releaseNamespace }} -ti -- /opt/bitnami/scripts/postgresql/entrypoint.sh /bin/bash + +In order to replicate the container startup scripts execute this command: + + /opt/bitnami/scripts/postgresql/entrypoint.sh /opt/bitnami/scripts/postgresql/run.sh + +{{- else }} + +{{- $customUser := include "postgresql.v1.username" . }} +{{- $postgresPassword := include "common.secrets.lookup" (dict "secret" (include "common.names.fullname" .) "key" .Values.auth.secretKeys.adminPasswordKey "defaultValue" (ternary .Values.auth.postgresPassword .Values.auth.password (eq $customUser "postgres")) "context" $) -}} +{{- $authEnabled := and (not (or .Values.global.postgresql.auth.existingSecret .Values.auth.existingSecret)) (or $postgresPassword .Values.auth.enablePostgresUser (and (not (empty $customUser)) (ne $customUser "postgres"))) }} +{{- if not $authEnabled }} + +WARNING: PostgreSQL has been configured without authentication, this is not recommended for production environments. +{{- end }} + +PostgreSQL can be accessed via port {{ include "postgresql.v1.service.port" . }} on the following DNS names from within your cluster: + + {{ include "postgresql.v1.primary.fullname" . }}.{{ $releaseNamespace }}.svc.cluster.local - Read/Write connection + +{{- if eq .Values.architecture "replication" }} + + {{ include "postgresql.v1.readReplica.fullname" . }}.{{ $releaseNamespace }}.svc.cluster.local - Read only connection + +{{- end }} + +{{- if and (not (empty $customUser)) (ne $customUser "postgres") }} +{{- if .Values.auth.enablePostgresUser }} + +To get the password for "postgres" run: + + export POSTGRES_ADMIN_PASSWORD=$(kubectl get secret --namespace {{ $releaseNamespace }} {{ include "postgresql.v1.secretName" . }} -o jsonpath="{.data.{{include "postgresql.v1.adminPasswordKey" .}}}" | base64 -d) +{{- end }} + +To get the password for "{{ $customUser }}" run: + + export POSTGRES_PASSWORD=$(kubectl get secret --namespace {{ $releaseNamespace }} {{ include "postgresql.v1.secretName" . }} -o jsonpath="{.data.{{include "postgresql.v1.userPasswordKey" .}}}" | base64 -d) +{{- else }} +{{- if .Values.auth.enablePostgresUser }} + +To get the password for "{{ default "postgres" $customUser }}" run: + + export POSTGRES_PASSWORD=$(kubectl get secret --namespace {{ $releaseNamespace }} {{ include "postgresql.v1.secretName" . }} -o jsonpath="{.data.{{ ternary "password" (include "postgresql.v1.adminPasswordKey" .) (and (not (empty $customUser)) (ne $customUser "postgres")) }}}" | base64 -d) +{{- end }} +{{- end }} + +To connect to your database run the following command: + {{- if $authEnabled }} + + kubectl run {{ include "common.names.fullname" . }}-client --rm --tty -i --restart='Never' --namespace {{ $releaseNamespace }} --image {{ include "postgresql.v1.image" . }} --env="PGPASSWORD=$POSTGRES_PASSWORD" \ + --command -- psql --host {{ include "postgresql.v1.primary.fullname" . }} -U {{ default "postgres" $customUser }} -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} -p {{ include "postgresql.v1.service.port" . }} + {{- else }} + + kubectl run {{ include "common.names.fullname" . }}-client --rm --tty -i --restart='Never' --namespace {{ $releaseNamespace }} --image {{ include "postgresql.v1.image" . }} \ + --command -- psql --host {{ include "postgresql.v1.primary.fullname" . }} -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} -p {{ include "postgresql.v1.service.port" . }} + {{- end }} + + > NOTE: If you access the container using bash, make sure that you execute "/opt/bitnami/scripts/postgresql/entrypoint.sh /bin/bash" in order to avoid the error "psql: local user with ID {{ .Values.primary.containerSecurityContext.runAsUser }}} does not exist" + +To connect to your database from outside the cluster execute the following commands: + +{{- if contains "NodePort" .Values.primary.service.type }} + + export NODE_IP=$(kubectl get nodes --namespace {{ $releaseNamespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + export NODE_PORT=$(kubectl get --namespace {{ $releaseNamespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "postgresql.v1.primary.fullname" . }}) + {{- if $authEnabled }} + PGPASSWORD="$POSTGRES_PASSWORD" psql --host $NODE_IP --port $NODE_PORT -U {{ default "postgres" $customUser }} -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} + {{- else }} + psql --host $NODE_IP --port $NODE_PORT -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} + {{- end }} +{{- else if contains "LoadBalancer" .Values.primary.service.type }} + + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + Watch the status with: 'kubectl get svc --namespace {{ $releaseNamespace }} -w {{ include "postgresql.v1.primary.fullname" . }}' + + export SERVICE_IP=$(kubectl get svc --namespace {{ $releaseNamespace }} {{ include "postgresql.v1.primary.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}") + {{- if $authEnabled }} + PGPASSWORD="$POSTGRES_PASSWORD" psql --host $SERVICE_IP --port {{ include "postgresql.v1.service.port" . }} -U {{ default "postgres" $customUser }} -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} + {{- else }} + psql --host $SERVICE_IP --port {{ include "postgresql.v1.service.port" . }} -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} + {{- end }} +{{- else if contains "ClusterIP" .Values.primary.service.type }} + + kubectl port-forward --namespace {{ $releaseNamespace }} svc/{{ include "postgresql.v1.primary.fullname" . }} {{ include "postgresql.v1.service.port" . }}:{{ include "postgresql.v1.service.port" . }} & + {{- if $authEnabled }} + PGPASSWORD="$POSTGRES_PASSWORD" psql --host 127.0.0.1 -U {{ default "postgres" $customUser }} -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} -p {{ include "postgresql.v1.service.port" . }} + {{- else }} + psql --host 127.0.0.1 -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} -p {{ include "postgresql.v1.service.port" . }} + {{- end }} +{{- end }} +{{- end }} + +WARNING: The configured password will be ignored on new installation in case when previous PostgreSQL release was deleted through the helm command. In that case, old PVC will have an old password, and setting it through helm won't take effect. Deleting persistent volumes (PVs) will solve the issue. + +{{- include "postgresql.v1.validateValues" . -}} +{{- include "common.warnings.rollingTag" .Values.image -}} +{{- include "common.warnings.rollingTag" .Values.volumePermissions.image }} +{{- include "common.warnings.resources" (dict "sections" (list "metrics" "primary" "readReplicas" "volumePermissions") "context" $) }} +{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.volumePermissions.image .Values.metrics.image) "context" $) }} +{{- include "common.errors.insecureImages" (dict "images" (list .Values.image .Values.volumePermissions.image .Values.metrics.image) "context" $) }} diff --git a/charts/postgresql/templates/_helpers.tpl b/charts/postgresql/templates/_helpers.tpl new file mode 100644 index 0000000..ad738eb --- /dev/null +++ b/charts/postgresql/templates/_helpers.tpl @@ -0,0 +1,455 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} + +{{/* +Create a default fully qualified app name for PostgreSQL Primary objects +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "postgresql.v1.primary.fullname" -}} +{{- if eq .Values.architecture "replication" -}} + {{- printf "%s-%s" (include "common.names.fullname" .) .Values.primary.name | trunc 63 | trimSuffix "-" -}} +{{- else -}} + {{- include "common.names.fullname" . -}} +{{- end -}} +{{- end -}} + +{{/* +Create a default fully qualified app name for PostgreSQL read-only replicas objects +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "postgresql.v1.readReplica.fullname" -}} +{{- printf "%s-%s" (include "common.names.fullname" .) .Values.readReplicas.name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create the default FQDN for PostgreSQL primary headless service +We truncate at 63 chars because of the DNS naming spec. +*/}} +{{- define "postgresql.v1.primary.svc.headless" -}} +{{- printf "%s-hl" (include "postgresql.v1.primary.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create the default FQDN for PostgreSQL read-only replicas headless service +We truncate at 63 chars because of the DNS naming spec. +*/}} +{{- define "postgresql.v1.readReplica.svc.headless" -}} +{{- printf "%s-hl" (include "postgresql.v1.readReplica.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Return the proper PostgreSQL image name +*/}} +{{- define "postgresql.v1.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }} +{{- end -}} + +{{/* +Return the proper PostgreSQL metrics image name +*/}} +{{- define "postgresql.v1.metrics.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.metrics.image "global" .Values.global) }} +{{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "postgresql.v1.volumePermissions.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.volumePermissions.image "global" .Values.global) }} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names +*/}} +{{- define "postgresql.v1.imagePullSecrets" -}} +{{ include "common.images.renderPullSecrets" (dict "images" (list .Values.image .Values.metrics.image .Values.volumePermissions.image) "context" $) }} +{{- end -}} + +{{/* +Return the name for a custom user to create +*/}} +{{- define "postgresql.v1.username" -}} +{{- if .Values.global.postgresql.auth.username -}} + {{- .Values.global.postgresql.auth.username -}} +{{- else -}} + {{- .Values.auth.username -}} +{{- end -}} +{{- end -}} + +{{/* +Return the name for a custom database to create +*/}} +{{- define "postgresql.v1.database" -}} +{{- if .Values.global.postgresql.auth.database -}} + {{- printf "%s" (tpl .Values.global.postgresql.auth.database $) -}} +{{- else if .Values.auth.database -}} + {{- printf "%s" (tpl .Values.auth.database $) -}} +{{- end -}} +{{- end -}} + +{{/* +Get the password secret. +*/}} +{{- define "postgresql.v1.secretName" -}} +{{- if .Values.global.postgresql.auth.existingSecret -}} + {{- printf "%s" (tpl .Values.global.postgresql.auth.existingSecret $) -}} +{{- else if .Values.auth.existingSecret -}} + {{- printf "%s" (tpl .Values.auth.existingSecret $) -}} +{{- else -}} + {{- printf "%s" (include "common.names.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Get the replication-password key. +*/}} +{{- define "postgresql.v1.replicationPasswordKey" -}} +{{- if or .Values.global.postgresql.auth.existingSecret .Values.auth.existingSecret -}} + {{- if .Values.global.postgresql.auth.secretKeys.replicationPasswordKey -}} + {{- printf "%s" (tpl .Values.global.postgresql.auth.secretKeys.replicationPasswordKey $) -}} + {{- else if .Values.auth.secretKeys.replicationPasswordKey -}} + {{- printf "%s" (tpl .Values.auth.secretKeys.replicationPasswordKey $) -}} + {{- else -}} + {{- "replication-password" -}} + {{- end -}} +{{- else -}} + {{- "replication-password" -}} +{{- end -}} +{{- end -}} + +{{/* +Get the admin-password key. +*/}} +{{- define "postgresql.v1.adminPasswordKey" -}} +{{- if or .Values.global.postgresql.auth.existingSecret .Values.auth.existingSecret -}} + {{- if .Values.global.postgresql.auth.secretKeys.adminPasswordKey -}} + {{- printf "%s" (tpl .Values.global.postgresql.auth.secretKeys.adminPasswordKey $) -}} + {{- else if .Values.auth.secretKeys.adminPasswordKey -}} + {{- printf "%s" (tpl .Values.auth.secretKeys.adminPasswordKey $) -}} + {{- end -}} +{{- else -}} + {{- "postgres-password" -}} +{{- end -}} +{{- end -}} + +{{/* +Get the user-password key. +*/}} +{{- define "postgresql.v1.userPasswordKey" -}} +{{- if or .Values.global.postgresql.auth.existingSecret .Values.auth.existingSecret -}} + {{- if or (empty (include "postgresql.v1.username" .)) (eq (include "postgresql.v1.username" .) "postgres") -}} + {{- printf "%s" (include "postgresql.v1.adminPasswordKey" .) -}} + {{- else -}} + {{- if .Values.global.postgresql.auth.secretKeys.userPasswordKey -}} + {{- printf "%s" (tpl .Values.global.postgresql.auth.secretKeys.userPasswordKey $) -}} + {{- else if .Values.auth.secretKeys.userPasswordKey -}} + {{- printf "%s" (tpl .Values.auth.secretKeys.userPasswordKey $) -}} + {{- end -}} + {{- end -}} +{{- else -}} + {{- "password" -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if a secret object should be created +*/}} +{{- define "postgresql.v1.createSecret" -}} +{{- $customUser := include "postgresql.v1.username" . -}} +{{- $postgresPassword := include "common.secrets.lookup" (dict "secret" (include "common.names.fullname" .) "key" .Values.auth.secretKeys.adminPasswordKey "defaultValue" (ternary (coalesce .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword .Values.global.postgresql.auth.password .Values.auth.password) (coalesce .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword) (or (empty $customUser) (eq $customUser "postgres"))) "context" $) -}} +{{- if and (not (or .Values.global.postgresql.auth.existingSecret .Values.auth.existingSecret)) (or $postgresPassword .Values.auth.enablePostgresUser (and (not (empty $customUser)) (ne $customUser "postgres")) (eq .Values.architecture "replication") (and .Values.ldap.enabled (or .Values.ldap.bind_password .Values.ldap.bindpw))) -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if a secret object should be created for PostgreSQL +*/}} +{{- define "postgresql.v1.createPreviousSecret" -}} +{{- if and .Values.passwordUpdateJob.previousPasswords.postgresPassword (not .Values.passwordUpdateJob.previousPasswords.existingSecret) }} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Return the secret with previous PostgreSQL credentials +*/}} +{{- define "postgresql.v1.update-job.previousSecretName" -}} + {{- if .Values.passwordUpdateJob.previousPasswords.existingSecret -}} + {{- /* The secret with the new password is managed externally */ -}} + {{- tpl .Values.passwordUpdateJob.previousPasswords.existingSecret $ -}} + {{- else if .Values.passwordUpdateJob.previousPasswords.postgresPassword -}} + {{- /* The secret with the new password is managed externally */ -}} + {{- printf "%s-previous-secret" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}} + {{- else -}} + {{- /* The secret with the new password is managed by the helm chart. We use the current secret name as it has the old password */ -}} + {{- include "common.names.fullname" . -}} + {{- end -}} +{{- end -}} + +{{/* +Return the secret with new PostgreSQL credentials +*/}} +{{- define "postgresql.v1.update-job.newSecretName" -}} + {{- if and (not .Values.passwordUpdateJob.previousPasswords.existingSecret) (not .Values.passwordUpdateJob.previousPasswords.postgresPassword) -}} + {{- /* The secret with the new password is managed by the helm chart. We create a new secret as the current one has the old password */ -}} + {{- printf "%s-new-secret" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}} + {{- else -}} + {{- /* The secret with the new password is managed externally */ -}} + {{- include "postgresql.v1.secretName" . -}} + {{- end -}} +{{- end -}} + +{{/* +Return PostgreSQL service port +*/}} +{{- define "postgresql.v1.service.port" -}} +{{- if .Values.global.postgresql.service.ports.postgresql -}} + {{- .Values.global.postgresql.service.ports.postgresql -}} +{{- else -}} + {{- .Values.primary.service.ports.postgresql -}} +{{- end -}} +{{- end -}} + +{{/* +Return PostgreSQL service port +*/}} +{{- define "postgresql.v1.readReplica.service.port" -}} +{{- if .Values.global.postgresql.service.ports.postgresql -}} + {{- .Values.global.postgresql.service.ports.postgresql -}} +{{- else -}} + {{- .Values.readReplicas.service.ports.postgresql -}} +{{- end -}} +{{- end -}} + +{{/* +Get the PostgreSQL primary configuration ConfigMap name. +*/}} +{{- define "postgresql.v1.primary.configmapName" -}} +{{- if .Values.primary.existingConfigmap -}} + {{- printf "%s" (tpl .Values.primary.existingConfigmap $) -}} +{{- else -}} + {{- printf "%s-configuration" (include "postgresql.v1.primary.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if a configmap object should be created for PostgreSQL primary with the configuration +*/}} +{{- define "postgresql.v1.primary.createConfigmap" -}} +{{- if and (or .Values.primary.configuration .Values.primary.pgHbaConfiguration) (not .Values.primary.existingConfigmap) -}} + {{- true -}} +{{- else -}} +{{- end -}} +{{- end -}} + +{{/* +Get the PostgreSQL primary extended configuration ConfigMap name. +*/}} +{{- define "postgresql.v1.primary.extendedConfigmapName" -}} +{{- if .Values.primary.existingExtendedConfigmap -}} + {{- printf "%s" (tpl .Values.primary.existingExtendedConfigmap $) -}} +{{- else -}} + {{- printf "%s-extended-configuration" (include "postgresql.v1.primary.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Get the PostgreSQL read replica extended configuration ConfigMap name. +*/}} +{{- define "postgresql.v1.readReplicas.extendedConfigmapName" -}} + {{- printf "%s-extended-configuration" (include "postgresql.v1.readReplica.fullname" .) -}} +{{- end -}} + +{{/* +Return true if a configmap object should be created for PostgreSQL primary with the extended configuration +*/}} +{{- define "postgresql.v1.primary.createExtendedConfigmap" -}} +{{- if and .Values.primary.extendedConfiguration (not .Values.primary.existingExtendedConfigmap) -}} + {{- true -}} +{{- else -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if a configmap object should be created for PostgreSQL read replica with the extended configuration +*/}} +{{- define "postgresql.v1.readReplicas.createExtendedConfigmap" -}} +{{- if .Values.readReplicas.extendedConfiguration -}} + {{- true -}} +{{- else -}} +{{- end -}} +{{- end -}} + +{{/* + Create the name of the service account to use + */}} +{{- define "postgresql.v1.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return true if a configmap should be mounted with PostgreSQL configuration +*/}} +{{- define "postgresql.v1.mountConfigurationCM" -}} +{{- if or .Values.primary.configuration .Values.primary.pgHbaConfiguration .Values.primary.existingConfigmap -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Get the pre-initialization scripts ConfigMap name. +*/}} +{{- define "postgresql.v1.preInitDb.scriptsCM" -}} +{{- if .Values.primary.preInitDb.scriptsConfigMap -}} + {{- printf "%s" (tpl .Values.primary.preInitDb.scriptsConfigMap $) -}} +{{- else -}} + {{- printf "%s-preinit-scripts" (include "postgresql.v1.primary.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Get the initialization scripts ConfigMap name. +*/}} +{{- define "postgresql.v1.initdb.scriptsCM" -}} +{{- if .Values.primary.initdb.scriptsConfigMap -}} + {{- printf "%s" (tpl .Values.primary.initdb.scriptsConfigMap $) -}} +{{- else -}} + {{- printf "%s-init-scripts" (include "postgresql.v1.primary.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if TLS is enabled for LDAP connection +*/}} +{{- define "postgresql.v1.ldap.tls.enabled" -}} +{{- if and (kindIs "string" .Values.ldap.tls) (not (empty .Values.ldap.tls)) -}} + {{- true -}} +{{- else if and (kindIs "map" .Values.ldap.tls) .Values.ldap.tls.enabled -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Get the readiness probe command +*/}} +{{- define "postgresql.v1.readinessProbeCommand" -}} +{{- $customUser := include "postgresql.v1.username" . -}} +- | +{{- if (include "postgresql.v1.database" .) }} + exec pg_isready -U {{ default "postgres" $customUser | quote }} -d "dbname={{ include "postgresql.v1.database" . }} {{- if .Values.tls.enabled }} sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} +{{- else }} + exec pg_isready -U {{ default "postgres" $customUser | quote }} {{- if .Values.tls.enabled }} -d "sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} +{{- end }} +{{- if contains "bitnami/" .Values.image.repository }} + [ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ] +{{- end }} +{{- end -}} + +{{/* +Compile all warnings into a single message, and call fail. +*/}} +{{- define "postgresql.v1.validateValues" -}} +{{- $messages := list -}} +{{- $messages := append $messages (include "postgresql.v1.validateValues.ldapConfigurationMethod" .) -}} +{{- $messages := append $messages (include "postgresql.v1.validateValues.psp" .) -}} +{{- $messages := without $messages "" -}} +{{- $message := join "\n" $messages -}} + +{{- if $message -}} +{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}} +{{- end -}} +{{- end -}} + +{{/* +Validate values of Postgresql - If ldap.url is used then you don't need the other settings for ldap +*/}} +{{- define "postgresql.v1.validateValues.ldapConfigurationMethod" -}} +{{- if and .Values.ldap.enabled (and (not (empty .Values.ldap.url)) (not (empty .Values.ldap.server))) -}} +postgresql: ldap.url, ldap.server + You cannot set both `ldap.url` and `ldap.server` at the same time. + Please provide a unique way to configure LDAP. + More info at https://www.postgresql.org/docs/current/auth-ldap.html +{{- end -}} +{{- end -}} + +{{/* +Validate values of Postgresql - If PSP is enabled RBAC should be enabled too +*/}} +{{- define "postgresql.v1.validateValues.psp" -}} +{{- if and .Values.psp.create (not .Values.rbac.create) -}} +postgresql: psp.create, rbac.create + RBAC should be enabled if PSP is enabled in order for PSP to work. + More info at https://kubernetes.io/docs/concepts/policy/pod-security-policy/#authorizing-policies +{{- end -}} +{{- end -}} + +{{/* +Return the path to the cert file. +*/}} +{{- define "postgresql.v1.tlsCert" -}} +{{- if .Values.tls.autoGenerated -}} + {{- printf "/opt/bitnami/postgresql/certs/tls.crt" -}} +{{- else -}} + {{- required "Certificate filename is required when TLS in enabled" .Values.tls.certFilename | printf "/opt/bitnami/postgresql/certs/%s" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the path to the cert key file. +*/}} +{{- define "postgresql.v1.tlsCertKey" -}} +{{- if .Values.tls.autoGenerated -}} + {{- printf "/opt/bitnami/postgresql/certs/tls.key" -}} +{{- else -}} +{{- required "Certificate Key filename is required when TLS in enabled" .Values.tls.certKeyFilename | printf "/opt/bitnami/postgresql/certs/%s" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the path to the CA cert file. +*/}} +{{- define "postgresql.v1.tlsCACert" -}} +{{- if .Values.tls.autoGenerated -}} + {{- printf "/opt/bitnami/postgresql/certs/ca.crt" -}} +{{- else -}} + {{- printf "/opt/bitnami/postgresql/certs/%s" .Values.tls.certCAFilename -}} +{{- end -}} +{{- end -}} + +{{/* +Return the path to the CRL file. +*/}} +{{- define "postgresql.v1.tlsCRL" -}} +{{- if .Values.tls.crlFilename -}} +{{- printf "/opt/bitnami/postgresql/certs/%s" .Values.tls.crlFilename -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if a TLS credentials secret object should be created +*/}} +{{- define "postgresql.v1.createTlsSecret" -}} +{{- if and .Values.tls.autoGenerated (not .Values.tls.certificatesSecret) -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Return the path to the CA cert file. +*/}} +{{- define "postgresql.v1.tlsSecretName" -}} +{{- if .Values.tls.autoGenerated -}} + {{- printf "%s-crt" (include "common.names.fullname" .) -}} +{{- else -}} + {{ tpl (required "A secret containing TLS certificates is required when TLS is enabled" .Values.tls.certificatesSecret) . }} +{{- end -}} +{{- end -}} diff --git a/charts/postgresql/templates/backup/cronjob.yaml b/charts/postgresql/templates/backup/cronjob.yaml new file mode 100644 index 0000000..c5fd9f7 --- /dev/null +++ b/charts/postgresql/templates/backup/cronjob.yaml @@ -0,0 +1,138 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.backup.enabled }} +{{- $customUser := include "postgresql.v1.username" . }} +apiVersion: batch/v1 +kind: CronJob +metadata: + name: {{ include "postgresql.v1.primary.fullname" . }}-pgdumpall + namespace: {{ include "common.names.namespace" . | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: pg_dumpall + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.annotations .Values.commonAnnotations ) "context" . ) }} + {{- if $annotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + schedule: {{ quote .Values.backup.cronjob.schedule }} + {{- if .Values.backup.cronjob.timezone }} + timeZone: {{ .Values.backup.cronjob.timezone | quote }} + {{- end }} + concurrencyPolicy: {{ .Values.backup.cronjob.concurrencyPolicy }} + failedJobsHistoryLimit: {{ .Values.backup.cronjob.failedJobsHistoryLimit }} + successfulJobsHistoryLimit: {{ .Values.backup.cronjob.successfulJobsHistoryLimit }} + {{- if .Values.backup.cronjob.startingDeadlineSeconds }} + startingDeadlineSeconds: {{ .Values.backup.cronjob.startingDeadlineSeconds }} + {{- end }} + jobTemplate: + spec: + {{- if .Values.backup.cronjob.ttlSecondsAfterFinished }} + ttlSecondsAfterFinished: {{ .Values.backup.cronjob.ttlSecondsAfterFinished }} + {{- end }} + template: + metadata: + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 12 }} + app.kubernetes.io/component: pg_dumpall + {{- if $annotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 12 }} + {{- end }} + spec: + {{- include "postgresql.v1.imagePullSecrets" . | nindent 10 }} + {{- if .Values.backup.cronjob.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.nodeSelector "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.backup.cronjob.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.tolerations "context" $) | nindent 12 }} + {{- end }} + containers: + - name: {{ include "postgresql.v1.primary.fullname" . }}-pgdumpall + image: {{ include "postgresql.v1.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + env: + - name: PGUSER + {{- if .Values.auth.enablePostgresUser }} + value: postgres + {{- else }} + value: {{ $customUser | quote }} + {{- end }} + {{- if .Values.auth.usePasswordFiles }} + - name: PGPASSFILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.adminPasswordKey" .) }} + {{- else }} + - name: PGPASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} + {{- end }} + - name: PGHOST + value: {{ include "postgresql.v1.primary.fullname" . }} + - name: PGPORT + value: {{ include "postgresql.v1.service.port" . | quote }} + - name: PGDUMP_DIR + value: {{ .Values.backup.cronjob.storage.mountPath }} + {{- if .Values.tls.enabled }} + - name: PGSSLROOTCERT + {{- if .Values.tls.autoGenerated }} + value: /tmp/certs/ca.crt + {{- else }} + value: {{ printf "/tmp/certs/%s" .Values.tls.certCAFilename }} + {{- end }} + {{- end }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.command "context" $) | nindent 14 }} + volumeMounts: + {{- if .Values.tls.enabled }} + - name: raw-certificates + mountPath: /tmp/certs + {{- end }} + {{- if .Values.backup.cronjob.storage.enabled }} + - name: datadir + mountPath: {{ .Values.backup.cronjob.storage.mountPath }} + subPath: {{ .Values.backup.cronjob.storage.subPath }} + {{- end }} + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + {{- if .Values.backup.cronjob.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.extraVolumeMounts "context" $) | nindent 14 }} + {{- end }} + {{- if .Values.backup.cronjob.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.backup.cronjob.containerSecurityContext "context" $) | nindent 14 }} + {{- end }} + {{- if .Values.backup.cronjob.resources }} + resources: {{- toYaml .Values.backup.cronjob.resources | nindent 14 }} + {{- else if ne .Values.backup.cronjob.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.backup.cronjob.resourcesPreset) | nindent 14 }} + {{- end }} + restartPolicy: {{ .Values.backup.cronjob.restartPolicy }} + {{- if .Values.backup.cronjob.podSecurityContext.enabled }} + securityContext: + fsGroup: {{ .Values.backup.cronjob.podSecurityContext.fsGroup }} + {{- end }} + volumes: + {{- if .Values.tls.enabled }} + - name: raw-certificates + secret: + secretName: {{ include "postgresql.v1.tlsSecretName" . }} + {{- end }} + {{- if .Values.backup.cronjob.storage.enabled }} + {{- if .Values.backup.cronjob.storage.existingClaim }} + - name: datadir + persistentVolumeClaim: + claimName: {{ printf "%s" (tpl .Values.backup.cronjob.storage.existingClaim .) }} + {{- else }} + - name: datadir + persistentVolumeClaim: + claimName: {{ include "postgresql.v1.primary.fullname" . }}-pgdumpall + {{- end }} + {{- end }} + - name: empty-dir + emptyDir: {} + {{- if .Values.backup.cronjob.extraVolumes }} + {{- include "common.tplvalues.render" ( dict "value" .Values.backup.cronjob.extraVolumes "context" $ ) | nindent 12 }} + {{- end }} +{{- end }} diff --git a/charts/postgresql/templates/backup/networkpolicy.yaml b/charts/postgresql/templates/backup/networkpolicy.yaml new file mode 100644 index 0000000..21e1add --- /dev/null +++ b/charts/postgresql/templates/backup/networkpolicy.yaml @@ -0,0 +1,32 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.backup.enabled .Values.backup.cronjob.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ include "postgresql.v1.primary.fullname" . }}-pgdumpall + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: pg_dumpall + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.podLabels .Values.commonLabels ) "context" . ) }} + podSelector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: pg_dumpall + policyTypes: + - Egress + egress: + - ports: + - port: 5432 + protocol: TCP + - port: 53 + protocol: TCP + - port: 53 + protocol: UDP +{{- end }} diff --git a/charts/postgresql/templates/backup/pvc.yaml b/charts/postgresql/templates/backup/pvc.yaml new file mode 100644 index 0000000..674ac3d --- /dev/null +++ b/charts/postgresql/templates/backup/pvc.yaml @@ -0,0 +1,34 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.backup.enabled .Values.backup.cronjob.storage.enabled (not .Values.backup.cronjob.storage.existingClaim) -}} +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ include "postgresql.v1.primary.fullname" . }}-pgdumpall + namespace: {{ include "common.names.namespace" . | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: pg_dumpall + {{- if or .Values.backup.cronjob.annotations .Values.commonAnnotations .Values.backup.cronjob.storage.resourcePolicy }} + annotations: + {{- if or .Values.backup.cronjob.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.annotations .Values.commonAnnotations ) "context" . ) }} + {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.backup.cronjob.storage.resourcePolicy }} + helm.sh/resource-policy: {{ .Values.backup.cronjob.storage.resourcePolicy | quote }} + {{- end }} + {{- end }} +spec: + accessModes: + {{- range .Values.backup.cronjob.storage.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.backup.cronjob.storage.size | quote }} + {{ include "common.storage.class" (dict "persistence" .Values.backup.cronjob.storage "global" .Values.global) }} +{{- end }} diff --git a/charts/postgresql/templates/extra-list.yaml b/charts/postgresql/templates/extra-list.yaml new file mode 100644 index 0000000..329f5c6 --- /dev/null +++ b/charts/postgresql/templates/extra-list.yaml @@ -0,0 +1,9 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- range .Values.extraDeploy }} +--- +{{ include "common.tplvalues.render" (dict "value" . "context" $) }} +{{- end }} diff --git a/charts/postgresql/templates/primary/configmap.yaml b/charts/postgresql/templates/primary/configmap.yaml new file mode 100644 index 0000000..ad231e5 --- /dev/null +++ b/charts/postgresql/templates/primary/configmap.yaml @@ -0,0 +1,26 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if (include "postgresql.v1.primary.createConfigmap" .) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-configuration" (include "postgresql.v1.primary.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + {{- if .Values.primary.configuration }} + postgresql.conf: | + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.configuration "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.primary.pgHbaConfiguration }} + pg_hba.conf: | + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.pgHbaConfiguration "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/postgresql/templates/primary/extended-configmap.yaml b/charts/postgresql/templates/primary/extended-configmap.yaml new file mode 100644 index 0000000..2d228e4 --- /dev/null +++ b/charts/postgresql/templates/primary/extended-configmap.yaml @@ -0,0 +1,20 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if (include "postgresql.v1.primary.createExtendedConfigmap" .) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-extended-configuration" (include "postgresql.v1.primary.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + override.conf: |- + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.extendedConfiguration "context" $ ) | nindent 4 }} +{{- end }} diff --git a/charts/postgresql/templates/primary/initialization-configmap.yaml b/charts/postgresql/templates/primary/initialization-configmap.yaml new file mode 100644 index 0000000..450812a --- /dev/null +++ b/charts/postgresql/templates/primary/initialization-configmap.yaml @@ -0,0 +1,17 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.primary.initdb.scripts (not .Values.primary.initdb.scriptsConfigMap) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-init-scripts" (include "postgresql.v1.primary.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: {{- include "common.tplvalues.render" (dict "value" .Values.primary.initdb.scripts "context" .) | nindent 2 }} +{{- end }} diff --git a/charts/postgresql/templates/primary/metrics-configmap.yaml b/charts/postgresql/templates/primary/metrics-configmap.yaml new file mode 100644 index 0000000..9bf889a --- /dev/null +++ b/charts/postgresql/templates/primary/metrics-configmap.yaml @@ -0,0 +1,18 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.metrics.enabled .Values.metrics.customMetrics }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-metrics" (include "postgresql.v1.primary.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + custom-metrics.yaml: {{ toYaml .Values.metrics.customMetrics | quote }} +{{- end }} diff --git a/charts/postgresql/templates/primary/metrics-svc.yaml b/charts/postgresql/templates/primary/metrics-svc.yaml new file mode 100644 index 0000000..2e77c5b --- /dev/null +++ b/charts/postgresql/templates/primary/metrics-svc.yaml @@ -0,0 +1,31 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.metrics.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ printf "%s-metrics" (include "postgresql.v1.primary.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: metrics + {{- if or .Values.commonAnnotations .Values.metrics.service.annotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.service.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + sessionAffinity: {{ .Values.metrics.service.sessionAffinity }} + {{- if .Values.metrics.service.clusterIP }} + clusterIP: {{ .Values.metrics.service.clusterIP }} + {{- end }} + ports: + - name: http-metrics + port: {{ .Values.metrics.service.ports.metrics }} + targetPort: http-metrics + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.podLabels .Values.commonLabels ) "context" . ) }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary +{{- end }} diff --git a/charts/postgresql/templates/primary/networkpolicy.yaml b/charts/postgresql/templates/primary/networkpolicy.yaml new file mode 100644 index 0000000..6e5e28f --- /dev/null +++ b/charts/postgresql/templates/primary/networkpolicy.yaml @@ -0,0 +1,78 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.primary.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ include "postgresql.v1.primary.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.podLabels .Values.commonLabels ) "context" . ) }} + podSelector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: primary + policyTypes: + - Ingress + - Egress + {{- if .Values.primary.networkPolicy.allowExternalEgress }} + egress: + - {} + {{- else }} + egress: + # Allow dns resolution + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + # Allow outbound connections to read-replicas + - ports: + - port: {{ .Values.containerPorts.postgresql }} + to: + - podSelector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }} + app.kubernetes.io/component: read + {{- if .Values.primary.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} + ingress: + - ports: + - port: {{ .Values.containerPorts.postgresql }} + {{- if .Values.metrics.enabled }} + - port: {{ .Values.metrics.containerPorts.metrics }} + {{- end }} + {{- if not .Values.primary.networkPolicy.allowExternal }} + from: + - podSelector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }} + - podSelector: + matchLabels: + {{ template "postgresql.v1.primary.fullname" . }}-client: "true" + {{- if .Values.primary.networkPolicy.ingressNSMatchLabels }} + - namespaceSelector: + matchLabels: + {{- range $key, $value := .Values.primary.networkPolicy.ingressNSMatchLabels }} + {{ $key | quote }}: {{ $value | quote }} + {{- end }} + {{- if .Values.primary.networkPolicy.ingressNSPodMatchLabels }} + podSelector: + matchLabels: + {{- range $key, $value := .Values.primary.networkPolicy.ingressNSPodMatchLabels }} + {{ $key | quote }}: {{ $value | quote }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.primary.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/postgresql/templates/primary/pdb.yaml b/charts/postgresql/templates/primary/pdb.yaml new file mode 100644 index 0000000..a03fb20 --- /dev/null +++ b/charts/postgresql/templates/primary/pdb.yaml @@ -0,0 +1,29 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.primary.pdb.create }} +apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} +kind: PodDisruptionBudget +metadata: + name: {{ include "postgresql.v1.primary.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.primary.pdb.minAvailable }} + minAvailable: {{ .Values.primary.pdb.minAvailable }} + {{- end }} + {{- if or .Values.primary.pdb.maxUnavailable ( not .Values.primary.pdb.minAvailable ) }} + maxUnavailable: {{ .Values.primary.pdb.maxUnavailable | default 1 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.podLabels .Values.commonLabels ) "context" . ) }} + selector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: primary +{{- end }} diff --git a/charts/postgresql/templates/primary/preinitialization-configmap.yaml b/charts/postgresql/templates/primary/preinitialization-configmap.yaml new file mode 100644 index 0000000..ae6d188 --- /dev/null +++ b/charts/postgresql/templates/primary/preinitialization-configmap.yaml @@ -0,0 +1,17 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.primary.preInitDb.scripts (not .Values.primary.preInitDb.scriptsConfigMap) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-preinit-scripts" (include "postgresql.v1.primary.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: {{- include "common.tplvalues.render" (dict "value" .Values.primary.preInitDb.scripts "context" .) | nindent 2 }} +{{- end }} diff --git a/charts/postgresql/templates/primary/servicemonitor.yaml b/charts/postgresql/templates/primary/servicemonitor.yaml new file mode 100644 index 0000000..b17d7f5 --- /dev/null +++ b/charts/postgresql/templates/primary/servicemonitor.yaml @@ -0,0 +1,46 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "postgresql.v1.primary.fullname" . }} + namespace: {{ coalesce .Values.metrics.serviceMonitor.namespace (include "common.names.namespace" .) | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: metrics + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.metrics.serviceMonitor.jobLabel }} + jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }} + {{- end }} + selector: + {{- $svcLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.selector .Values.commonLabels ) "context" . ) }} + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $svcLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: metrics + endpoints: + - port: http-metrics + {{- if .Values.metrics.serviceMonitor.interval }} + interval: {{ .Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.relabelings }} + relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 6 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.metricRelabelings }} + metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 6 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.honorLabels }} + honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }} + {{- end }} + namespaceSelector: + matchNames: + - {{ include "common.names.namespace" . | quote }} +{{- end }} diff --git a/charts/postgresql/templates/primary/statefulset.yaml b/charts/postgresql/templates/primary/statefulset.yaml new file mode 100644 index 0000000..5e3c1df --- /dev/null +++ b/charts/postgresql/templates/primary/statefulset.yaml @@ -0,0 +1,705 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- $customUser := include "postgresql.v1.username" . }} +apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} +kind: StatefulSet +metadata: + name: {{ include "postgresql.v1.primary.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary + {{- if or .Values.commonAnnotations .Values.primary.annotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + replicas: 1 + serviceName: {{ include "postgresql.v1.primary.svc.headless" . }} + {{- if .Values.primary.updateStrategy }} + updateStrategy: {{- toYaml .Values.primary.updateStrategy | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.podLabels .Values.commonLabels ) "context" . ) }} + selector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: primary + template: + metadata: + name: {{ include "postgresql.v1.primary.fullname" . }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} + app.kubernetes.io/component: primary + {{- if or .Values.passwordUpdateJob.enabled (include "postgresql.v1.primary.createConfigmap" .) (include "postgresql.v1.primary.createExtendedConfigmap" .) .Values.primary.podAnnotations }} + annotations: + {{- if (include "postgresql.v1.primary.createConfigmap" .) }} + checksum/configuration: {{ pick (include (print $.Template.BasePath "/primary/configmap.yaml") . | fromYaml) "data" | toYaml | sha256sum }} + {{- end }} + {{- if (include "postgresql.v1.primary.createExtendedConfigmap" .) }} + checksum/extended-configuration: {{ pick (include (print $.Template.BasePath "/primary/extended-configmap.yaml") . | fromYaml) "data" | toYaml | sha256sum }} + {{- end }} + {{- if .Values.passwordUpdateJob.enabled }} + charts.bitnami.com/password-last-update: {{ now | date "20060102150405" | quote }} + {{- end }} + {{- if .Values.primary.podAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.podAnnotations "context" $ ) | nindent 8 }} + {{- end }} + {{- end }} + spec: + {{- if .Values.primary.extraPodSpec }} + {{- include "common.tplvalues.render" (dict "value" .Values.primary.extraPodSpec "context" $) | nindent 6 }} + {{- end }} + serviceAccountName: {{ include "postgresql.v1.serviceAccountName" . }} + {{- include "postgresql.v1.imagePullSecrets" . | nindent 6 }} + automountServiceAccountToken: {{ .Values.primary.automountServiceAccountToken }} + {{- if .Values.primary.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.primary.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.primary.affinity }} + affinity: {{- include "common.tplvalues.render" (dict "value" .Values.primary.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.primary.podAffinityPreset "component" "primary" "customLabels" $podLabels "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.primary.podAntiAffinityPreset "component" "primary" "customLabels" $podLabels "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.primary.nodeAffinityPreset.type "key" .Values.primary.nodeAffinityPreset.key "values" .Values.primary.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.primary.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.primary.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.primary.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.primary.tolerations "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.primary.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.primary.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.primary.priorityClassName }} + priorityClassName: {{ .Values.primary.priorityClassName }} + {{- end }} + {{- if .Values.primary.schedulerName }} + schedulerName: {{ .Values.primary.schedulerName | quote }} + {{- end }} + {{- if .Values.primary.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.primary.terminationGracePeriodSeconds }} + {{- end }} + {{- if .Values.primary.podSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.primary.podSecurityContext "context" $) | nindent 8 }} + {{- end }} + hostNetwork: {{ .Values.primary.hostNetwork }} + hostIPC: {{ .Values.primary.hostIPC }} + {{- if or (and .Values.tls.enabled (not .Values.volumePermissions.enabled)) (and .Values.volumePermissions.enabled (or .Values.primary.persistence.enabled .Values.shmVolume.enabled)) .Values.primary.initContainers }} + initContainers: + {{- if and .Values.tls.enabled (not .Values.volumePermissions.enabled) }} + - name: copy-certs + image: {{ include "postgresql.v1.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + {{- if .Values.primary.resources }} + resources: {{- toYaml .Values.primary.resources | nindent 12 }} + {{- else if ne .Values.primary.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.primary.resourcesPreset) | nindent 12 }} + {{- end }} + # We don't require a privileged container in this case + {{- if .Values.primary.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.primary.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + command: + - /bin/sh + - -ec + - | + cp /tmp/certs/* /opt/bitnami/postgresql/certs/ + chmod 600 {{ include "postgresql.v1.tlsCertKey" . }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + - name: raw-certificates + mountPath: /tmp/certs + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + {{- else if and .Values.volumePermissions.enabled (or .Values.primary.persistence.enabled .Values.shmVolume.enabled) }} + - name: init-chmod-data + image: {{ include "postgresql.v1.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + {{- if .Values.volumePermissions.resources }} + resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} + {{- else if ne .Values.volumePermissions.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }} + {{- end }} + command: + - /bin/sh + - -ec + - | + {{- if .Values.primary.persistence.enabled }} + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + chown `id -u`:`id -G | cut -d " " -f2` {{ .Values.primary.persistence.mountPath }} + {{- else }} + chown {{ .Values.primary.containerSecurityContext.runAsUser }}:{{ .Values.primary.podSecurityContext.fsGroup }} {{ .Values.primary.persistence.mountPath }} + {{- end }} + mkdir -p {{ .Values.primary.persistence.mountPath }}/data {{- if (include "postgresql.v1.mountConfigurationCM" .) }} {{ .Values.primary.persistence.mountPath }}/conf {{- end }} + chmod 700 {{ .Values.primary.persistence.mountPath }}/data {{- if (include "postgresql.v1.mountConfigurationCM" .) }} {{ .Values.primary.persistence.mountPath }}/conf {{- end }} + find {{ .Values.primary.persistence.mountPath }} -mindepth 1 -maxdepth 1 {{- if not (include "postgresql.v1.mountConfigurationCM" .) }} -not -name "conf" {{- end }} -not -name ".snapshot" -not -name "lost+found" | \ + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + xargs -r chown -R `id -u`:`id -G | cut -d " " -f2` + {{- else }} + xargs -r chown -R {{ .Values.primary.containerSecurityContext.runAsUser }}:{{ .Values.primary.podSecurityContext.fsGroup }} + {{- end }} + {{- end }} + {{- if .Values.shmVolume.enabled }} + chmod -R 777 /dev/shm + {{- end }} + {{- if .Values.tls.enabled }} + cp /tmp/certs/* /opt/bitnami/postgresql/certs/ + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/postgresql/certs/ + {{- else }} + chown -R {{ .Values.primary.containerSecurityContext.runAsUser }}:{{ .Values.primary.podSecurityContext.fsGroup }} /opt/bitnami/postgresql/certs/ + {{- end }} + chmod 600 {{ include "postgresql.v1.tlsCertKey" . }} + {{- end }} + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "runAsUser" | toYaml | nindent 12 }} + {{- else }} + securityContext: {{- .Values.volumePermissions.containerSecurityContext | toYaml | nindent 12 }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + - name: {{ .Values.primary.persistence.volumeName }} + mountPath: {{ .Values.primary.persistence.mountPath }} + {{- if .Values.primary.persistence.subPath }} + subPath: {{ .Values.primary.persistence.subPath }} + {{- end }} + {{- if .Values.shmVolume.enabled }} + - name: dshm + mountPath: /dev/shm + {{- end }} + {{- if .Values.tls.enabled }} + - name: raw-certificates + mountPath: /tmp/certs + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + {{- end }} + {{- end }} + {{- if .Values.primary.initContainers }} + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.initContainers "context" $ ) | nindent 8 }} + {{- end }} + {{- end }} + containers: + - name: postgresql + image: {{ include "postgresql.v1.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + {{- if .Values.primary.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.primary.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.primary.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.primary.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.primary.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.primary.args "context" $) | nindent 12 }} + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }} + - name: POSTGRESQL_PORT_NUMBER + value: {{ .Values.containerPorts.postgresql | quote }} + - name: POSTGRESQL_VOLUME_DIR + value: {{ .Values.primary.persistence.mountPath | quote }} + {{- if .Values.primary.persistence.mountPath }} + - name: PGDATA + value: {{ .Values.postgresqlDataDir | quote }} + {{- end }} + # Authentication + {{- if or (eq $customUser "postgres") (empty $customUser) }} + {{- if .Values.auth.enablePostgresUser }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.adminPasswordKey" .) }} + {{- else }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} + {{- end }} + {{- else }} + - name: ALLOW_EMPTY_PASSWORD + value: "true" + {{- end }} + {{- else }} + - name: POSTGRES_USER + value: {{ $customUser | quote }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.userPasswordKey" .) }} + {{- else }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.userPasswordKey" . }} + {{- end }} + {{- if .Values.auth.enablePostgresUser }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_POSTGRES_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.adminPasswordKey" .) }} + {{- else }} + - name: POSTGRES_POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} + {{- end }} + {{- end }} + {{- end }} + {{- if (include "postgresql.v1.database" .) }} + - name: POSTGRES_DATABASE + value: {{ (include "postgresql.v1.database" .) | quote }} + {{- end }} + {{- if or (eq .Values.architecture "replication") .Values.primary.standby.enabled }} + # Replication + - name: POSTGRES_REPLICATION_MODE + value: {{ ternary "slave" "master" .Values.primary.standby.enabled | quote }} + - name: POSTGRES_REPLICATION_USER + value: {{ .Values.auth.replicationUsername | quote }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_REPLICATION_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.replicationPasswordKey" .) }} + {{- else }} + - name: POSTGRES_REPLICATION_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.replicationPasswordKey" . }} + {{- end }} + {{- if ne .Values.replication.synchronousCommit "off" }} + - name: POSTGRES_SYNCHRONOUS_COMMIT_MODE + value: {{ .Values.replication.synchronousCommit | quote }} + - name: POSTGRES_NUM_SYNCHRONOUS_REPLICAS + value: {{ .Values.replication.numSynchronousReplicas | quote }} + {{- end }} + - name: POSTGRES_CLUSTER_APP_NAME + value: {{ .Values.replication.applicationName }} + {{- end }} + {{- if .Values.primary.initdb.args }} + # Initdb + - name: POSTGRES_INITDB_ARGS + value: {{ .Values.primary.initdb.args | quote }} + {{- end }} + {{- if .Values.primary.initdb.postgresqlWalDir }} + - name: POSTGRES_INITDB_WALDIR + value: {{ .Values.primary.initdb.postgresqlWalDir | quote }} + {{- end }} + {{- if .Values.primary.initdb.user }} + - name: POSTGRES_INITSCRIPTS_USERNAME + value: {{ .Values.primary.initdb.user }} + {{- end }} + {{- if .Values.primary.initdb.password }} + - name: POSTGRES_INITSCRIPTS_PASSWORD + value: {{ .Values.primary.initdb.password | quote }} + {{- end }} + {{- if .Values.primary.standby.enabled }} + # Standby + - name: POSTGRES_MASTER_HOST + value: {{ .Values.primary.standby.primaryHost }} + - name: POSTGRES_MASTER_PORT_NUMBER + value: {{ .Values.primary.standby.primaryPort | quote }} + {{- end }} + # LDAP + - name: POSTGRESQL_ENABLE_LDAP + value: {{ ternary "yes" "no" .Values.ldap.enabled | quote }} + {{- if .Values.ldap.enabled }} + {{- if or .Values.ldap.url .Values.ldap.uri }} + - name: POSTGRESQL_LDAP_URL + value: {{ coalesce .Values.ldap.url .Values.ldap.uri }} + {{- else }} + - name: POSTGRESQL_LDAP_SERVER + value: {{ .Values.ldap.server }} + - name: POSTGRESQL_LDAP_PORT + value: {{ .Values.ldap.port | quote }} + - name: POSTGRESQL_LDAP_SCHEME + value: {{ .Values.ldap.scheme }} + {{- if (include "postgresql.v1.ldap.tls.enabled" .) }} + - name: POSTGRESQL_LDAP_TLS + value: "1" + {{- end }} + - name: POSTGRESQL_LDAP_PREFIX + value: {{ .Values.ldap.prefix | quote }} + - name: POSTGRESQL_LDAP_SUFFIX + value: {{ .Values.ldap.suffix | quote }} + - name: POSTGRESQL_LDAP_BASE_DN + value: {{ coalesce .Values.ldap.baseDN .Values.ldap.basedn }} + - name: POSTGRESQL_LDAP_BIND_DN + value: {{ coalesce .Values.ldap.bindDN .Values.ldap.binddn}} + {{- if or (not (empty .Values.ldap.bind_password)) (not (empty .Values.ldap.bindpw)) }} + - name: POSTGRESQL_LDAP_BIND_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: ldap-password + {{- end }} + - name: POSTGRESQL_LDAP_SEARCH_ATTR + value: {{ coalesce .Values.ldap.search_attr .Values.ldap.searchAttribute }} + - name: POSTGRESQL_LDAP_SEARCH_FILTER + value: {{ coalesce .Values.ldap.search_filter .Values.ldap.searchFilter }} + {{- end }} + {{- end }} + # TLS + - name: POSTGRESQL_ENABLE_TLS + value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} + {{- if .Values.tls.enabled }} + - name: POSTGRESQL_TLS_PREFER_SERVER_CIPHERS + value: {{ ternary "yes" "no" .Values.tls.preferServerCiphers | quote }} + - name: POSTGRESQL_TLS_CERT_FILE + value: {{ include "postgresql.v1.tlsCert" . }} + - name: POSTGRESQL_TLS_KEY_FILE + value: {{ include "postgresql.v1.tlsCertKey" . }} + {{- if .Values.tls.certCAFilename }} + - name: POSTGRESQL_TLS_CA_FILE + value: {{ include "postgresql.v1.tlsCACert" . }} + {{- end }} + {{- if .Values.tls.crlFilename }} + - name: POSTGRESQL_TLS_CRL_FILE + value: {{ include "postgresql.v1.tlsCRL" . }} + {{- end }} + {{- end }} + # Audit + - name: POSTGRESQL_LOG_HOSTNAME + value: {{ .Values.audit.logHostname | quote }} + - name: POSTGRESQL_LOG_CONNECTIONS + value: {{ .Values.audit.logConnections | quote }} + - name: POSTGRESQL_LOG_DISCONNECTIONS + value: {{ .Values.audit.logDisconnections | quote }} + {{- if .Values.audit.logLinePrefix }} + - name: POSTGRESQL_LOG_LINE_PREFIX + value: {{ .Values.audit.logLinePrefix | quote }} + {{- end }} + {{- if .Values.audit.logTimezone }} + - name: POSTGRESQL_LOG_TIMEZONE + value: {{ .Values.audit.logTimezone | quote }} + {{- end }} + {{- if .Values.audit.pgAuditLog }} + - name: POSTGRESQL_PGAUDIT_LOG + value: {{ .Values.audit.pgAuditLog | quote }} + {{- end }} + - name: POSTGRESQL_PGAUDIT_LOG_CATALOG + value: {{ .Values.audit.pgAuditLogCatalog | quote }} + # Others + - name: POSTGRESQL_CLIENT_MIN_MESSAGES + value: {{ .Values.audit.clientMinMessages | quote }} + - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES + value: {{ .Values.postgresqlSharedPreloadLibraries | quote }} + {{- if .Values.primary.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.primary.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + {{- if or .Values.primary.extraEnvVarsCM .Values.primary.extraEnvVarsSecret }} + envFrom: + {{- if .Values.primary.extraEnvVarsCM }} + - configMapRef: + name: {{ .Values.primary.extraEnvVarsCM }} + {{- end }} + {{- if .Values.primary.extraEnvVarsSecret }} + - secretRef: + name: {{ .Values.primary.extraEnvVarsSecret }} + {{- end }} + {{- end }} + ports: + - name: tcp-postgresql + containerPort: {{ .Values.containerPorts.postgresql }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.primary.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.primary.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.primary.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.primary.startupProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /bin/sh + - -c + {{- if (include "postgresql.v1.database" .) }} + - exec pg_isready -U {{ default "postgres" $customUser | quote }} -d "dbname={{ include "postgresql.v1.database" . }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- else }} + - exec pg_isready -U {{ default "postgres" $customUser | quote }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} -d "sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- end }} + {{- end }} + {{- if .Values.primary.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.primary.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.primary.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.primary.livenessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /bin/sh + - -c + {{- if (include "postgresql.v1.database" .) }} + - exec pg_isready -U {{ default "postgres" $customUser | quote }} -d "dbname={{ include "postgresql.v1.database" . }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- else }} + - exec pg_isready -U {{ default "postgres" $customUser | quote }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} -d "sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- end }} + {{- end }} + {{- if .Values.primary.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.primary.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.primary.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.primary.readinessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /bin/sh + - -c + - -e + {{- include "postgresql.v1.readinessProbeCommand" . | nindent 16 }} + {{- end }} + {{- end }} + {{- if .Values.primary.resources }} + resources: {{- toYaml .Values.primary.resources | nindent 12 }} + {{- else if ne .Values.primary.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.primary.resourcesPreset) | nindent 12 }} + {{- end }} + {{- if .Values.primary.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.primary.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + - name: empty-dir + mountPath: /opt/bitnami/postgresql/conf + subPath: app-conf-dir + - name: empty-dir + mountPath: /opt/bitnami/postgresql/tmp + subPath: app-tmp-dir + {{- if or .Values.primary.preInitDb.scriptsConfigMap .Values.primary.preInitDb.scripts }} + - name: custom-preinit-scripts + mountPath: /docker-entrypoint-preinitdb.d/ + {{- end }} + {{- if .Values.primary.preInitDb.scriptsSecret }} + - name: custom-preinit-scripts-secret + mountPath: /docker-entrypoint-preinitdb.d/secret + {{- end }} + {{- if or .Values.primary.initdb.scriptsConfigMap .Values.primary.initdb.scripts }} + - name: custom-init-scripts + mountPath: /docker-entrypoint-initdb.d/ + {{- end }} + {{- if .Values.primary.initdb.scriptsSecret }} + - name: custom-init-scripts-secret + mountPath: /docker-entrypoint-initdb.d/secret + {{- end }} + {{- if or .Values.primary.extendedConfiguration .Values.primary.existingExtendedConfigmap }} + - name: postgresql-extended-config + mountPath: {{ .Values.primary.persistence.mountPath }}/conf/conf.d/ + {{- end }} + {{- if .Values.auth.usePasswordFiles }} + - name: postgresql-password + mountPath: /opt/bitnami/postgresql/secrets/ + {{- end }} + {{- if .Values.tls.enabled }} + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + readOnly: true + {{- end }} + {{- if .Values.shmVolume.enabled }} + - name: dshm + mountPath: /dev/shm + {{- end }} + - name: {{ .Values.primary.persistence.volumeName }} + mountPath: {{ .Values.primary.persistence.mountPath }} + {{- if .Values.primary.persistence.subPath }} + subPath: {{ .Values.primary.persistence.subPath }} + {{- end }} + {{- if or .Values.primary.configuration .Values.primary.pgHbaConfiguration .Values.primary.existingConfigmap }} + - name: postgresql-config + mountPath: {{ .Values.primary.persistence.mountPath }}/conf + {{- end }} + {{- if .Values.primary.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.primary.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.metrics.enabled }} + - name: metrics + image: {{ include "postgresql.v1.metrics.image" . }} + imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} + {{- if .Values.metrics.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.metrics.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if or .Values.metrics.customMetrics .Values.metrics.collectors }} + args: + {{- if .Values.metrics.customMetrics }} + - --extend.query-path + - /conf/custom-metrics.yaml + {{- end }} + {{- range $name, $enabled := .Values.metrics.collectors }} + - --{{ if not $enabled }}no-{{ end }}collector.{{ $name }} + {{- end }} + {{- end }} + env: + - name: DATA_SOURCE_URI + value: {{ printf "127.0.0.1:%d/postgres?sslmode=disable" (int (include "postgresql.v1.service.port" .)) }} + {{- if .Values.auth.usePasswordFiles }} + - name: DATA_SOURCE_PASS_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include (ternary "postgresql.v1.adminPasswordKey" "postgresql.v1.userPasswordKey" (empty $customUser)) .) }} + {{- else }} + - name: DATA_SOURCE_PASS + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include (ternary "postgresql.v1.adminPasswordKey" "postgresql.v1.userPasswordKey" (empty $customUser)) . }} + {{- end }} + - name: DATA_SOURCE_USER + value: {{ default "postgres" $customUser | quote }} + {{- if .Values.metrics.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + ports: + - name: http-metrics + containerPort: {{ .Values.metrics.containerPorts.metrics }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.metrics.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: http-metrics + {{- end }} + {{- if .Values.metrics.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: http-metrics + {{- end }} + {{- if .Values.metrics.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: http-metrics + {{- end }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + {{- if .Values.auth.usePasswordFiles }} + - name: postgresql-password + mountPath: /opt/bitnami/postgresql/secrets/ + {{- end }} + {{- if .Values.metrics.customMetrics }} + - name: custom-metrics + mountPath: /conf + readOnly: true + {{- end }} + {{- if .Values.metrics.resources }} + resources: {{- toYaml .Values.metrics.resources | nindent 12 }} + {{- else if ne .Values.metrics.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.primary.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.sidecars "context" $ ) | nindent 8 }} + {{- end }} + volumes: + - name: empty-dir + emptyDir: {} + {{- if or .Values.primary.configuration .Values.primary.pgHbaConfiguration .Values.primary.existingConfigmap }} + - name: postgresql-config + configMap: + name: {{ include "postgresql.v1.primary.configmapName" . }} + {{- end }} + {{- if or .Values.primary.extendedConfiguration .Values.primary.existingExtendedConfigmap }} + - name: postgresql-extended-config + configMap: + name: {{ include "postgresql.v1.primary.extendedConfigmapName" . }} + {{- end }} + {{- if .Values.auth.usePasswordFiles }} + - name: postgresql-password + secret: + secretName: {{ include "postgresql.v1.secretName" . }} + {{- end }} + {{- if or .Values.primary.preInitDb.scriptsConfigMap .Values.primary.preInitDb.scripts }} + - name: custom-preinit-scripts + configMap: + name: {{ include "postgresql.v1.preInitDb.scriptsCM" . }} + {{- end }} + {{- if .Values.primary.preInitDb.scriptsSecret }} + - name: custom-preinit-scripts-secret + secret: + secretName: {{ tpl .Values.primary.preInitDb.scriptsSecret $ }} + {{- end }} + {{- if or .Values.primary.initdb.scriptsConfigMap .Values.primary.initdb.scripts }} + - name: custom-init-scripts + configMap: + name: {{ include "postgresql.v1.initdb.scriptsCM" . }} + {{- end }} + {{- if .Values.primary.initdb.scriptsSecret }} + - name: custom-init-scripts-secret + secret: + secretName: {{ tpl .Values.primary.initdb.scriptsSecret $ }} + {{- end }} + {{- if .Values.tls.enabled }} + - name: raw-certificates + secret: + secretName: {{ include "postgresql.v1.tlsSecretName" . }} + - name: postgresql-certificates + emptyDir: {} + {{- end }} + {{- if .Values.primary.extraVolumes }} + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.extraVolumes "context" $ ) | nindent 8 }} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.customMetrics }} + - name: custom-metrics + configMap: + name: {{ printf "%s-metrics" (include "postgresql.v1.primary.fullname" .) }} + {{- end }} + {{- if .Values.shmVolume.enabled }} + - name: dshm + emptyDir: + medium: Memory + {{- if .Values.shmVolume.sizeLimit }} + sizeLimit: {{ .Values.shmVolume.sizeLimit }} + {{- end }} + {{- end }} + {{- if and .Values.primary.persistence.enabled .Values.primary.persistence.existingClaim }} + - name: {{ .Values.primary.persistence.volumeName }} + persistentVolumeClaim: + claimName: {{ tpl .Values.primary.persistence.existingClaim $ }} + {{- else if not .Values.primary.persistence.enabled }} + - name: {{ .Values.primary.persistence.volumeName }} + emptyDir: {} + {{- else }} + {{- if .Values.primary.persistentVolumeClaimRetentionPolicy.enabled }} + persistentVolumeClaimRetentionPolicy: + whenDeleted: {{ .Values.primary.persistentVolumeClaimRetentionPolicy.whenDeleted }} + whenScaled: {{ .Values.primary.persistentVolumeClaimRetentionPolicy.whenScaled }} + {{- end }} + volumeClaimTemplates: + - apiVersion: v1 + kind: PersistentVolumeClaim + metadata: + name: {{ .Values.primary.persistence.volumeName }} + {{- if .Values.primary.persistence.annotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.primary.persistence.annotations "context" $) | nindent 10 }} + {{- end }} + {{- if .Values.primary.persistence.labels }} + labels: {{- include "common.tplvalues.render" (dict "value" .Values.primary.persistence.labels "context" $) | nindent 10 }} + {{- end }} + spec: + accessModes: + {{- range .Values.primary.persistence.accessModes }} + - {{ . | quote }} + {{- end }} + {{- if .Values.primary.persistence.dataSource }} + dataSource: {{- include "common.tplvalues.render" (dict "value" .Values.primary.persistence.dataSource "context" $) | nindent 10 }} + {{- end }} + resources: + requests: + storage: {{ .Values.primary.persistence.size | quote }} + {{- if .Values.primary.persistence.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.primary.persistence.selector "context" $) | nindent 10 }} + {{- end }} + {{- include "common.storage.class" (dict "persistence" .Values.primary.persistence "global" .Values.global) | nindent 8 }} + {{- end }} diff --git a/charts/postgresql/templates/primary/svc-headless.yaml b/charts/postgresql/templates/primary/svc-headless.yaml new file mode 100644 index 0000000..180cfcb --- /dev/null +++ b/charts/postgresql/templates/primary/svc-headless.yaml @@ -0,0 +1,31 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +apiVersion: v1 +kind: Service +metadata: + name: {{ include "postgresql.v1.primary.svc.headless" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary + annotations: + {{- if or .Values.primary.service.headless.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.service.headless.annotations .Values.commonAnnotations ) "context" . ) }} + {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + clusterIP: None + # We want all pods in the StatefulSet to have their addresses published for + # the sake of the other Postgresql pods even before they're ready, since they + # have to be able to talk to each other in order to become ready. + publishNotReadyAddresses: true + ports: + - name: tcp-postgresql + port: {{ template "postgresql.v1.service.port" . }} + targetPort: tcp-postgresql + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.podLabels .Values.commonLabels ) "context" . ) }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary diff --git a/charts/postgresql/templates/primary/svc.yaml b/charts/postgresql/templates/primary/svc.yaml new file mode 100644 index 0000000..33002d8 --- /dev/null +++ b/charts/postgresql/templates/primary/svc.yaml @@ -0,0 +1,54 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +apiVersion: v1 +kind: Service +metadata: + name: {{ include "postgresql.v1.primary.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary + {{- if or .Values.commonAnnotations .Values.primary.service.annotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.service.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.primary.service.type }} + {{- if or (eq .Values.primary.service.type "LoadBalancer") (eq .Values.primary.service.type "NodePort") }} + externalTrafficPolicy: {{ .Values.primary.service.externalTrafficPolicy | quote }} + {{- end }} + {{- if and (eq .Values.primary.service.type "LoadBalancer") (not (empty .Values.primary.service.loadBalancerSourceRanges)) }} + loadBalancerSourceRanges: {{ .Values.primary.service.loadBalancerSourceRanges | toJson}} + {{- end }} + {{- if and (eq .Values.primary.service.type "LoadBalancer") (not (empty .Values.primary.service.loadBalancerClass)) }} + loadBalancerClass: {{ .Values.primary.service.loadBalancerClass }} + {{- end }} + {{- if and (eq .Values.primary.service.type "LoadBalancer") (not (empty .Values.primary.service.loadBalancerIP)) }} + loadBalancerIP: {{ .Values.primary.service.loadBalancerIP }} + {{- end }} + {{- if and .Values.primary.service.clusterIP (eq .Values.primary.service.type "ClusterIP") }} + clusterIP: {{ .Values.primary.service.clusterIP }} + {{- end }} + {{- if .Values.primary.service.sessionAffinity }} + sessionAffinity: {{ .Values.primary.service.sessionAffinity }} + {{- end }} + {{- if .Values.primary.service.sessionAffinityConfig }} + sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.primary.service.sessionAffinityConfig "context" $) | nindent 4 }} + {{- end }} + ports: + - name: tcp-postgresql + port: {{ template "postgresql.v1.service.port" . }} + targetPort: tcp-postgresql + {{- if and (or (eq .Values.primary.service.type "NodePort") (eq .Values.primary.service.type "LoadBalancer")) (not (empty .Values.primary.service.nodePorts.postgresql)) }} + nodePort: {{ .Values.primary.service.nodePorts.postgresql }} + {{- else if eq .Values.primary.service.type "ClusterIP" }} + nodePort: null + {{- end }} + {{- if .Values.primary.service.extraPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.primary.service.extraPorts "context" $) | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.podLabels .Values.commonLabels ) "context" . ) }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary diff --git a/charts/postgresql/templates/prometheusrule.yaml b/charts/postgresql/templates/prometheusrule.yaml new file mode 100644 index 0000000..0ec8e6a --- /dev/null +++ b/charts/postgresql/templates/prometheusrule.yaml @@ -0,0 +1,22 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule +metadata: + name: {{ include "common.names.fullname" . }} + namespace: {{ coalesce .Values.metrics.prometheusRule.namespace (include "common.names.namespace" .) | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.prometheusRule.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: metrics + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + groups: + - name: {{ include "common.names.fullname" . }} + rules: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.prometheusRule.rules "context" $ ) | nindent 8 }} +{{- end }} diff --git a/charts/postgresql/templates/psp.yaml b/charts/postgresql/templates/psp.yaml new file mode 100644 index 0000000..41267ec --- /dev/null +++ b/charts/postgresql/templates/psp.yaml @@ -0,0 +1,42 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and (include "common.capabilities.psp.supported" .) .Values.psp.create }} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ include "common.names.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + privileged: false + volumes: + - 'configMap' + - 'secret' + - 'persistentVolumeClaim' + - 'emptyDir' + - 'projected' + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + rule: 'RunAsAny' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + readOnlyRootFilesystem: false +{{- end }} diff --git a/charts/postgresql/templates/read/extended-configmap.yaml b/charts/postgresql/templates/read/extended-configmap.yaml new file mode 100644 index 0000000..6ffc93c --- /dev/null +++ b/charts/postgresql/templates/read/extended-configmap.yaml @@ -0,0 +1,20 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if (include "postgresql.v1.readReplicas.createExtendedConfigmap" .) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-extended-configuration" (include "postgresql.v1.readReplica.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + override.conf: |- + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.extendedConfiguration "context" $ ) | nindent 4 }} +{{- end }} diff --git a/charts/postgresql/templates/read/metrics-configmap.yaml b/charts/postgresql/templates/read/metrics-configmap.yaml new file mode 100644 index 0000000..a4ed6b7 --- /dev/null +++ b/charts/postgresql/templates/read/metrics-configmap.yaml @@ -0,0 +1,18 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.metrics.enabled .Values.metrics.customMetrics (eq .Values.architecture "replication") }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-metrics" (include "postgresql.v1.readReplica.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + custom-metrics.yaml: {{ toYaml .Values.metrics.customMetrics | quote }} +{{- end }} diff --git a/charts/postgresql/templates/read/metrics-svc.yaml b/charts/postgresql/templates/read/metrics-svc.yaml new file mode 100644 index 0000000..fccd1b9 --- /dev/null +++ b/charts/postgresql/templates/read/metrics-svc.yaml @@ -0,0 +1,31 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.metrics.enabled (eq .Values.architecture "replication") }} +apiVersion: v1 +kind: Service +metadata: + name: {{ printf "%s-metrics" (include "postgresql.v1.readReplica.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: metrics-read + {{- if or .Values.commonAnnotations .Values.metrics.service.annotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.service.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + sessionAffinity: {{ .Values.metrics.service.sessionAffinity }} + {{- if .Values.metrics.service.clusterIP }} + clusterIP: {{ .Values.metrics.service.clusterIP }} + {{- end }} + ports: + - name: http-metrics + port: {{ .Values.metrics.service.ports.metrics }} + targetPort: http-metrics + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.podLabels .Values.commonLabels ) "context" . ) }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read +{{- end }} diff --git a/charts/postgresql/templates/read/networkpolicy.yaml b/charts/postgresql/templates/read/networkpolicy.yaml new file mode 100644 index 0000000..9c730d8 --- /dev/null +++ b/charts/postgresql/templates/read/networkpolicy.yaml @@ -0,0 +1,80 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if eq .Values.architecture "replication" }} +{{- if .Values.readReplicas.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ include "postgresql.v1.readReplica.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.podLabels .Values.commonLabels ) "context" . ) }} + podSelector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: read + policyTypes: + - Ingress + - Egress + {{- if .Values.readReplicas.networkPolicy.allowExternalEgress }} + egress: + - {} + {{- else }} + egress: + # Allow dns resolution + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + # Allow outbound connections to primary + - ports: + - port: {{ .Values.containerPorts.postgresql }} + to: + - podSelector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }} + app.kubernetes.io/component: primary + {{- if .Values.readReplicas.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} + ingress: + - ports: + - port: {{ .Values.containerPorts.postgresql }} + {{- if .Values.metrics.enabled }} + - port: {{ .Values.metrics.containerPorts.metrics }} + {{- end }} + {{- if not .Values.readReplicas.networkPolicy.allowExternal }} + from: + - podSelector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }} + - podSelector: + matchLabels: + {{ template "postgresql.v1.readReplica.fullname" . }}-client: "true" + {{- if .Values.readReplicas.networkPolicy.ingressNSMatchLabels }} + - namespaceSelector: + matchLabels: + {{- range $key, $value := .Values.readReplicas.networkPolicy.ingressNSMatchLabels }} + {{ $key | quote }}: {{ $value | quote }} + {{- end }} + {{- if .Values.readReplicas.networkPolicy.ingressNSPodMatchLabels }} + podSelector: + matchLabels: + {{- range $key, $value := .Values.readReplicas.networkPolicy.ingressNSPodMatchLabels }} + {{ $key | quote }}: {{ $value | quote }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.readReplicas.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/postgresql/templates/read/pdb.yaml b/charts/postgresql/templates/read/pdb.yaml new file mode 100644 index 0000000..bd2eaad --- /dev/null +++ b/charts/postgresql/templates/read/pdb.yaml @@ -0,0 +1,29 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and ( eq .Values.architecture "replication" ) .Values.readReplicas.pdb.create }} +apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} +kind: PodDisruptionBudget +metadata: + name: {{ include "postgresql.v1.readReplica.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.readReplicas.pdb.minAvailable }} + minAvailable: {{ .Values.readReplicas.pdb.minAvailable }} + {{- end }} + {{- if or .Values.readReplicas.pdb.maxUnavailable ( not .Values.readReplicas.pdb.minAvailable ) }} + maxUnavailable: {{ .Values.readReplicas.pdb.maxUnavailable | default 1 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.podLabels .Values.commonLabels ) "context" . ) }} + selector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: read +{{- end }} diff --git a/charts/postgresql/templates/read/servicemonitor.yaml b/charts/postgresql/templates/read/servicemonitor.yaml new file mode 100644 index 0000000..b1536a6 --- /dev/null +++ b/charts/postgresql/templates/read/servicemonitor.yaml @@ -0,0 +1,46 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled (eq .Values.architecture "replication") }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "postgresql.v1.readReplica.fullname" . }} + namespace: {{ coalesce .Values.metrics.serviceMonitor.namespace (include "common.names.namespace" .) | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: metrics-read + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.metrics.serviceMonitor.jobLabel }} + jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }} + {{- end }} + selector: + {{- $svcLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.selector .Values.commonLabels ) "context" . ) }} + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $svcLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: metrics-read + endpoints: + - port: http-metrics + {{- if .Values.metrics.serviceMonitor.interval }} + interval: {{ .Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.relabelings }} + relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 6 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.metricRelabelings }} + metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 6 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.honorLabels }} + honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }} + {{- end }} + namespaceSelector: + matchNames: + - {{ include "common.names.namespace" . | quote }} +{{- end }} diff --git a/charts/postgresql/templates/read/statefulset.yaml b/charts/postgresql/templates/read/statefulset.yaml new file mode 100644 index 0000000..a81a837 --- /dev/null +++ b/charts/postgresql/templates/read/statefulset.yaml @@ -0,0 +1,588 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if eq .Values.architecture "replication" }} +{{- $customUser := include "postgresql.v1.username" . }} +apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} +kind: StatefulSet +metadata: + name: {{ include "postgresql.v1.readReplica.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read + {{- if or .Values.commonAnnotations .Values.readReplicas.annotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + replicas: {{ .Values.readReplicas.replicaCount }} + serviceName: {{ include "postgresql.v1.readReplica.svc.headless" . }} + {{- if .Values.readReplicas.updateStrategy }} + updateStrategy: {{- toYaml .Values.readReplicas.updateStrategy | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.podLabels .Values.commonLabels ) "context" . ) }} + selector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: read + template: + metadata: + name: {{ include "postgresql.v1.readReplica.fullname" . }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} + app.kubernetes.io/component: read + {{- if or .Values.passwordUpdateJob.enabled (include "postgresql.v1.readReplicas.createExtendedConfigmap" .) .Values.readReplicas.podAnnotations }} + annotations: + {{- if (include "postgresql.v1.readReplicas.createExtendedConfigmap" .) }} + checksum/extended-configuration: {{ pick (include (print $.Template.BasePath "/primary/extended-configmap.yaml") . | fromYaml) "data" | toYaml | sha256sum }} + {{- end }} + {{- if .Values.passwordUpdateJob.enabled }} + charts.bitnami.com/password-last-update: {{ now | date "20060102150405" | quote }} + {{- end }} + {{- if .Values.readReplicas.podAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.podAnnotations "context" $ ) | nindent 8 }} + {{- end }} + {{- end }} + spec: + {{- if .Values.readReplicas.extraPodSpec }} + {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.extraPodSpec "context" $) | nindent 6 }} + {{- end }} + serviceAccountName: {{ include "postgresql.v1.serviceAccountName" . }} + {{- include "postgresql.v1.imagePullSecrets" . | nindent 6 }} + automountServiceAccountToken: {{ .Values.readReplicas.automountServiceAccountToken }} + {{- if .Values.readReplicas.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.readReplicas.affinity }} + affinity: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.readReplicas.podAffinityPreset "component" "read" "customLabels" $podLabels "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.readReplicas.podAntiAffinityPreset "component" "read" "customLabels" $podLabels "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.readReplicas.nodeAffinityPreset.type "key" .Values.readReplicas.nodeAffinityPreset.key "values" .Values.readReplicas.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.readReplicas.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.readReplicas.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.tolerations "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.readReplicas.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.topologySpreadConstraints "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.readReplicas.priorityClassName }} + priorityClassName: {{ .Values.readReplicas.priorityClassName }} + {{- end }} + {{- if .Values.readReplicas.schedulerName }} + schedulerName: {{ .Values.readReplicas.schedulerName | quote }} + {{- end }} + {{- if .Values.readReplicas.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.readReplicas.terminationGracePeriodSeconds }} + {{- end }} + {{- if .Values.readReplicas.podSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.readReplicas.podSecurityContext "context" $) | nindent 8 }} + {{- end }} + hostNetwork: {{ .Values.readReplicas.hostNetwork }} + hostIPC: {{ .Values.readReplicas.hostIPC }} + {{- if or (and .Values.tls.enabled (not .Values.volumePermissions.enabled)) (and .Values.volumePermissions.enabled (or .Values.readReplicas.persistence.enabled .Values.shmVolume.enabled)) .Values.readReplicas.initContainers }} + initContainers: + {{- if and .Values.tls.enabled (not .Values.volumePermissions.enabled) }} + - name: copy-certs + image: {{ include "postgresql.v1.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + {{- if .Values.readReplicas.resources }} + resources: {{- toYaml .Values.readReplicas.resources | nindent 12 }} + {{- else if ne .Values.readReplicas.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.readReplicas.resourcesPreset) | nindent 12 }} + {{- end }} + # We don't require a privileged container in this case + {{- if .Values.readReplicas.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.readReplicas.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + command: + - /bin/sh + - -ec + - | + cp /tmp/certs/* /opt/bitnami/postgresql/certs/ + chmod 600 {{ include "postgresql.v1.tlsCertKey" . }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + - name: raw-certificates + mountPath: /tmp/certs + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + {{- else if and .Values.volumePermissions.enabled (or .Values.readReplicas.persistence.enabled .Values.shmVolume.enabled) }} + - name: init-chmod-data + image: {{ include "postgresql.v1.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + {{- if .Values.readReplicas.resources }} + resources: {{- toYaml .Values.readReplicas.resources | nindent 12 }} + {{- else if ne .Values.readReplicas.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.readReplicas.resourcesPreset) | nindent 12 }} + {{- end }} + command: + - /bin/sh + - -ec + - | + {{- if .Values.readReplicas.persistence.enabled }} + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + chown `id -u`:`id -G | cut -d " " -f2` {{ .Values.readReplicas.persistence.mountPath }} + {{- else }} + chown {{ .Values.readReplicas.containerSecurityContext.runAsUser }}:{{ .Values.readReplicas.podSecurityContext.fsGroup }} {{ .Values.readReplicas.persistence.mountPath }} + {{- end }} + mkdir -p {{ .Values.readReplicas.persistence.mountPath }}/data {{- if (include "postgresql.v1.mountConfigurationCM" .) }} {{ .Values.readReplicas.persistence.mountPath }}/conf {{- end }} + chmod 700 {{ .Values.readReplicas.persistence.mountPath }}/data {{- if (include "postgresql.v1.mountConfigurationCM" .) }} {{ .Values.readReplicas.persistence.mountPath }}/conf {{- end }} + find {{ .Values.readReplicas.persistence.mountPath }} -mindepth 1 -maxdepth 1 {{- if not (include "postgresql.v1.mountConfigurationCM" .) }} -not -name "conf" {{- end }} -not -name ".snapshot" -not -name "lost+found" | \ + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + xargs -r chown -R `id -u`:`id -G | cut -d " " -f2` + {{- else }} + xargs -r chown -R {{ .Values.readReplicas.containerSecurityContext.runAsUser }}:{{ .Values.readReplicas.podSecurityContext.fsGroup }} + {{- end }} + {{- end }} + {{- if .Values.shmVolume.enabled }} + chmod -R 777 /dev/shm + {{- end }} + {{- if .Values.tls.enabled }} + cp /tmp/certs/* /opt/bitnami/postgresql/certs/ + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/postgresql/certs/ + {{- else }} + chown -R {{ .Values.readReplicas.containerSecurityContext.runAsUser }}:{{ .Values.readReplicas.podSecurityContext.fsGroup }} /opt/bitnami/postgresql/certs/ + {{- end }} + chmod 600 {{ include "postgresql.v1.tlsCertKey" . }} + {{- end }} + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "runAsUser" | toYaml | nindent 12 }} + {{- else }} + securityContext: {{- .Values.volumePermissions.containerSecurityContext | toYaml | nindent 12 }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + - name: data + mountPath: {{ .Values.readReplicas.persistence.mountPath }} + {{- if .Values.readReplicas.persistence.subPath }} + subPath: {{ .Values.readReplicas.persistence.subPath }} + {{- end }} + {{- if .Values.shmVolume.enabled }} + - name: dshm + mountPath: /dev/shm + {{- end }} + {{- if .Values.tls.enabled }} + - name: raw-certificates + mountPath: /tmp/certs + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + {{- end }} + {{- end }} + {{- if .Values.readReplicas.initContainers }} + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.initContainers "context" $ ) | nindent 8 }} + {{- end }} + {{- end }} + containers: + - name: postgresql + image: {{ include "postgresql.v1.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + {{- if .Values.readReplicas.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.readReplicas.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.readReplicas.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.readReplicas.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.args "context" $) | nindent 12 }} + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }} + - name: POSTGRESQL_PORT_NUMBER + value: {{ .Values.containerPorts.postgresql | quote }} + - name: POSTGRESQL_VOLUME_DIR + value: {{ .Values.readReplicas.persistence.mountPath | quote }} + {{- if .Values.readReplicas.persistence.mountPath }} + - name: PGDATA + value: {{ .Values.postgresqlDataDir | quote }} + {{- end }} + # Authentication + {{- if or (eq $customUser "postgres") (empty $customUser) }} + {{- if .Values.auth.enablePostgresUser }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.adminPasswordKey" .) }} + {{- else }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} + {{- end }} + {{- else }} + - name: ALLOW_EMPTY_PASSWORD + value: "true" + {{- end }} + {{- else }} + - name: POSTGRES_USER + value: {{ $customUser | quote }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.userPasswordKey" .) }} + {{- else }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.userPasswordKey" . }} + {{- end }} + {{- if .Values.auth.enablePostgresUser }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_POSTGRES_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.adminPasswordKey" .) }} + {{- else }} + - name: POSTGRES_POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} + {{- end }} + {{- end }} + {{- end }} + # Replication + - name: POSTGRES_REPLICATION_MODE + value: "slave" + - name: POSTGRES_REPLICATION_USER + value: {{ .Values.auth.replicationUsername | quote }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_REPLICATION_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.replicationPasswordKey" .) }} + {{- else }} + - name: POSTGRES_REPLICATION_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.replicationPasswordKey" . }} + {{- end }} + - name: POSTGRES_CLUSTER_APP_NAME + value: {{ .Values.replication.applicationName }} + - name: POSTGRES_MASTER_HOST + value: {{ include "postgresql.v1.primary.fullname" . }} + - name: POSTGRES_MASTER_PORT_NUMBER + value: {{ include "postgresql.v1.service.port" . | quote }} + # TLS + - name: POSTGRESQL_ENABLE_TLS + value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} + {{- if .Values.tls.enabled }} + - name: POSTGRESQL_TLS_PREFER_SERVER_CIPHERS + value: {{ ternary "yes" "no" .Values.tls.preferServerCiphers | quote }} + - name: POSTGRESQL_TLS_CERT_FILE + value: {{ include "postgresql.v1.tlsCert" . }} + - name: POSTGRESQL_TLS_KEY_FILE + value: {{ include "postgresql.v1.tlsCertKey" . }} + {{- if .Values.tls.certCAFilename }} + - name: POSTGRESQL_TLS_CA_FILE + value: {{ include "postgresql.v1.tlsCACert" . }} + {{- end }} + {{- if .Values.tls.crlFilename }} + - name: POSTGRESQL_TLS_CRL_FILE + value: {{ include "postgresql.v1.tlsCRL" . }} + {{- end }} + {{- end }} + # Audit + - name: POSTGRESQL_LOG_HOSTNAME + value: {{ .Values.audit.logHostname | quote }} + - name: POSTGRESQL_LOG_CONNECTIONS + value: {{ .Values.audit.logConnections | quote }} + - name: POSTGRESQL_LOG_DISCONNECTIONS + value: {{ .Values.audit.logDisconnections | quote }} + {{- if .Values.audit.logLinePrefix }} + - name: POSTGRESQL_LOG_LINE_PREFIX + value: {{ .Values.audit.logLinePrefix | quote }} + {{- end }} + {{- if .Values.audit.logTimezone }} + - name: POSTGRESQL_LOG_TIMEZONE + value: {{ .Values.audit.logTimezone | quote }} + {{- end }} + {{- if .Values.audit.pgAuditLog }} + - name: POSTGRESQL_PGAUDIT_LOG + value: {{ .Values.audit.pgAuditLog | quote }} + {{- end }} + - name: POSTGRESQL_PGAUDIT_LOG_CATALOG + value: {{ .Values.audit.pgAuditLogCatalog | quote }} + # Others + - name: POSTGRESQL_CLIENT_MIN_MESSAGES + value: {{ .Values.audit.clientMinMessages | quote }} + - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES + value: {{ .Values.postgresqlSharedPreloadLibraries | quote }} + {{- if .Values.readReplicas.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + {{- if or .Values.readReplicas.extraEnvVarsCM .Values.readReplicas.extraEnvVarsSecret }} + envFrom: + {{- if .Values.readReplicas.extraEnvVarsCM }} + - configMapRef: + name: {{ .Values.readReplicas.extraEnvVarsCM }} + {{- end }} + {{- if .Values.readReplicas.extraEnvVarsSecret }} + - secretRef: + name: {{ .Values.readReplicas.extraEnvVarsSecret }} + {{- end }} + {{- end }} + ports: + - name: tcp-postgresql + containerPort: {{ .Values.containerPorts.postgresql }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.readReplicas.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.readReplicas.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readReplicas.startupProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /bin/sh + - -c + {{- if (include "postgresql.v1.database" .) }} + - exec pg_isready -U {{ default "postgres" $customUser| quote }} -d "dbname={{ include "postgresql.v1.database" . }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- else }} + - exec pg_isready -U {{ default "postgres" $customUser | quote }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} -d "sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- end }} + {{- end }} + {{- if .Values.readReplicas.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.readReplicas.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readReplicas.livenessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /bin/sh + - -c + {{- if (include "postgresql.v1.database" .) }} + - exec pg_isready -U {{ default "postgres" $customUser | quote }} -d "dbname={{ include "postgresql.v1.database" . }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- else }} + - exec pg_isready -U {{default "postgres" $customUser | quote }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} -d "sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- end }} + {{- end }} + {{- if .Values.readReplicas.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.readReplicas.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readReplicas.readinessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /bin/sh + - -c + - -e + {{- include "postgresql.v1.readinessProbeCommand" . | nindent 16 }} + {{- end }} + {{- end }} + {{- if .Values.readReplicas.resources }} + resources: {{- toYaml .Values.readReplicas.resources | nindent 12 }} + {{- else if ne .Values.readReplicas.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.readReplicas.resourcesPreset) | nindent 12 }} + {{- end }} + {{- if .Values.readReplicas.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + - name: empty-dir + mountPath: /opt/bitnami/postgresql/conf + subPath: app-conf-dir + - name: empty-dir + mountPath: /opt/bitnami/postgresql/tmp + subPath: app-tmp-dir + {{- if .Values.auth.usePasswordFiles }} + - name: postgresql-password + mountPath: /opt/bitnami/postgresql/secrets/ + {{- end }} + {{- if .Values.readReplicas.extendedConfiguration }} + - name: postgresql-extended-config + mountPath: {{ .Values.readReplicas.persistence.mountPath }}/conf/conf.d/ + {{- end }} + {{- if .Values.tls.enabled }} + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + readOnly: true + {{- end }} + {{- if .Values.shmVolume.enabled }} + - name: dshm + mountPath: /dev/shm + {{- end }} + - name: data + mountPath: {{ .Values.readReplicas.persistence.mountPath }} + {{- if .Values.readReplicas.persistence.subPath }} + subPath: {{ .Values.readReplicas.persistence.subPath }} + {{- end }} + {{- if .Values.readReplicas.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.metrics.enabled }} + - name: metrics + image: {{ include "postgresql.v1.metrics.image" . }} + imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} + {{- if .Values.metrics.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.metrics.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if or .Values.metrics.customMetrics .Values.metrics.collectors }} + args: + {{- if .Values.metrics.customMetrics }} + - --extend.query-path + - /conf/custom-metrics.yaml + {{- end }} + {{- range $name, $enabled := .Values.metrics.collectors }} + - --{{ if not $enabled }}no-{{ end }}collector.{{ $name }} + {{- end }} + {{- end }} + env: + - name: DATA_SOURCE_URI + value: {{ printf "127.0.0.1:%d/postgres?sslmode=disable" (int (include "postgresql.v1.service.port" .)) }} + {{- if .Values.auth.usePasswordFiles }} + - name: DATA_SOURCE_PASS_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include (ternary "postgresql.v1.adminPasswordKey" "postgresql.v1.userPasswordKey" (empty $customUser)) .) }} + {{- else }} + - name: DATA_SOURCE_PASS + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include (ternary "postgresql.v1.adminPasswordKey" "postgresql.v1.userPasswordKey" (empty $customUser)) . }} + {{- end }} + - name: DATA_SOURCE_USER + value: {{ default "postgres" $customUser | quote }} + {{- if .Values.metrics.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + ports: + - name: http-metrics + containerPort: {{ .Values.metrics.containerPorts.metrics }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.metrics.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: http-metrics + {{- end }} + {{- if .Values.metrics.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: http-metrics + {{- end }} + {{- if .Values.metrics.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: http-metrics + {{- end }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + {{- if .Values.auth.usePasswordFiles }} + - name: postgresql-password + mountPath: /opt/bitnami/postgresql/secrets/ + {{- end }} + {{- if .Values.metrics.customMetrics }} + - name: custom-metrics + mountPath: /conf + readOnly: true + {{- end }} + {{- if .Values.metrics.resources }} + resources: {{- toYaml .Values.metrics.resources | nindent 12 }} + {{- else if ne .Values.metrics.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.readReplicas.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.sidecars "context" $ ) | nindent 8 }} + {{- end }} + volumes: + {{- if .Values.readReplicas.extendedConfiguration }} + - name: postgresql-extended-config + configMap: + name: {{ include "postgresql.v1.readReplicas.extendedConfigmapName" . }} + {{- end }} + {{- if .Values.auth.usePasswordFiles }} + - name: postgresql-password + secret: + secretName: {{ include "postgresql.v1.secretName" . }} + {{- end }} + {{- if .Values.tls.enabled }} + - name: raw-certificates + secret: + secretName: {{ include "postgresql.v1.tlsSecretName" . }} + - name: postgresql-certificates + emptyDir: {} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.customMetrics }} + - name: custom-metrics + configMap: + name: {{ printf "%s-metrics" (include "postgresql.v1.readReplica.fullname" .) }} + {{- end }} + {{- if .Values.shmVolume.enabled }} + - name: dshm + emptyDir: + medium: Memory + {{- if .Values.shmVolume.sizeLimit }} + sizeLimit: {{ .Values.shmVolume.sizeLimit }} + {{- end }} + {{- end }} + - name: empty-dir + emptyDir: {} + {{- if .Values.readReplicas.extraVolumes }} + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.extraVolumes "context" $ ) | nindent 8 }} + {{- end }} + {{- if and .Values.readReplicas.persistence.enabled .Values.readReplicas.persistence.existingClaim }} + - name: data + persistentVolumeClaim: + claimName: {{ tpl .Values.readReplicas.persistence.existingClaim $ }} + {{- else if not .Values.readReplicas.persistence.enabled }} + - name: data + emptyDir: {} + {{- else }} + {{- if .Values.readReplicas.persistentVolumeClaimRetentionPolicy.enabled }} + persistentVolumeClaimRetentionPolicy: + whenDeleted: {{ .Values.readReplicas.persistentVolumeClaimRetentionPolicy.whenDeleted }} + whenScaled: {{ .Values.readReplicas.persistentVolumeClaimRetentionPolicy.whenScaled }} + {{- end }} + volumeClaimTemplates: + - apiVersion: v1 + kind: PersistentVolumeClaim + metadata: + name: data + {{- if .Values.readReplicas.persistence.annotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.persistence.annotations "context" $) | nindent 10 }} + {{- end }} + {{- if .Values.readReplicas.persistence.labels }} + labels: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.persistence.labels "context" $) | nindent 10 }} + {{- end }} + spec: + accessModes: + {{- range .Values.readReplicas.persistence.accessModes }} + - {{ . | quote }} + {{- end }} + {{- if .Values.readReplicas.persistence.dataSource }} + dataSource: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.persistence.dataSource "context" $) | nindent 10 }} + {{- end }} + resources: + requests: + storage: {{ .Values.readReplicas.persistence.size | quote }} + {{- if .Values.readReplicas.persistence.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.persistence.selector "context" $) | nindent 10 }} + {{- end -}} + {{- include "common.storage.class" (dict "persistence" .Values.readReplicas.persistence "global" .Values.global) | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/postgresql/templates/read/svc-headless.yaml b/charts/postgresql/templates/read/svc-headless.yaml new file mode 100644 index 0000000..15342a3 --- /dev/null +++ b/charts/postgresql/templates/read/svc-headless.yaml @@ -0,0 +1,33 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if eq .Values.architecture "replication" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "postgresql.v1.readReplica.svc.headless" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read + annotations: + {{- if or .Values.readReplicas.service.headless.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.service.headless.annotations .Values.commonAnnotations ) "context" . ) }} + {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + clusterIP: None + # We want all pods in the StatefulSet to have their addresses published for + # the sake of the other Postgresql pods even before they're ready, since they + # have to be able to talk to each other in order to become ready. + publishNotReadyAddresses: true + ports: + - name: tcp-postgresql + port: {{ include "postgresql.v1.readReplica.service.port" . }} + targetPort: tcp-postgresql + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.podLabels .Values.commonLabels ) "context" . ) }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read +{{- end }} diff --git a/charts/postgresql/templates/read/svc.yaml b/charts/postgresql/templates/read/svc.yaml new file mode 100644 index 0000000..452b875 --- /dev/null +++ b/charts/postgresql/templates/read/svc.yaml @@ -0,0 +1,56 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if eq .Values.architecture "replication" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "postgresql.v1.readReplica.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read + {{- if or .Values.commonAnnotations .Values.readReplicas.service.annotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.service.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.readReplicas.service.type }} + {{- if or (eq .Values.readReplicas.service.type "LoadBalancer") (eq .Values.readReplicas.service.type "NodePort") }} + externalTrafficPolicy: {{ .Values.readReplicas.service.externalTrafficPolicy | quote }} + {{- end }} + {{- if and (eq .Values.readReplicas.service.type "LoadBalancer") (not (empty .Values.readReplicas.service.loadBalancerSourceRanges)) }} + loadBalancerSourceRanges: {{ .Values.readReplicas.service.loadBalancerSourceRanges }} + {{- end }} + {{- if and (eq .Values.readReplicas.service.type "LoadBalancer") (not (empty .Values.readReplicas.service.loadBalancerClass)) }} + loadBalancerClass: {{ .Values.readReplicas.service.loadBalancerClass }} + {{- end }} + {{- if and (eq .Values.readReplicas.service.type "LoadBalancer") (not (empty .Values.readReplicas.service.loadBalancerIP)) }} + loadBalancerIP: {{ .Values.readReplicas.service.loadBalancerIP }} + {{- end }} + {{- if and .Values.readReplicas.service.clusterIP (eq .Values.readReplicas.service.type "ClusterIP") }} + clusterIP: {{ .Values.readReplicas.service.clusterIP }} + {{- end }} + {{- if .Values.readReplicas.service.sessionAffinity }} + sessionAffinity: {{ .Values.readReplicas.service.sessionAffinity }} + {{- end }} + {{- if .Values.readReplicas.service.sessionAffinityConfig }} + sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.service.sessionAffinityConfig "context" $) | nindent 4 }} + {{- end }} + ports: + - name: tcp-postgresql + port: {{ include "postgresql.v1.readReplica.service.port" . }} + targetPort: tcp-postgresql + {{- if and (or (eq .Values.readReplicas.service.type "NodePort") (eq .Values.readReplicas.service.type "LoadBalancer")) (not (empty .Values.readReplicas.service.nodePorts.postgresql)) }} + nodePort: {{ .Values.readReplicas.service.nodePorts.postgresql }} + {{- else if eq .Values.readReplicas.service.type "ClusterIP" }} + nodePort: null + {{- end }} + {{- if .Values.readReplicas.service.extraPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.service.extraPorts "context" $) | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.podLabels .Values.commonLabels ) "context" . ) }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read +{{- end }} diff --git a/charts/postgresql/templates/role.yaml b/charts/postgresql/templates/role.yaml new file mode 100644 index 0000000..86ce182 --- /dev/null +++ b/charts/postgresql/templates/role.yaml @@ -0,0 +1,32 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.rbac.create }} +kind: Role +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ include "common.names.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +# yamllint disable rule:indentation +rules: + {{- if and (include "common.capabilities.psp.supported" .) .Values.psp.create }} + - apiGroups: + - 'policy' + resources: + - 'podsecuritypolicies' + verbs: + - 'use' + resourceNames: + - {{ include "common.names.fullname" . }} + {{- end }} + {{- if .Values.rbac.rules }} + {{- include "common.tplvalues.render" ( dict "value" .Values.rbac.rules "context" $ ) | nindent 2 }} + {{- end }} +# yamllint enable rule:indentation +{{- end }} diff --git a/charts/postgresql/templates/rolebinding.yaml b/charts/postgresql/templates/rolebinding.yaml new file mode 100644 index 0000000..58c5ef2 --- /dev/null +++ b/charts/postgresql/templates/rolebinding.yaml @@ -0,0 +1,24 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.rbac.create }} +kind: RoleBinding +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ include "common.names.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +roleRef: + kind: Role + name: {{ include "common.names.fullname" . }} + apiGroup: rbac.authorization.k8s.io +subjects: + - kind: ServiceAccount + name: {{ include "postgresql.v1.serviceAccountName" . }} + namespace: {{ include "common.names.namespace" . | quote }} +{{- end }} diff --git a/charts/postgresql/templates/secrets.yaml b/charts/postgresql/templates/secrets.yaml new file mode 100644 index 0000000..a41a73a --- /dev/null +++ b/charts/postgresql/templates/secrets.yaml @@ -0,0 +1,120 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- $host := include "postgresql.v1.primary.fullname" . }} +{{- $port := include "postgresql.v1.service.port" . }} +{{- $customUser := include "postgresql.v1.username" . }} +{{- $postgresPassword := (ternary (coalesce .Values.global.postgresql.auth.password .Values.auth.password .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword) (coalesce .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword) (or (empty $customUser) (eq $customUser "postgres"))) }} +{{- if (not $postgresPassword) }} +{{- $postgresPassword = include "common.secrets.lookup" (dict "secret" (include "postgresql.v1.secretName" .) "key" (coalesce .Values.global.postgresql.auth.secretKeys.adminPasswordKey .Values.auth.secretKeys.adminPasswordKey) "defaultValue" (ternary (coalesce .Values.global.postgresql.auth.password .Values.auth.password .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword) (coalesce .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword) (or (empty $customUser) (eq $customUser "postgres"))) "context" $) | trimAll "\"" | b64dec }} +{{- end }} +{{- if and (not $postgresPassword) .Values.auth.enablePostgresUser }} +{{- $postgresPassword = randAlphaNum 10 }} +{{- end }} +{{- $replicationPassword := "" }} +{{- if eq .Values.architecture "replication" }} +{{- $replicationPassword = include "common.secrets.passwords.manage" (dict "secret" (include "postgresql.v1.secretName" .) "key" (coalesce .Values.global.postgresql.auth.secretKeys.replicationPasswordKey .Values.auth.secretKeys.replicationPasswordKey) "providedValues" (list "auth.replicationPassword") "honorProvidedValues" true "context" $) | trimAll "\"" | b64dec }} +{{- end }} +{{- $ldapPassword := "" }} +{{- if and .Values.ldap.enabled (or .Values.ldap.bind_password .Values.ldap.bindpw) }} +{{- $ldapPassword = coalesce .Values.ldap.bind_password .Values.ldap.bindpw }} +{{- end }} +{{- $password := "" }} +{{- if and (not (empty $customUser)) (ne $customUser "postgres") }} +{{- $password = include "common.secrets.passwords.manage" (dict "secret" (include "postgresql.v1.secretName" .) "key" (coalesce .Values.global.postgresql.auth.secretKeys.userPasswordKey .Values.auth.secretKeys.userPasswordKey) "providedValues" (list "global.postgresql.auth.password" "auth.password") "honorProvidedValues" true "context" $) | trimAll "\"" | b64dec }} +{{- end }} +{{- $database := include "postgresql.v1.database" . }} +{{- if (include "postgresql.v1.createSecret" .) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.names.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.secretAnnotations .Values.commonAnnotations }} + annotations: + {{- if .Values.secretAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.secretAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} +type: Opaque +data: + {{- if $postgresPassword }} + postgres-password: {{ $postgresPassword | b64enc | quote }} + {{- end }} + {{- if $password }} + password: {{ $password | b64enc | quote }} + {{- end }} + {{- if $replicationPassword }} + replication-password: {{ $replicationPassword | b64enc | quote }} + {{- end }} + # We don't auto-generate LDAP password when it's not provided as we do for other passwords + {{- if and .Values.ldap.enabled (or .Values.ldap.bind_password .Values.ldap.bindpw) }} + ldap-password: {{ $ldapPassword | b64enc | quote }} + {{- end }} +{{- end }} +{{- if .Values.serviceBindings.enabled }} +{{- if $postgresPassword }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.names.fullname" . }}-svcbind-postgres + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.secretAnnotations .Values.commonAnnotations }} + annotations: + {{- if .Values.secretAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.secretAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} +type: servicebinding.io/postgresql +data: + provider: {{ print "bitnami" | b64enc | quote }} + type: {{ print "postgresql" | b64enc | quote }} + host: {{ $host | b64enc | quote }} + port: {{ $port | b64enc | quote }} + username: {{ print "postgres" | b64enc | quote }} + database: {{ print "postgres" | b64enc | quote }} + password: {{ $postgresPassword | b64enc | quote }} + uri: {{ printf "postgresql://postgres:%s@%s:%s/postgres" $postgresPassword $host $port | b64enc | quote }} +{{- end }} +{{- if $password }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.names.fullname" . }}-svcbind-custom-user + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.secretAnnotations .Values.commonAnnotations }} + annotations: + {{- if .Values.secretAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.secretAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} +type: servicebinding.io/postgresql +data: + provider: {{ print "bitnami" | b64enc | quote }} + type: {{ print "postgresql" | b64enc | quote }} + host: {{ $host | b64enc | quote }} + port: {{ $port | b64enc | quote }} + username: {{ $customUser | b64enc | quote }} + password: {{ $password | b64enc | quote }} + {{- if $database }} + database: {{ $database | b64enc | quote }} + {{- end }} + uri: {{ printf "postgresql://%s:%s@%s:%s/%s" $customUser $password $host $port $database | b64enc | quote }} +{{- end }} +{{- end }} diff --git a/charts/postgresql/templates/serviceaccount.yaml b/charts/postgresql/templates/serviceaccount.yaml new file mode 100644 index 0000000..3a0ccf0 --- /dev/null +++ b/charts/postgresql/templates/serviceaccount.yaml @@ -0,0 +1,18 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "postgresql.v1.serviceAccountName" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} +{{- end }} diff --git a/charts/postgresql/templates/tls-secrets.yaml b/charts/postgresql/templates/tls-secrets.yaml new file mode 100644 index 0000000..d6be0f3 --- /dev/null +++ b/charts/postgresql/templates/tls-secrets.yaml @@ -0,0 +1,30 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if (include "postgresql.v1.createTlsSecret" . ) }} +{{- $secretName := printf "%s-crt" (include "common.names.fullname" .) }} +{{- $ca := genCA "postgresql-ca" 365 }} +{{- $fullname := include "common.names.fullname" . }} +{{- $releaseNamespace := include "common.names.namespace" . }} +{{- $clusterDomain := .Values.clusterDomain }} +{{- $primaryHeadlessServiceName := include "postgresql.v1.primary.svc.headless" . }} +{{- $readHeadlessServiceName := include "postgresql.v1.readReplica.svc.headless" . }} +{{- $altNames := list (printf "*.%s.%s.svc.%s" $fullname $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $fullname $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $primaryHeadlessServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $primaryHeadlessServiceName $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $readHeadlessServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $readHeadlessServiceName $releaseNamespace $clusterDomain) $fullname }} +{{- $cert := genSignedCert $fullname nil $altNames 365 $ca }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $secretName }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }} + tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }} + ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }} +{{- end }} diff --git a/charts/postgresql/templates/update-password/job.yaml b/charts/postgresql/templates/update-password/job.yaml new file mode 100644 index 0000000..4bd9161 --- /dev/null +++ b/charts/postgresql/templates/update-password/job.yaml @@ -0,0 +1,235 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.passwordUpdateJob.enabled }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ printf "%s-password-update" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: postgresql + app.kubernetes.io/component: update-job + {{- $defaultAnnotations := dict "helm.sh/hook" "pre-upgrade" "helm.sh/hook-delete-policy" "hook-succeeded" }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonAnnotations $defaultAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} +spec: + backoffLimit: {{ .Values.passwordUpdateJob.backoffLimit }} + template: + metadata: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.passwordUpdateJob.podLabels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} + app.kubernetes.io/part-of: postgresql + app.kubernetes.io/component: update-job + {{- if .Values.passwordUpdateJob.podAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.podAnnotations "context" $) | nindent 8 }} + {{- end }} + spec: + {{- include "postgresql.v1.imagePullSecrets" . | nindent 6 }} + restartPolicy: OnFailure + {{- if .Values.passwordUpdateJob.podSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.passwordUpdateJob.podSecurityContext "context" $) | nindent 8 }} + {{- end }} + automountServiceAccountToken: {{ .Values.passwordUpdateJob.automountServiceAccountToken }} + {{- if .Values.passwordUpdateJob.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.hostAliases "context" $) | nindent 8 }} + {{- end }} + initContainers: + {{- if .Values.passwordUpdateJob.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.initContainers "context" $) | nindent 8 }} + {{- end }} + containers: + - name: update-credentials + image: {{ template "postgresql.v1.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + {{- if .Values.passwordUpdateJob.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.command "context" $) | nindent 12 }} + {{- else }} + command: + - /bin/bash + - -ec + {{- end }} + {{- if .Values.passwordUpdateJob.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.args "context" $) | nindent 12 }} + {{- else }} + args: + - | + {{- $customUser := include "postgresql.v1.username" . }} + {{- $customDatabase := include "postgresql.v1.database" . | default "postgres" }} + {{- if .Values.usePasswordFiles }} + # We need to load all the secret env vars to the system + for file in $(find /bitnami/postgresql/secrets -type f); do + env_var_name="$(basename $file)" + echo "Exporting $env_var_name" + export $env_var_name="$(< $file)" + done + {{- end }} + + . /opt/bitnami/scripts/postgresql-env.sh + . /opt/bitnami/scripts/libpostgresql.sh + . /opt/bitnami/scripts/liblog.sh + + primary_host={{ include "postgresql.v1.primary.fullname" . }}-0.{{ include "postgresql.v1.primary.svc.headless" . }} + info "Starting password update job" + {{- if .Values.auth.enablePostgresUser }} + if [[ -f /job-status/postgres-password-changed ]]; then + info "Postgres password already updated. Skipping" + else + info "Updating postgres password" + echo "ALTER USER postgres WITH PASSWORD '$POSTGRESQL_NEW_POSTGRES_PASSWORD';" | postgresql_remote_execute $primary_host {{ .Values.containerPorts.postgresql }} "" postgres $POSTGRESQL_PREVIOUS_POSTGRES_PASSWORD + touch /job-status/postgres-password-changed + info "Postgres password successfully updated" + fi + {{- end }} + {{- if and (not (empty $customUser)) (ne $customUser "postgres") }} + if [[ -f /job-status/password-changed ]]; then + info "User password already updated. Skipping" + else + info "Updating user password" + echo "ALTER USER {{ $customUser }} WITH PASSWORD '$POSTGRESQL_NEW_PASSWORD';" | postgresql_remote_execute $primary_host {{ .Values.containerPorts.postgresql }} "{{ $customDatabase }}" $POSTGRESQL_USER $POSTGRESQL_PREVIOUS_PASSWORD + touch /job-status/password-changed + info "User password successfully updated" + fi + {{- end }} + {{- if or (eq .Values.architecture "replication") .Values.primary.standby.enabled }} + if [[ -f /job-status/replication-password-changed ]]; then + info "Replication password already updated. Skipping" + else + info "Updating replication password" + echo "ALTER USER $POSTGRESQL_REPLICATION_USER WITH PASSWORD '$POSTGRESQL_NEW_REPLICATION_PASSWORD';" | postgresql_remote_execute $primary_host {{ .Values.containerPorts.postgresql }} "{{ $customDatabase }}" $POSTGRESQL_REPLICATION_USER $POSTGRESQL_PREVIOUS_REPLICATION_PASSWORD + touch /job-status/replication-password-changed + info "Replication password successfully updated" + fi + {{- end }} + {{- if .Values.passwordUpdateJob.extraCommands }} + info "Running extra commmands" + {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.extraCommands "context" $) | nindent 14 }} + {{- end }} + info "Password update job finished successfully" + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" .Values.image.debug | quote }} + {{- if not .Values.auth.usePasswordFiles }} + - name: POSTGRESQL_PREVIOUS_POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "postgresql.v1.update-job.previousSecretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} + - name: POSTGRESQL_NEW_POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "postgresql.v1.update-job.newSecretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} + {{- end }} + {{- if not (empty .Values.auth.username) }} + - name: POSTGRESQL_USER + value: {{ .Values.auth.username | quote }} + {{- if not .Values.auth.usePasswordFiles }} + - name: POSTGRESQL_PREVIOUS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "postgresql.v1.update-job.previousSecretName" . }} + key: {{ include "postgresql.v1.userPasswordKey" . }} + - name: POSTGRESQL_NEW_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "postgresql.v1.update-job.newSecretName" . }} + key: {{ include "postgresql.v1.userPasswordKey" . }} + {{- end }} + {{- end }} + {{- if eq .Values.architecture "replication" }} + - name: POSTGRESQL_REPLICATION_USER + value: {{ .Values.auth.replicationUsername | quote }} + {{- if not .Values.auth.usePasswordFiles }} + - name: POSTGRESQL_PREVIOUS_REPLICATION_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "postgresql.v1.update-job.previousSecretName" . }} + key: {{ include "postgresql.v1.replicationPasswordKey" . }} + - name: POSTGRESQL_NEW_REPLICATION_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "postgresql.v1.update-job.newSecretName" . }} + key: {{ include "postgresql.v1.replicationPasswordKey" . }} + {{- end }} + {{- end }} + {{- if .Values.passwordUpdateJob.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + {{- if or .Values.passwordUpdateJob.extraEnvVarsCM .Values.passwordUpdateJob.extraEnvVarsSecret }} + envFrom: + {{- if .Values.passwordUpdateJob.extraEnvVarsCM }} + - configMapRef: + name: {{ .Values.passwordUpdateJob.extraEnvVarsCM }} + {{- end }} + {{- if .Values.passwordUpdateJob.extraEnvVarsSecret }} + - secretRef: + name: {{ .Values.passwordUpdateJob.extraEnvVarsSecret }} + {{- end }} + {{- end }} + {{- if .Values.passwordUpdateJob.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.passwordUpdateJob.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.passwordUpdateJob.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.passwordUpdateJob.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.passwordUpdateJob.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /job-status + subPath: job-dir + {{- if .Values.usePasswordFiles }} + - name: postgresql-previous-credentials + mountPath: /bitnami/postgresql/secrets/previous + - name: postgresql-new-credentials + mountPath: /bitnami/postgresql/secrets/new + {{- end }} + {{- if .Values.passwordUpdateJob.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.passwordUpdateJob.resources }} + resources: {{- toYaml .Values.passwordUpdateJob.resources | nindent 12 }} + {{- else if ne .Values.passwordUpdateJob.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.passwordUpdateJob.resourcesPreset) | nindent 12 }} + {{- end }} + volumes: + - name: empty-dir + emptyDir: {} + {{- if and .Values.auth.usePasswordFiles }} + - name: postgresql-previous-credentials + secret: + secretName: {{ template "postgresql.update-job.previousSecretName" . }} + items: + - key: postgresql-root-password + path: POSTGRESQL_PREVIOUS_POSTGRES_PASSWORD + - key: postgresql-password + path: POSTGRESQL_PREVIOUS_PASSWORD + {{- if eq .Values.architecture "replication" }} + - key: postgresql-replication-password + path: POSTGRESQL_PREVIOUS_REPLICATION_PASSWORD + {{- end }} + - name: postgresql-new-credentials + secret: + secretName: {{ template "postgresql.update-job.newSecretName" . }} + items: + - key: postgresql-root-password + path: POSTGRESQL_NEW_POSTGRES_PASSWORD + - key: postgresql-password + path: POSTGRESQL_NEW_PASSWORD + {{- if eq .Values.architecture "replication" }} + - key: postgresql-replication-password + path: POSTGRESQL_NEW_REPLICATION_PASSWORD + {{- end }} + {{- end }} + {{- if .Values.passwordUpdateJob.extraVolumes }} + {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.extraVolumes "context" $) | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/postgresql/templates/update-password/new-secret.yaml b/charts/postgresql/templates/update-password/new-secret.yaml new file mode 100644 index 0000000..ab1eacf --- /dev/null +++ b/charts/postgresql/templates/update-password/new-secret.yaml @@ -0,0 +1,32 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.passwordUpdateJob.enabled (include "postgresql.v1.createSecret" .) (not ( include "postgresql.v1.createPreviousSecret" . )) (not .Values.passwordUpdateJob.previousPasswords.existingSecret) }} +{{- $customUser := include "postgresql.v1.username" . }} +{{- $postgresPassword := (ternary (coalesce .Values.global.postgresql.auth.password .Values.auth.password .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword) (coalesce .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword) (or (empty $customUser) (eq $customUser "postgres"))) }} +{{- $password := coalesce .Values.global.postgresql.auth.password .Values.auth.password }} +{{- $replicationPassword := .Values.auth.replicationPassword }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ printf "%s-new-secret" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: postgresql + {{- $defaultAnnotations := dict "helm.sh/hook" "pre-upgrade" "helm.sh/hook-delete-policy" "hook-succeeded" }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonAnnotations $defaultAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} +type: Opaque +data: + {{- if .Values.auth.enablePostgresUser }} + postgres-password: {{ required "The new postgres password is required!" $postgresPassword | b64enc | quote }} + {{- end }} + {{- if and (not (empty $customUser)) (ne $customUser "postgres") }} + password: {{ required "The new user password is required!" $password | b64enc | quote }} + {{- end }} + {{- if or (eq .Values.architecture "replication") .Values.primary.standby.enabled }} + replication-password: {{ required "The new replication password is required!" $replicationPassword | b64enc | quote }} + {{- end }} +{{- end }} diff --git a/charts/postgresql/templates/update-password/previous-secret.yaml b/charts/postgresql/templates/update-password/previous-secret.yaml new file mode 100644 index 0000000..aac8564 --- /dev/null +++ b/charts/postgresql/templates/update-password/previous-secret.yaml @@ -0,0 +1,32 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.passwordUpdateJob.enabled (include "postgresql.v1.createPreviousSecret" .) }} +{{- $customUser := include "postgresql.v1.username" . }} +{{- $postgresPassword := .Values.passwordUpdateJob.previousPasswords.postgresPassword }} +{{- $password := .Values.passwordUpdateJob.previousPasswords.password }} +{{- $replicationPassword := .Values.passwordUpdateJob.previousPasswords.replicationPassword }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ printf "%s-previous-secret" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: postgresql + {{- $defaultAnnotations := dict "helm.sh/hook" "pre-upgrade" "helm.sh/hook-delete-policy" "hook-succeeded" }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonAnnotations $defaultAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} +type: Opaque +data: + {{- if .Values.auth.enablePostgresUser }} + postgres-password: {{ required "The previous postgres password is required!" $postgresPassword | b64enc | quote }} + {{- end }} + {{- if and (not (empty $customUser)) (ne $customUser "postgres") }} + password: {{ required "The previous user password is required!" $password | b64enc | quote }} + {{- end }} + {{- if or (eq .Values.architecture "replication") .Values.primary.standby.enabled }} + replication-password: {{ required "The previous replication password is required!" $replicationPassword | b64enc | quote }} + {{- end }} +{{- end }} diff --git a/charts/postgresql/values.schema.json b/charts/postgresql/values.schema.json new file mode 100644 index 0000000..fc41483 --- /dev/null +++ b/charts/postgresql/values.schema.json @@ -0,0 +1,156 @@ +{ + "$schema": "http://json-schema.org/schema#", + "type": "object", + "properties": { + "architecture": { + "type": "string", + "title": "PostgreSQL architecture", + "form": true, + "description": "Allowed values: `standalone` or `replication`" + }, + "auth": { + "type": "object", + "title": "Authentication configuration", + "form": true, + "properties": { + "enablePostgresUser": { + "type": "boolean", + "title": "Enable \"postgres\" admin user", + "description": "Assign a password to the \"postgres\" admin user. Otherwise, remote access will be blocked for this user", + "form": true + }, + "postgresPassword": { + "type": "string", + "title": "Password for the \"postgres\" admin user", + "description": "Defaults to a random 10-character alphanumeric string if not set", + "form": true + }, + "database": { + "type": "string", + "title": "PostgreSQL custom database", + "description": "Name of the custom database to be created during the 1st initialization of PostgreSQL", + "form": true + }, + "username": { + "type": "string", + "title": "PostgreSQL custom user", + "description": "Name of the custom user to be created during the 1st initialization of PostgreSQL. This user only has permissions on the PostgreSQL custom database", + "form": true + }, + "password": { + "type": "string", + "title": "Password for the custom user to create", + "description": "Defaults to a random 10-character alphanumeric string if not set", + "form": true + }, + "replicationUsername": { + "type": "string", + "title": "PostgreSQL replication user", + "description": "Name of user used to manage replication.", + "form": true, + "hidden": { + "value": "standalone", + "path": "architecture" + } + }, + "replicationPassword": { + "type": "string", + "title": "Password for PostgreSQL replication user", + "description": "Defaults to a random 10-character alphanumeric string if not set", + "form": true, + "hidden": { + "value": "standalone", + "path": "architecture" + } + } + } + }, + "persistence": { + "type": "object", + "properties": { + "size": { + "type": "string", + "title": "Persistent Volume Size", + "form": true, + "render": "slider", + "sliderMin": 1, + "sliderMax": 100, + "sliderUnit": "Gi" + } + } + }, + "resources": { + "type": "object", + "title": "Required Resources", + "description": "Configure resource requests", + "form": true, + "properties": { + "requests": { + "type": "object", + "properties": { + "memory": { + "type": "string", + "form": true, + "render": "slider", + "title": "Memory Request", + "sliderMin": 10, + "sliderMax": 2048, + "sliderUnit": "Mi" + }, + "cpu": { + "type": "string", + "form": true, + "render": "slider", + "title": "CPU Request", + "sliderMin": 10, + "sliderMax": 2000, + "sliderUnit": "m" + } + } + } + } + }, + "replication": { + "type": "object", + "form": true, + "title": "Replication Details", + "properties": { + "enabled": { + "type": "boolean", + "title": "Enable Replication", + "form": true + }, + "readReplicas": { + "type": "integer", + "title": "read Replicas", + "form": true, + "hidden": { + "value": "standalone", + "path": "architecture" + } + } + } + }, + "volumePermissions": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "form": true, + "title": "Enable Init Containers", + "description": "Change the owner of the persist volume mountpoint to RunAsUser:fsGroup" + } + } + }, + "metrics": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "title": "Configure metrics exporter", + "form": true + } + } + } + } +} diff --git a/charts/postgresql/values.yaml b/charts/postgresql/values.yaml new file mode 100644 index 0000000..78cd069 --- /dev/null +++ b/charts/postgresql/values.yaml @@ -0,0 +1,1924 @@ +# Copyright Broadcom, Inc. All Rights Reserved. +# SPDX-License-Identifier: APACHE-2.0 + +## @section Global parameters +## Please, note that this will override the parameters, including dependencies, configured to use the global value +## +global: + ## @param global.imageRegistry Global Docker image registry + ## + imageRegistry: "" + ## @param global.imagePullSecrets Global Docker registry secret names as an array + ## e.g. + ## imagePullSecrets: + ## - myRegistryKeySecretName + ## + imagePullSecrets: [] + ## @param global.defaultStorageClass Global default StorageClass for Persistent Volume(s) +## @param global.storageClass DEPRECATED: use global.defaultStorageClass instead + ## + defaultStorageClass: "" + storageClass: "" + ## Security parameters + ## + security: + ## @param global.security.allowInsecureImages Allows skipping image verification + allowInsecureImages: false + postgresql: + ## @param global.postgresql.auth.postgresPassword Password for the "postgres" admin user (overrides `auth.postgresPassword`) + ## @param global.postgresql.auth.username Name for a custom user to create (overrides `auth.username`) + ## @param global.postgresql.auth.password Password for the custom user to create (overrides `auth.password`) + ## @param global.postgresql.auth.database Name for a custom database to create (overrides `auth.database`) + ## @param global.postgresql.auth.existingSecret Name of existing secret to use for PostgreSQL credentials (overrides `auth.existingSecret`). + ## @param global.postgresql.auth.secretKeys.adminPasswordKey Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.adminPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. + ## @param global.postgresql.auth.secretKeys.userPasswordKey Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.userPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. + ## @param global.postgresql.auth.secretKeys.replicationPasswordKey Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.replicationPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. + ## + auth: + postgresPassword: "" + username: "" + password: "" + database: "" + existingSecret: "" + secretKeys: + adminPasswordKey: "" + userPasswordKey: "" + replicationPasswordKey: "" + ## @param global.postgresql.service.ports.postgresql PostgreSQL service port (overrides `service.ports.postgresql`) + ## + service: + ports: + postgresql: "" + ## Compatibility adaptations for Kubernetes platforms + ## + compatibility: + ## Compatibility adaptations for Openshift + ## + openshift: + ## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) + ## + adaptSecurityContext: auto +## @section Common parameters +## + +## @param kubeVersion Override Kubernetes version +## +kubeVersion: "" +## @param nameOverride String to partially override common.names.fullname template (will maintain the release name) +## +nameOverride: "" +## @param fullnameOverride String to fully override common.names.fullname template +## +fullnameOverride: "" +## @param namespaceOverride String to fully override common.names.namespace +## +namespaceOverride: "" +## @param clusterDomain Kubernetes Cluster Domain +## +clusterDomain: cluster.local +## @param extraDeploy Array of extra objects to deploy with the release (evaluated as a template) +## +extraDeploy: [] +## @param commonLabels Add labels to all the deployed resources +## +commonLabels: {} +## @param commonAnnotations Add annotations to all the deployed resources +## +commonAnnotations: {} +## @param secretAnnotations Add annotations to the secrets +## +secretAnnotations: {} +## Enable diagnostic mode in the statefulset +## +diagnosticMode: + ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) + ## + enabled: false + ## @param diagnosticMode.command Command to override all containers in the statefulset + ## + command: + - sleep + ## @param diagnosticMode.args Args to override all containers in the statefulset + ## + args: + - infinity +## @section PostgreSQL common parameters +## + +## Bitnami PostgreSQL image version +## ref: https://hub.docker.com/r/bitnami/postgresql/tags/ +## @param image.registry [default: REGISTRY_NAME] PostgreSQL image registry +## @param image.repository [default: REPOSITORY_NAME/postgresql] PostgreSQL image repository +## @skip image.tag PostgreSQL image tag (immutable tags are recommended) +## @param image.digest PostgreSQL image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag +## @param image.pullPolicy PostgreSQL image pull policy +## @param image.pullSecrets Specify image pull secrets +## @param image.debug Specify if debug values should be set +## +image: + registry: docker.io + repository: bitnami/postgresql + tag: 17.4.0-debian-12-r4 + digest: "" + ## Specify a imagePullPolicy + ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## Example: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Set to true if you would like to see extra information on logs + ## + debug: false +## Authentication parameters +## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#setting-the-root-password-on-first-run +## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#creating-a-database-on-first-run +## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#creating-a-database-user-on-first-run +## +auth: + ## @param auth.enablePostgresUser Assign a password to the "postgres" admin user. Otherwise, remote access will be blocked for this user + ## + enablePostgresUser: true + ## @param auth.postgresPassword Password for the "postgres" admin user. Ignored if `auth.existingSecret` is provided + ## + postgresPassword: "" + ## @param auth.username Name for a custom user to create + ## + username: "" + ## @param auth.password Password for the custom user to create. Ignored if `auth.existingSecret` is provided + ## + password: "" + ## @param auth.database Name for a custom database to create + ## + database: "" + ## @param auth.replicationUsername Name of the replication user + ## + replicationUsername: repl_user + ## @param auth.replicationPassword Password for the replication user. Ignored if `auth.existingSecret` is provided + ## + replicationPassword: "" + ## @param auth.existingSecret Name of existing secret to use for PostgreSQL credentials. `auth.postgresPassword`, `auth.password`, and `auth.replicationPassword` will be ignored and picked up from this secret. The secret might also contains the key `ldap-password` if LDAP is enabled. `ldap.bind_password` will be ignored and picked from this secret in this case. + ## + existingSecret: "" + ## @param auth.secretKeys.adminPasswordKey Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. + ## @param auth.secretKeys.userPasswordKey Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. + ## @param auth.secretKeys.replicationPasswordKey Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. + ## + secretKeys: + adminPasswordKey: postgres-password + userPasswordKey: password + replicationPasswordKey: replication-password + ## @param auth.usePasswordFiles Mount credentials as a files instead of using an environment variable + ## + usePasswordFiles: false +## @param architecture PostgreSQL architecture (`standalone` or `replication`) +## +architecture: standalone +## Replication configuration +## Ignored if `architecture` is `standalone` +## +replication: + ## @param replication.synchronousCommit Set synchronous commit mode. Allowed values: `on`, `remote_apply`, `remote_write`, `local` and `off` + ## @param replication.numSynchronousReplicas Number of replicas that will have synchronous replication. Note: Cannot be greater than `readReplicas.replicaCount`. + ## ref: https://www.postgresql.org/docs/current/runtime-config-wal.html#GUC-SYNCHRONOUS-COMMIT + ## + synchronousCommit: "off" + numSynchronousReplicas: 0 + ## @param replication.applicationName Cluster application name. Useful for advanced replication settings + ## + applicationName: my_application +## @param containerPorts.postgresql PostgreSQL container port +## +containerPorts: + postgresql: 5432 +## Audit settings +## https://github.com/bitnami/containers/tree/main/bitnami/postgresql#auditing +## @param audit.logHostname Log client hostnames +## @param audit.logConnections Add client log-in operations to the log file +## @param audit.logDisconnections Add client log-outs operations to the log file +## @param audit.pgAuditLog Add operations to log using the pgAudit extension +## @param audit.pgAuditLogCatalog Log catalog using pgAudit +## @param audit.clientMinMessages Message log level to share with the user +## @param audit.logLinePrefix Template for log line prefix (default if not set) +## @param audit.logTimezone Timezone for the log timestamps +## +audit: + logHostname: false + logConnections: false + logDisconnections: false + pgAuditLog: "" + pgAuditLogCatalog: "off" + clientMinMessages: error + logLinePrefix: "" + logTimezone: "" +## LDAP configuration +## @param ldap.enabled Enable LDAP support +## @param ldap.server IP address or name of the LDAP server. +## @param ldap.port Port number on the LDAP server to connect to +## @param ldap.prefix String to prepend to the user name when forming the DN to bind +## @param ldap.suffix String to append to the user name when forming the DN to bind +## DEPRECATED ldap.baseDN It will removed in a future, please use 'ldap.basedn' instead +## DEPRECATED ldap.bindDN It will removed in a future, please use 'ldap.binddn' instead +## DEPRECATED ldap.bind_password It will removed in a future, please use 'ldap.bindpw' instead +## @param ldap.basedn Root DN to begin the search for the user in +## @param ldap.binddn DN of user to bind to LDAP +## @param ldap.bindpw Password for the user to bind to LDAP +## DEPRECATED ldap.search_attr It will removed in a future, please use 'ldap.searchAttribute' instead +## DEPRECATED ldap.search_filter It will removed in a future, please use 'ldap.searchFilter' instead +## @param ldap.searchAttribute Attribute to match against the user name in the search +## @param ldap.searchFilter The search filter to use when doing search+bind authentication +## @param ldap.scheme Set to `ldaps` to use LDAPS +## DEPRECATED ldap.tls as string is deprecated, please use 'ldap.tls.enabled' instead +## @param ldap.tls.enabled Se to true to enable TLS encryption +## +ldap: + enabled: false + server: "" + port: "" + prefix: "" + suffix: "" + basedn: "" + binddn: "" + bindpw: "" + searchAttribute: "" + searchFilter: "" + scheme: "" + tls: + enabled: false + ## @param ldap.uri LDAP URL beginning in the form `ldap[s]://host[:port]/basedn`. If provided, all the other LDAP parameters will be ignored. + ## Ref: https://www.postgresql.org/docs/current/auth-ldap.html + ## + uri: "" +## @param postgresqlDataDir PostgreSQL data dir folder +## +postgresqlDataDir: /bitnami/postgresql/data +## @param postgresqlSharedPreloadLibraries Shared preload libraries (comma-separated list) +## +postgresqlSharedPreloadLibraries: "pgaudit" +## Start PostgreSQL pod(s) without limitations on shm memory. +## By default docker and containerd (and possibly other container runtimes) limit `/dev/shm` to `64M` +## ref: https://github.com/docker-library/postgres/issues/416 +## ref: https://github.com/containerd/containerd/issues/3654 +## +shmVolume: + ## @param shmVolume.enabled Enable emptyDir volume for /dev/shm for PostgreSQL pod(s) + ## + enabled: true + ## @param shmVolume.sizeLimit Set this to enable a size limit on the shm tmpfs + ## Note: the size of the tmpfs counts against container's memory limit + ## e.g: + ## sizeLimit: 1Gi + ## + sizeLimit: "" +## TLS configuration +## +tls: + ## @param tls.enabled Enable TLS traffic support + ## + enabled: false + ## @param tls.autoGenerated Generate automatically self-signed TLS certificates + ## + autoGenerated: false + ## @param tls.preferServerCiphers Whether to use the server's TLS cipher preferences rather than the client's + ## + preferServerCiphers: true + ## @param tls.certificatesSecret Name of an existing secret that contains the certificates + ## + certificatesSecret: "" + ## @param tls.certFilename Certificate filename + ## + certFilename: "" + ## @param tls.certKeyFilename Certificate key filename + ## + certKeyFilename: "" + ## @param tls.certCAFilename CA Certificate filename + ## If provided, PostgreSQL will authenticate TLS/SSL clients by requesting them a certificate + ## ref: https://www.postgresql.org/docs/9.6/auth-methods.html + ## + certCAFilename: "" + ## @param tls.crlFilename File containing a Certificate Revocation List + ## + crlFilename: "" +## @section PostgreSQL Primary parameters +## +primary: + ## @param primary.name Name of the primary database (eg primary, master, leader, ...) + ## + name: primary + ## @param primary.configuration PostgreSQL Primary main configuration to be injected as ConfigMap + ## ref: https://www.postgresql.org/docs/current/static/runtime-config.html + ## + configuration: "" + ## @param primary.pgHbaConfiguration PostgreSQL Primary client authentication configuration + ## ref: https://www.postgresql.org/docs/current/static/auth-pg-hba-conf.html + ## e.g:# + ## pgHbaConfiguration: |- + ## local all all trust + ## host all all localhost trust + ## host mydatabase mysuser 192.168.0.0/24 md5 + ## + pgHbaConfiguration: "" + ## @param primary.existingConfigmap Name of an existing ConfigMap with PostgreSQL Primary configuration + ## NOTE: `primary.configuration` and `primary.pgHbaConfiguration` will be ignored + ## + existingConfigmap: "" + ## @param primary.extendedConfiguration Extended PostgreSQL Primary configuration (appended to main or default configuration) + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#allow-settings-to-be-loaded-from-files-other-than-the-default-postgresqlconf + ## + extendedConfiguration: "" + ## @param primary.existingExtendedConfigmap Name of an existing ConfigMap with PostgreSQL Primary extended configuration + ## NOTE: `primary.extendedConfiguration` will be ignored + ## + existingExtendedConfigmap: "" + ## Initdb configuration + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#specifying-initdb-arguments + ## + initdb: + ## @param primary.initdb.args PostgreSQL initdb extra arguments + ## + args: "" + ## @param primary.initdb.postgresqlWalDir Specify a custom location for the PostgreSQL transaction log + ## + postgresqlWalDir: "" + ## @param primary.initdb.scripts Dictionary of initdb scripts + ## Specify dictionary of scripts to be run at first boot + ## e.g: + ## scripts: + ## my_init_script.sh: | + ## #!/bin/sh + ## echo "Do something." + ## + scripts: {} + ## @param primary.initdb.scriptsConfigMap ConfigMap with scripts to be run at first boot + ## NOTE: This will override `primary.initdb.scripts` + ## + scriptsConfigMap: "" + ## @param primary.initdb.scriptsSecret Secret with scripts to be run at first boot (in case it contains sensitive information) + ## NOTE: This can work along `primary.initdb.scripts` or `primary.initdb.scriptsConfigMap` + ## + scriptsSecret: "" + ## @param primary.initdb.user Specify the PostgreSQL username to execute the initdb scripts + ## + user: "" + ## @param primary.initdb.password Specify the PostgreSQL password to execute the initdb scripts + ## + password: "" + ## Pre-init configuration + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql/#on-container-start + preInitDb: + ## @param primary.preInitDb.scripts Dictionary of pre-init scripts + ## Specify dictionary of shell scripts to be run before db boot + ## e.g: + ## scripts: + ## my_pre_init_script.sh: | + ## #!/bin/sh + ## echo "Do something." + scripts: {} + ## @param primary.preInitDb.scriptsConfigMap ConfigMap with pre-init scripts to be run + ## NOTE: This will override `primary.preInitDb.scripts` + scriptsConfigMap: "" + ## @param primary.preInitDb.scriptsSecret Secret with pre-init scripts to be run + ## NOTE: This can work along `primary.preInitDb.scripts` or `primary.preInitDb.scriptsConfigMap` + scriptsSecret: "" + ## Configure current cluster's primary server to be the standby server in other cluster. + ## This will allow cross cluster replication and provide cross cluster high availability. + ## You will need to configure pgHbaConfiguration if you want to enable this feature with local cluster replication enabled. + ## @param primary.standby.enabled Whether to enable current cluster's primary as standby server of another cluster or not + ## @param primary.standby.primaryHost The Host of replication primary in the other cluster + ## @param primary.standby.primaryPort The Port of replication primary in the other cluster + ## + standby: + enabled: false + primaryHost: "" + primaryPort: "" + ## @param primary.extraEnvVars Array with extra environment variables to add to PostgreSQL Primary nodes + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + extraEnvVars: [] + ## @param primary.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for PostgreSQL Primary nodes + ## + extraEnvVarsCM: "" + ## @param primary.extraEnvVarsSecret Name of existing Secret containing extra env vars for PostgreSQL Primary nodes + ## + extraEnvVarsSecret: "" + ## @param primary.command Override default container command (useful when using custom images) + ## + command: [] + ## @param primary.args Override default container args (useful when using custom images) + ## + args: [] + ## Configure extra options for PostgreSQL Primary containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param primary.livenessProbe.enabled Enable livenessProbe on PostgreSQL Primary containers + ## @param primary.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param primary.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param primary.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param primary.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param primary.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param primary.readinessProbe.enabled Enable readinessProbe on PostgreSQL Primary containers + ## @param primary.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param primary.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param primary.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param primary.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param primary.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param primary.startupProbe.enabled Enable startupProbe on PostgreSQL Primary containers + ## @param primary.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param primary.startupProbe.periodSeconds Period seconds for startupProbe + ## @param primary.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param primary.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param primary.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param primary.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param primary.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param primary.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## @param primary.lifecycleHooks for the PostgreSQL Primary container to automate configuration before or after startup + ## + lifecycleHooks: {} + ## PostgreSQL Primary resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param primary.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if primary.resources is set (primary.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param primary.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Pod Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## @param primary.podSecurityContext.enabled Enable security context + ## @param primary.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy + ## @param primary.podSecurityContext.sysctls Set kernel settings using the sysctl interface + ## @param primary.podSecurityContext.supplementalGroups Set filesystem extra groups + ## @param primary.podSecurityContext.fsGroup Group ID for the pod + ## + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## @param primary.containerSecurityContext.enabled Enabled containers' Security Context + ## @param primary.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container + ## @param primary.containerSecurityContext.runAsUser Set containers' Security Context runAsUser + ## @param primary.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup + ## @param primary.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot + ## @param primary.containerSecurityContext.privileged Set container's Security Context privileged + ## @param primary.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem + ## @param primary.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation + ## @param primary.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param primary.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsGroup: 1001 + runAsNonRoot: true + privileged: false + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + ## @param primary.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: false + ## @param primary.hostAliases PostgreSQL primary pods host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param primary.hostNetwork Specify if host network should be enabled for PostgreSQL pod (postgresql primary) + ## + hostNetwork: false + ## @param primary.hostIPC Specify if host IPC should be enabled for PostgreSQL pod (postgresql primary) + ## + hostIPC: false + ## @param primary.labels Map of labels to add to the statefulset (postgresql primary) + ## + labels: {} + ## @param primary.annotations Annotations for PostgreSQL primary pods + ## + annotations: {} + ## @param primary.podLabels Map of labels to add to the pods (postgresql primary) + ## + podLabels: {} + ## @param primary.podAnnotations Map of annotations to add to the pods (postgresql primary) + ## + podAnnotations: {} + ## @param primary.podAffinityPreset PostgreSQL primary pod affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param primary.podAntiAffinityPreset PostgreSQL primary pod anti-affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## PostgreSQL Primary node affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param primary.nodeAffinityPreset.type PostgreSQL primary node affinity preset type. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param primary.nodeAffinityPreset.key PostgreSQL primary node label key to match Ignored if `primary.affinity` is set. + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## @param primary.nodeAffinityPreset.values PostgreSQL primary node label values to match. Ignored if `primary.affinity` is set. + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param primary.affinity Affinity for PostgreSQL primary pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## Note: primary.podAffinityPreset, primary.podAntiAffinityPreset, and primary.nodeAffinityPreset will be ignored when it's set + ## + affinity: {} + ## @param primary.nodeSelector Node labels for PostgreSQL primary pods assignment + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param primary.tolerations Tolerations for PostgreSQL primary pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param primary.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: [] + ## @param primary.priorityClassName Priority Class to use for each pod (postgresql primary) + ## + priorityClassName: "" + ## @param primary.schedulerName Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param primary.terminationGracePeriodSeconds Seconds PostgreSQL primary pod needs to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## @param primary.updateStrategy.type PostgreSQL Primary statefulset strategy type + ## @param primary.updateStrategy.rollingUpdate PostgreSQL Primary statefulset rolling update configuration parameters + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## + updateStrategy: + type: RollingUpdate + rollingUpdate: {} + ## @param primary.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the PostgreSQL Primary container(s) + ## + extraVolumeMounts: [] + ## @param primary.extraVolumes Optionally specify extra list of additional volumes for the PostgreSQL Primary pod(s) + ## + extraVolumes: [] + ## @param primary.sidecars Add additional sidecar containers to the PostgreSQL Primary pod(s) + ## For example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param primary.initContainers Add additional init containers to the PostgreSQL Primary pod(s) + ## Example + ## + ## initContainers: + ## - name: do-something + ## image: busybox + ## command: ['do', 'something'] + ## + initContainers: [] + ## Pod Disruption Budget configuration + ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb + ## @param primary.pdb.create Enable/disable a Pod Disruption Budget creation + ## @param primary.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled + ## @param primary.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `primary.pdb.minAvailable` and `primary.pdb.maxUnavailable` are empty. + ## + pdb: + create: true + minAvailable: "" + maxUnavailable: "" + ## @param primary.extraPodSpec Optionally specify extra PodSpec for the PostgreSQL Primary pod(s) + ## + extraPodSpec: {} + ## Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param primary.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + ## @param primary.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param primary.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param primary.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraIngress: + ## - ports: + ## - port: 1234 + ## from: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + extraIngress: [] + ## @param primary.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraEgress: + ## - ports: + ## - port: 1234 + ## to: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + ## + extraEgress: [] + ## @param primary.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces + ## @param primary.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces + ## + ingressNSMatchLabels: {} + ingressNSPodMatchLabels: {} + ## PostgreSQL Primary service configuration + ## + service: + ## @param primary.service.type Kubernetes Service type + ## + type: ClusterIP + ## @param primary.service.ports.postgresql PostgreSQL service port + ## + ports: + postgresql: 5432 + ## Node ports to expose + ## NOTE: choose port between <30000-32767> + ## @param primary.service.nodePorts.postgresql Node port for PostgreSQL + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## + nodePorts: + postgresql: "" + ## @param primary.service.clusterIP Static clusterIP or None for headless services + ## e.g: + ## clusterIP: None + ## + clusterIP: "" + ## @param primary.service.annotations Annotations for PostgreSQL primary service + ## + annotations: {} + ## @param primary.service.loadBalancerClass Load balancer class if service type is `LoadBalancer` + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class + ## + loadBalancerClass: "" + ## @param primary.service.loadBalancerIP Load balancer IP if service type is `LoadBalancer` + ## Set the LoadBalancer service type to internal only + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + loadBalancerIP: "" + ## @param primary.service.externalTrafficPolicy Enable client source IP preservation + ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + ## @param primary.service.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer + ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## + ## loadBalancerSourceRanges: + ## - 10.10.10.0/24 + ## + loadBalancerSourceRanges: [] + ## @param primary.service.extraPorts Extra ports to expose in the PostgreSQL primary service + ## + extraPorts: [] + ## @param primary.service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP" + ## If "ClientIP", consecutive client requests will be directed to the same Pod + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + ## + sessionAffinity: None + ## @param primary.service.sessionAffinityConfig Additional settings for the sessionAffinity + ## sessionAffinityConfig: + ## clientIP: + ## timeoutSeconds: 300 + ## + sessionAffinityConfig: {} + ## Headless service properties + ## + headless: + ## @param primary.service.headless.annotations Additional custom annotations for headless PostgreSQL primary service + ## + annotations: {} + ## PostgreSQL Primary persistence configuration + ## + persistence: + ## @param primary.persistence.enabled Enable PostgreSQL Primary data persistence using PVC + ## + enabled: true + ## @param primary.persistence.volumeName Name to assign the volume + ## + volumeName: "data" + ## @param primary.persistence.existingClaim Name of an existing PVC to use + ## + existingClaim: "" + ## @param primary.persistence.mountPath The path the volume will be mounted at + ## Note: useful when using custom PostgreSQL images + ## + mountPath: /bitnami/postgresql + ## @param primary.persistence.subPath The subdirectory of the volume to mount to + ## Useful in dev environments and one PV for multiple services + ## + subPath: "" + ## @param primary.persistence.storageClass PVC Storage Class for PostgreSQL Primary data volume + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + storageClass: "" + ## @param primary.persistence.accessModes PVC Access Mode for PostgreSQL volume + ## + accessModes: + - ReadWriteOnce + ## @param primary.persistence.size PVC Storage Request for PostgreSQL volume + ## + size: 8Gi + ## @param primary.persistence.annotations Annotations for the PVC + ## + annotations: {} + ## @param primary.persistence.labels Labels for the PVC + ## + labels: {} + ## @param primary.persistence.selector Selector to match an existing Persistent Volume (this value is evaluated as a template) + ## selector: + ## matchLabels: + ## app: my-app + ## + selector: {} + ## @param primary.persistence.dataSource Custom PVC data source + ## + dataSource: {} + ## PostgreSQL Primary Persistent Volume Claim Retention Policy + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention + ## + persistentVolumeClaimRetentionPolicy: + ## @param primary.persistentVolumeClaimRetentionPolicy.enabled Enable Persistent volume retention policy for Primary Statefulset + ## + enabled: false + ## @param primary.persistentVolumeClaimRetentionPolicy.whenScaled Volume retention behavior when the replica count of the StatefulSet is reduced + ## + whenScaled: Retain + ## @param primary.persistentVolumeClaimRetentionPolicy.whenDeleted Volume retention behavior that applies when the StatefulSet is deleted + ## + whenDeleted: Retain +## @section PostgreSQL read only replica parameters (only used when `architecture` is set to `replication`) +## +readReplicas: + ## @param readReplicas.name Name of the read replicas database (eg secondary, slave, ...) + ## + name: read + ## @param readReplicas.replicaCount Number of PostgreSQL read only replicas + ## + replicaCount: 1 + ## @param readReplicas.extendedConfiguration Extended PostgreSQL read only replicas configuration (appended to main or default configuration) + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#allow-settings-to-be-loaded-from-files-other-than-the-default-postgresqlconf + ## + extendedConfiguration: "" + ## @param readReplicas.extraEnvVars Array with extra environment variables to add to PostgreSQL read only nodes + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + extraEnvVars: [] + ## @param readReplicas.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for PostgreSQL read only nodes + ## + extraEnvVarsCM: "" + ## @param readReplicas.extraEnvVarsSecret Name of existing Secret containing extra env vars for PostgreSQL read only nodes + ## + extraEnvVarsSecret: "" + ## @param readReplicas.command Override default container command (useful when using custom images) + ## + command: [] + ## @param readReplicas.args Override default container args (useful when using custom images) + ## + args: [] + ## Configure extra options for PostgreSQL read only containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param readReplicas.livenessProbe.enabled Enable livenessProbe on PostgreSQL read only containers + ## @param readReplicas.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param readReplicas.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param readReplicas.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param readReplicas.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param readReplicas.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param readReplicas.readinessProbe.enabled Enable readinessProbe on PostgreSQL read only containers + ## @param readReplicas.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param readReplicas.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param readReplicas.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param readReplicas.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param readReplicas.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param readReplicas.startupProbe.enabled Enable startupProbe on PostgreSQL read only containers + ## @param readReplicas.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param readReplicas.startupProbe.periodSeconds Period seconds for startupProbe + ## @param readReplicas.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param readReplicas.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param readReplicas.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param readReplicas.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param readReplicas.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param readReplicas.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## @param readReplicas.lifecycleHooks for the PostgreSQL read only container to automate configuration before or after startup + ## + lifecycleHooks: {} + ## PostgreSQL read only resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param readReplicas.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if readReplicas.resources is set (readReplicas.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param readReplicas.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Pod Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## @param readReplicas.podSecurityContext.enabled Enable security context + ## @param readReplicas.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy + ## @param readReplicas.podSecurityContext.sysctls Set kernel settings using the sysctl interface + ## @param readReplicas.podSecurityContext.supplementalGroups Set filesystem extra groups + ## @param readReplicas.podSecurityContext.fsGroup Group ID for the pod + ## + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## @param readReplicas.containerSecurityContext.enabled Enabled containers' Security Context + ## @param readReplicas.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container + ## @param readReplicas.containerSecurityContext.runAsUser Set containers' Security Context runAsUser + ## @param readReplicas.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup + ## @param readReplicas.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot + ## @param readReplicas.containerSecurityContext.privileged Set container's Security Context privileged + ## @param readReplicas.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem + ## @param readReplicas.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation + ## @param readReplicas.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param readReplicas.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsGroup: 1001 + runAsNonRoot: true + privileged: false + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + ## @param readReplicas.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: false + ## @param readReplicas.hostAliases PostgreSQL read only pods host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param readReplicas.hostNetwork Specify if host network should be enabled for PostgreSQL pod (PostgreSQL read only) + ## + hostNetwork: false + ## @param readReplicas.hostIPC Specify if host IPC should be enabled for PostgreSQL pod (postgresql primary) + ## + hostIPC: false + ## @param readReplicas.labels Map of labels to add to the statefulset (PostgreSQL read only) + ## + labels: {} + ## @param readReplicas.annotations Annotations for PostgreSQL read only pods + ## + annotations: {} + ## @param readReplicas.podLabels Map of labels to add to the pods (PostgreSQL read only) + ## + podLabels: {} + ## @param readReplicas.podAnnotations Map of annotations to add to the pods (PostgreSQL read only) + ## + podAnnotations: {} + ## @param readReplicas.podAffinityPreset PostgreSQL read only pod affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param readReplicas.podAntiAffinityPreset PostgreSQL read only pod anti-affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## PostgreSQL read only node affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param readReplicas.nodeAffinityPreset.type PostgreSQL read only node affinity preset type. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param readReplicas.nodeAffinityPreset.key PostgreSQL read only node label key to match Ignored if `primary.affinity` is set. + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## @param readReplicas.nodeAffinityPreset.values PostgreSQL read only node label values to match. Ignored if `primary.affinity` is set. + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param readReplicas.affinity Affinity for PostgreSQL read only pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## Note: primary.podAffinityPreset, primary.podAntiAffinityPreset, and primary.nodeAffinityPreset will be ignored when it's set + ## + affinity: {} + ## @param readReplicas.nodeSelector Node labels for PostgreSQL read only pods assignment + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param readReplicas.tolerations Tolerations for PostgreSQL read only pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param readReplicas.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: [] + ## @param readReplicas.priorityClassName Priority Class to use for each pod (PostgreSQL read only) + ## + priorityClassName: "" + ## @param readReplicas.schedulerName Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param readReplicas.terminationGracePeriodSeconds Seconds PostgreSQL read only pod needs to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## @param readReplicas.updateStrategy.type PostgreSQL read only statefulset strategy type + ## @param readReplicas.updateStrategy.rollingUpdate PostgreSQL read only statefulset rolling update configuration parameters + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## + updateStrategy: + type: RollingUpdate + rollingUpdate: {} + ## @param readReplicas.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the PostgreSQL read only container(s) + ## + extraVolumeMounts: [] + ## @param readReplicas.extraVolumes Optionally specify extra list of additional volumes for the PostgreSQL read only pod(s) + ## + extraVolumes: [] + ## @param readReplicas.sidecars Add additional sidecar containers to the PostgreSQL read only pod(s) + ## For example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param readReplicas.initContainers Add additional init containers to the PostgreSQL read only pod(s) + ## Example + ## + ## initContainers: + ## - name: do-something + ## image: busybox + ## command: ['do', 'something'] + ## + initContainers: [] + ## Pod Disruption Budget configuration + ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb + ## @param readReplicas.pdb.create Enable/disable a Pod Disruption Budget creation + ## @param readReplicas.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled + ## @param readReplicas.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `readReplicas.pdb.minAvailable` and `readReplicas.pdb.maxUnavailable` are empty. + ## + pdb: + create: true + minAvailable: "" + maxUnavailable: "" + ## @param readReplicas.extraPodSpec Optionally specify extra PodSpec for the PostgreSQL read only pod(s) + ## + extraPodSpec: {} + ## Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param readReplicas.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + ## @param readReplicas.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param readReplicas.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param readReplicas.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraIngress: + ## - ports: + ## - port: 1234 + ## from: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + extraIngress: [] + ## @param readReplicas.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraEgress: + ## - ports: + ## - port: 1234 + ## to: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + ## + extraEgress: [] + ## @param readReplicas.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces + ## @param readReplicas.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces + ## + ingressNSMatchLabels: {} + ingressNSPodMatchLabels: {} + ## PostgreSQL read only service configuration + ## + service: + ## @param readReplicas.service.type Kubernetes Service type + ## + type: ClusterIP + ## @param readReplicas.service.ports.postgresql PostgreSQL service port + ## + ports: + postgresql: 5432 + ## Node ports to expose + ## NOTE: choose port between <30000-32767> + ## @param readReplicas.service.nodePorts.postgresql Node port for PostgreSQL + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## + nodePorts: + postgresql: "" + ## @param readReplicas.service.clusterIP Static clusterIP or None for headless services + ## e.g: + ## clusterIP: None + ## + clusterIP: "" + ## @param readReplicas.service.annotations Annotations for PostgreSQL read only service + ## + annotations: {} + ## @param readReplicas.service.loadBalancerClass Load balancer class if service type is `LoadBalancer` + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class + ## + loadBalancerClass: "" + ## @param readReplicas.service.loadBalancerIP Load balancer IP if service type is `LoadBalancer` + ## Set the LoadBalancer service type to internal only + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + loadBalancerIP: "" + ## @param readReplicas.service.externalTrafficPolicy Enable client source IP preservation + ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + ## @param readReplicas.service.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer + ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## + ## loadBalancerSourceRanges: + ## - 10.10.10.0/24 + ## + loadBalancerSourceRanges: [] + ## @param readReplicas.service.extraPorts Extra ports to expose in the PostgreSQL read only service + ## + extraPorts: [] + ## @param readReplicas.service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP" + ## If "ClientIP", consecutive client requests will be directed to the same Pod + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + ## + sessionAffinity: None + ## @param readReplicas.service.sessionAffinityConfig Additional settings for the sessionAffinity + ## sessionAffinityConfig: + ## clientIP: + ## timeoutSeconds: 300 + ## + sessionAffinityConfig: {} + ## Headless service properties + ## + headless: + ## @param readReplicas.service.headless.annotations Additional custom annotations for headless PostgreSQL read only service + ## + annotations: {} + ## PostgreSQL read only persistence configuration + ## + persistence: + ## @param readReplicas.persistence.enabled Enable PostgreSQL read only data persistence using PVC + ## + enabled: true + ## @param readReplicas.persistence.existingClaim Name of an existing PVC to use + ## + existingClaim: "" + ## @param readReplicas.persistence.mountPath The path the volume will be mounted at + ## Note: useful when using custom PostgreSQL images + ## + mountPath: /bitnami/postgresql + ## @param readReplicas.persistence.subPath The subdirectory of the volume to mount to + ## Useful in dev environments and one PV for multiple services + ## + subPath: "" + ## @param readReplicas.persistence.storageClass PVC Storage Class for PostgreSQL read only data volume + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + storageClass: "" + ## @param readReplicas.persistence.accessModes PVC Access Mode for PostgreSQL volume + ## + accessModes: + - ReadWriteOnce + ## @param readReplicas.persistence.size PVC Storage Request for PostgreSQL volume + ## + size: 8Gi + ## @param readReplicas.persistence.annotations Annotations for the PVC + ## + annotations: {} + ## @param readReplicas.persistence.labels Labels for the PVC + ## + labels: {} + ## @param readReplicas.persistence.selector Selector to match an existing Persistent Volume (this value is evaluated as a template) + ## selector: + ## matchLabels: + ## app: my-app + ## + selector: {} + ## @param readReplicas.persistence.dataSource Custom PVC data source + ## + dataSource: {} + ## PostgreSQL Read only Persistent Volume Claim Retention Policy + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention + ## + persistentVolumeClaimRetentionPolicy: + ## @param readReplicas.persistentVolumeClaimRetentionPolicy.enabled Enable Persistent volume retention policy for read only Statefulset + ## + enabled: false + ## @param readReplicas.persistentVolumeClaimRetentionPolicy.whenScaled Volume retention behavior when the replica count of the StatefulSet is reduced + ## + whenScaled: Retain + ## @param readReplicas.persistentVolumeClaimRetentionPolicy.whenDeleted Volume retention behavior that applies when the StatefulSet is deleted + ## + whenDeleted: Retain +## @section Backup parameters +## This section implements a trivial logical dump cronjob of the database. +## This only comes with the consistency guarantees of the dump program. +## This is not a snapshot based roll forward/backward recovery backup. +## ref: https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/ +backup: + ## @param backup.enabled Enable the logical dump of the database "regularly" + enabled: false + cronjob: + ## @param backup.cronjob.schedule Set the cronjob parameter schedule + schedule: "@daily" + ## @param backup.cronjob.timeZone Set the cronjob parameter timeZone + timeZone: "" + ## @param backup.cronjob.concurrencyPolicy Set the cronjob parameter concurrencyPolicy + concurrencyPolicy: Allow + ## @param backup.cronjob.failedJobsHistoryLimit Set the cronjob parameter failedJobsHistoryLimit + failedJobsHistoryLimit: 1 + ## @param backup.cronjob.successfulJobsHistoryLimit Set the cronjob parameter successfulJobsHistoryLimit + successfulJobsHistoryLimit: 3 + ## @param backup.cronjob.startingDeadlineSeconds Set the cronjob parameter startingDeadlineSeconds + startingDeadlineSeconds: "" + ## @param backup.cronjob.ttlSecondsAfterFinished Set the cronjob parameter ttlSecondsAfterFinished + ttlSecondsAfterFinished: "" + ## @param backup.cronjob.restartPolicy Set the cronjob parameter restartPolicy + restartPolicy: OnFailure + ## @param backup.cronjob.podSecurityContext.enabled Enable PodSecurityContext for CronJob/Backup + ## @param backup.cronjob.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy + ## @param backup.cronjob.podSecurityContext.sysctls Set kernel settings using the sysctl interface + ## @param backup.cronjob.podSecurityContext.supplementalGroups Set filesystem extra groups + ## @param backup.cronjob.podSecurityContext.fsGroup Group ID for the CronJob + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## backup container's Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param backup.cronjob.containerSecurityContext.enabled Enabled containers' Security Context + ## @param backup.cronjob.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container + ## @param backup.cronjob.containerSecurityContext.runAsUser Set containers' Security Context runAsUser + ## @param backup.cronjob.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup + ## @param backup.cronjob.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot + ## @param backup.cronjob.containerSecurityContext.privileged Set container's Security Context privileged + ## @param backup.cronjob.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem + ## @param backup.cronjob.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation + ## @param backup.cronjob.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param backup.cronjob.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsGroup: 1001 + runAsNonRoot: true + privileged: false + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + ## @param backup.cronjob.command Set backup container's command to run + command: + - /bin/sh + - -c + - "pg_dumpall --clean --if-exists --load-via-partition-root --quote-all-identifiers --no-password --file=${PGDUMP_DIR}/pg_dumpall-$(date '+%Y-%m-%d-%H-%M').pgdump" + ## @param backup.cronjob.labels Set the cronjob labels + labels: {} + ## @param backup.cronjob.annotations Set the cronjob annotations + annotations: {} + ## @param backup.cronjob.nodeSelector Node labels for PostgreSQL backup CronJob pod assignment + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/ + ## + nodeSelector: {} + ## @param backup.cronjob.tolerations Tolerations for PostgreSQL backup CronJob pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## backup cronjob container resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param backup.cronjob.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if backup.cronjob.resources is set (backup.cronjob.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param backup.cronjob.resources Set container requests and limits for different resources like CPU or memory + ## Example: + resources: {} + ## resources: + ## requests: + ## cpu: 1 + ## memory: 512Mi + ## limits: + ## cpu: 2 + ## memory: 1024Mi + networkPolicy: + ## @param backup.cronjob.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + storage: + ## @param backup.cronjob.storage.enabled Enable using a `PersistentVolumeClaim` as backup data volume + ## + enabled: true + ## @param backup.cronjob.storage.existingClaim Provide an existing `PersistentVolumeClaim` (only when `architecture=standalone`) + ## If defined, PVC must be created manually before volume will be bound + ## + existingClaim: "" + ## @param backup.cronjob.storage.resourcePolicy Setting it to "keep" to avoid removing PVCs during a helm delete operation. Leaving it empty will delete PVCs after the chart deleted + ## + resourcePolicy: "" + ## @param backup.cronjob.storage.storageClass PVC Storage Class for the backup data volume + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. + ## + storageClass: "" + ## @param backup.cronjob.storage.accessModes PV Access Mode + ## + accessModes: + - ReadWriteOnce + ## @param backup.cronjob.storage.size PVC Storage Request for the backup data volume + ## + size: 8Gi + ## @param backup.cronjob.storage.annotations PVC annotations + ## + annotations: {} + ## @param backup.cronjob.storage.mountPath Path to mount the volume at + ## + mountPath: /backup/pgdump + ## @param backup.cronjob.storage.subPath Subdirectory of the volume to mount at + ## and one PV for multiple services. + ## + subPath: "" + ## Fine tuning for volumeClaimTemplates + ## + volumeClaimTemplates: + ## @param backup.cronjob.storage.volumeClaimTemplates.selector A label query over volumes to consider for binding (e.g. when using local volumes) + ## A label query over volumes to consider for binding (e.g. when using local volumes) + ## See https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#labelselector-v1-meta for more details + ## + selector: {} + ## @param backup.cronjob.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the backup container + ## + extraVolumeMounts: [] + ## @param backup.cronjob.extraVolumes Optionally specify extra list of additional volumes for the backup container + ## + extraVolumes: [] + +## @section Password update job +## +passwordUpdateJob: + ## @param passwordUpdateJob.enabled Enable password update job + ## + enabled: false + ## @param passwordUpdateJob.backoffLimit set backoff limit of the job + ## + backoffLimit: 10 + ## @param passwordUpdateJob.command Override default container command on mysql Primary container(s) (useful when using custom images) + ## + command: [] + ## @param passwordUpdateJob.args Override default container args on mysql Primary container(s) (useful when using custom images) + ## + args: [] + ## @param passwordUpdateJob.extraCommands Extra commands to pass to the generation job + ## + extraCommands: "" + ## @param passwordUpdateJob.previousPasswords.postgresPassword Previous postgres password (set if the password secret was already changed) + ## @param passwordUpdateJob.previousPasswords.password Previous password (set if the password secret was already changed) + ## @param passwordUpdateJob.previousPasswords.replicationPassword Previous replication password (set if the password secret was already changed) + ## @param passwordUpdateJob.previousPasswords.existingSecret Name of a secret containing the previous passwords (set if the password secret was already changed) + previousPasswords: + postgresPassword: "" + password: "" + replicationPassword: "" + existingSecret: "" + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param passwordUpdateJob.containerSecurityContext.enabled Enabled containers' Security Context + ## @param passwordUpdateJob.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container + ## @param passwordUpdateJob.containerSecurityContext.runAsUser Set containers' Security Context runAsUser + ## @param passwordUpdateJob.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup + ## @param passwordUpdateJob.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot + ## @param passwordUpdateJob.containerSecurityContext.privileged Set container's Security Context privileged + ## @param passwordUpdateJob.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem + ## @param passwordUpdateJob.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation + ## @param passwordUpdateJob.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param passwordUpdateJob.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsGroup: 1001 + runAsNonRoot: true + privileged: false + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + ## Configure Pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param passwordUpdateJob.podSecurityContext.enabled Enabled credential init job pods' Security Context + ## @param passwordUpdateJob.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy + ## @param passwordUpdateJob.podSecurityContext.sysctls Set kernel settings using the sysctl interface + ## @param passwordUpdateJob.podSecurityContext.supplementalGroups Set filesystem extra groups + ## @param passwordUpdateJob.podSecurityContext.fsGroup Set credential init job pod's Security Context fsGroup + ## + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## @param passwordUpdateJob.extraEnvVars Array containing extra env vars to configure the credential init job + ## For example: + ## extraEnvVars: + ## - name: GF_DEFAULT_INSTANCE_NAME + ## value: my-instance + ## + extraEnvVars: [] + ## @param passwordUpdateJob.extraEnvVarsCM ConfigMap containing extra env vars to configure the credential init job + ## + extraEnvVarsCM: "" + ## @param passwordUpdateJob.extraEnvVarsSecret Secret containing extra env vars to configure the credential init job (in case of sensitive data) + ## + extraEnvVarsSecret: "" + ## @param passwordUpdateJob.extraVolumes Optionally specify extra list of additional volumes for the credential init job + ## + extraVolumes: [] + ## @param passwordUpdateJob.extraVolumeMounts Array of extra volume mounts to be added to the jwt Container (evaluated as template). Normally used with `extraVolumes`. + ## + extraVolumeMounts: [] + ## @param passwordUpdateJob.initContainers Add additional init containers for the mysql Primary pod(s) + ## + initContainers: [] + ## Container resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param passwordUpdateJob.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if passwordUpdateJob.resources is set (passwordUpdateJob.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "micro" + ## @param passwordUpdateJob.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## @param passwordUpdateJob.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param passwordUpdateJob.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param passwordUpdateJob.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## @param passwordUpdateJob.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: false + ## @param passwordUpdateJob.hostAliases Add deployment host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param passwordUpdateJob.annotations [object] Add annotations to the job + ## + annotations: {} + ## @param passwordUpdateJob.podLabels Additional pod labels + ## Ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param passwordUpdateJob.podAnnotations Additional pod annotations + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + +## @section Volume Permissions parameters +## + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume(s) mountpoint(s) to 'runAsUser:fsGroup' on each node +## +volumePermissions: + ## @param volumePermissions.enabled Enable init container that changes the owner and group of the persistent volume + ## + enabled: false + ## @param volumePermissions.image.registry [default: REGISTRY_NAME] Init container volume-permissions image registry + ## @param volumePermissions.image.repository [default: REPOSITORY_NAME/os-shell] Init container volume-permissions image repository + ## @skip volumePermissions.image.tag Init container volume-permissions image tag (immutable tags are recommended) + ## @param volumePermissions.image.digest Init container volume-permissions image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag + ## @param volumePermissions.image.pullPolicy Init container volume-permissions image pull policy + ## @param volumePermissions.image.pullSecrets Init container volume-permissions image pull secrets + ## + image: + registry: docker.io + repository: bitnami/os-shell + tag: 12-debian-12-r39 + digest: "" + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## Example: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Init container resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param volumePermissions.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param volumePermissions.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Init container' Security Context + ## Note: the chown of the data folder is done to containerSecurityContext.runAsUser + ## and not the below volumePermissions.containerSecurityContext.runAsUser + ## @param volumePermissions.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container + ## @param volumePermissions.containerSecurityContext.runAsUser User ID for the init container + ## @param volumePermissions.containerSecurityContext.runAsGroup Group ID for the init container + ## @param volumePermissions.containerSecurityContext.runAsNonRoot runAsNonRoot for the init container + ## @param volumePermissions.containerSecurityContext.seccompProfile.type seccompProfile.type for the init container + ## + containerSecurityContext: + seLinuxOptions: {} + runAsUser: 0 + runAsGroup: 0 + runAsNonRoot: false + seccompProfile: + type: RuntimeDefault +## @section Other Parameters +## + +## @param serviceBindings.enabled Create secret for service binding (Experimental) +## Ref: https://servicebinding.io/service-provider/ +## +serviceBindings: + enabled: false +## Service account for PostgreSQL to use. +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ +## +serviceAccount: + ## @param serviceAccount.create Enable creation of ServiceAccount for PostgreSQL pod + ## + create: true + ## @param serviceAccount.name The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the common.names.fullname template + ## + name: "" + ## @param serviceAccount.automountServiceAccountToken Allows auto mount of ServiceAccountToken on the serviceAccount created + ## Can be set to false if pods using this serviceAccount do not need to use K8s API + ## + automountServiceAccountToken: false + ## @param serviceAccount.annotations Additional custom annotations for the ServiceAccount + ## + annotations: {} +## Creates role for ServiceAccount +## @param rbac.create Create Role and RoleBinding (required for PSP to work) +## +rbac: + create: false + ## @param rbac.rules Custom RBAC rules to set + ## e.g: + ## rules: + ## - apiGroups: + ## - "" + ## resources: + ## - pods + ## verbs: + ## - get + ## - list + ## + rules: [] +## Pod Security Policy +## ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/ +## @param psp.create Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later +## +psp: + create: false +## @section Metrics Parameters +## +metrics: + ## @param metrics.enabled Start a prometheus exporter + ## + enabled: false + ## @param metrics.image.registry [default: REGISTRY_NAME] PostgreSQL Prometheus Exporter image registry + ## @param metrics.image.repository [default: REPOSITORY_NAME/postgres-exporter] PostgreSQL Prometheus Exporter image repository + ## @skip metrics.image.tag PostgreSQL Prometheus Exporter image tag (immutable tags are recommended) + ## @param metrics.image.digest PostgreSQL image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag + ## @param metrics.image.pullPolicy PostgreSQL Prometheus Exporter image pull policy + ## @param metrics.image.pullSecrets Specify image pull secrets + ## + image: + registry: docker.io + repository: bitnami/postgres-exporter + tag: 0.17.1-debian-12-r0 + digest: "" + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## Example: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## @param metrics.collectors Control enabled collectors + ## ref: https://github.com/prometheus-community/postgres_exporter#flags + ## Example: + ## collectors: + ## wal: false + collectors: {} + ## @param metrics.customMetrics Define additional custom metrics + ## ref: https://github.com/prometheus-community/postgres_exporter#adding-new-metrics-via-a-config-file-deprecated + ## customMetrics: + ## pg_database: + ## query: "SELECT d.datname AS name, CASE WHEN pg_catalog.has_database_privilege(d.datname, 'CONNECT') THEN pg_catalog.pg_database_size(d.datname) ELSE 0 END AS size_bytes FROM pg_catalog.pg_database d where datname not in ('template0', 'template1', 'postgres')" + ## metrics: + ## - name: + ## usage: "LABEL" + ## description: "Name of the database" + ## - size_bytes: + ## usage: "GAUGE" + ## description: "Size of the database in bytes" + ## + customMetrics: {} + ## @param metrics.extraEnvVars Extra environment variables to add to PostgreSQL Prometheus exporter + ## see: https://github.com/prometheus-community/postgres_exporter#environment-variables + ## For example: + ## extraEnvVars: + ## - name: PG_EXPORTER_DISABLE_DEFAULT_METRICS + ## value: "true" + ## + extraEnvVars: [] + ## PostgreSQL Prometheus exporter containers' Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param metrics.containerSecurityContext.enabled Enabled containers' Security Context + ## @param metrics.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container + ## @param metrics.containerSecurityContext.runAsUser Set containers' Security Context runAsUser + ## @param metrics.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup + ## @param metrics.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot + ## @param metrics.containerSecurityContext.privileged Set container's Security Context privileged + ## @param metrics.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem + ## @param metrics.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation + ## @param metrics.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param metrics.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsGroup: 1001 + runAsNonRoot: true + privileged: false + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + ## Configure extra options for PostgreSQL Prometheus exporter containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param metrics.livenessProbe.enabled Enable livenessProbe on PostgreSQL Prometheus exporter containers + ## @param metrics.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param metrics.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param metrics.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param metrics.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param metrics.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param metrics.readinessProbe.enabled Enable readinessProbe on PostgreSQL Prometheus exporter containers + ## @param metrics.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param metrics.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param metrics.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param metrics.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param metrics.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param metrics.startupProbe.enabled Enable startupProbe on PostgreSQL Prometheus exporter containers + ## @param metrics.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param metrics.startupProbe.periodSeconds Period seconds for startupProbe + ## @param metrics.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param metrics.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param metrics.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param metrics.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param metrics.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param metrics.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## @param metrics.containerPorts.metrics PostgreSQL Prometheus exporter metrics container port + ## + containerPorts: + metrics: 9187 + ## PostgreSQL Prometheus exporter resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param metrics.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param metrics.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Service configuration + ## + service: + ## @param metrics.service.ports.metrics PostgreSQL Prometheus Exporter service port + ## + ports: + metrics: 9187 + ## @param metrics.service.clusterIP Static clusterIP or None for headless services + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address + ## + clusterIP: "" + ## @param metrics.service.sessionAffinity Control where client requests go, to the same pod or round-robin + ## Values: ClientIP or None + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/ + ## + sessionAffinity: None + ## @param metrics.service.annotations [object] Annotations for Prometheus to auto-discover the metrics endpoint + ## + annotations: + prometheus.io/scrape: "true" + prometheus.io/port: "{{ .Values.metrics.service.ports.metrics }}" + ## Prometheus Operator ServiceMonitor configuration + ## + serviceMonitor: + ## @param metrics.serviceMonitor.enabled Create ServiceMonitor Resource for scraping metrics using Prometheus Operator + ## + enabled: false + ## @param metrics.serviceMonitor.namespace Namespace for the ServiceMonitor Resource (defaults to the Release Namespace) + ## + namespace: "" + ## @param metrics.serviceMonitor.interval Interval at which metrics should be scraped. + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint + ## + interval: "" + ## @param metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint + ## + scrapeTimeout: "" + ## @param metrics.serviceMonitor.labels Additional labels that can be used so ServiceMonitor will be discovered by Prometheus + ## + labels: {} + ## @param metrics.serviceMonitor.selector Prometheus instance selector labels + ## ref: https://github.com/bitnami/charts/tree/main/bitnami/prometheus-operator#prometheus-configuration + ## + selector: {} + ## @param metrics.serviceMonitor.relabelings RelabelConfigs to apply to samples before scraping + ## + relabelings: [] + ## @param metrics.serviceMonitor.metricRelabelings MetricRelabelConfigs to apply to samples before ingestion + ## + metricRelabelings: [] + ## @param metrics.serviceMonitor.honorLabels Specify honorLabels parameter to add the scrape endpoint + ## + honorLabels: false + ## @param metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in prometheus. + ## + jobLabel: "" + ## Custom PrometheusRule to be defined + ## The value is evaluated as a template, so, for example, the value can depend on .Release or .Chart + ## ref: https://github.com/coreos/prometheus-operator#customresourcedefinitions + ## + prometheusRule: + ## @param metrics.prometheusRule.enabled Create a PrometheusRule for Prometheus Operator + ## + enabled: false + ## @param metrics.prometheusRule.namespace Namespace for the PrometheusRule Resource (defaults to the Release Namespace) + ## + namespace: "" + ## @param metrics.prometheusRule.labels Additional labels that can be used so PrometheusRule will be discovered by Prometheus + ## + labels: {} + ## @param metrics.prometheusRule.rules PrometheusRule definitions + ## Make sure to constraint the rules to the current postgresql service. + ## rules: + ## - alert: HugeReplicationLag + ## expr: pg_replication_lag{service="{{ printf "%s-metrics" (include "common.names.fullname" .) }}"} / 3600 > 1 + ## for: 1m + ## labels: + ## severity: critical + ## annotations: + ## description: replication for {{ include "common.names.fullname" . }} PostgreSQL is lagging by {{ "{{ $value }}" }} hour(s). + ## summary: PostgreSQL replication is lagging by {{ "{{ $value }}" }} hour(s). + ## + rules: [] diff --git a/copy_images.tf b/copy_images.tf index 0d6341c..c77347e 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -1,45 +1,77 @@ locals { - keycloak_key = format("%v#%v", "keycloak", var.keycloak_tag) - gogatekeeper_key = format("%v#%v", "gogatekeeper", var.gogatekeeper_tag) + keycloak_name = "keycloak/keycloak" + keycloak_key = format("%v#%v", local.keycloak_name, var.keycloak_tag) + postgresql_key = format("%v#%v", "bitnami/postgresql", var.postgresql_tag) + kubectl_key = format("%v#%v", "bitnami/kubectl-debian", var.kubectl_image_tag) image_config = [ { enabled = true dest_path = null - name = "keycloak" - source_image = "bitnami/keycloak" - source_registry = "docker.io" + name = "keycloak/keycloak" + source_image = "keycloak/keycloak" + source_registry = "quay.io" source_tag = var.keycloak_tag tag = var.keycloak_tag }, { enabled = true dest_path = null - name = "gogatekeeper" - source_image = "gogatekeeper/gatekeeper" - source_registry = "quay.io" - source_tag = var.gogatekeeper_tag - tag = var.gogatekeeper_tag + name = "bitnami/postgresql" + source_image = "bitnami/postgresql" + source_registry = "public.ecr.aws" + source_tag = var.postgresql_tag + tag = var.postgresql_tag }, + { + enabled = true + dest_path = null + name = "bitnami/kubectl-debian" + source_image = "bitnami/kubectl" + source_registry = "docker.io" + source_tag = var.kubectl_image_tag + tag = var.kubectl_image_tag + }, + # { + # enabled = true + # dest_path = null + # name = "bitnami/keycloak" + # source_image = "bitnami/keycloak" + # source_registry = "public.ecr.aws" + # source_tag = var.keycloak_tag + # tag = var.keycloak_tag + # }, + # { + # enabled = true + # dest_path = null + # name = "bitnami/postgresql" + # source_image = "bitnami/postgresql" + # source_registry = "public.ecr.aws" + # source_tag = var.postgresql_tag + # tag = var.postgresql_tag + # }, + # { + # enabled = true + # dest_path = null + # name = "gogatekeeper" + # source_image = "bitnami/keycloak-gatekeeper" + # source_registry = "public.ecr.aws" + # source_tag = var.gogatekeeper_tag + # tag = var.gogatekeeper_tag + # }, ] } module "images" { - source = "git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/?ref=2.0.2" + source = "git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/?ref=tf-upgrade" profile = var.profile application_name = var.cluster_name image_config = local.image_config tags = {} - ### optional - ## account_alias = "" - ## account_id = "" - ## destination_password = "" - ## destination_username = "" - ## override_prefixes = {} - ## region = "" - ## source_password = "" - ## source_username = "" + enable_lifecycle_policy = true + lifecycle_policy_all = true + force_delete = true + lifecycle_policy_keep_count = 3 } - diff --git a/data.tf b/data.tf new file mode 100644 index 0000000..93abcd1 --- /dev/null +++ b/data.tf @@ -0,0 +1,27 @@ +# data "aws_vpcs" "vpcs" {} + +# data "aws_vpc" "vpcs" { +# for_each = toset(data.aws_vpcs.vpcs.ids) +# id = each.key +# } + +# data "aws_secretsmanager_secret" "rds_password" { +# depends_on = [module.keycloak_db] +# arn = module.keycloak_db.db_instance_master_user_secret_arn +# } + +# data "aws_secretsmanager_secret_version" "rds_password" { +# secret_id = data.aws_secretsmanager_secret.rds_password.id +# } + +# data "aws_subnets" "db" { +# for_each = { for k, v in data.aws_vpc.vpcs : k => v if v.tags["Name"] != "vpc0-dummy" } +# filter { +# name = "tag:Name" +# values = ["*-db-*"] +# } +# filter { +# name = "vpc-id" +# values = [each.key] +# } +# } diff --git a/database.tf.off b/database.tf.off new file mode 100644 index 0000000..197838f --- /dev/null +++ b/database.tf.off @@ -0,0 +1,85 @@ +# RDS Prerequisites +module "rds_prereqs" { + # tflint-ignore: terraform_module_pinned_source + source = "git@github.e.it.census.gov:terraform-modules/aws-rds.git//parameter-groups/postgres-15" + + create_baseline_parameter_group = true +} + +# RDS Database Instance +module "keycloak_db" { + depends_on = [module.rds_prereqs, module.sg_postgres, aws_db_subnet_group.rds] + source = "terraform-aws-modules/rds/aws" + version = "~> 6.10" + + identifier = format("rds-db-%v-%v-apgs", var.cluster_name, var.environment) + + engine = var.db_engine + engine_version = var.db_engine_version + major_engine_version = var.major_engine_version + family = var.db_engine_family + instance_class = var.db_instance_type + allocated_storage = 20 + storage_encrypted = true + + manage_master_user_password = true + deletion_protection = true + + db_name = var.db_name + username = var.db_user + port = 5432 + + multi_az = true + db_subnet_group_name = aws_db_subnet_group.rds[0].name + vpc_security_group_ids = [module.sg_postgres.aws_security_group.this_security_group_id] + + maintenance_window = "Mon:00:00-Mon:03:00" + backup_window = "03:00-06:00" + backup_retention_period = 35 + copy_tags_to_snapshot = true + skip_final_snapshot = false + + performance_insights_enabled = true + performance_insights_retention_period = 7 + create_monitoring_role = true + monitoring_interval = 60 + + enabled_cloudwatch_logs_exports = ["postgresql"] + + auto_minor_version_upgrade = true + allow_major_version_upgrade = false + apply_immediately = false + + tags = var.tags +} + +module "sg_postgres" { + for_each = { for k, v in data.aws_subnets.db : k => tolist(v.ids) } + source = "git@github.e.it.census.gov:terraform-modules/aws-common-security-groups.git//rds-postgres?ref=tf-upgrade" + + vpc_id = each.key + ingress_prefix_list_names = ["all-networks.core"] + ingress_networks = null + + tags = merge( + var.tags, + { Environment = data.aws_vpc.vpcs[each.key].tags["Environment"] }, + ) +} + +resource "aws_db_subnet_group" "rds" { + for_each = { for k, v in data.aws_subnets.db : k => tolist(v.ids) } + + description = format("RDS subnet group for %v", data.aws_vpc.vpcs[each.key].tags["Name"]) + name = format("rds-ng-%v", data.aws_vpc.vpcs[each.key].tags["Name"]) + subnet_ids = each.value + + tags = merge( + local.base_tags, + var.tags, + { + Environment = data.aws_vpc.vpcs[each.key].tags["Environment"] + Name = format("rds-ng-%v", data.aws_vpc.vpcs[each.key].tags["Name"]) + } + ) +} diff --git a/examples/complete/main.tf b/examples/complete/main.tf new file mode 100644 index 0000000..f5786e5 --- /dev/null +++ b/examples/complete/main.tf @@ -0,0 +1,22 @@ +terraform { + required_version = ">= 0.13" +} + +module "keycloak" { + source = "../../" + + cluster_name = "my-eks-cluster" + profile = "my-aws-profile" + region = "us-west-2" + + keycloak_tag = "21.1.1" + gogatekeeper_tag = "3.7.4" + + # Additional customization + tag_costallocation = "my-cost-center" +} + +output "public_endpoint" { + description = "Keycloak public endpoint" + value = module.keycloak.public_endpoint +} diff --git a/keycloak-db-values.yaml b/keycloak-db-values.yaml new file mode 100644 index 0000000..cf0eb44 --- /dev/null +++ b/keycloak-db-values.yaml @@ -0,0 +1,33 @@ +# See https://github.com/bitnami/charts/tree/master/bitnami/postgresql +global: + security: + allowInsecureImages: true + postgresql: + # architecture: replication + auth: + database: keycloak + existingSecret: 'keycloak-db-creds' + secretKeys: + adminPasswordKey: password + userPasswordKey: postgres-password + replicationPasswordKey: replication-password +image: + registry: + repository: + tag: +primary: + resources: + requests: + memory: "128Mi" + cpu: "100m" + limits: + memory: "2Gi" + cpu: "2000m" +readReplicas: + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 2000m + memory: 2Gi \ No newline at end of file diff --git a/keycloak-server-values.yaml b/keycloak-server-values.yaml new file mode 100644 index 0000000..aaa8f6c --- /dev/null +++ b/keycloak-server-values.yaml @@ -0,0 +1,66 @@ +# See https://www.keycloak.org/server/configuration +# See https://www.keycloak.org/server/all-config + +replicas: 3 + +skipInitContainers: true + +command: + - "/opt/keycloak/bin/kc.sh" + - "--verbose" + - "start" + - "--hostname=${hostname}" + - "--http-enabled=true" + - "--http-port=8080" + - "--hostname-strict=false" + - "--spi-events-listener-jboss-logging-success-level=info" + - "--spi-events-listener-jboss-logging-error-level=warn" + +extraEnv: | + - name: KC_BOOTSTRAP_ADMIN_USERNAME + valueFrom: + secretKeyRef: + name: keycloak-admin-creds + key: username + - name: KC_BOOTSTRAP_ADMIN_PASSWORD + valueFrom: + secretKeyRef: + name: keycloak-admin-creds + key: password + - name: JAVA_OPTS_APPEND + value: >- + -XX:+UseContainerSupport + -XX:MaxRAMPercentage=50.0 + -Djava.awt.headless=true + -Djgroups.dns.query={{ include "keycloak.fullname" . }}-headless + +# dbchecker: +# enabled: true +resources: + requests: + cpu: "500m" + memory: "1024Mi" + limits: + cpu: "1" + memory: "4096Mi" + +database: + vendor: postgres + hostname: ${database_hostname} + port: 5432 + username: ${database_username} + # password: dbpassword + existingSecret: keycloak-db-creds + existingSecretKey: password + database: ${database_name} + +http: + relativePath: "/" + +# secrets: +# admin-creds: +# annotations: +# my-test-annotation: Test secret for {{ include "keycloak.fullname" . }} +# stringData: +# user: admin +# password: secret diff --git a/keycloak-values.yaml.tmpl b/keycloak-values.yaml.tmpl deleted file mode 100644 index 1b4d058..0000000 --- a/keycloak-values.yaml.tmpl +++ /dev/null @@ -1,73 +0,0 @@ -replicaCount: 3 - -global: - imageRegistry: "${image_registry}" - -image: - registry: "${image_registry}" - repository: "${image_repository}" - tag: "${image_tag}" - -postgresql: - enabled: false - -auth: - adminUser: "admin" - existingSecret: "keycloak-admin-creds" - passwordSecretKey: "keycloak-password" - -service: - type: "ClusterIP" - -production: true -proxy: "edge" - -extraEnvVars: -- name: PROXY_ADDRESS_FORWARDING - value: "true" -- name: KC_CONFIG_FILE - value: "/opt/bitnami/keycloak/kcadm.config" -- name: DB_VENDOR - value: "${external_db_type}" - -metrics: - enabled: true - -externalDatabaes: - host: "${external_db_addr}" - port: "${external_db_port}" - user: "${external_db_user}" - database: "${external_db_database}" - existingSecret: "keycloak-db-creds" - existingSecretPasswordKey: "database-password" - -extraVolumeMounts: | - - name: keycloak-db-creds - mountPath: /secrets/keycloak-db-creds - readOnly: true - - name: keycloak-admin-creds - mountPath: /secrets/keycloak-admin-creds - readOnly: true - -extraVolumes: | - - name: keycloak-db-creds - secret: - secretName: keycloak-db-creds - - name: keycloak-admin-creds - secret: - secretName: keycloak-admin-creds - -extraEnv: | - - name: DB_PASSWORD_FILE - value: /secrets/keycloak-db-creds/database-password - - name: KEYCLOAK_PASSWORD_FILE - value: /secrets/keycloak-admin-creds/keycloak-password - - name: JGROUPS_DISCOVERY_PROTOCOL - value: dns.DNS_PING - - name: JGROUPS_DISCOVERY_PROPERTIES - value: 'dns_query={{ include "keycloak.serviceDnsName" . }}' - - name: CACHE_OWNERS_COUNT - value: "3" - - name: CACHE_OWNERS_AUTH_SESSIONS_COUNT - value: "3" - diff --git a/main.tf b/main.tf index b775da0..4e21785 100644 --- a/main.tf +++ b/main.tf @@ -1,12 +1,48 @@ +# main.tf +resource "random_uuid" "admin-secret" {} + locals { public_hostname = format("%v.%v", var.keycloak_hostname, var.cluster_domain) public_port_number = "80" public_url = format("https://%v:%v/", local.public_hostname, local.public_port_number) + internal_port_number = "8080" + admin_internal_port_number = "9000" + + admin-client-id = "sso.admin" + secrets_job_script = <. -variable "keycloak_hostname" { - description = "The hostname used to access the keycloak service." +variable "keycloak_database" { + description = "The name of the database to create in the RDS instance." type = string default = "keycloak" } -variable "cluster_domain" { - description = "The domain name used to reference ingresses for the cluster." +variable "keycloak_postgres_db_hostname" { + description = "The hostname of the postgres database for keycloak to use." type = string + default = "keycloak-db" } -variable "certificate_issuer" { - description = "The name of the certificate issuer to use for ingresses." +variable "keycloak_user" { + description = "The username for the database." type = string + default = "keycloak" } -variable "istio_namespace" { - description = "The namespace in which the certificate request is to be created." +variable "keycloak_password" { + description = "The initial password for the database." type = string - default = "istio-system" + default = "keycloak" } -variable "default_realm" { - description = "The default realm to use to configure the environment." +variable "keycloak_hostname" { + description = "The hostname used to access the keycloak service." type = string - default = "cluster-admin" + default = "keycloak" } -variable "admin_email" { - description = "The email address of the admin of the default realm." +variable "default_storage_class" { + description = "The default storage class to use for persistent volumes" type = string + default = "gp3-encrypted" } -variable "external_database_vendor" { - description = "The type of database keycloak will be using to store configuration data. mariadb/mssql/mysql/oracle/postgres" +variable "service_name" { + description = "The name of the service to be deployed in the EKS cluster." type = string - default = "postgresql" + default = "service" } -variable "external_database_address" { - description = "The address to access the external database. for example: `adsd-rds-mft-sbox.c2tx3ocukdth.us-gov-east-1.rds.amazonaws.com`" +variable "telemetry_namespace" { + description = "The namespace used for telemetry." type = string + default = "namespace" } -variable "external_database_port" { - description = "The port to use to access the database." +variable "postgresql_chart_version" { + description = "The helm chart version of postgresql to use." type = string + default = "16.5.1" } -variable "external_database_database" { - description = "The name of the database within which keycloak should maintain configuration data." +variable "postgresql_tag" { + description = "The tag of the postgresql image to use." type = string - default = "keycloak" + default = "17.4.0" } -variable "external_database_username" { - description = "The username keycloak should use to log into the external database." - type = string - default = "keycloak" +variable "kubectl_image_tag" { + description = "Version tag for the docker image to use to execute kubectl commands." + default = "1.25.2-debian-11-r3" } variable "external_database_password" { description = "The password for the external_database_username user." type = string + default = "I am a great, thoughtful and extremely well respected password. Vegetable. Phrenologist. Ethiopia." +} + +variable "default_realm" { + description = "The default realm to use to configure the environment." + type = string + default = "cluster-admin" } + +variable "admin_email" { + description = "The email address of the admin of the default realm." + type = string + default = "luther.coleman.mcginty@census.gov" +} \ No newline at end of file diff --git a/version.tf b/version.tf new file mode 100644 index 0000000..47c6f5c --- /dev/null +++ b/version.tf @@ -0,0 +1,4 @@ +locals { + module_name = "tfmod-keycloak" + module_version = "0.1.0" +} From eeaa10b12369b371fdc4d8b0c5348063847016e6 Mon Sep 17 00:00:00 2001 From: mcgin314 Date: Mon, 14 Apr 2025 15:14:12 -0400 Subject: [PATCH 03/67] Automate DB config and minor keycloak config adjustments --- main.tf | 52 +++++++++++++++++++++++++++++++++++----------------- outputs.tf | 10 +++++----- 2 files changed, 40 insertions(+), 22 deletions(-) diff --git a/main.tf b/main.tf index 4e21785..0b80697 100644 --- a/main.tf +++ b/main.tf @@ -23,8 +23,8 @@ ensure_secret admin-sso client_secret "${random_uuid.admin-secret.result}" SECRETS config_job_script = < /tmp/db_config.sql < Date: Mon, 14 Apr 2025 17:49:27 -0400 Subject: [PATCH 04/67] pull from ent-ecr --- README.md | 4 ++++ copy_images.tf | 31 ++++++++++++++++----------- variables.tf | 58 ++++++++++++++++++++++++++++---------------------- 3 files changed, 54 insertions(+), 39 deletions(-) diff --git a/README.md b/README.md index 95208a2..3bd396c 100644 --- a/README.md +++ b/README.md @@ -71,6 +71,7 @@ Common issues and solutions: | Name | Version | |------|---------| +| [aws](#provider\_aws) | 5.88.0 | | [helm](#provider\_helm) | 2.17.0 | ## Modules @@ -85,11 +86,14 @@ Common issues and solutions: | Name | Type | |------|------| | [helm_release.keycloak](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | +| [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | +| [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| +| [account\_id](#input\_account\_id) | aws account number | `string` | `""` | no | | [cluster\_domain](#input\_cluster\_domain) | The domain name used to reference ingresses for the cluster. | `string` | n/a | yes | | [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes | | [default\_storage\_class](#input\_default\_storage\_class) | The default storage class to use for persistent volumes | `string` | `"gp3-encrypted"` | no | diff --git a/copy_images.tf b/copy_images.tf index 9ea2ccd..878b1d7 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -2,7 +2,7 @@ locals { keycloak_name = "bitnami/keycloak" keycloak_key = format("%v#%v", local.keycloak_name, var.keycloak_tag) postgresql_key = format("%v#%v", "bitnami/postgresql", var.postgresql_tag) - + ent_ecr_source = format("%v.%v.%v.%v", var.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images") image_config = [ { @@ -10,7 +10,7 @@ locals { dest_path = null name = "bitnami/keycloak" source_image = "bitnami/keycloak" - source_registry = "public.ecr.aws" + source_registry = format("%v/%v", local.ent_ecr_source, "public-ecr") source_tag = var.keycloak_tag tag = var.keycloak_tag }, @@ -19,19 +19,10 @@ locals { dest_path = null name = "bitnami/postgresql" source_image = "bitnami/postgresql" - source_registry = "public.ecr.aws" + source_registry = format("%v/%v", local.ent_ecr_source, "public-ecr") source_tag = var.postgresql_tag tag = var.postgresql_tag }, - # { - # enabled = true - # dest_path = null - # name = "gogatekeeper" - # source_image = "bitnami/keycloak-gatekeeper" - # source_registry = "public.ecr.aws" - # source_tag = var.gogatekeeper_tag - # tag = var.gogatekeeper_tag - # }, ] } @@ -46,5 +37,19 @@ module "images" { enable_lifecycle_policy = true lifecycle_policy_all = true force_delete = true - lifecycle_policy_keep_count = 3 + lifecycle_policy_keep_count = 5 + + source_username = data.aws_ecr_authorization_token.ecr_token.user_name + source_password = data.aws_ecr_authorization_token.ecr_token.password + + destination_username = data.aws_ecr_authorization_token.token.user_name + destination_password = data.aws_ecr_authorization_token.token.password +} + +data "aws_ecr_authorization_token" "ecr_token" { + registry_id = var.account_id +} + +data "aws_ecr_authorization_token" "token" { + registry_id = var.account_id } diff --git a/variables.tf b/variables.tf index 194fdbc..457f4c2 100644 --- a/variables.tf +++ b/variables.tf @@ -1,29 +1,23 @@ -variable "cluster_name" { - description = "EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev)" - type = string -} - -variable "profile" { - description = "AWS config profile used to upload images into ECR" +variable "account_id" { + description = "aws account number" type = string default = "" } -variable "namespace" { - description = "The namespace which will be created and into which keycloak will be deployed." +variable "cluster_domain" { + description = "The domain name used to reference ingresses for the cluster." type = string - default = "keycloak" } -variable "keycloak_tag" { - description = "The image tag associated with the keycloak_chart_version" +variable "cluster_name" { + description = "EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev)" type = string - default = "22.0.1-debian-11-r30" } -variable "cluster_domain" { - description = "The domain name used to reference ingresses for the cluster." +variable "default_storage_class" { + description = "The default storage class to use for persistent volumes" type = string + default = "gp3-encrypted" } variable "keycloak_database" { @@ -32,22 +26,40 @@ variable "keycloak_database" { default = "keycloak" } +variable "keycloak_password" { + description = "The initial password for the database." + type = string + default = "keycloak" +} + +variable "keycloak_tag" { + description = "The image tag associated with the keycloak_chart_version" + type = string + default = "22.0.1-debian-11-r30" +} + variable "keycloak_user" { description = "The username for the database." type = string default = "keycloak" } -variable "keycloak_password" { - description = "The initial password for the database." +variable "namespace" { + description = "The namespace which will be created and into which keycloak will be deployed." type = string default = "keycloak" } -variable "default_storage_class" { - description = "The default storage class to use for persistent volumes" +variable "postgresql_tag" { + description = "The tag of the postgresql image to use." type = string - default = "gp3-encrypted" + default = "17.4.0" +} + +variable "profile" { + description = "AWS config profile used to upload images into ECR" + type = string + default = "" } variable "service_name" { @@ -61,9 +73,3 @@ variable "telemetry_namespace" { type = string default = "namespace" } - -variable "postgresql_tag" { - description = "The tag of the postgresql image to use." - type = string - default = "17.4.0" -} From 8ddfbf050d25163aa609934fb491b69fce61900f Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 14 Apr 2025 21:03:03 -0400 Subject: [PATCH 05/67] add region --- README.md | 1 + variables.tf | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/README.md b/README.md index 3bd396c..c981c86 100644 --- a/README.md +++ b/README.md @@ -104,6 +104,7 @@ Common issues and solutions: | [namespace](#input\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no | | [postgresql\_tag](#input\_postgresql\_tag) | The tag of the postgresql image to use. | `string` | `"17.4.0"` | no | | [profile](#input\_profile) | AWS config profile used to upload images into ECR | `string` | `""` | no | +| [region](#input\_region) | region name | `string` | `"us-gov-east-1"` | no | | [service\_name](#input\_service\_name) | The name of the service to be deployed in the EKS cluster. | `string` | `"service"` | no | | [telemetry\_namespace](#input\_telemetry\_namespace) | The namespace used for telemetry. | `string` | `"namespace"` | no | diff --git a/variables.tf b/variables.tf index 457f4c2..aabae0e 100644 --- a/variables.tf +++ b/variables.tf @@ -62,6 +62,12 @@ variable "profile" { default = "" } +variable "region" { + description = "region name" + type = string + default = "us-gov-east-1" +} + variable "service_name" { description = "The name of the service to be deployed in the EKS cluster." type = string From 125314a9a70e5e5d695cafbc166a1748a6783517 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Tue, 15 Apr 2025 14:48:27 -0400 Subject: [PATCH 06/67] revert --- copy_images.tf | 6 +++--- variables.tf | 1 + 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/copy_images.tf b/copy_images.tf index 878b1d7..3af88f7 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -2,7 +2,7 @@ locals { keycloak_name = "bitnami/keycloak" keycloak_key = format("%v#%v", local.keycloak_name, var.keycloak_tag) postgresql_key = format("%v#%v", "bitnami/postgresql", var.postgresql_tag) - ent_ecr_source = format("%v.%v.%v.%v", var.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images") + # ent_ecr_source = format("%v.%v.%v.%v", var.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images") image_config = [ { @@ -10,7 +10,7 @@ locals { dest_path = null name = "bitnami/keycloak" source_image = "bitnami/keycloak" - source_registry = format("%v/%v", local.ent_ecr_source, "public-ecr") + source_registry = "public.ecr.aws" source_tag = var.keycloak_tag tag = var.keycloak_tag }, @@ -19,7 +19,7 @@ locals { dest_path = null name = "bitnami/postgresql" source_image = "bitnami/postgresql" - source_registry = format("%v/%v", local.ent_ecr_source, "public-ecr") + source_registry = "public.ecr.aws" source_tag = var.postgresql_tag tag = var.postgresql_tag }, diff --git a/variables.tf b/variables.tf index aabae0e..9f73f81 100644 --- a/variables.tf +++ b/variables.tf @@ -62,6 +62,7 @@ variable "profile" { default = "" } +# tflint-ignore: terraform_unused_declarations variable "region" { description = "region name" type = string From c62c0748a12a110f8fe007569a55414106140ed7 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Tue, 15 Apr 2025 16:20:48 -0400 Subject: [PATCH 07/67] token expired --- README.md | 3 --- copy_images.tf | 20 ++++++++++---------- variables.tf | 1 + 3 files changed, 11 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index c981c86..f62f6a2 100644 --- a/README.md +++ b/README.md @@ -71,7 +71,6 @@ Common issues and solutions: | Name | Version | |------|---------| -| [aws](#provider\_aws) | 5.88.0 | | [helm](#provider\_helm) | 2.17.0 | ## Modules @@ -86,8 +85,6 @@ Common issues and solutions: | Name | Type | |------|------| | [helm_release.keycloak](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | -| [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | -| [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | ## Inputs diff --git a/copy_images.tf b/copy_images.tf index 3af88f7..2fc1b3c 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -39,17 +39,17 @@ module "images" { force_delete = true lifecycle_policy_keep_count = 5 - source_username = data.aws_ecr_authorization_token.ecr_token.user_name - source_password = data.aws_ecr_authorization_token.ecr_token.password + # source_username = data.aws_ecr_authorization_token.ecr_token.user_name + # source_password = data.aws_ecr_authorization_token.ecr_token.password - destination_username = data.aws_ecr_authorization_token.token.user_name - destination_password = data.aws_ecr_authorization_token.token.password + # destination_username = data.aws_ecr_authorization_token.token.user_name + # destination_password = data.aws_ecr_authorization_token.token.password } -data "aws_ecr_authorization_token" "ecr_token" { - registry_id = var.account_id -} +# data "aws_ecr_authorization_token" "ecr_token" { +# registry_id = var.account_id +# } -data "aws_ecr_authorization_token" "token" { - registry_id = var.account_id -} +# data "aws_ecr_authorization_token" "token" { +# registry_id = var.account_id +# } diff --git a/variables.tf b/variables.tf index 9f73f81..fa1f4f4 100644 --- a/variables.tf +++ b/variables.tf @@ -1,3 +1,4 @@ +# tflint-ignore: terraform_unused_declarations variable "account_id" { description = "aws account number" type = string From 3156eb459cd7388dad2522a8b763fff9145c684c Mon Sep 17 00:00:00 2001 From: mcgin314 Date: Wed, 16 Apr 2025 09:36:43 -0400 Subject: [PATCH 08/67] Remove references to admin user, for the most part --- copy_images.tf | 27 --------------------------- keycloak-server-values.yaml | 4 ++-- main.tf | 21 +++++++++++---------- outputs.tf | 11 ++++++++--- variables.tf | 2 +- 5 files changed, 22 insertions(+), 43 deletions(-) diff --git a/copy_images.tf b/copy_images.tf index c77347e..858d2c6 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -32,33 +32,6 @@ locals { source_tag = var.kubectl_image_tag tag = var.kubectl_image_tag }, - # { - # enabled = true - # dest_path = null - # name = "bitnami/keycloak" - # source_image = "bitnami/keycloak" - # source_registry = "public.ecr.aws" - # source_tag = var.keycloak_tag - # tag = var.keycloak_tag - # }, - # { - # enabled = true - # dest_path = null - # name = "bitnami/postgresql" - # source_image = "bitnami/postgresql" - # source_registry = "public.ecr.aws" - # source_tag = var.postgresql_tag - # tag = var.postgresql_tag - # }, - # { - # enabled = true - # dest_path = null - # name = "gogatekeeper" - # source_image = "bitnami/keycloak-gatekeeper" - # source_registry = "public.ecr.aws" - # source_tag = var.gogatekeeper_tag - # tag = var.gogatekeeper_tag - # }, ] } diff --git a/keycloak-server-values.yaml b/keycloak-server-values.yaml index aaa8f6c..6fe67b7 100644 --- a/keycloak-server-values.yaml +++ b/keycloak-server-values.yaml @@ -20,12 +20,12 @@ extraEnv: | - name: KC_BOOTSTRAP_ADMIN_USERNAME valueFrom: secretKeyRef: - name: keycloak-admin-creds + name: keycloak-user-creds key: username - name: KC_BOOTSTRAP_ADMIN_PASSWORD valueFrom: secretKeyRef: - name: keycloak-admin-creds + name: keycloak-user-creds key: password - name: JAVA_OPTS_APPEND value: >- diff --git a/main.tf b/main.tf index 0b80697..468b14b 100644 --- a/main.tf +++ b/main.tf @@ -1,5 +1,5 @@ # main.tf -resource "random_uuid" "admin-secret" {} +resource "random_uuid" "user_secret" {} locals { public_hostname = format("%v.%v", var.keycloak_hostname, var.cluster_domain) @@ -9,17 +9,18 @@ locals { internal_port_number = "8080" admin_internal_port_number = "9000" - admin-client-id = "sso.admin" + user_client_id = "sso.user" + user_secret = "user-sso" secrets_job_script = < Date: Wed, 16 Apr 2025 11:36:21 -0400 Subject: [PATCH 09/67] Fix module references --- main.tf | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/main.tf b/main.tf index 468b14b..6757444 100644 --- a/main.tf +++ b/main.tf @@ -71,16 +71,13 @@ resource "kubernetes_namespace" "keycloak" { } module "service_account" { - #source = "git@github.it.census.gov:SOA/tfmod-config-job.git//service-account?ref=1.0.0" source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//service-account" namespace = kubernetes_namespace.keycloak.metadata[0].name } module "pre_install" { - #source = "git@github.it.census.gov:SOA/tfmod-config-job.git//config-job?ref=1.0.0" - # source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job?ref=feature-kiali-baseline" - source = "/data/terraform/workspaces/mcgin314/tfmod-config-job//config-job" + source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job" namespace = kubernetes_namespace.keycloak.metadata[0].name service_account_name = module.service_account.service_account_name @@ -130,9 +127,7 @@ data "kubernetes_secret" "db-secrets" { } module "keycloak_db_config" { - #source = "git@github.it.census.gov:SOA/tfmod-config-job.git//config-job?ref=1.0.0" - # source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job?ref=feature-kiali-baseline" - source = "/data/terraform/workspaces/mcgin314/tfmod-config-job//config-job" + source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job" depends_on = [ helm_release.keycloak-db ] @@ -180,8 +175,7 @@ resource "helm_release" "keycloak" { module "ingress_resources" { # depends_on = [helm_release.keycloak] # tflint-ignore: terraform_module_pinned_source - # source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-istio-service-ingress.git?ref=main" - source = "/data/terraform/workspaces/mcgin314/tfmod-istio-service-ingress" + source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-istio-service-ingress.git?ref=main" public_hostname = var.service_name public_domain = var.cluster_domain service_name = "keycloak-keycloakx-http" @@ -191,8 +185,7 @@ module "ingress_resources" { module "post_install" { depends_on = [ helm_release.keycloak ] - # source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job?ref=feature-kiali-baseline" - source = "/data/terraform/workspaces/mcgin314/tfmod-config-job//config-job" + source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job" namespace = kubernetes_namespace.keycloak.metadata[0].name service_account_name = module.service_account.service_account_name From 4ce631edc56f82d440c705813f92b0b847831db7 Mon Sep 17 00:00:00 2001 From: mcgin314 Date: Wed, 16 Apr 2025 11:57:30 -0400 Subject: [PATCH 10/67] Fix variables --- variables.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/variables.tf b/variables.tf index a4c12e7..60a8208 100644 --- a/variables.tf +++ b/variables.tf @@ -9,7 +9,7 @@ variable "profile" { default = "" } -variable "namespace" { +variable "keycloak_namespace" { description = "The namespace which will be created and into which keycloak will be deployed." type = string default = "keycloak" From 219e349f5e00299e21c207699397c89fc20a82b0 Mon Sep 17 00:00:00 2001 From: mcgin314 Date: Wed, 16 Apr 2025 12:54:20 -0400 Subject: [PATCH 11/67] Update documentation --- README.md | 4 ++++ simple-arch.svg | 36 ++++++++++++++++++++++++++++++++++++ 2 files changed, 40 insertions(+) create mode 100644 simple-arch.svg diff --git a/README.md b/README.md index bc977c9..63a9699 100644 --- a/README.md +++ b/README.md @@ -2,6 +2,10 @@ Terraform module for deploying and configuring Keycloak on EKS clusters. +Keycloak is a temporary OIDC solution to our clusters for enabling SSO login to the three web applications core to observability with the platform, ie. the Kubernetes Dashboard, Grafana and Kiali. Eventually, Keycloak will be replaced with OKTA provided OIDC, once TCO is ready for supporting this integration. Keycloak works in concert with GoGatekeeper that serves as an OIDC proxy fronting the web applications and validating the tokens originating from Keycloak. In our current configuration, we have a single generic user named `user` that acts as a master key for authenticating with Keycloak in the `cluster-user` realm, which is created by this module, and may access any of these applications. To retrieve the generic user password, run the following command: `kubectl get secret -n keycloak keycloak-user-creds -o jsonpath="{.data.password}" | base64 --decode ; echo` + +![Explanation of architecture](./simple-arch.svg "Explanation of architecture") + ## Overview - Deploys Keycloak identity and access management solution - Configures AWS integration for authentication diff --git a/simple-arch.svg b/simple-arch.svg new file mode 100644 index 0000000..e354988 --- /dev/null +++ b/simple-arch.svg @@ -0,0 +1,36 @@ + + + + + +
+ + + From d47d523440ddffe7dd86ca6f902a42a0633bd861 Mon Sep 17 00:00:00 2001 From: mcgin314 Date: Wed, 16 Apr 2025 14:51:32 -0400 Subject: [PATCH 12/67] Update documentation --- README.md | 9 +++++---- keycloak-gatekeeper.png | Bin 0 -> 102294 bytes 2 files changed, 5 insertions(+), 4 deletions(-) create mode 100644 keycloak-gatekeeper.png diff --git a/README.md b/README.md index 63a9699..9738de3 100644 --- a/README.md +++ b/README.md @@ -2,16 +2,17 @@ Terraform module for deploying and configuring Keycloak on EKS clusters. -Keycloak is a temporary OIDC solution to our clusters for enabling SSO login to the three web applications core to observability with the platform, ie. the Kubernetes Dashboard, Grafana and Kiali. Eventually, Keycloak will be replaced with OKTA provided OIDC, once TCO is ready for supporting this integration. Keycloak works in concert with GoGatekeeper that serves as an OIDC proxy fronting the web applications and validating the tokens originating from Keycloak. In our current configuration, we have a single generic user named `user` that acts as a master key for authenticating with Keycloak in the `cluster-user` realm, which is created by this module, and may access any of these applications. To retrieve the generic user password, run the following command: `kubectl get secret -n keycloak keycloak-user-creds -o jsonpath="{.data.password}" | base64 --decode ; echo` - -![Explanation of architecture](./simple-arch.svg "Explanation of architecture") - ## Overview - Deploys Keycloak identity and access management solution - Configures AWS integration for authentication - Sets up default realms and clients - Manages pod security and networking policies +Keycloak is a temporary OIDC solution to our clusters for enabling SSO login to the three web applications core to observability with the platform, ie. the Kubernetes Dashboard, Grafana and Kiali. Eventually, Keycloak will be replaced with OKTA provided OIDC, once TCO is ready for supporting this integration. Keycloak works in concert with GoGatekeeper that serves as an OIDC proxy fronting the web applications and validating the tokens originating from Keycloak. In our current configuration, we have a single generic user named `user` that acts as a master key for authenticating with Keycloak in the `cluster-user` realm, which is created by this module, and may access any of these applications. To retrieve the generic user password, run the following command: `kubectl get secret -n keycloak keycloak-user-creds -o jsonpath="{.data.password}" | base64 --decode ; echo` + +### Explanation of architecture +![Explanation of architecture](./keycloak-gatekeeper.png "Explanation of architecture") + ## Prerequisites - Kubernetes cluster (EKS) - Helm v3+ diff --git a/keycloak-gatekeeper.png b/keycloak-gatekeeper.png new file mode 100644 index 0000000000000000000000000000000000000000..c971ddf682fe26c7e16ecc4ffda9c55447791c1d GIT binary patch literal 102294 zcmcG#1yEdD*DXp28Ug_l+${ux1c%1mo#5{7jcagsmmrN3+?|l%5*l|1?(TM*oWnWa zck8{n@4b3|S5b6tc5jx=F~=Bltq?gGQRG*+ub`lykj2G>6riABl%SxXGZEk*SHiSq z8z8@4I4Fn;K$Q*SZ$m!7nD9&ULqSzWA>HZ0LOvtfim5q3L19un{k#xYAU}eFddw3S z;#YFf-dljx#h=RHJvz)urjV>NGIqijWVg#&d2g1gpdeLFby};^@G!QRaA5zl#tctp zj2Ssj5QW3oSVSC?iDvBaesNIjqgow>My$%@r9qVOB3`D}{_x#d2c{yQ(BCg^W44~> z_v3=E3sKSjdYz-cq<+5M`orhd-_WPO>pe?2IJb!0`tArwx1 zwqa%C-8mbaQt+Qwp=>M5p!=uG}or`$mkROJZw-xC97hp8H0iK570qgw>gd7DJ;MHIHNDSJ`Rp|^gjH) z#@0D82*27SFdpukVTz5u{Hj9Y+W8?|-3^P8hjl95!Q9Yu28Dv|dAI_DH?%0GZ%@7T z&sH?auhWgKO~iMWw#Ycx?`~D(&QAbL^@n1J*oc@QZ60}e60l9`i_0^CjIUm+jv17v zhB$rIc};pFQj=zCGQI4lZ#RkeZ_EH0_Q&kpj#?t%NiLEBlX-x~Az5ZE_e}X7(|Hx* zkC@%!nuUlR+6 z;;!H(h1IDzb+Q2PB3qcx9bfsE%#BBVh~2~@^QghONPh<;W?(-VLj}x3Z5CQG^HyNa z=&-->&G>99ivxGq48NQScwNT8u|L3k@0vhogw7=wwB|~NHm?z;`YFc`zfu>wk`Eh$ z=$bR<+l$p?FK;FR_+8*9@`e)JNWE>JuE@YgPb@3?1EJYkMTWghJkI?w7M?f0wChK0 z&ZyUqKxF8&ff%PDr5dg_v~9K#A)0smHM9t6bG~4t!->tW=Zyiq_lx>4bt>Pvt+2Vu z_eXbCZztzIPYFX)p{vH&t=cS#9yrqp^ARMKjyWDmFy9;1E^2crU*ovYWd9Xn%rG^3 zw0__EmvVJOD@wfkXr0E(=Jhtxd8n@SB%MfRe~W_Zq~V!%ysuHx$*LVg!UJ_$zWKqS zGZ$T5trp%#QMk?2Q8bU*j<~z2e?gNr_ZlQ(g?_Uw&PP6LmJ)y3L+nw5h*8h;Dylz; zFVtP1@cYC!^LE09_Zz!>fk3Ghut@yU-KSKd1t?KF%rCdQsPl@sepCX`L_K@eNQfJ~ z7p;dx0^?W$VYAAog1bHqq_6wJM0PtQe_BOl-;|l?I&c8?IgO5mrY9;{3oXD`K^VcT zMGlR+r6|Kc##t$#$U7mc;u%7aUrdaYiKy2ONu5iXyS~PFRM*Rw(V@W?1`WR)0ec>` zRAPOTwVI%iT&~#W3v&;Y*Af*gimNFp*t$z*Gu?p3sUPCsAlUrgyhnUzA?c`1gT7lM zMS~tNWTj*Vo-np#74p=(nu_l@o#d(EX@q@<5Iy(ccyFQR-h?MNw<94D?6^=6U+Akv zP%p@>Tw+IQju&Ixp0cIAvmWOto?LcY*T)){0hlJejdq9u18!1jXBG(8vYDb@JjZ;8 zqCC7x;jNQmBqh~OV0+b~R7TsRNnPhg&F&7nnls&(>JKkndE3wz*)G0U8)DhFyW@C# zL?OE^!OGrxn2Y9e29;&LrJu$0;U0UJ?|FS;V+It ztt9MKiqW_Gl0&tT6Bpl68cZ00F+YhG%^T{6)zPJx?GAucVORGzA-j1csUA)dI z1B_kWu5aMyv~~TRZAMW)osePW(tgX$h{-gSG5eW3qG^^7_r|QHcBlGLpzq64?p>m& z;|RBqXT(3#pnujwC*0LAY!!DI5zH zIGFz40_Yn&S3suC@%6_kmSnl(x9{!_k&TCs8w;>V9}85{iiSnFT;Wf=Tmn*dc)>>{ z%&8UxlHENU`s3i{!Nz;hVd>#fFpG3Zk6rz9iW^n49w!KsZ+}Fk#*6GY2qU2akJ^^9 zk@@eSS&6mjzNT~8H!-$8B)Azs2dQvIGkU^Q9Ri5j5`v!MRjkp4D|Uodq^1wv-I!5< z4nK%|n|el16g25K7?qLRER14F7sSm8Yo;O{m`hBM-G$tQg}-gjp}7zkkJL@7Ihx}> zFRsnpWZ)jw-2s80`8XuhSsfEXX_G!A5t8#z@d^r#bJp~qYGTdSxanQs^9zSIPsI6E z`;}f?TGR2bUmG+}SU(frfF``L`#IBm9-RLWiQzjP`fn z{p!7fU9WGzxN-ZHTxqdZN3Qf-`(;-nEO1#y@o+Up+jG49lER*B-ZuYPqdBy5SUp)g66Zz3@Y_l0-sDf;HFw5U zTkqE9nX#^&b-oeaq@jiVSjNqWI2tu(pJ>>>Cg{ES?uu|w#J{VkG3vNP{qF9@&2S!o z_ie;lbQY+H22g!-3G!G-sC00Qlqt|;SBB>R4HzK~Z!HUHQ_pJ8hoqNlf&3WC5MA9; zQf=By31j%3r|xVvi}uI2JH$>6@S=~i)es2G{4F%;JW3)vxEXYurSYk)1p2QHmOVFp zP$FHHW}-?*XnedS15jp}AB}2J9H+;D)dfu}AH)PF+PS|ajoi!&ta;fmK+k8%t<@$rU2CvplCSG3I*j{hApZi_yxwkvccE-D)uOTF`bhaOV zz;`V&z3X~~-@3vtly+}BLL;C$6n79#kxWV+j9O+cOoJ-WP=mJ4#v8sN%0|3BuRo2? zYUp*M=^x3Qb-=5`_T{ztjF_KF(tGhtPUw{r<8hB$iYsM8Uv6%38zyZ~AH1kcsCL`& zn*lwCSs-GpX_!tDow&jrLIN{sLpw?)+vU!_dlC`j6x^3vbNPqPAk=xS+?Qk*^GeKj zCj`uQONw3umCsst(^j7~ojbRO%pTH@_AF?nL9k-g&(`xG$z`k5D*@=YshH5G@&L-BveDd`c5&M8r4FHW@E zF@xZJFgC`=S?xu{%Xqye7%^s45nT-mF3HR6{h57)y)vGI3z`+Oh{DJ9Ig#z;5qj|F zKu~IwrJzKOn0U(D5I4b%c=U))@Mz~u#S z-HqKcxM*LTSQJ{Waj8*>{$o>S!R0s4jA4>PN|h8zFrNWmz+Wu$CPOKp?_oz6yY=p) z&rp8Jup@>QQU?d4ViGu-uPYh2^vkM1EP<$qk(@%EJS*CB$`!$qTJ&a!3CNN;KJcCx z^V2L{h>FW0E%r5dbMW0Vewtqkk*4pNhRL>%^jt|ZkP1T!V{2F#a75A*?e4v-3q>RX)sA~yLDK~ep>r-gUHX}me_@uqDK6#6-R-QNsG$g|&E zQ1~H3oI|HoPGu;jPWmR*!h`UYmlv&i<}CD7GX6rc^>)BzsslXXoZP?6N5~{^63c0e z_4AG3mK?Xo?m+bA{Xop|3WsTvO)W=I;H&49lEahmfkG(|J@G%k?DwUHjkGJ6@{n)w zP5CDW_xHC*o7>u7XuuS953=Q~imge9#q-rOcVcf&2D}t2h9^SyEU6l$qJtAq4CiK&L3*Sr477T>hEe|%X)(H zIqsN)i2WHVv1W5dd{}~A^;oQM@NFFh2U?lw=s+Kjl{m_RZmH6JjFAEzPI)tv6Q(h7 z#c`pvsdD7hKfqp4PuUZnlb9splviT1S%|+d7Hy$PNXlZ>bZb1LvXl4rtOnmgR%o1e z=>uo?qH9Eo;C;mBzeP@=?0H?k?88XeWa~D}<@gp|9K{FHPNeP8{A(MF=+hxdR4%y! z_x9tKI(QTo-ikc@ZMGpL*;={NofX2bVZUNT8oJkW_7k)KswBR#s>G!)-vNjfX8mU$ zRdd|Csjkk?dmDhP>R%TkAp=6{C}(A$&~_kScvCX6yBcfI{})5v>9$HEQVkoN+uZgH zEK%2!1?FC71ADLQ0Bx-}LxF}W3^nJBpki6xnN@8M)pe8Q%KpES3|fXAx)fFONx8_Uykd+P zIC}hRGk^~o&#Zr_2GIlrFy(FJ;5EN+Qvb!Tr}6+0$&@{1bv40RcsI@~f7`0!=p*t4 zU)hJWB3I&&5)*+$b2j)SjY#A)7cbh;x-yfVobR`W;+N1lLchzQRN#+pbFnvbeHYOWX1)b}5-1+( z1t_5ZxIN%^c(Jv^YBnXqqSzA){I)+gw&0eQs7n6IJ(gi4@i%xPwA54mcT#0R(fO(v zFyksq>|vxlfO{ff(%VWHv}my5bkx>LG(0*ZmZ}D`6xwA>M?w7zu^;rrn#rGZ&jr?q z=#J4_$8!RA5%liTTR3o8vLW4s+Ah2GpUEDRru3$XtOFek6Hx*U zJzVOnyM%=1ps9J^idP5L+wh($o&pnyB6kCwCtj{kfMtjPbU_TFsRHhk`$ zn|$cwCNixx3Yy zbl7d|^MfQ*YAc~tnprpqR7?jN{=~>7#;!x9`tnPgPB@t{dPH)(6 zap5>iP;%-qje%?Ju7}$DJmg zVod@oA{o3mhgVV{w6OSKyBA<0L1QWSoTtV^X63}2ou~sB9LS(KOO`VkrJNNlWn~3U z?)3emSi3UgzSs&Q&BvW^g4c&^WtGelY(^vlHitaL+VubsZ5_>3j-6S50WmbTE*$@h zQI#FI&8Q{&f>MNo-TVOMJHrKkD3$RVgpC*8j!Xdok0vT)`#0N#_m@fXM`63aPJX-> z!u9OE>c#g=2kTlcdTU1RlyjFSVf~am@P`m%h_bIEr_^sl)iiKe(a;F(pL@(s!ht|O zd(Q@OO+DtY{ETUvH*(bhK!?Dgl}Du!rR><1j~Px>4?v2{Grh+;J&!W(<&EfJA#vsu z8T6kjCg;VftJRxSLe;Qj-q#wTlJHdXV}aRf>z_UD>=v{t9E6MuYEbf(YDvM%0c5<= z1q2*aZcPwowBmWFTTnA(7DPJ}U>ZggGs{ZA9OKD+Z-u<`cuPx=yp71w7BAUNb||W{ zqd^ZqC%?91*v_;fyIuq}nhDEzwgJibj z!@5ZnHb)2C7pKD}3+i_EXB4$6IK~Ys7V^hPF+;bCS<6N_09KMfve})fvC%rH)Q6T= z>qKra5NDjRqZbWWyDDr=uBGIoBQ*{$@mEE{t=iF>txe9Af(*nz0S@f%jI7%lIeX z6kcDqx1a=EF6O)>j7ep6u*MG}NFmAy8y#pXErDTqFiSuw6MI>o@-?-*PCv-lu1Sc6`LV?HD@sK*K11%d+GD%EG-j{}Ja*d>EvXT=W(X5*&se zmSrh`#KAZt8Zc^UjV$S^I4$o~*N@q+J6xA%-!EJ#Nl#_#28$r_6hCz74*J#Og`Ow! z*53E$ho67k4xQdnW?!A0ajR&0BcuIE0$!Z_ig*n9@sth%0WnS!h9E6o={LugbfWI{ z{Q}OyGz%mpm5xy@yr-h<_QN*I_$hhrdzBkNQE0j0_t{U7xGW#h zh$L}c6!RpA)OKj+X)7I}6*{=YB&%pe7k3cJy7sN@z5Brt96%ae2MZwya&Fmn$T05z zVK55a53{ghK~&iI(*1k$_I9BpguVtVlsml0oZpk8D>^FXbY=)iY`GhA^quu5!6BZ2SZ!cAue~168ophMt(iY%KcA|##UVfLKj!So| zQ;G<|LK1O2TERxEm2t9nPr!j_z8FAMCdxr+_vkJm-!3m3+3s*a6JY50$9S8SwZW1t zZdCUuAGWVm!V%3vP@PFVSw*utL4j71i!Z>5N)19a7YItq%t4b0=f8zpNgN~y{50R5 zVuNtwv=`sSoidk4493M$1^+-byV&Idoc@EcURV&~@V9cZhGNy6$&rj9AHs>WYi5uS9v_uR1+&#t!3zOm5btIUoZeidR*mLQ$}xO18+&(9F{~4P`G} z?GhQJ#UQ>Zj*)(rW6T6q%Y=*bpztQjg+D|_VtcfEm{jK^5bhyO;kU9zhe#~)SVvP0|2!CqY-B`QMJ>%*dxSH0?pl?N+ zQCI-*-sj^q^$@qVq}rT+A_td!&A%iW=wqz*wsuRG}DHEGb+Adhgp1>MFa<%{s zzOTDJ&vy*kip@OIiaY^$IsLY1?e=Z@lIX{!DN;ueTA5v=sk>3qVjvkCMy0N5eE|Bj zddT3&V34;~%B(VBD$!iO*HnR4DTC{$tHFkxSTm69^bdH@R=BvWJRgh>l!BiUNzyD8xHR zUG4cW5Nery-bV|`g5Qk^{dnH%Ap8kPJXc3$y=Nv4hXJwI{&qdWTfS=My?ozx`KFV* z1R+<&8@VWqGG{$Rx`*bi)kRm#*U-`ty1l}(x1q$VUDZG+VTlYw?_&>;HY@+8WKm-N ztuo1a3j>5Rrj3pNhF82No1>C z4!<0i%pGKcGHJ%9K>e~?wtgu&)dbHGBL5XPSlg?R>AwsTp?^!aqiV9aaRg6Q$Aue$ zaF-Jlrpxj5`=eK_8H1d|6Lb05LH`;B$U+H3kn$nK49RY0y(p&_JozGTD@%~yESTsx z`#BEnJP4A#1AcY7Eu1rGqA>GTXz&9 z|5q!5c+!CF%!-B`_QjxKgNPBy=@^pZ#Z!;kxTF!@aUs!Afb8e3g`+@+T{89`nNMV@$BLi*L;=m}>;($v_jT!tyau!) zGePhm=>kiYWBoj&5|Tg|2@X3D9(_qPdTWPi(#g$01X1I*nE5ZA@K8e_rKZb;mtu{! z>7yA{Fq(-(A~!)MM3>lxDGz%_!7md2bzzwc$?0(;IyUT;<}a{|58dGE-cdrtgX1hD z#z5MPgiqo$%9;;SC_}YE+=``9uqSV*SGEy^W{~#Q@S7!S3l%de8Rirr4~4M&tdk4x ztmDgpb5=`nndz~(v%NyfU^(&JVdr;7=||WdIj>C!{-M6VBw9Vt@f(XOC^>+$5K*5e z03sI$&6J-;_GIpS;U*JLA{@nM%?KQGQHm_G`q9F#1^eOfpajk8DCfM?Jx#JG9f zT3{IoU5fw|(3+PwgL&I&tTnt*h5mnL4%6OaNWm3S-y7|WPo%7Wy`%do1LwI!D&%SY zDPE3a?*CSM2Nxzir(;sm9g62s3l4S*`MV(WN2=5RZKjVGEH)mcAtbS+P~m>)Q+#FD z2i8fW+Oc^a8u_m$pC{84nSUt+Zl)-XFa77U|LNI(gclmx|HMX$=hi@;9!r~_Jofj7 zjDr1#+e5a3Ev3Bt{NERIHf)OV!OsoM;Q@{ssdRE%)}`cVhr!ux(rz+j#V-H*XNngI zePQjvHG^DCL2d?{{U$haI57XGofXLZowo11A<^s1)j~M6*o;o(ZA$BPJLy$(CAfhu zBli`h0Ca4+G?n4{;_mwygu6(%6Ahy8`|7@} z=6C*Ab#W)dvsSge8TZ;4<7;McVQ0+m?}KP5A|h|N&w7_)*sOWx#fwZ!>3&8|(C4~* z*W`}$|1y1b!HfFps?uOW(zeLx!p04cL)gF(N`LNlB*z8J;l}wbVxs9xlpOziU|y8L z)pW{q+X?Isefd45xme=Bc&?cJtGU!lhkf+5DD0^HkJ`WHKFqXY4xM8FvSJexqWtC- zMb~38KJYeR@W?WCkF>}^Duj3gnYS5)huW8b*fGY52f|&)@G9CFla9IKL{|(oS2DRO z6N0Lsi0(FI$(T%yV3u<3!eJ7ha~qyepYqQc?ueEs@bi6U(`OgFE4CCX3k3(GJ!Jej zTIQT>lkf58A9zHHcMYoX%B8JltOwJS!)K~Zc9|*OKbHq^p_TW_g+=I*1Pr_NRb4BF zr7}{}zmEnBlbM!sztXWF!>40A5taH8ernUvsNw-_bjzA5NjR`AAs{J;F`H^`w-Vt@ zLd8PRB_iE9h{O{tzNuLz>8_Nt_xO0!(#t!is$XF+O84RDi$>_H;U}-#?1W$i^^L6kgHY9F433MkT(XL^cWreBk)sE; zJLvCw$nqphf#fb^6LI=G*yAwzJ6}No@yclS1g}J8e;(N}*$o>J2^%lkX2|-%KX2I* z>*|Gb-*T%<@jp@v(GlI!xDqn8%{WqSe6N9{YN$(9@9?x6;#l*X>( zMW*)7+mT29dV2jBYW73!Q_j7)tHd&t_|!~;;q6aelftU4YhJbUHb5vc?=>MU^o=3! zJN&ez+oZ;L`B|f@1~t{=?_Vn+K@Hfad`LFbn1LmW;^>a+qr=Xda=owos(+srwVfsF z#LuAIegn05KgDfY%neby$?Tg7mY$DlTHM>eE-)%)u3UJgr^oRQ&eXC0E)4nCXV<(~ zdYn?0a-JPbkK@FzUMZQ9`pGheG?bp%xK&m1$@Lfuh=EVCA0UR9084bGlmw8ydBO0VsF7n7Qa95fcOPX8c&NyBV@(zt;S(0JaO$1F7OdCzQ# zbV-v{rA2#LD@mDJq?i;R8yTSDeY0mn_QQB=B8sl^q&Xz!Q4IMI@nFG{HXh6%Z%P7?~N^bhqm{+r(({y=dwIA z^w3i`v{7U!meA?K#uYw-B@f}cwP{5SQD00Jq7G7;Bn?Tf!E_-9ojry_Nn9!P$OHZC z+8>rDTJL%py=+Pj_IqZ7_B4uDdx=ZU`jW1z($BiddW?pWI-+V@EF~{y+GsuT&DHu; zZbNyMQxaE`sAW?d%dB6kNRKUVHfS&ug#0PRnj&B)q=m|U<%J6?Ko%4+W_*RjWVcu& z;IRTmygEpTV`%);rFk;W^)J90%fKVb;Lp}+It$~!cCmBmk$`FWHr;yg`CWK=@czfl zps@^pEsMl0x^U-jp0K$Ebiek?A(^9M|K21fKGoOxYm=xIZ6NJHrocmRNE4c>yduPj zl%{Fj1esuE)!jikm3krm4Rm0}lM08Sj~_BWsjRn$i+u==u;DH9qiUXNja)mUsbNvx zC3H*VzIC6rWVLkL{Mw7hBQxZUJYjyTz?f&b1h@7YFM<^qF3pnX)-G(2zgx`9-wuDs zeak6E^r?BOt+>2vC8Ok*s@4}l&cv=Uu+Nv@;x{hMiW+rzr}-EL7ke|tC={gsz-mtS z283b2<{qC9ykA~D4P$UsZQ>|+6ubP%5n$kW*^LtPwwkU5aSTfOu?`0dtbI^B6H#IQ2-2H4B zWT1g-{#8Q? z`({-XX-O8gE7|)k>vSgjFaWFtNGQC1XgVoAxU%@hU+{&Ng3`5;EW=Z`^XphF`aO36s^W%D-o^3j?vWYJ+7bu66M$~qJ3)-@f;QKYJYL)Ny0aH-xC;x(C^q$IvtO?dX z|AFskjy%lE#o@6^?7K`%0+;9(G4k-}ej?soQb-6b@aW9)AznuS1GJY8eV67!3)My8 zwvA_YP8xRICNBi|+ZW5%23QT-!FiR!`RA2Fq)jH7p@MVg_BozkH=Jl0X>TEPZgr;h z;&a00=q)nr(0VgQbIZwKWf;fwA4ut43q6b4s_NV3-1kjiH}l% zXQAVbP^qfq9H%MAh3L-KGGoTQO{!MsEM{f1dppt@n0$b#Hkm{hsmNq6@9s!cSMGuK zP-l!k+lanmD^{+;Zk&3MsCIFEa{ripLDI|H$iezr~Q&~7P}Yoef$F;M-! zBPAIH8D5Z6Dc6A;xNC$XX(4caWfkqnJsN_qrFUrT4OTeCl1>JTzoYaf1K9K)K7SRm zUcp`~F^IF$2&K&Q%@kV=3Zo9`hQv8gyx5g7x% zey77fo;oB@a3fYEBynZcSnns2cXtyT;iy%Tqv#h>g>&PnREp`N$yM{_vbZwJJXun6 z9R*?21xOc)dBMZ|I~11&*Qb{`#g1&Tv11hwxnOEm$T$T}9ktidkM&rJmrlTW@3BDO z0PLgtLzb+>zpz_LvrM->03DD4bJO~v9MXS5fa5G((;l^y_MI@uXd{Kg1WQ(u+o{w8 zEv)Q5J!P!^e_Uh_u70sOobl5~;>$mt69i%Y zPipvoTjm0io4T|qG>JptBP1~c6}^-s(_Sp&Gt zffSOT(si;43~coDv&d0ONqI8VuAEBqv0<-4N1udZYX zN>2K>J(M7nGIFdnGWXvu(^_;6C{K+*7I_-(QJ*mi`Tj`KU$cS1BQ_f-1mLT0oZQIb zuCBeY%b{at!%w@Vb2`8L=`ZTTtXoZdJn1+%v|`C*BNj#xw3#)o2iu#G^l#WPXkUT#fBv1e49*|t2~%h#PeDn_Jbx$$&7NS;*p z$%wrXTA18N7@s2B<8^o6;fTX8q7uX7K<9{ipUm;}D987Ig0vuS-4<~cRH;T^a`75Q zMFe1PEF~ymU6%6aG>8fGlT37!Amt%4&r^~R%uNw|`SZY*I4=w8`gG&32QmNp(gYf+LS7}Aju7tu1q zv?3$P#YY62-VJt9^17pvU4P`Hk@w#SMR+4?AwtktOdRPCK^e+ zrk7jo$FJbT8aTuY?^HiGNJ0u|#))FmV~Hfre?Y|BtC+zzx7}ezllT5JERiK%15P!c zKff3)OcC_+CF2mUFNx)_PKWfDnH{zZh!C(l(eNT$jOn}E5i#y53HmWfVAf6OtL^2G zikZEg0s_|aHybrwi7-KAuudAU(jy(&_snc(nU)=mi|yWP4&x^zK$xw^IeruAtLhusfijoB#;)D4; z3{+912255kpUFY`iU#6%s~21rUbps6?D$2t9QM&`)N-p_+)jY1aSzg*)jy#CC|as} zxmZjs)P=?r1jnS}2C&bUo?M`Li$)R4xQ zJmE&IQYtbxdg70m-%{&@+^y}6eBi!8#Z=(ev)Lv3xVm(lu{3Y6;aIWJ*EIQQUyx1j z*7tq`Juo#8PV*>5cKaT|g1axyRjbc_(y7#_d9I9owDJu|P6N-J%|>u_m>aTWMpMut zYqGL|9FgO9IGhq~p^!b=!oV?fm%CfwEhRd({98A2#OvnryKNPF$4r^sfZ5GmE;1vU zkA98*3E4@}c1fMRtlh_B-5$i~$6a_d!isZnT31U%O`!1=I-*P_t*=}Fc;>P?%Wjy() zUqXrKBx5&ChDrXn*A|E~L4@J)mC>)?d%ix=p)X(>Tn{HfKkvX}_ZJzFP-1HhHXaet zq74ZS{BsB`klovWta!3ibb1aARgAffZ#g+j*qMCmq*mt<{mtFlfdMp5?8AczZ%}*t zi9~&#Y?Ir?e*LUu8U9Gcyyo4Wq)zwj{@n3&Y|@Zs4ZK0yW6H?3UCzBBcygl~%k)GDE0dSwkPrGP`b#2m+dbgcSP*nWgRt)#04{Rx5U z+Og(p4zBlOy*z=7fti$&efAq!eKqfPUU%Zr@C(jC*lD}3@)DgtnWb~MY2lNEFhw~1 zJdtHQA-ZosQ7>Jrn;6_*45dwDa6d6j=XH-v8JiJy7?D3UPAgh% z-f20lG@YcGf4r-vMEzK;cvN#$DB&51bHZ-q>GC8YbHI@$*etY;N*f+@`3(IH4$z1$VMN~_myB= z0doXW?AN5|C}h<9(HHAR@@nk{ztTQ=sfL*{4y2k4vLz*%Ww2sa+2=6uw)nm*w9yKD zKLSWpC&3k%{y>X1iaMe0_70iTDYfVaIfW4DN1x)O!y7`^ZDC0Fkm>I>oB?tqzL6vM zXOtfZm4hE|FP!Jb6ebD^CM-dq{-LFZd^#gi-M6=Ub_seO>2_caW zIi5K8Y>RZeg_U>vQ=8}6L#w_8L-;M)F5EmaiAjucWCm5;+NeNwcec(A%cUURgey&mR1*{P{+pO>Do);FQ>y z(Z$d+{qbKHJT1QH2~>Kxq=31nT0HX)rSb)zM8Tk;@nw=1C{(oIxH{?IeO1S;_h+F~2JXr$oT`vTgU>|VV^GNq zbraA-kcfK?3qUbP*Pb8B*+ci|>VLNy9WF<(X?KNU3{+U{ViMdH+7ybiV;`t$*{I4w zf)=4V z)>N+}A+z9gQ+OjHArhNS=_tz&W^okUmAHa7a$`ly;C^BYxB|sfR{rg6i&Dru3MYaR zK4NbGED;%ai3!@yA{ZE{MJNghJv-Yb3rk-+g1Wp{}O@b{@Qlz$BoiK z{u;QdbJMNB#1E-sF~m>t`hE-IEtr!Cp^wpvpN_7PPwk=}&GyEfQPDi!=`T6CY}L3dliAR|Snr!_8(JHbZhXj+ zkzy<k^arWd~#}a1ug=TAQflN^B_IVMzftMzskADXmN`Ejt!l-7CEA)h!q5 zVAn+l(2j1;xpMu3wbez8XLY4h9Oim90)dgk6J!=R28qK=W6FWG{m6sRXf1u$23){dm*u zb>`2oB|kqoF2rme4%9AKrznD~%qiZ8J%e8JZZ0*6L?(FYd`=Pf%Y&cQBRqb*_uFq= z4raVpd|<%mC*2;`W~JtNfVeQK}6sQU&F7*zf0bG z?t6Q2xXdcb3s?~<(dd}v2b+F~)i!fVxaaKOIZ!FO0^^DxBIW)FNd45WvE>h=0NTtT zn5)yfjr>+vTr5P6&YJk^quSe(Y6DBF&r#`-NpnG(VrL@=w?e40IsIygO(8XFg6*mtc_Xi)5>}r`_fzN5gPzd)j$v=UQE-SU zv0`%n%Bx@^!;tk-y@FmQvFYkgd4$fKsOYiogp5D{#pMWD~1A?l0bK*JxF ztS&l>S6Osj6*;UD#+O(xkx)poT%TPw8+n7viEF-ZYF*K_Ik6Jt6_-jVs4nt)8%N&I zu*l9>iKtvYN0=Z<^A(2-P7#s9tM2y(t>Fwh-6vguM{;Mz4SG#~Sft^uv+Zg?Sw{E- zqlo(YG`?H26HWYVE6`WEzaPA5{_5Qyw+-5eh7K0?Awp&|vO z{Y3qlUF8r#U>vq0M@6AeNgMMo~ zi%;Gl=QZYV)f%T6Y9N`AaIsB|3xJ2pL~Y2bw948Lij#)qE&H!RXje!qp_j zme{8l!vYoYY6w3^F$vIu3cESTqA29ZdUEwRO%?$DxsD>GWnnS&+iPp@XtX^j=-Pi%zb4Wy-JIF)NtCOE{^*p3*LNUq3jiC|3&rz2u?K)8 z^C53={yqHQJNYI1`~tl-3M|M<#N9*r{D_Hh{(ioTbrpU7uh-yhGw_MR8NN5|l2i#2Huct104%bOe)b@%h#SRat#QnqzA~eU-7`8($Wyxcc&AMtN8?l+rCw(X25N zY`Q<8q7!COeoG7ngCllr;FJK+8U)+q&S;vE_zCZGgq}_njH+ebEf^u(P9xBsx7UpR z?ET8oC51MsiykIiQL@);YN|DQ98JiUNbEBaC}CibOP2ti++gs767k`Kf9c5Ffq<&o z`Qp0LC;}->rI}%TPDoZdEIUiA7&>K2a(%lJMF^)A7LmYo^qN)EWt5`fViu3VwO@&V zJ!VR%^#j3}x#f8sdFx|ChAYG-9AQsEW=LUDg_F|O|J{10F zJ-FCpugSCH6Q&X_b513(Q@jVVbmn*m*B9t1b25|Z1Lb4g1fr~hsE9D-RG_PN;#Im}evC*s(=M zf47A!@>b_4na#cZ>Ywv&g*64A+LK_ubG}e`FuEv0?`s<&-{@ZPH&zfCDx&p(p-T9W za;wRgAf_sdNUMKl3fTcC!=J}-&>K#bU|K&1{N?>qf*goX3On;5+Dr5{fy~20_1~Wq zxCa85QiAqzjPEbwkg!b0w8wIhA@IIA%vJ!~W`-H#=O`Gu8TDXb>PKMoo@#yI!Uv;G z+dsT{T&bWpnwnC*`>_NINfvwID*z{Op$xrWFd1AYFeLYdv{eoh;d>dB{54fe0?zQ< z(LDm~nqCX?-rWe6nkIgw$R$PR!{n%|va{NGihH!L`Pr|+)3f7g1e&cJ{oLNiTo2V1 zzQLlRDJA(Voq$cBm}pH0+IFs2_)^FL+JvK5aX9urCz6HQ$~~8rhD-bbhQnVSN1x(cR#JqopU_e5m|lbP4P%1B0dHe1ZlI+-WhcQ)7<=R2gWioaZcXB&Q+uaWQ}q<;d+sZO#EEb70DuDP!cCL}Rvc=N3& zAL)D<0*HROdlPe&ypa>xd%KN!`0MiJzi+TPfWP*h|FcT^#5RbtA*H*W$T)9N9-l(2 z6CeU{!Fc=)aiTgnfNm%_4heXLidQ=?gmhP8R=bjnayuYQ`UNc66daK!JZ+{eBcUqh z&eaRok`o2LUFQd!2{_3d#}l!cdJJ?T zN5PAUxM<|lt?K|fQUvzUERHzS$?11-jh&BAJ^Vre6zflrL^>N?gBr}n#zwv}6Tu}y z*yI*uKVo^6nr94}4PSuQ5D%YsTXFJ8Z6QjwLu-qq#|SoFoot!*qM<EjTM zGN(^Srg38dMPSN=MqqJ)PAR26D8h>D)=LC5@VTe&eLZXeX7pX<{qgXGQQ+~?ghPV! zX3lN}&QPN<1ETzPM|iOarlBbmis!Lqt}iVwJ>01$_t@t&izYEIvCeNGLUe!mnC{0A zFSszqY43-Z?vn#lc7TbkW-EcWhs>)^&Pr`?z)`8DSPrTU+!QnidgXDzF-)UO{rr^v zQ$xzFAUZ*W3gv+?u(PHN`SCcAy-^=Y9cd#~YQE9Xyd%{aS$JEIvNqAciuu#Q&)ahq z9q;Z;c3HM1dklRz3ZdHVOHbEfoV>x(1BvlJGEym|$FQ5BUmV-&j1lEf?!VBjX|W1K z-k^b_%&#+#kL{xY`GB69QRYq}()T_ZHs@lW1zEg)PX+#pH$2$iRF;7&)ldC^LfF{@ z*c2&l?ycXG$ys!TZ(Ghw|DJ1(lqn0zrFg{Ktr-fpOu_21BA~{b+6)RlL5Tx>&%}U8 z-~%()ifTeT>SK}hv%W-H`^RH)Q6;dbP!~TFn8VfPPt!b?l4P*4u61uf2{z@QEk&M+ zbNP4Hc)QexW;lAf)&cmIWX{WZ_|G+L`=p-wvLyKSg=5b=MysYas}NWno}b>o*q8un zCyI?MxA_K~t0)`N^W@ff=9w#t`(XjwzeLszOtTh5A=in;T&Z4vvsrOxuXobwt~fc0 zW}C(uN(O){IzQ5P?(7&gO~&I!7grkx^qc(0-o{TJIuyqmqWQ+PcJ3s0uG$>BeUbkX z9Vc*A4b)4EcXEqb!w(jlQqnu#{F1z7@){TSdKIqg-tL}DzWm38xq2ChGn|A?*VuS_ z@%&=*jLmoCSr+Fg)_?wcC&n_-$%+O1a1)mOLhF1LoiFPFP^Y33W^TQ4Uh{h{jmeMf z$bBLv5AJB%w?#uv)ca+#0?r7->#Z-)d%?tuK_h^2<~5?V zY-h2281VFSX+Ugcx*x*08zlnkIrVGGL&4>2zdE5dbw7H3)1fLLoK6CHw_u3KTOq>ngFx-l+lTFrD7}F@$|wo=~eUE z_Kq?l7K2F^e+3pETpA|$--@><+59qEBvxq5=B)j^LkY~Nb{wvN?M#A9+gBk5njrph z9x46iFL|YnmWOjr&F0gO3-vbNHkvX==MG+Ua=?UNzM8TiQyZXDWe8^QG*$I2^uCvr z@CDJZ_oXRc0z1lT90Mi~7FSbEle|=ZU;fC^6jJ~Z*9hiBKiMo}+@{@(;e9B^CF5dR zT>oH&-wC@+wyrMsXYY!k`Y&}u`LfFZtCK44AmklM_%}oZXU9F*Odw2 zt)rwz9_u#GcQYqM#x6S*8vW)4fHXO9s0~8fK~JhmaP;4Kl)d|*pMl`On?toGY&2XlQgE zZ(Q8r$b026Gv7PZYB@e;Fbxxo5q$rI{^>CVKvBp+MSvtbFBTK+UD#MTmtCmlwB`7o zj||aG5c#CgUe!j*i6{NZd~FY{1daL&VYJc6(62vx?}%evMJ}uoC(O@Sa9cXB`Bm@b z2lhplc$6L3Xyu#p`;reYlF5B#^d@7oaz_p5-X7mBPkN!3pvqeeg?yl)Fy5J;stNC) z-9M%=ySiOW{Z~$tr#xCthgKu{ddI6+zH93X*GTp>I$aL7l@+_1ctpRNuN~#E_?*<-z2z*{zxwt-FAuo# zM+?8~V2$^%fu=9OA9Risu5`%yyW+n0lHaWy?1GxBiafr7IU^Yzs{?bgpzkW@MUY=U zv|2Hm@>IBqGU@WmRD_=tc;?InLSzId)9t(b5?RyY#C5S^u0o^!w=KxoCoL16qXZwe z0ry@1?TYGl3)Capy(|zG4GKfv(Or?2EBaM0&u9|;3qiV)EMji-egXQYj6|*gMr5Xj zls_K?ix`w3Wb0W-s{vJU@Q$yaXm!_}Ubh=l>s>zps%sa+O5l;96!I+{A?r@l4pfS> zc=c7*=FKEkIsP3IW|AzTG7ItU0JS38lic>(GZ&@Vl8!n<-i(UmnlrvzD$<&X*{2X2 zb2S+d1}8L0D!m`0cHFHn4A_=AM<?K3<0cu99?qv4K zQs~Gx3oo^`3gXdhv##P>*Jm`B%51y51>oswt@i9bklm1=mXM7Ug%f^$RU>qS)Vth3 zHVNqiAtrq9BpVzhwt!Ph40#ny*{0(S^|YSJ4K*1^uXuHgay0tZT$qbL;D&lzShLmOP#AKurUO@yw5tt+w({d~XqPY0fvi2pA^qX+CL& zT57TUCPi{Mf>;R_3Mw%=tGb4SEfF+#z1z27Shw|xq@8U6@q!pAUIA9p_RkVVH~k{> zUn%n`0Q!|8aku2frlOa5((LxkRF9{lS)0-{ZR+e(%PJM#*D zAwidgFem^Ibl&7B@#sZ&HWD|z@QZbdeFp9%sATs*|DA#d_Md!fM&|t*tl{rBbrq ze0QqJyS4dYzu9qh73I0rYDv|LH-@;H6b{Mthc<_Y9ci%8MOE1WU9OSP5Q|<5f>~9N z<@918q9IbrX2q2yEUpjkw*wcE71l$eKCex6%(qRXukT|^sg>ZgM@H83>jA@DmN!_| z12y`0eh89P2o`PpsY+NU3*0Z406G84>hiYznf++M$t}gwNSg|0O9KfnHwx`3yG+1c z)j7T>iZ!WpP-L)*F4t5oX^XP&#;^I_*!j1F_ss9_b9|*LwoMZ*Y-aQzxj3Vlov7R9$b}F2;(Nna3vKl|o{21=ATwfAJ2^f- z;V13!xXg#6hk;=L9`*CN18IFWl$!n_nc8@@GfDX-U@pAS_(@Y|0ZUWtXu z-jL4^<~M@TyY0mY;mO~_JtOad!rBG!G>{XwTxQQ|q{qd5YcXBhtc3qUZ8JC%R~VG2 zipq^I1Tf4jq}VLJ<53QZ$7g>1rH_nO-2drTnbMSN+Rbh}%}G-c$CT!miZ;>oyfxBC zsMUYP4qGzw4^C;wtFJ3`6z=PG7bUq;CANq}icJ0>Gs?3flaNU13M_>5P@0Bd z{Yjjm*XKH0i4yt!=sFEw6^2Q%G*+DwXL-Z52yt2_EPX6}BB$u|fO<3fOdat%hnAa{7f3DSvPOcYCI(!;7Xebx?-g}{-_j#mVnY8A0scjl*B1c0=FXgf#SG~Xd-z&Y5(fmN1Dc7A$5%*N}s(Xeo) zcfK)k=L_MRMRqBI@LjhFf>LpE(JVTV^5B-%0rdd`2pxnFr_Pje*Hmm{9m*$3cT2mv zUb>;?JT`Ne)^I(qZqu+1SQJ~huecVxiPb3`(x!O>>eS2|Eu1We2ui*8dcw|4OAEpUCS+6jU(0bb)(l(8+iOW12!0Z|#=nxN!rv-uW?=o?17CYq4>e zihFt7pp<28tHW_X>ga_(%4!#ibtu5>cE4N2Q!y<~)=Pg$BbXyoWAR%Eqw?M5AhZpD zLfHdL2eNE51;8Spib!9Gv?-_k`-OmVRf->&xXbuw(abf2ArOYnoIDWr#~{55Er7eY zVs8jh@~2o6i@naU(EhqLBjq5V2e};Ba%e00hssa5{891?V|f!Tz@V6zhPUM5RhBEa zLuLx#x_wXH*`?vAf%#}I$tt<9{N%9%WPXU8zDqTqg&**erTc=KKg5+_q$IsgAw4A_ zn}(BT*)V9{c&zb_aOr`^jcLv;S!AkZG{!WkLdp5n%o{s9$(D8B#OPUgo)2Qr5An%& zpR7Be1F<2ukB6O!_#QjoYI1G-lU&6c2>vag$HT?bb8vgS$<;dDEK8?tUuLHx=-DQv zC=*rSX(x`XakG4AsBSGGo&$a=g-3karFus&ZOj(9(>^}JgiooisVk}~o(1 z+K7VlgL(ZhHNlq2r?Sk{1ANr#q2NH?rR|a!u@fJ!I4-B0nkUz2?@#(eE7x z4lhEbcVO57J+ox-1d*Pe=4i5C$tzX@R>^ON%=r|7DAo_UO)P`ttI71~-)B;6a$S4q z=h^o7+5LpETM}l(R1sBH5;ENxYUMf|E}v5>6lS_KlU#F1n=zMD5mKm7C_%Qx(^s!G zgdqK5tm}4W7RS;%^Vr`$FYK4kQ=|P=97n*EShe*V3Mh}Rpn(5zSXhur%|^_i26tS6 zY2RBX2zkJJ#dC5H+9!-aKF23Q#{+=|S%D@9%xT%bL=E#i^=D~j>hKi|DM57;f%TLS z0{4u(@HGerIgKIEP8F4FNZX^7QRWtiNy>)3`TiEicD{xP^z(5PX5XxyQCyF4c4Q{P zBF2QL=Oja-$fw}>Xbz6ansd3O3_$m5IX0iR{^}rMKN0*$T4pXO0I46G0PWl&o>xDFTq|9JqYI$}BofR+fwU|$ru6SJ=NyGGg zmp)BfL*=(f;@wENC;@oP6D+754j zMY+ldCBUaxt;WgS)iV0dk5Sn;^Qoyvpxovc%@Ku?dGoq8qfzbs^L! zFW!di?|c;w@$F|~k-v~L=iKMUYjC#C+E^H-D0$ij1(i}ryY<23eerGFbjuK6`A*6) zP5(bocv~fjAPh z#;_kIpxRWlD`n=G8Q?tp<=(r!k2|_1_EhSm(($!hZPKLl<4!we%zDcRwZ9oiA+wGgXH=7ED$nx7T5T61#W2I!>aALy?jXbp-Czpa)xorf|y>#qp zdH>A`9#get3lwEp@#6FP`+i7FR+WL=zD>vZN7~l3_n;Ny!G6)-l8M=S-Tqm8%!ZXi z!YwNYU)W6mLML@K>h+Zrp{yh+23cJ+=#C*GNsp==p3#F2vKrt_8H+_bxVp7=fQ|Cy z(+pyc1k}k{1rJEiREK2#T>K9uSU9x0rU+lm2vx^)g4nSc6M#=YC}UvaUd&Y>J94-K zGqm|@JkkN;Jj`VV7}ku+kX}c>T2o={@Y+ZlUG&c*yxPwx*j(7z(&K8!HHRITsM|w^ zq@cdoxy!Uap&F4TrO@Aajns`AQjadeR%r|vYVHtHk7*26*5t|R#!zTh@7` z=}0@dq1H;nNWX2jou231Q}z#j*4Q}{MBy$EJ_SH;*Y`-B5Y*WB7t1VGi}a^c;_sLy zrdYlR#o7F8A3T$h(u7}+% z?QYmT^5swwG883Sa90}Z3QEFrWb6!{d039;5h-Mpr3X~f&uVNVE_fkVj&tixU24@A zbwhR;xblHt7Nd1)hIU@ttm<==_*|!U(oM4IA{4mjr{2NDoQO%QK48A1l1@B&}q=Y~g9-BXcSRG_AL@yVUXJjzv#`1nxsg7ODgs zfhvVr2WNcq-4fp^Hc&Dh(T;hC2c1y|LDjiug!@}tH12k zjjfkJF^l~vVso$o6aRo5_G|edi$o2e#rRY%&4i7(+4y^-e``V7zXY5|lGaa4?-fq= zm7%Br7;}ALu!^{sbdnD$^DtNZPD*#fNUJnI3brStjr3@RH#hmu@>_96_~&<$!#|;(j6Nu!G`*4nC@$0xi_v)i`F~p&#t?DJg{T4%9{--i3Z#z;@EWutvD?Qz z+o%1TxNr&Vb@b>aJwg|48%gfQkQMnmW8J-eBDNwK|0hx1F!B1!<#VJ*;Wbe!%C`eW zO3$KII%N;UtIQt>A6s)5Zj+8#?%}S|Ou&2z@$^zN(#4$O&}i&pp70%grKl4r*#;=z zq6~E3fO5oERK=sSP*s!+G{R%8iQkd+z2vX_cJeZNK82YSf!IyFef1nBd# zd8Z+muCTB#@Cv(qBhGG-fUqtUFElQej6=%79XqReKD4$=pVh$e)q>T~f7p8`W>G~| z)x@0edaSPQ;b`6VQ^M1jGHLyl?Y!kvQAnirH+EDl1?kY$9$JXe%)hAZVPg9-hhuE6 zLwN6QK~%cu^`#<`RFHbe5dKHK8+cP-zFXBX@uuc*Ij1}==6epoN&CQ3wVl)oMS{VH z;=XWouY}OYVpt*6eQBN?Y=nec5MS(x*#3CD!PhzTU^hKY(?C-eq}U4Ifpe)9$q2{v zDLy~jZtRYD(-cYAoqIOBOdW^vOcLu<)*lEB>NoZOZJ(o_?*y93O{m3l5eQt{gw)9f zG{rX&CyO>XDsY0%^3G$>X8o?VS;lfRVgE9JPU)i#AQRdUnC?)@nWBrwrVnf*;BdRE z<0Y!)&w+&U)OCF<++r;(#Yf;L$>K9?=R2R}JxG5tPk`|JJxi1n=8HlIhWtKSnmk%t zc2Q~%iKOI3?N2j=Dq9cL)wu;?h(ViEv%~=PIU|mWj)tZNay;ekL3%A=2JpGmPS1~Z z%Z8Q9u)Gq=^na&8#g+rCZi*-v`h!w+!>B`#5UjgX*TRAlN8x7>|NizRShi1%3tuQHu|X!le6Yy{;c8{ZTzOywciYo$Sk`ccr_dP9Q)z zCYWoA&nh+OnE@YEv^0wvoM)Aru$QjcT_YknrfE-?C9CNOsRdjr7OTU$bMuPy&6RRP zDkFBr=gOlb3d0fLp*B4}ksWo+7k3Y-IOEb0U5%Jf{q|e;=kGQu~nlFm>s*{pYh z2uzif?6h-nA4+-|O_K3JZZOmj1+@g#H*ZLAT77+nAosF#qMS7#IHG3K23DY5k=+<~%7EMmKOs}Qc#V_g*+siU4gmgS@j;$Lb8CLHl4 z$TAf-Ep?wSq72uAopz|ph&b{o4$3z8onua$sJMits zwtrfNOsU!VsH85Z<|?CQCg&Oy)6*hy;1Ky9bP9RX3hUx9>jdm}Y#@IPnkf;{C-!M{ zLjl_opqCZ2=O)c5fGCI2Emhgqeq>0~5tZC~(1X4!@{pxwr!YO)i zP%HZ6CMLzU{ytiKfI4pqEqbXr=7sAAVkGVw4DRTZ#C610W$l*y!G52<>aQv%3`o7c z<@*JtW&vMW?S-_pw7&h^oct`D{zHJdFqq)`Hm$S!_leSz{LkiL-tRxw2-PgY;tj0~ zMEZ%2Y+F3QAJN?wpvuHjhR{kP%JhY|C$Ly*B0am)B5rrkq~F;`px6gtiS2(0+;YzG|=Q5=mUbM|B71K;IH)woxNv4Q=Qq+yksaRA-3@2I1c~U&31ytM7cE+ z-F#qj{GjPR5kpr4G*_I+(cjtJ+^FvtZaN(WB<2)gC@Rs*@g%BE621er3kfoA$P|1Y z3jVFaF0uY`SQ>p&I5E=x_;dS>C{!Ek@)hZJ$5(!ZEg?LT4;7zlVWrN+<(;(q=85BY z?bF(@N(y@rwxl>k30U4fcc?^v3$7OiB; zXs^7Iy>uueF?tKvaB0T~NzD$>+K+Pb_7twx)Dab~zYJzCGalPc$Oa|1^qyxeAxsGCP85~>C^T0}7+;;*@ z>E7o`Xz%WghQSppY4^?9$f#oVL4Z4%DEY2}swF>GG*+z5UUMh<1TQl3a|ijCewxXW zrx@c7VJhP;;#!Y;2S&rY+=MBPy|6K!ui^b|bgeRTg9abXZ`@YNZ)e1tTgPHET|6DPfW z()6fMO)LW566nJf)2M#9O5o?H&b!?i%H#N$u`_U2fuks3=!RY~*ScuG9xLMVJHy*# z2Bk`m1GVFUa7?rFS%nivy+&;^HYS`8nmK~Y#)_}9Z*PBJ*dI%{;)d;ADHG8-t=wsvmCtXIR+P%zF6VvT!J;3wlv6pVPc$Ex!?R>YD&+mfeBIG$1ErFusO*HW%9633e z3|`T{8gF+EWNmPXLGs?KXIYRV+f;XN8zFIf??KH&%qewA~AIQvh7Q>$i zZ5U3=Xf+~W-97W*4dNQ;3ajh*FnF2UGgBoE_q0Fji*(7hbr@C}pRUYnH#&oIO*@sM zJrWsdK;caoP=^6CPCbYU6#Pg zi~_tJj-R0`nm@?J&>8wP3lg=vqaBGu^I??;36h)?az=9(l>Rei8<=gmNLnJ!}XcUru|2 zFKf8$54Wmj0!)e;IIW0lRCEe^D)uh0IL|h0OJZvTG=I6(F+oT;FWa3@n8H@k+n=fY zH8c!$$!oMW(eBdBTCl!r$En%T4T-mr)Z1qaeGhF-7F`h>&hp(B>I9V%(?w8pVh}4q zE+}xaIR@p4CaU#udnWv=p>9@h}8)& z(Zl{;luaUlFPF8|1usXT?VhqQh@l@(FKt!)pOUc;rhVz*7@8=yjPnle4ni)Qj@WBI zJb!$$K9Usq9y^NiZK>8H>pD6)`v~15@kvM~s^UH^ra`52d01}X(#hDJNfJV<>To?f%L zStyS*&}izAM2jTdEsm2t*0}crkAaUsU3<^?P^3u@fLH^D%F38Co}hPN&w+D+u&0Q_ ze5{X^dNTU(n69!EluG^lkM=d`^Su2Z=-jKJ=U&e|7~!YO^@pi22Q`l3X4=Qpq@Kgm zK?|31@;Z3QWNmjM^zG$a5`mgfk);<2d>Bd>qBgC3-LJ(3w8vvzmd^tDSF6DW9s29- ze5&H5+i@-&tjsB-Pp)_IO(MmC^GR%Q^d~xx^0Gl6@ta)b|9&IZa{~Lf&X!P^uHm^v zoN3go!uacVX7HuD<_OqL`>fN}{9pKxjV@^b#LBj|hFV->OUJu$!S04-y={E?g(Trs z*z{LFPpq%Y!pw^xaRRJTJJ6c>rxJne9nIbA^c*jFG|^{`12Y7*-3)_)d8yAuQ6{Av zq1QDi6cR$!yKR|^ngi|4d@4?%6;!wCvNmXEIBp$nC~8uy5^#)KhQ3UGm*96bIT;iX zrM4vqQ1;!G{TLI`m29s+hUQG8wtKH+*-cp@h+*f$g#2)m5N6p+1x0u%;W84;ZFeaR zwW-fc#_LBU6+^zK33hSd)HgbK`Upyn)L0yE_Wh-j0u;odEH3z?qR8>q!K?oRjXF>0 zl3YcgV;pIY-#lv*&I&+MloWh*z4P}bhL7t&oizCbDSdo!*v`*yaCwWC0{@!RloLYG zHTK-so`1V`8WhSZq!~$wAS=5vN)QChcaAO98vpuu%N2oDi6;yQlHmw`$^=J&-$rla z3R-(&-B1l=CE9!@h9Ze|zXJ%w92|s5JTFwD@fpxd2mxxY$L;K(fwttxT`V`#We3vS z)qnk2tDnIIOJ>dEWgi;Ih-alR?38QI^CTairNp683q7;8Em24YQB~;kbvkz8_PuXQ zSaXh>s7mH3y!YC4y&q!BXJ%6x5-0>w(al%^E-&9)D*O>M6%F8`!ULWbJly{DwA7^z z>e^OzF;HM}n7>)&!MHofzRV#0qAYB~B@P3ANI39ZKLpDzYAk=IPN#?^aU#R3?Jd9< zt~NlkX4P8J8lH$F=U1Zm62U-FcjS=lHYJOcV%ec!XJu76SfYTvl=e6P$Ie~xE?q5t z5YFfAn}z#+C&JYA@KgUU6uSuH^?nAg{5(DfU-Xs|)NW1vNjW)v4*1}Y91#vw06wUA zh(Kq?&fv0i>SCr=AI(~d`BvhuntIoLexCCA_sQgGGH87ik1__9#IR5JV&2=iL{Z3i zII{~Inr9BR?g&h4!`xP#XEe`2jbQQgLJ765X?7dV%}RLg4vH@UBeht@w{_(hI)dGV zozHk;%L#opR)S?hk#QvM(jB76e#HvdycVe6&=_P-0wUu{qAF+P^f#!N>dlKtcu7ZzIfO;5&Zf#fnO!CAmPf!vRljDevb&295Of{JL{iWWj|KjfV#NWv3HM7zN*cwTqakifO=G+OHx5$a?U3zDe?OPYQBT z1YLql>Gzicnq~9e-NLtzaNTw5VeKT9{gZ}voGwpNoBqyhWisM(5iGksS?#%!y7|jv zykEiJvxzAnn-fcZmHZdng#|lWTe1_A9HrQDZ@ez?GjW4oQEPPwr-wP4s<>s*q`%9e zA11;Ne8P}|4vETJu;Z$8l!5{ZIsz;!dM%qBfcTni>*?j+WdSPMXEl*!524o_FWVZu$e+DrM$me08~U_1(;T-*%*M-#tq9lD%#uix7J#=58Xy^F=fzm#oRF)D%q(v3IR zjkQM{fj~`Y+;@1*dsl;%5#n6;dZ6G^{VOrYfp)pXuiD`}zR${U9j!kt%`?k|N*v~j zjJfrcTq$C58=uP8TR^FK#A2KTM|z254%>ew`YPCGQ*N@=IO$E2WuaKfT~|KsrA#O@ zJuj@VZOu4UIl(mb&LDaxt;q;mU))Bk{CMq>yAGQh>Q7XNp|Vd^Ot8)XyhqCr6sDeC z7<>QNOrup$YT6;xvNS$blG>(e-X-IoN0DH}%L{oH%8JwK(hb3!IL^z3FZNNYBGFmK#2!V(t^U=w4$XCW1AGywh_L>nu=fjPqO#CeQpeE}% z(Kj`<@$4?QCRbR6Im67A1#q6EHSEs73LaHD1^UcLT11Mig7j^ynD=KMTJjH3MbdRb znyyBFQ55GEm!{{Y?&GL@L51?bdzHKx3s#9BdhBF8ZuUxeh6wrXMdy?K)#BihwNBeK z`9sl7o?)Zn8)1Sr%^Rn7O0}@|i(pKPol{b@LEM@laSPe|?r)z%TQ82|_Dqia(FUa^ zk5@NFbY4{|H#UV&%Wr&}hf_oa*8g-1sk|pSB#FhWPW{YAP8E;epAb>7<-OCipFTS3 zo$NPPbFg`5_#?ddigi7x7b)}Wx7!Lu;MY9hQZBD^f?_F+IRz!Ju99%qzDGJg1dhwG zKrxDV?^t=JmefHCJIGjgzwA-YLogY7b$h?zXunR$`|{xn^>{%&>9TD!mE0Ny5YQqk9$|A3hj% zrJIpsK!5ht+F^@gt>vGKMFoeF1XP4>$DwAqkbYdvUCM`$rK{ZO(2ELY&WS9%{z^`_ z_#i-8IHBXaT5B^2g4lkSMa5eOjB3wJTj2=h84BK4c!!q>TvZ5MTYH^zV zTkn@OhhUF7-m2g6%ky~g@1nCH|w(MD30y`<*WR|NDQ7QNyaHtJUYqeWl;3 zN6=e<15&pF{zGAaRno!m$~vp7`K{39yuLSx{gQf{o`U}eeujl29sANY5K&a=MhK7l z+ei1?J@3_4L)AeYE0SMW%0~`_SN)6!8Cl$DlXfpzd~YA2mNR4<_ka5?LSb6X!UeIm zCeL0n%EJ@@O{#bb5I;nRVVb~dz-y;QJgd9a*Y{XQHX?5(6yEA;0pg-Sg{^&suzGVE z31FgwPm^zhl?Xc(tiDqt0smdC)3AtC+?PjEzgkCZvEDjh`~HgI0Wj(33fs5Sy2V-Yyj>FuKp+>t(@xNFPucEI;jMul)f@IL) zVFyWdCmK6(gb}oY9HFDt*T={{Uhd67bTgk7oFgxjS@b{4rArSaF3j7S@lq}eon>0a zf3#2>NQ$C*#12VJD83D0V|df~(3)Ex)K#6Bia6KCo+^?$ADA_vDK;!h(^RE!(qyYT z8zUKT%O*!9F`<-)d2zV;{)_kbq{BUssToBS;JN`oRxt$OdeU4Y` z^tgUIu1Hv4NnQ>;S3NvO&VH;MBiS41?pnB9o6&-{mXMfG%c7MMG2i;A?E~cLvwx}Z ze!lE$6E@mf>ObvC0Ia?TQd!nB^HMYs>j&2l1oI7%7iUUq4Sp;;0dIT=TaQ?4_^$sX z3it7PK(A0J1QMT-SOi9tnd+~)^XPBD+^W)_JPe2&-5S_x6Ko^?N;j>#s#*aX> zi(4~vq;r7eT{i~r13__bXpkIKjO{`VPj9ku80GYO!at^N$#u;0S4-EjWFmV9Q9Y!& zf}k-gTGic`-13RjELPBIaavq#KDS6%L}uJ@jwcjYtg-2T^~q6i7b%!LWRC1Q8k?RN z03d0jK}Wu)a-fTg;P{&^L{m8-LEL%fubsPPO1pe6z7>u#!yfZ5Vr*I?@FwIX-ntcO zKzpV>UjB$QaV{d(X_*{ZG6pI=bN3yoOH6e94F|9hdvY3**S+3b(G5(QfyXf0?~6}h zLT@5?{Cj{1HR;J9hhl3a0!!T5qhTUrOKCO9&feEwUDmD&R_7WyHcZ)vgi&jk{sfFD z-%K!*c3lmXucx6+LPx@?I`B37uZSl68F@W#`WK;L55e#A;kXa#=uLY!qq>@TzI&{L z);iw)4&s)L*$r^(pN=*cUnG&02KJS>4q(z0q3jjY-ov%Ga1Z>be;^dE{SB{V18&?E z*}94~t#etd=9p;_Ko4h+{$oU0o4>#AbJ9U#$T_Ak?83{+j=e&Q0I&DZ;X;}#16#L zkNYX_!4f;wQ$0Awzt5ZxE7hhwTRPVZtF!5b_va$eyDtQYZw_m=#EW6q*D^T9=8mFn zo&HNzkO4cUc`?`{$VU^}nud%2mCOZVH#t{D6iH#XkH}9;AFWFfmp$G({+5{U40!Tk ztTR3OC=(ts9w1w4Ufd7~)SiY-jTODxKERJzBQUj&Gheoq(SB`O9r7siky>+J0NOB~ zwum&@YYi6eyCFD7i=Hd($$3m1Z+H~dtIOICJqfesTA za#mJ4{*x%K?K<*c+zD@Owd~YzA2Y4U=(@F`bg+{{8hhAm6d5mR_x}21*O@n|pIOkZ ze}?WQ<#-%6;Qj-;`>T3Xp))t7mG@$Dl#Jaky=W)!p;?M(*4+{nEFge6M3q@fu^Zj` ztjpexzOMh`&y}Hx-5ZYHx64dL^v}8@8$RuWoq4q(vgg@H*!1{kjCvf;JLx*E(15Rk z$3LQ+r~F1Gu`C_~u4d6}6)?GUOko&BPLo0$ZV+hdpymO`xIC6h$99OBxV**R$!L2rSDKFNQjaxAX(WYZe;U{1 zgj0z|33`USc@Ny`RK7=`w4HnZhp4ttXW{=4e0MWAihkZN8e~n|dRzc4JWCG*mHbZO ze>_~Jlx}bsDaavgh@hE%1itgn9Y$v% z@EbmyWz@D?@okHprF=ji>AI!5!fx* z6Sxf~to_EOkC@_6+<$Ny%KZ71M_R|~-9Q0R{I(s);;FtVdyEaANVkb@6Hnr20-@WG zCb+&)y6t|l+T5JD2W9)v^^gZ*q1uYaz=X>#F1iynm(G{SRSdaw8Yp7g{AkS9py>15 zPqVgNV;f35?@XN|k;mfa{#Iw-3GNh+eli)fbPeX) zXtHQ5eBnt;Aa5qC6P~3CH_^CEAYIVj;0FN!7P-7bjE{7mId{bi+3e_!9$!OUgMIjV zk`volg>Kqy^q#v@S`Ox^*HKOrR#^SsOenv;6cgEEWPejmOtKgZ!@WDpFgcj+VgamP z$}DK{2@Qr%l#N*20;c13qogXXq}%akC}Uhh4I21Z3c&|oR^o!|_FtG)-;Anfv3$cpxZ*z3VUaC1#=%a>m-xa(LP9tI%)|P&+ zgVGWbSulPWE+p7Xi-_NWkf64UNv%aq5CEp`=9igxd!KA3(qTjQ-ERWqdmVusLS0%B$%YLM_?w4*A zo$k%CBhnd78GBto*Uw>picfc2BBvNG7*o{frB4KIS(M)g+-!cJ{zb8t68|3n;Xoe0 z0tXU=kwKP~wB!rPi%-k;WU$r|(xysfb7_0qDpI8{nmL(PNHF$a2vfQAGUUQV5E%F1IAcJR!IWmM}2kQ-_G}?{9zIGux^%2v7Xh{kA^M* z6>;>41MA+C_D>`TqcUVri|NuJYOG6>n1i%`BEgL{?$HblQ)ae&hKhc-thiGYJAoZu=ZrUcCqjUrNPnN2Q&-k<@>`--qgI^WI3mxg^_| zm$3Is)Ngi{_pW`B3nrajKxN`Eqlc`Io|ld_caOxDUlikk&lh0cSYx{%oOkl}SfrH7 zcyl{FA=QMomG*5=#c{V{PWOowZ4vD1MP!TURDC4Zi5zFgm)+i~t-1%9jU~(Um&S+Y zeO`Tes&B`B;&vwK(jW3LFAwnNjJgP^W>uCqc0P%}N-BJlFIM|Ic5(%rGtV_mxY865yvclaFyBLVdRw+`zMzpERMm1U$YlBK(z zQQKf(5t4IwMV*r;(2CWE-q1ZC zNtGdK@OFFoT0M3;TzGB!6Yz(9Sh0VJJ~z28d#kpfR-N}MwVoWyyL+G4C6@M9Z9~1M z3ghwZ+mbeblzRq3;XyKY6m3Y4v>=iA3W{GO9fNbs>-P z>fZa!Bs4el-~G<%aI5E{Ig7$^!3$#?4A`(`b@vZJQng0TZTM(uxYjC_qH?TKAyP6$ zEg`{_t?OLayz1l+Qxzpn3>y(cR*qB-lH-sAktt(Z2U3g#-g-$&yL2C*k=4dejTp;H zTBg*0X}_hmQjRJy$u)DT+cCM#kYhK`R!!J&@gxROG^((We&-ir4o6mDUJ$`5925{$~VKfL#?E@yy1*>4r~@QVKC#Jo!3g zr{w7%g_ItVhi@5VzI4GWV{fQUPs;28sOVZZv)vgvMBW#9X2w&{7-&$=DyNtwFaVd-L5x>`PW%q1wP-;3hx2|7sQa=LNB z#H;o3Nms$f{$r?YDQ)k5SOO|r%U0?0yycubv9odmntk;~a6(-h$(K?g66BC`8k09! z2U0#T<0F_;e7^4PS&m76#i~1+_~Vk2BvN9e)!(SL*`U|mUcLrZ&84_;_NVkUu}DCr zyKTsRFP?n8K3?g*xhQM24mQa(lR(amb3Ua@naG3aFm>&uo96~^tqz{Z>nO*5#nf96 ziiS|ua1fDL1Q$)ZRtKG=l#8r?q;9XyllMfmdd>D#Z^7Q`tvc``*Kv=GD>q|z)h3;m zi7~R zpi;kmCp_g9X6n===j0-#u)s_ak)@{TH8ixYP*dtbRtHRs2Xy)F428q$Vc6`l*NnaE zk^1rWi%AIh6Z65hV0Z+h#)pmAg??byBh*&eQF`F`jZjvXJ9J~V!-hw75Jgs$u~C9V z4Ql$pZYP$%(X)r5NLaRM*Fl=pba_rOFQUo1da^y~%K3P_9vddl48tLds7**|4mm41 zrxUGrrb%x{QccQu^QeQBvHVxV{P_zpW5z7KoIVj5nO8&yo@mJUzgL@e*Tg-M;nKe{D+9X z7E;``qmZoJFv%drebqm^9S)lVc6B|S>dwk(cj*!{66BJgkCb3?yOMQR+4B0ybxL-n z=tgN%+-lI{boIKV>o!&#EdjV=F67uw-txEvRBBKMwKmk2k(ri@^pqT3+9(l*6eJ-j z;?l=GZ=1}jOyo^HqUXK^{c+ggQ z^0tL?rcQ?Q3|9|o*tuIB>*)vblJj$slAmv;h{#gi^gLQTn~jH9HAp)n#&?fVLdB?- zAz3QV{A!ZX>rbcX2jfIEc2X1tg;L!|&PRQ3OHjlfL+L@6?vD6Gq=DIyW1>h&H>&nX z`zI1e(QT@zAyYle)mGWi(s<(SSSHU3W7?c>-1U`Q3DC%ffy4Wp*tpWImpzf9kx`^) zs_zKv^-(`l(qcHc+ofJ7y-325b9K4&+3IuE^-%SM4YOy@!Tbe_jO(J(`i#tLWSkuh z1?3H4{Nc@JGj($3PfW&*J*bk?owWx8_~;+2)%|!33&$sS+YZX|J$^jB&Z8SuUZnPQ zBDv{yJhZIUOr2aX9K-Dwb}lh|I{LobU0$-TpW-lCpJ`nyaRN zSO*fstJ|MY(-U z8&(~7U47}rbV-s6)wxK?3)!BO0C{c46PQ0{F_!LnT5Y39@B8W*AH|COujN}>E??eBEy5b23Vj`>iX(JRUL{OPD_ zDZ_c=uR7+qq>7MK$&p}=Z0nNAH>&-u#m#d+hbPzHt4q{Kuthwz;l6ISAy%q9r`@Tq z#}(5)q=PThho7sDTY4snzn)^nf!FkS=7@!OVatO^cBP@&TaRmJeOyNX|X}UnHb!-JVooab={V=zQZn+MTkc@0h=% z1FtF8iuYsd(1wmSfKFGg`rW_joX?^-XM&ky@K#l$cGDI!b$o@3jNhaFa zdM_LOZSnO1-QBPhwvmT=t8~eGOOkXcl#@wH0dD-5Pq$Gb!5Fy}llwNSt&_GE8(w=l z1vMwBZZm#r7}wsWzGL;ZlTtqFPQ)6k!`r{pg?H64^~9|CAN}gQwGo!TYq6tZOM0|P45|0JL?KFRo?mxfoRw23@uOVyr?@Gt~RHR)wFj%nh%~lNY+z%vu7f`*eGpAL>)F9_z>!vrERs2hgn^r zM2&r3zZnED0s`_REc0qAZTQWP`tC2SeaYpH;l@w+jgla0(4|v!AjF2J9!Sx_h@SfB zzj=+`g4DFN9eL)LbX~OrOP)+ZOH=pvd_~0(d{7-nQmPR=X%DKXX-V$g=EA$LoV;X; zMYea@^#QfMxea-eQp4WuPHf-M^Tsg;lJsnpnkLC<6aoGu~<4E_%zkIn7vqrh`)vJyTyhtgP4Tl0) zxzDfLH2LoJS?XE9j;iJee)?P^-rH^51D>az_a6Sj$*T$f=Q9m>W?j$!5cZqf^Kk8) zR5NvYy8q-k9rB?pbGr z*V=m(Oc5_Wo&vu*S0f;!wx~{9ml#&Vu;CG0bxS}8aJtIKisGu9{klqyTq#-Jh!Gf( zg_8Y_UIkNxZhThns^i>bO4^G_RMy)_zaHjT4qo0%t*tG39RI$u=EZB&uEtoX?Y{Na;%<{BrqV0`cH z+qRVU?tD+A@9*IChZND7A?;RNIPn^M^QvD%+O`-Bq?*uzv5U>rnQ_g`kLhYsXF^fd zD17+byYTUaU&Dlg8D{R#Gnk9jdMYY)W2L=yqF_RDe$T!@2fK(raZ4ph^{uA;Mtenl z$(EFuf59a>(;`uyx{Wr<2*{JaaZ7DALMtf=D99{ho(#dDu~Z_;D>O=@7{@GwIuSLl ztLpvto!@7}3y&x3YBsVB`O4H)h-9pW(G$bC=EI%4LY4fhZw(;7NF9fCv8>YiIAp9= zt~zSRYftw+cpiz^&{%KpbZ+t^Cocwv^W+b%XM}O-je|9hS6@dp4g>;vEQ4M|&oCCT z)W7*84*$=W5pFiBgcN@0iERk@hW4Cl&PnMPCY)Q!|`p8#xo*at=He{PJE%}bDTyxn* zJy`U)ndc(cE7I1{Zi#jMjBC{WI`QW#>qgW*W#6)HS2-8ohyy?U47S`h6%Fq^d(1Vl z1i~?FI^6TFgeMldbZHXHpWbT0>)X8e;=^@V{EG^le|I@H9Wk~SiX8uU;;FT5_{-ZZ zxOG8CTP%yGr|7PY|FpCPdFc*hq;%}(MCOg{U0`&3A9kJ0UVdoM>e_8`JZX=^>Nc2Y zFlakkfrz@PNpwcmoudd6=;m9o1E@H zVtP#)A(qCNGgCTOmulL75Yb@Y{gvcYWlx%DP8oFdtv!3qRNu;;G(o?|uI{6rPvj9rhMGzTwysIcAmxNH*9?<2K^l7PK_f{8Lk5fJ8 zL?ozEe#C(p^TPV0*$AjeutZI(bY5Xp?N1tqH9lXi`-mSCr+00JK&_-MTz!olFFc-l z%8kfoWk->#OW??n7_Wu=C@*p7<4i=Z_`-qmU~L}zu)<-u>84xtHLZUBZ)jZkD%v(L zN6VHKXx*|>J;Vo)K79ewXJ3G@deBdwVYGiHfrE-ieu?29|0bLnMh|xK(7*RPAJjn! zM^XyP?)#ArR8;-zk4T$x4r*U{7_D1ZqH)D5Xn6NIBo&R()3VL#=l=?u!>RJ0MbpaH z;N7>yD2bwuwfecgB2ZnXmq{8i7R_tkMAm}K;YiCwsJ0ySZ#{+dY3J(F7)@*5fOr2^ zbskHQz3?ji#*<*kplaa z%;|Q$%E#|P^Xk{t^@^(fK8=*IQ*q=s-$c~!L&@*H1y^n%>fiV$TsZ|e@RK`q5TxeW z`}FoaJJ+G^)yEKOs8-kF5v0#L51!o{k+n!2r+NMMeB(NO&FWrz9Cr1h$^7_rQpZo% z*G|s2b@TiB8uzM%eXJgNG&D86uchWZ>i{omK# zf0~_4Vt$4Y5hb+VR{3cR+Rw;P+oEm^8hv^wJy?N#YqoW}Tu+9hr8Vu_iXV0zX+TTN zg-~*uag%zM3bwQ&)MoWimN;5VN_$m(tGCW{Z$(6jOM1i6&wuK6T9*?r6EbBC#-uS% ze#R2FmI*Smq*{#}zy7Zn$KOW?3lN2R@#6eHGTH@2ty-cu9O^UvJ#Lb&w002bd6 zz>IT4YB}l6N3N8yj4bbIvth|o$q1gt-!PgQ9Om|nZz+9#>W4n(1SRLL$NGo*X&!Vm zV)Vi!d38%3MdQ2AqyBC6@cqUUx+F;J_SJCZ4_DW+bII?PP0NrvaW;~MckaDTf-fUK z_hSSbs$ow`Q4jU$aODm|{X5SgSW}MSpZFF=e&z>o=Z`Sg=n(aL(YkFFl8YxGsc1A> zx2{kR<575aZ_vSy(O>x`QpQe0%DCxp4>SI7D#s>42G_8Wdi%w9{wGF!>U)SvsTQ+3 zjPLMnq)ncS!rQ)r5uf=Xn%6GX`CVDZp7j6OI}5-(ioA_Kc`fd4O+9sYH{9Lj(8D>n zJ2(zF4m;$KLqFi)aCi5jrIZ@fy^S>P?%zEB-F@>WP1+=VQ<8Rm?Phjnc4uehot=61 zKQoE_#oyL`6h^pB@Yvb14FwHag2WzwF`^DVQ^G6)hl~?zmB@on6>F97Sw|ym#*t{O zsTOgH!bxjF#?3~;nSVy?375zU!pN_kwAL8ar=>N>_`bdfaQR?(k_&HN z9f#AV28rNu*C`RW=CDva_GPJb=NbF=4D84^&N(66fw)lPnPU9lI48!bblzW4DPgpL z8Jp6%F2Z9wVWmRLna*}|Y7g%VD*JQoSEJErx(VOVj*lI)t-^+vcR2Azx?`U&Pkpfk zkG}OQ9(iL0p7?lUo7;4Bd45TOq}6(P<%iLm_^7;NO7nKg3R zgnHF}sVFmB_FZJ_20OlZ*VniXa)>6VD`)&u>r>{`V&cpiGu{k0`X)*b`~OL9w`EXhzN2_LwstguXDQ;b{xUs z2p&BhArs~y@!T5_(0@1v-ufbfM@_@_e_x6E!d%(DH5^3ON?#UQb=i#uyN`0ME{{BN0e)A3rzIYwQKYXAfjpv=|+SEB! zY*=Af{bU)l_pRupu)u+4Jz2cD8kOp|b;P9@ZuvEJLlvNqeg|D;o<;0jy3NYRpN5%Vs%HEZc8jVJCK;jn_Wv+FMszx7_*6;hJ zsG<&qW!1{9Ren{WYGa#@E+wiC#k5*4#pN}~$SX&BaUHU%eXyp~h9C0m_$t?qSJItW zR%Az++P}9`mDlm<3HJr;cGi`#a5{sJvvYl%HJSqnS^yZf6!aL@6h_6`3N`;S&Wy3! z`M2j0WLawPBs{WMTI`+i?bfbv;)lfRE%tT=2u-c;aDN;g5n$7{&cp%V`r&` z`*P&G^?%6x-yKr^hm4siqR93K{v=&dXoW(nkIgroF5PE*eEktRaXxlFe-ARBy;H1J zYV&qt%RkSRu0ZTsL<^0IjVnYjAQUueb2E_t*~{+qx88A~Sa3MQjM-rV28={~alXW{ z8&bra<0PKe99wQX57lWKWxLk2wO?y^p6qV3>4sCJn-25S9<**LTfG=rFWraAEvwLE z3NfB=@ZatCU4_i&?h@;iUG}N3lk?4e_rK;IChGo;e0~{5y+}dqSB!dP6-K|l776G6 zO@tK5m)a&`!AThX#(E6C`z`p!_my2cBdGW}eZ-o?;+D6IaM`m)eI_ihZD}DY*p47S z8~$`ysC45Y6k&cf1&y<21moV*BJsp|(fHd@Vdx*@M1ENVE`BBtKW(bU<6o8Hx>pNi z+uboXrE_%*Z&|2#f7;}owRoe*Fy+x`x)aZ7lQo*23Jch}x(2wMd#=Fk`1mt(ZTHYZ z<*f|9GV-ZgtN}wp8qm&AN_)kRSc)wTX*`@)XgzImO;ItjfBIS0 zdjip8MG#ZU3KdzgO(#qAU&12MUe0@7d6Tj{;=W{y0q3IXcUi=hMWhgwRCeDKwKJ+E6MuTMabX`P~I z;HQ)_r$Z@%6#@HPnoXyEP9*Tyi8=j`VjhD!ReZNHyppDI(@Tr`^k9v zHiXYO0)a!uo3Wk4+t;PBwgxMY>yNtpY(yV<4if(Gcj->$Nm@ZY4!OJI7PIW$^Wvp3 zrVrAU$AaB^Xp!PcL3sma+`3cZURqR+oRa2#iWFy_yEtZ-E=1&t=kxL9>Xwri+;MUQ zj-Rmm^3F3qdm=i-j_+>Vwd+}D@&2#GqY%?*G+l%5yG5(AaPP~@@Zq9usH-=>^eFO6 zs&L11OYpb<`w{~WmH6Ptt+KzhFg>Q*QFuI#bHRPySh&dy^$wpeNyDb}mL`+E85W7JeYFvvEZ&Z) zn%#@dc9-`mdiyU;sBEwyyV?g!3T=2V(<$q{jon$N1ougn!GHH9`$9}1u8?4JO{3AY z#%}YMcZRX>A6Jws;~$uz;uvxK+hU;69)vL%Eiv;f*ihPq!Dx5Kk6*a3dZ|lZx{ko$C)vm$J^H>_njvYKJ#ddd3P)N-}KBbVhUNY zy_4O2T8ST*E(pP-0ltV2vrCs9T9jDimNwuouN2C9Sb)8Sm_jJBv?ZpHJ5P#`S$-^r z#5<7^x#w=f?WNZic`ASDg?n!Z;(bAdC6`8{*()-0%duu#0j@rIECPHT_~EymW(>cC zG@(yyF#h$&>A2FyAnqp;S7ZIyO>k?p|da__&+x(oJKugc9ceJ!y$ z>GiU5YIR*Xg3wuXg)70186e$5|T zdJ;h)%qv9=E6+y0jjl4@W$Q*e>g(09R9lTx8gn=dYiU&e+?_UT-{76DMxGR_bMZVk z%k7EXeyEKwfBa*)e2AFez(DofNw``VB@sqkcfoN|A{U%&`g%94yKx%ne%C#Qi1{ZP z7rTpi`?^FQbsqX%|M)Hg2Ya%7`>x%NcE`Y&mcrx}2ZxH4$=5d|pl`Gj=RK8&6CcXK z^{*9T_U${}0?RL3tFi8$WSlg)*}~-HDQ(a6NH|^c5n}>meL{ar1;=;+OajW1XD-E%P9BUZ{pBc ztlnCHgy=x5*qDdUm+U}zkT1?Xe3-d++hpdKFL_rE(9*U=L_`$-p26~3Gr8@|hTVqIzP5LGyfPHkza>1#=FN*_3b4J!^#D;+ao9HPgK zfp54mC1r2NKSm2G8clmR>>*+uAXRD8TEM7SH!p0fHCqy}8;APS1EGbAfps1R#imt< zw_w+zc}E&uet1Ob;^VQXYLZN+JV$NgALw0yK&)*jJje+e)-ZH~LYR{thEJ1mALIdQ zcKIv?sdtWLp(2||gt3XHcVq8B0nyn3Y1d@7zx~`{Mm=^-MlDusuaQA&2gDizjCGt_ zPlyn)gyFt>=(9a6(b)I6J#_Q2sHtzlFCK&5c7&BX_F}p(6Fr8Crq{wTR8}tDD$}e| zO}AbHp0xRRt2cyach@#$V$dC^*4*XFC}87`sCe|B>( z%oQ^kE4AGoquFa>-0NL}6~?z7Bc@i}gS_JAZdDY%SlOF0A`U0d8zlFmXzhBGZr@>U z(LTL#43)p1ZH$}2E@|X+^*oOo9D~=t-iRgZa(3}|g-~Y`W=1z)NN`J&(yq{5W2nRj zBq4jz™wTqqI*B5cqroiFfwy;)~mX5M*J5X2Aw!qrcu{)heI%uBh(`dSfvdx(& z`gsHDN-N->5`)Nzsql^N9fIWQv@4OG_nfLC7@~tUh6?@F)ivt zsQ1B*7j=A=xP8S@r&q~PeGnzRZP4HEhp4Wj`W2n&o z$4f59C6`{Mu9Lb_`)CXmP0yh-V~$wdc47ohoV2UR@z7@_GJtH~Xb0Z8I!?w&As?@- z#Eeuwg!tP~TGfcj|HwpWfDMap*?srs|9w}6dp<12K_mR}(Aj(bAoJ&!3-FOTR%c*$ zC0f|*4c`Bic$Q)sO*a!6>MsI8u)j;WT%3kKK)GrO4s;nyfU$%G`XWTRp(@N;Ld+#J z$X6B$6~?*|Pd^u0iWm#m%_YPa5g~rYqT;x48~T~I$WXc-iwchp3qZ7rV;37^@slMw z%wNQiXtjg|yD(!^0{(Q$Smnk`emqHv4#FkJjgn>7m_$`z+2tHoZEYR_J0rIoiE6ty zzuAoKS*4gVJRTPuH9`cMvPz>XPg|_mlqZ%U<5HtBAjznN^8KrJlf`@&yKy;eA_lYv zg@mm;OXMBx>oR6AU^k}JKH(TSAPNUh>VqIZCu+@cVj3EZBOElb4^Esr2s^S%u_?0{ z{S!l_i_(CEFtyNCiwd)rfhw==CE0Wtt`>?n)-pIbT$Vv<8;U!!sCDMYic9SiA$~4H zQkoYEKSNU@)Vf;KHe4U7!YN2eoVg6^7by$HuHpS6WJ!opFCO#a@p@6XN{$Uu_a)AK z{d9MTy`!Yo2g{0V*k0LlD}c04X-iBY;i-e#6;lYuR*9cE4Pk0KyQ}wg5A$*AF@iMR z$Idr@#8;y)#j^RgBKxX$PW_;$vhQM`PMxn_45Z)i!DjDyT}%RlnhX&|u*s{BW7B$b{1kR6nsay!LL!>b)W{DM>Uid2`K^T_ z6qmk(8!+q8z5g0*!2xIu>lD7;)r#B(pXM2kdJuek8ZCR(q6mOv|R5ZPo{dtxjb`5#qvvtzYE-tIVsS5_XEl+5n zLhBHYec}nn<#^%K^{B0Hkj8qTzY}L2G6Y5CH4;vtiCu}<$UkygKiQ`(3zc;{3i0JH z=^_AZOfSOx@yTLYv2J^zdLjED(9ele<`2eGAFRg6{*lO6am)+5_z=rNg=4@l9f~L% z!-du;0}{jJSl_M8lz5(Bbhtm}sbg4q%*-ptF|!7Ug$l=0sc&e+#38X_snT0vA$!NO zOOR8j3VQW^p)hplloSzUTGNr4ezb+k?(jjBs{zL()+5~2_3P6e7Ai*!ISuyJ*=Vfa z^&J^HZ~(#v4>WyyroOsbtW`?4Z8t-@MqolbDt2~!bpO43eN7s27THV2bO-n_hPV1mF@G7 zsX?Fqsw`z0ZI;tk`@c+tn(l2@WN=h8qJ>2(~=(r9*Ml= zE6tGZC4AUWg!JuW`ZOBvu^ew=YH~x;02^|+N_a!;SA7I6n zGo=wriw7IsCZkbXS68o=IuTIB8bURU`37M7_?5>4uxe?~u>cz|v>wC8*14@zD6IJS zG-35JCpNC$`>rtTX48LIJ)8ULpSmDoS)ne3a%*dV4`1P|HO92YPA9LDAs`smG87Vg zu=EEfR{pg2*KFGSS`m<#ye#U5aDd#8U+-CCqWSqZ!J#g_=qU<$jwH`Mc>cv#F=hf@96f(_z#Ur1W;L$JJ9@lM8%pdNLN6zWEbu|T&Eje|VG1w2) zbxnA8Sp~+VxN!MFp_s11NLFzJUi`5PFE1*GuhR$jo)(F1d39K{sRmab9D-qqEk#*Q z`%F=&tg364VNaePjhU%?_j~pJFT?zyYBU;+#wZfm<>}f}$Ki?-NAFflAue-3(%n&1 zYgAG-?UP?)!`6zPQ~9G+N@e!0LXl0?a5)fdSK$D*oDnE)%A`)u2oyGGpjeIA{r16^ zRMooCVv43a*!=K&9THPW-1Zso%+K; zS9=n^zAArgu(S29@=B{&u9g<<{kv=G{95!ITrV^FFx>{}&I7mm#XEk;%eEmm%cj|X0)PBs@xT&=mI(qlr4LU+;v1RRHEIdzY5zf7^kn9fl{ItxG;j`Ioh>eYP z=by-5^{27296O)83tR8JNQ)`^F&E4Y!NmSus|S3wrb@<4=_vpAhbVk;eLVhgd^rAf zN(7D>A1Jfz(7I&e&6zmrzHH39b0?npwoC+<+fR%TvE%F+!Ln~_F{P@u377sazsq9E z*)xLnT1+9{|8?kkzDA?bxM7ia{Op0~8{e@(1O4OoJTTVYbY(eED5&+p@}iz&0^d;E zwmB_@mfWSwk-zd+)D#w(p`FJ!BHUv}pl~y^ef%OL5YoRd?7prJZNInhI2w(&+5Y&) z2rBJ(L%>)4Ys#rWRc1>w@}7dfZ(n(57>n2ms1@~>i@OVk5oT?}|1t4hYfN+(4s}at zMPn^87Dtm0s;ijmt}||0EmB9-i)dj8HYz=FjpgePd|PyVO5f(dHy^8e&dXyiT&M8T zsPZ#;ZXNok?%fErRdP^9}JA+{*WUPxrkNTgOkchar1i44DsHldr zVq`pX8<1FR18xzNQCIR8}q1?`kx?jiAIt_?Uy# zYW9w@dK-51-~nnqso0r~?8Qq^uxbrzOS)!yO9J9zWt@`8k;CB%ZfCkgRcYp!Ef#(e z-7l!Pg7$2ArO|Yj+;4tGV2;^J>>vSoKFIxXwdw0wIPKwZIwGYiEfxa|q}700jP5hE zB5012zv_QXf|sVP@et4FVV-MiI(M%;89ufSBgWG*MWtn0orq|VtvToPL*XA`2EdIu&wll0)IPSfScf$SD{!`}GAR(pe*RQtP;~eEYX(`hLm!C?! zhako!>eBPs;UCN8JxcD=#|&#iU2#6r9={RGkM4t=Pv3!t$})saKLUY6I^HF0%PXK;vYZ8y2}wLTbDdHy-P~x{vp3nq4m|HJZJK z1Gc{K`Fh;)%+KyYTs4~BhAXgR^X+SPPeFAPHkb9Tmr{9p2C^6bjG}cLP*>6Q(dvVe zlMpw3D#B6+?_wPi(l13UR4n}VfrUyyLae!_(Rh#QtU|cZIa2^fc@wI)?)^AT-9?c9 zV7CQs zb&@8<5DFoZCSBE(S+UrKwJX~n4`t0Vrwl~P{f(J_Oi@L-HU}_ePA#Ik*lnt|MqPO3 zMSRALMm$bWvQXhnP|eSa`YRs8O-bpC#@cG6J@gm+dh7sXy?j5K)QxItG{*a?-nk8{ z&YgtS=S>j-WX%QBvF4(gYMF(#f1HE0m(0c5OXp+5UyegvVGg$3em;tR_)zWNfV!ew z6nymt2H*2Ge3J&Cbm`ZUCSiQ=n3)*+{tk?NXA43n&PV>IFG(DQ9Et*EmmtI{^2?_VB)&E>1MFP7~n6xHQt z$vSDQs*qzajMtC(vEnS~ZzwNm^ISZ)mAq5DQ4bEc=eFF=%ByEQ^TB;v98ZNC*F)u% z$5Yq6CTj<3bJ9_pn;}9~t;#3wPhDXy>WlMHUs@>Xa(kXfLsdBz3~a>JhlUzyc7dy3 zEI?)_C#D(S&-kJIaefHm!wd_Vp@}Y>KPMQmp>~Y!)AkSP>$O#Qtc&BmkeiMRN1RIE zTi9<=nCo8Qhq4B&t?pW(q|tPSlOr4mcgX7jnfc{1nB^N^Z<1MJCJv3m^pWurXYuRi ze0;QMn+$xJU08`{KVFLsX+=oSEytkbaCyJ1-CihzhpyU^j~`d<#HNfAj2akayoB0d z*@j#cm)Bs$#yrGF2Eys+SdHe>pLZZE*cSnQMg^d?e_z4#P0J}Wru6Ls`6X3Yx;_^v zacy^JNmpreK-P|ScWF&&MJ+!6B~7L;{@};0NQw!9%h9p`EK%40>tz{x9Gj#yR^BRW z>UX&Yi&kaHG|rsa@gr1IIW~ZBY~EofaHE z*s!Yeb)4jW4Ki+ub)GH9`S8K|UmaNX>2mN>EiU-Dqp5wkj(nv$fJ(I$T8#K ziti_l?y7BTVR!kViL=qEO@hZvN8sSGaK$9SHzpCzsCc*{lfh#;3j?hRrLc-w; zi$d6xLlHjhFw|zJBWT2AI76dQzV;VXZ(onf&A%ah#t~{e!}@??KwFLiVfwk^C}0p2rCtKUW57uimi% zMc;h@|CChheEuGk{PZbozJADj{%$l@lp*J>$6)gh6w!zlC^Z>dkpB3M;DeO);=d6z ze6mX4_+U}88Lf8pOZ6+7;`O8uTz|Nuutl!!BZZtLZP55bZ z4UU@-2#396zoW?m{A57dF)1yDlWBweaPF*NB!=&5b+#?99vA*M4|QEMEW7*E2+SSo zZ~DB0_XU;m2CVJkz%Uw3XP}@`oL7dIzgUlVzuStuqAGb=@F&b^f$LSJgN@~y+Ir*` zS7G(m0;!0M85E6*Dr5TKQ3Io~Vq-1_CDF{*Ces765IE!DAsEp=3Tw9&N<)2TUIkwL zYNIrQ2PTDKOJ=b;?nYJdsYPORknF?hgg;-BhF{j_A}Y)eZ-28{x*c(f+@i7?y!zz^ ztX7T1*oXjpxinq!!nDd&UOxV5yJ5DfUU08{wFz5xmZ<$gRGy4RGxPrHmm5Vm;yx67 z-uZ5eOmWQg7q7|2S1QeQ+l#P%M-hHmmxBR`p(037WU}(%>on4%p!CA0>qLCwl*Z9v z0eJ8GEm*ibL#{);YP5Z|EM2BOW*VRVyj|YCvEczSW%DPCx68Tri3>rED$z1jIt!Pl z;|JAPPL2(h>5mBord?%5j)H%T6Nk2o-_zpn#%B~>B>(a*d^h55@h zW8P>|&21^Z4M_=?`@-sq8oYp6JNFL@0^0$p;CD8f?Ikds}A5Sg7|SG1tgahxtYk^)qv z(B8TC(oRuk-N>DLrYG{ygRjP7wMM!al1S9{awODkf~ zRDTp>{GuWe5E~0eKmdG0cNIA6D=JY_)b%l3c84=CV6O(=)o9wIYFjo+7jA%``qxp4 zV{6d&`eWfAx9ha^J%Q@lbmW(Pp^6?_rKkc(E!I@Fd=EFumu?j%uLr|2g2hzMP6yJr z_Kf$!fT0brd$fa?e+m^_H|*Lt+8r?ojhH&GR;8uRP&NLIGc_0G-?q_##S1$=K2ydv zJHjKI5E7<#SNj`_icqeve-pw~TvnQTKiBgZ9fLwezrj>dlt(S1Q>dk^$cDnao*}6C z`dNb-8+qf|88$1xIpOqgp3 z8lJ})JVrz!iZ9jM*CFbV(^0;9G2+j-R`T6cUyHa?uYzAnDhj`T3y$D0gikvhp;Hb< zZEhx#F1Q)>r3E6UxMGa@PUVK>h*IYsx!`26&IuSa2En7Ji={}#+FuYfWE{#?Emrxw zQPQDsRrLM)$bIYo&$B%b?BLhKI}|6S1!z(BPdM9 z7Fo2h8rdbCS1bz48?ia3PNpL64$7(`QaEmA2TZMnU@C$B#c8PTVNsb9t4Y~xF zGx&+95u=uGRAaqwd?*6^nqTs?xVYoFCHT+lD^w#dQoV9~uuyGx=#&%$`MXquFcZtv zHWwZ}TpH9QtDr)x6v|Yi{>(#$;OnL7m^3U-HOeF87~ieT#F5kcWA3;l`5F=%?vJs9 z4V9ka1O05kGu`u!9EQGeA^3T1vq|!bO?j9)A|50AN1;+3hxt8qK`N3|!=4s4JF-i0 z#I$~5F~M{xrZD_d)u8vx2jTVM`bl#K$@$gQH;Mq05EUfHrdX3xSShdCljaRVVQDo^ zKWGRtRC?95^^#AXV@X8~idEyE+fo=9J2*!2$h=rkI2o7}itSmn#%NBztkM{ulj-q% zEzgao;ExpwvHLZ3KyAV&0y z6d{cHFeS@Mc1MfBO2RwUiV&N+N2YU>(zNv}107S2C% zIM!`1L}6J~i}P5wtw4mQOOG1`m(wmY4e&bfxuKA7|7*)}-z&>;|EtUKz-ue;*q7Vz zV?pOCp8Fe|M)}{D&BUakd)HN@xT+EM!NU+cc_O05j7G$;AqeT;PpmflqoQQYk>HeM zgbf}fmKz+{HEI4Fnaa4QP*+)rqV*e)wdiNmRhPpR8io z;2;FX$C_TIPNokUnU1<}?mRa5AR@XEBxNM4zVnuxIqgQngiMV0;KNW$oaBW{u`@R{nhCUo39Gz!($S6(&b3Lr}B9_3O;)oja8L!1c!^z5i(&O63@Lsge8hf7Sirf*Fvs`dI+1;HStRx zh+uVYK_jQizQLnsAY|+;gp8YwknwY+dsXP91qhpRFhZvsVu)nwUh{rf+~vB@4QzKH_~r#d@AvKUi+R>FRjHwb1d_is|e* zJ|;Q{H=Z*|gnM|- z6-8u--!A)D)S9+yzAlG|EEH%g4gfbn$iADBf>M>%hl{p}fIxv}(W;%Ot~K^yniNxL zfe{+$a(5kSoe#ou;dP>DK!J!ZkHus1*o4=ImL|Mx?Dpbv+GHsxsm3RZcZg`fG%Wno zeo>)*YJa<2m)5jSpB5Pwp@Hhfrw+utXXRJ4nLY^%av?~aqg~Z>XpKT>9qQG2Z_h51`^btL?-?y&l4F9}P0xb&z&gL2 zf~pqhK{3V8yfzfUc)qk$p~yo)>CTI%;oi$;;J(Xe;{GdU;lZnB;lshsVgf($)+u6Fb5(iUArBdpZpMCEw~mtUTf}~-WB}9!{7|)j%UsXf$F+y zG~Iz;Y#1Wvk3vao+vRd=a+1q2@T%iXU(X~oaEwvYQ56oO>cc<$v_rpL{WU%w8KLfI z^c~#!ugTqkLo6$qDODFxtCkf=ZFR?+909>i7(cyETto0+8Y)d$fWllme)zoeVhUki ze)!zi=pJRJ+dM7{$D?V$xal2xo=9D-xv#lD&zr7l)AtDM4n8l2Jqj0jsEie)rVd3^ zRFs6tGi5w*5*?U27DFER2qT~S1!b#$mhjF(A*H^g0BH~Z6+2(JM?{sjaD+u6_QXrU zE+`RmjziX~4~hjz;lj7jSXqH>cl{B0A3d+$eU)%U#-m*2XZw9uA@jMr5I*Z@M9e(_ zX^&oyt#@1?H^DElznO9~*>608j3@sgU2AA1L#q+bg zV@IIKk@56xDz8_H_~M^37}c3u)ww)}qVL{U=Tn7{F*7CIZFgOQ+MEpO(nD(*jxUq< z(X%3cuzODCvv;EGw?*n6wfr6V`1-rkVArFD(n2$4??{et;O67IZpC-s$HiE-y^Dh; zwZj9Slwk4Zu60dLjd#hoDcyySs_e_p-&@?Zvj%SzsY0E}$`6ytD_8rq-^>0t2Kl4E zuTikDfzGZYU;dIN4dFv3r%1OSPuN9+-7wBNbSS=5+p_Bc8_w+VarBJ-(s1V37VOS* z)b#$+aDMT#^*DC+K-HMek}fH<)|fw`kBBR52y@(wgD0iPKBERiVPkqR4w~3U1P^va zp-3{UZ-g|U*%gIdjpmF^lCC;DrQ>E9iuk+VZxQi>4ftwx9Cj0#KR($#_6UWPs_J?X zRSufeN4k$N@9TCHVcLjz6qHtBp4y&ce~ca&CDthvDDqW9(lZ~^M;YSLkH77d@WQfc zOdJx6K5@a)U5OSU%xh{&gye%l0=vIV8ySzUm!*q!#urP|<=AVt6{`IAN18eo;c?l0 zh1Y3(sxkF11p{`InKmjOzi!HRr+=Kfro5ZHCog@zK|}`LxACdbShyn7o&MG^R;wAjVg!>+hK!!+6d=ug#V&K)mN16NO?HuQj`M zd7cNKIf_TTKBEUk%RQmE#b@YP^EvROEG->{tJj*omTarA;jIi-CYejk?qIWHs(OA; zTQJxR=@{?-`Ye7;`$>u$ZxDIn)WbXKVyZvyS zl4Gya~Je z&{~FhGoBM8oK`>Qo&QH%e&wI!J!yPnH=Z$Z!2ytsI(AQj1G>_}q|X(1n<1L+gaf~F zHl41(>5t#NIu3E>V6%GztzIsFuIsb6et2yh2E=yk_uLh{FQ{bI;*Bnv;%GFT;f;ZQ zZb8L@-8t9*|7}YFZasgBG=Mcd7YZsAY$!r$b|rJ+cc`!0bxJr2DsPLRvY(-9%QRQ@ zHtYs>-Vwu1U&rWOf{FpN8a%WQ5)Pe=A=jRafW*#qTPoX;j>0u$859yhM ze`@wGmjB@a6fRtYkR3ki_ZF<0hc?uyf0YsSC<&`U$~g-#_~uj1t$Q}>GX93N+$W?# zOWOiz*s2CG-I|&j)Yj6xpZ2px1D-+vtt>u&#~0sy^81=bgoHI>;w;08lwD^ig80~) zkiOM{wJY}Am36|*S|s%~-UFhe(7J+Ys8x<_^4+H{6y0Gk6-@&?`h_XRw~xH(VB+WlKH&%zK5}3{=v%U zDWovgru?iwbG>K5nQ2OX{z5EFH2VfliTuHeuFpF7d-KG3(U>))JG?VZS!z z;qTDXwP+o#<8^!&;yo=?T9aK+A>Az6n|(&pGvJse1*O$Uj0!SCG@j%xUx}*hUAw&O ztg_*UJO}*joP-j4j@abkKHk9VjWTj(K5v-dg<~UB^|}0uYHl5>D}@qv2Oz= z&a9Q|$HU0AG+nOHN`=>TcTAjBi_mb>YRFs~)cfrB7PnaR28QqfVV+D26;XVA5FH(h z=U;pcF)?v`vQ$v>Ge+0u(|up_HNB5h9?rpU=^gJ1*HgIZ*l?Uat^3;;-5{vc8iI;O z)6KMHp`y|3Pt>XgZuU=0R0YWURvSH)UyJSdBFDQ8pOO6|anUg&O<%|8&4P+WK%ZEI z4(WptH=m8@=_Ab0-IKdyDXQ`dOyAz&7ZHKjDHBbfMx*H{weW^Ba**};FZlVwd$H`QM^L^!+l*-+K6Bn8IJxD3-x`fZRbNz# zwxMeGgEhJwkq8T%z}k+&toN7;8@_hca<@X7R}6-Y`F%fXI#u~?%zEP^v))jU;9`!Y z-6s808)Px|GrFa4)*a5o!!&+d(tTnI*|yP+4Zk|f;~9g@8jF#ik>l$S9j{i}p|;jI zPh*xJ?r(JeasAE%(>kTA5A(LmV}dcG$Cv>|j3Fc$TNvVsM$?Q#{rsM~z?hx1H_$iA zvCqU5(ha{DL){cdTcwc?4N!{#@FAXJTueWyZ2MNE)AQX`Vik8bpy6N{~4P2si_^j zHGQ%(z#jpLiKb7Z(OCG{eDL!H_hRG2Z=;c8p|nF($UL*^<5Blf3s>zdi(3GY#fFWmog#R2Hyc(vux*pG z#qq5?kzr%&5Ejw4s8U;Fo~K%1Zo>UJ!0zt_t%4lB#==I- zZ){*}Vs5C>crdz;FK+I}nR2|zi~0Jdji$FzUtR@AkiY3` zNyb+T(NME@eODXn8nEX2mr!p`Io(sCm{OuD-fdS~yN1iB2_c>A4qk~W)WUn$%BCu) z0q}=I{o5OOAJNo^>a1cjq~oxP?4J~kkRg3A{O@NXcFq_h!h`ziYUD0ihPrZN_O7lH zl$3zTQJw2%)te|>x&bBYcA(!`2cx#I46AQ{0X6w07;)oS2p+ueripH>t4HywZHO4x zJVsDOS}tr(JN)C@?_O3@P>P)&Ek?hyIUr@{u#Op^o+S!&L;rk=8Do(7!6JkVO+oO$ z-3w~#{{0#f4xfUZA1_AyArn#j+g9{FV}TjFXNp&C?eso9g}fhEmXmoZ+7E0*Ht4Ts7)Ee4v@FWBk=L<@+Dib}QK#Nt32?^2tWMtu_=xiuKMJAa@0 z5ywDD?$^+w0Z)U66+by;<{MAgJ!sU#T8ZbT++LlLa*Z7`w%V~~#l9WOgX6!%B{j&k zrMw{5R)zCASCrYrTBf4a3_~dc>eYE0LbY`-xU607L{Y)-b00Xnk6(acVZ#&f97ARL zj5&Dd;m1@2&x3C#<%(4b*KDxa_QOH%HD2SUHw*FRk_yw;^LX|07!iN=CH7ks=DJt- zp{xOGtIevgRo-Y3!wT$O)Rk0V!-H=keC#0j*lpPQ?59}$&*xxsIc3ZP zcP*s5QE%5GRUvhS1;IvpJ_Re|4VBe!1_y}0J(%afKC!U-ce2p(I3}+_@W3QE0-HzQ zF58%af+gz^JZSfg5?02!@21D!Q)vZb+jE~GdRoWEi6E?uXMed2VWaw+A-^w0ziz=V zf4m%--!+>xiAzserFG^oWX@1>@c2X`OoZ8mns!s~}abQ*`lBaT2e}LJAvAbqyj?&~l+cZEJHmP+y_$v3d>g z{ZLz6ZV0X{YgHOtuPrKv&DV)aRbJEjh~gO2Y-(u4mZv|GG=loZp;ono~Iy|X}$88Ln^3VvFP@Nt7=A0C6} zx%1N{h*j64_4&3=H|vun2uV#=dD$%Gec9$r1gbpqoIS4(pLZ+&yiQh{)!Bt8-BCKwzI3c`e9O&$Gw3;~;gu zJRkMQ%6441PkycqRh7->ye|m|RJk{Q^YWK@qN98#o^%REjT)K_hnGe(4Uhg^H%v(pxQ5*qB*%)x%OjobtcxP_`)p zx!?VU!IvM0<<~xjK^Gq-U-t+rvK&E-l|%{`tXw(*eBG7|tY}NT(=L_a`l=ccLRfJn zJO(S@^{TS$8yO<$Fs`^V=tf^BC#$fsS zXXTA)maN&1f?w9l^=4(9Go$?8vp{@v)D77A;ZM>a8~KlO5Iw{A!e3ifE?rTY>bqXH z(z4;#tDi;X_B=D>z=DPj>IFTqGCr53YTxhpg$fh z;Vf4uGPB$ptjZO$I(7z@UipyxPIDHnz^Gf!MTR<0&N#*Al-G%Q^GuV+ zt=N_=Wj95m5_OIZwar4HcdNG^Pl%V&tz`&t=KQo>i8kRzvRy$FUyYK6%9LFY5<()ZcZJ`no5s610eG-EQ4^a^+ zZxm6~Kl5g(d*w2pH;rcZjK3)pl{Gy_R5@Zy0RDaY-VOZURkVeQc6+VcTP;+4>~>YD zoP@HiI}xKA%z-Jfh@6m$tj~Ty>4r2UA3IY-0kTY0Ftb&Kn0_|$XxYL_yI*Vsid1EO z`%7P*CzRpTiRt8af%M2$87 zdI_N;`pMU^h_QpjJiM`{7U^m`em#^gpHF@$Ulg}K{ju@Y)f61~RgGT*DF$s;>08^d zvd_UUDa>qr=3`aS4M5J<%SB9ah6G~m-LJ^`X1>2jj+yuUDikf-h|=|GQn8FvdFR*7 zkkllsxb|^*`EOPYV4m-9s*=xiD8f*1qNz6<9EHDZKf>Zlo`Be|Q(_}vCipu4h7pgo&O&+RlPWL=dQo-Vv#QH`Nb((7HMd)d$R*Px? z(ISY#6HVl4X~VCsTc7zv8bi!y=+M5XDJoXmRGKMv9_AtE)0LI zYUF&gQo0(jak=gJ&&@5M8i;3!U`J7r4YmCpTBXz$l%Z^WCW@DDgEKNnl>>X%Kbl|H zV@8igjY>D|^@SpW))kkxxlr)z=)$tEtuz=eRv3G^Fb&I^!yV3b_d={IUdVs`YDQM zf3*xlt~p7{?gEvbUvwD!<03?y&R6;3ahYF=+tJfUB2&E!VrP$$vYGFU!etu}HFda@ z&n#;R%iB10{yYZHlV#QL>raQ>S2ZqcRe4rfBgd)C$P)`j3O;cMO%SmsM3up<(`DIR zx^9P@I|cZ`mmVwcyOP!0r8^QWUMkcvXqCcv&opT*v*F>lrHrQ-y7jqFMR?(K$y}J1 zjxLQ=wMJRo!G#|$+6v#@!uKw(y|qw8t4ucpZZ=@Wibq|;2zCFXrwteD0*BonnT4;K z4P48Lz}#Lf^|WqMEquPYL{K4W0}h5tQG!+;`D%{oqlF5S<&Rgp+U*|qjX?oD-ahy6rsqLP*#k=NCi&gh-^lwotyluewHgWr$JXZuGD@_VfyuNH8O?l?8SbW|+ zBCNEyU#7b!zdV*6;dEQy_q~DlcEaOVA?y1^=xSFCZK2X^p+f7Ed0*ZqjkurAz7siL zuMi<}>hm|qbN2OuYt6k5Ed2XKA#7wa;*S~+|Kyh4&N_;JWH@3bPcnV`FDxr8YZ6*m z&~k<4>GEqImoRG_70Z&YXys-pyOWQfDHbU<^&Z&r)Q1>;!x~-6e6V7X3pHKu)#z11!WuDVihAcVbG*KE%xldhE6ste8|;XP zZba(HI@!ds7~;LyzS*(Q$FgCMvC!~FR!;<}f=GT1q370H@5Et;AFZxEPs$WiXAnXHr@AjSj_{J72K{M};RK~3eJuBtgUichi@4gs?suG@~D(18V2^&37zSOdD z!gI0&m9{G5wW@(qk&$Oq0M+%CzQ?SYC`bCVn_-@D9rd#oX@$4tSM?lmX?nlttUKM0 zykAtPnANAM1`I8N3Re7v@~kYmUY$h?DlG+-*4=yP=kvAvn#bf>I$%+i?4SX$h&^l! zqGt`2t|lFY&v5jFvG9-Tni$iY@Dx;NO|tI(H{cBR7i+qaH=ixPS7Mdn6q=V`^Qe@? zCF{~K=3f_zV8AYp6i8g5ff)JEKVZp4{}z#)mLKEpzf6^%xneoOvXo_L+}tr({^$P_ zQJhvX!*4uGx)m`W>}Er@Jo5>1zg;Op?B=IFlC&wvj8?~_a6+M-{^;pOIm$e+TxVGs zGjk-?|K}|c&v$|Gq@ZZC7NdSX_cQ=V167}aqVN0FN*uU0b0p@HTO?)uX!y7U3P4{&L z|LWC!D=jNC8u&8Shw<(({J@Kk1YpzJecM1DG^`%s(S~5c?mld{bNT6O7g9&nBPvE^ z%nb99enG}Mtyg|s>_mB)^7J5RaWi6EopDWNG4scD<)m-1qqM{aLq?lz9|@;;(S)=u z4&-DS_iSGg5Jc-4l?T>C&3s6n)blZ7#3ahONeKN4DKl9vrG- z%fb3Q1r=JSSQSrJPA5Eam3wvut1?crZgzR`QI%l|Fhj37N#d3XZi64E}#aMOI(}%`LdDh`GvvUcwV+~Iq-1@%M6Nq6R``4QX!yD29tSQg zWql)q;0*D{plgmqVE>LyKj;@4irDE>Oy7Y8%W;b6R=3E`z;ep6^w1m_{BZI=!7f)E zH;3=e-BD4q1wXE(Sf=U`sR{wCb3b*NMT+nQyA7B zyx4}jW3vN&`g7oE`KD&x2M)w*->2QKSncH0&XP4QDy%s_KDgx4D{$@~E;Pjxo{e(l zUhvs+sOPHV0=h=y$?A+cJpX+uzS~fZlFD5_D0`cMu}(}M?1u~Ih9ENN_b)fJg$mLB zUg_W8rcLJ8J${AkEUmi_X?iF868+iaOJ&Rhsbsff8Ib?$DpX|dG<_XMTd1@YREQ;_ zu)(jDq5+&?fe22GN8j`3!9Ov=3~e74%aP+oBQP$`2+(vGS|zgE8M^~% z_J3$Oz>f=^dEc+tdOGq-zLthCu`E>BAg-ycMMZhJYB(#usvEJoB#mj+rlI@%BLUdD zZr@p{q>iYUL1&x9I)x2&(`6(rQq+niwwP^sY+U6)eooJ>&n5J2K*|74r>s1@zI0XQ zd7XIP%kius2Y*}yb@nQ2lBHW>U7k(DL+LM=~BZ*os)IWa*irYEO7P_0fEdB?>!yk`Jjh+h>nTD z+wQ@JFp(?RK}T(HxjWju;MS;J%-|VSj^z&vMXY z4${m4iY<;<^Q?3SI#6&$hamot(HM67DM&bGLZ_|W{G+4bAHS=03dgq+bMt*j{-QN9 zu&_nNjvN`Zm0cq{L(VrVW#Cy(z0LtvJIdDQK9gyDEn53K3isiFv8~}XSGV zY?h9~>GL@qe(U`>1{DV?XP4B@V5MilG@16E=;-;i1+Q0Eu61uAG3spfSL_ayW4Ok; z`VBi>YB3wdVtK&-#uoI>Japeqn4RUVAIZK%78p1{Q<8(H`*I!f}`7bwJFz)}nc?V|6<3-e z2Ns;hm4hSaEL>@Z7;Jj%U75byGn`@Dp5MP``eDh*0aQaqB%%K$2gy{)j-bwWCA0ha zA%40syNm^A`1<+6f1_+e`aYe?wrq2zF~e7FJ>uq%lL5NZUR?;A%YmpV!<1_@IN8;U zQx+F2Stm27arQBGy9w$Subz{wSn=2YlZJWdu)eadGc*v}p8XV=A1;<@i`V|^B@tXA zC#1@N;2bx{5!7m%I`nKm$@bg-PtL?Y^_am9Q->%Z;G|8NK zhh0f2Ce`E=N|!heSk6J5Ia{60*D15TaX;UP5IFpO<@lNJ|0uJ;@%O{@m^V)GPeF^< zol^pPo-gBg{W;J%XY&ajm?YMgyiOFOw!ip=&+=*1ZWG zmID98sQuPjGuVFw((|8H4dfd2JQ;(E%J>)R*|OO{h1s7a|*w{EJhZts~E90neozq!s3l)uKZ|DX= zr5d5Q*>h*7>}rwAdOQLJF`S`5AR6zq6?Ap(+OL`>k+^PCCH zFFH&F7S8@f%a>9AJXZvh|LZ@c>;n5C5k9eTU3UG!zLqWKs<_;Z$jRp)sjDo zUF??T8ySk4!cye_v=)OeKTghxRwV59k$A)unK6c<1BDPzK_%nu?`0-8AG=+qWahcC zt7t=|YMk3`XjEy$%o;5MPr~6-5H_Np2x6Qa&J`IVGoo=?`>@dikp0zixqh5NnKO}X zefCp1FV1q*@9cwBUTpII<@Mz(W%Xs8s=rQVpQ8}udA{5(FgZr1V5WshV4qkCPxJBlmtA3KE#ZT*VjpbV z(EBYSN(y`s8r}$-&9GA8`AL@_TB`7xtEEO=>(b(G>I`7w=idnb0J+lc`_07&0ggTH zBpiOk(Q3_jPK*c&a)g44pSoY&n@5dif2W(KO|CP28cp}XX_I%E%HIPTR{0UT5GJ&~49uhWJA!N(Hg+84JvqJ;UjS8*1th zm|{+6s?NJerNPESSHI4!`}b=ym9Sq-m>FU~llQPu{r7l&*7utN>_)?KH}$F$MD(GxNATce^?n&6`|`S$Z_bpNzi53^_{#=FP9EwO9QvJk zkfg`+U>6(C^2RClX{ABS8>VCBW8A`C``{3KzT%w9?_MS^dvH0#zBgVwn;%d$i<{RyuqpDAMrSm8?sX z*~~o8mli*q)}KNREmaZ^pMu7Q206Z!kD7u~Ri`33%ePRVIfx;sx>Zo_T`HC~9 zbXKmq-vb7w;^u$chJgbIsQ`6PR7T~AQm$d;U(XNS~i_LgoCRI2etp*d|b3sUWB zx0~EI1~&^Td~xh}^=qv9=X0tNo{o|KI0qwdIalJm0fiG*NVmQC1xDU{whUrPXr|2Y z(RW-RX4Hg@37R+4bp#tPs#?|fp%5dLZuOI61(9JK!(oImh`L_9U2iC9@rx?+%L+6bGNW!gPxi5{1CPlu87y&& zUr!rr>flo6!AiB2Zwe~?&pS*VS2YUE^fTUHq#6Vf2vLoUHq%kpt#w}52;yW zdd_hG*kFhlH)xmZ!+mMeZk;o)0j~wWhVnd!r#Q!Jz-wYt`KeRKqPe?VOSP@dk2b() zas9fJf>mo!o}OX)dOyW=HoTVRKv{kBbGx?;2yDc0Nu3k=f5cL3X-G558!r%yK+LdB zKs1a7Zda+?k&kt^yn*W65;LS@@VN{d*#}9dPDk*N1T(bj&@v)+;w1cZ=AB{*;x3;} zq%2YYjLT(-*TVb-RteY3xV_Swd#~T=7#DN%+M@v?zxNfBO_4tg_S+ zRM_=qn$gReMVj>Y!_2a>S)`N}b?GV{fvg@aHN3L%BdRen@in0)*!lyA>=3o7gu!*>9M z0=|P{=Z}-FOKk}%wASGHQ7DO+kSgV%r=YU@+Q+19Wmz}if+Mi`iT4pYG)3;+z>ANP zZD?V{ZcFh8PY@x4-I(~!;(4)rF5j9ZU48nTJXgw2o*Tb+!Qp7d=r6r}Ps;UNOpJ5|fgcTJdUbVdc zl0SZ1(tXyusUs;csNbmiiJHG?S+A?}k?}|BmAgN|sfzmzs&`*sUTZ>Oqq58g>D#)m zn^j0yBYgb~%OC#cq_i}JG%lB4aScv6^$hp3;py_pvD<_ASJKjGG+jqqsAzgEv{32i zFf0#N-TFK#wq~kORkcu+x8ruc=~e3#R%Y3N&s(%cDh3o(*hhVbs<^ST7(IQ2TTo%e z@yAncl`m(k0B=^6`Ixz5#XOvqONub8AlBrSsLEkE23>lrRN7h5Wd)XL(+oXaRrU*) zZNPx@k3e-!A$ESU1fj$Gib=VXee0|1F!V2{$QML@ymuJa2h zg@%C_9VKG|(0U~Mi>2tVD(Ts(Qg1b6n1}C=zga{dnz;8laW-mIWte^V*?{5k23~Ru zR^9xJ9-?U9gq945n@&9t+Z$Xv*xas z(f`~-@$-52$UW!y1^gl&J#{#$a*Cu@BgL#$)XJ)-pYev*B4E-# z{mMRs1JOvtWL2Evi_Y`Q-UjGKe|9++!(=}+l$@dH~o;Nn^ zo1YaUta+U@KTpQC?Z+D!+q6tqdCV0n-g6)2Ya`xTw_GEvIo;OBRUWxc4ULufaotqZ z)vNc5Ife@V$+~ju>grKaT!MO4Z{hnvL=`$_L%XWd2T$G;fYKsv?|o87)EnpH!>&JU zymPu_A8g;~K+S&IeQLI z@#b3)5*(`TfgzeuNMXEsmKg)iJ6!t2(@G`h>*aDR%Tk7Ev0n%XkEZ%Qqq8JwxbV9w?^J9si%pvEku&FkFSxqQo*aS?Jon6A};V1puTct2!*ytu{n ziJX`!Uv7Dv%};zF$F~F(&-+NM>)n>1vgz^nWZR-&x5)kE7vr{O>DX(eg31cAS@EV{ z1@lQwIcF9UkMCsns2;}tCa6SiNyo^yztNF`ga81KdPzh?-oxKb}R}YhQ~$P?c3jZ+=Rmt00!+&XE0c{1b1pBkw6} z+IgE=WBG3gDTerBtXGs*ptP*asKRi359PS4G^*jfVYL%)Jl#Ew>48IyE-=guv!vSZ z$k=8_W%>SH7KBAKA||2HxW>HJ%BiaGLFNwcTY%W@O^A$9$KnNUWPR1Vzl>D(J1{T^ zf4%-j%$>VHh4b04o)P7$jVQ16Tzl=c?l6mU&N&CqKmWX}_vzCIix)3Oe0)5vxZ(<&d+xayKYqN#eel5txbMFE z@Y-vy;gnNO!MERjE8!MAUP3|wjyvu+yz|aG?)~n*`)+YByX-Q_gXey;XV1omAAX1+ zRcGmL_zUwcQi7T*vTnNCul-*3+oM8M1KAkZPo}3+@a5tR^h1PdBu7pfg2*Yux;l8%~+#G|Jn`Pdm^lHBKnS+M)I z9G8UMJ6O@>ED1Ya{z?P|T1{Bc+?^FyE}-5<`qa_Pzoes}ax=E>f&p{P^ z!-Fv4;VWfe!?kz6B40h*q>bytt~)d}C)Sru3+q1a0xK{oFBILZd(nE^=`a2rCl-Bx zlZrpYNhKfQ)OYRwlowboqfzQk$uU*WWduW@?g z*Emfrr#CG$)*HUU=_*{})pp!=!O!>hdNE~xq+XRB_3Aekxn?68U$_e;A3lVJ0$S5` zA9i-Tm^l=w*B^`IGiG>IOkr1_sPTrSmM0V!XS{loOgWu=+)Pw#%f^mZ_B>6lX7^BF zppZ+kyQ^XfVOiQ{S=K=~UYEDU6vA`jx$zven9^}lqAx^{U#h!$)V#vioDcl{{o&`U z-bwtYf(@~SThIdx9#N0!3pzIyc1K}tjE#G~8Cf;kxnutqQ%G^44f(moY)d?E_ZT+a zKxnwSjWVl`Lfu>A{+f&Wf8^1}V9uO*;y3QUJ61e4o2qMSF-6k}&O7fsqt2_ArAwFM z>8GC-A%!elXmqoD^UXKiVT5AJuwh0QP%e)=@(4~l?X(u#5Q-_>_nU9NL117YQc_Z| zbLUR?eq1b}COkYGx7~KzE@_a~`yF=JVIs8b3%oC=u<(!qgr$kKXutM*-ybwCRR*3t z{MV;tP*{0msK#yS#tgAu82{kq82`X!7L82j%_FitIF@BO3nl^=7rTJE~Y zSpIb(M&EgXjD<4l_VcB?2`w!~-TDWN{O2Eb84rWqiMY?CC$2@x>GP#eIW0L_Lougl z`9|q3LrVtE`aq#%`L&PBcrP5!q&4iuLIHtYSlE@RuCzkLonLQ!8q5FmsPq@-cr5H9 z!)Yi9E6VH&l=jBA?(~1T^g(Il$T%SirpvKbR{Z&K{C4v*ZBA#(e*N6$$J1`Znmb?I zZ3Uiv;W^Fa_Lshpu}*4Bb}igEw!m_AJX(5Ctdc<Uw+$yjaoh@yjN@}ID*v@8WFR4x4&`Op0oWnVsnhLSup#v4e%h`@ny7<|nU zNWK0T1gUjz!ZDP>2M>f(Re0KiQ`gRX`&KEJIgqGEqv;;{$6e#D9+^LX1NBa{+a2%^ z2#~3CjjEHefof*Bx1W7@4F(J|#&7c`jSXDXah031(}wcW-M_o`Ckk_IC@xUv-pE0K z)pcm++t=O@9NGw%Z)5Whp)kY&CTZP5YbADr>Wy$P$E@!c zb$BY}p2+^z<%i>^jC^+?{0ohNkcm~C*~4NHFyROUj6W1Me?$1(6K!?*VOqY4;fOzc z9HQrsfYTfd+uH;sCn0j=aMP#JXnt>2?YIoNB_FFYfTaNILloalSNTgz%TT5kmN}f| z#~Rzi8fT-T%!cP4@<(yOo`3VgT#T|Ft;ZBQK-G@B8?pR%gXnn#o|Mjnb;mkA7 z#7#HdgfGARQnsOR!{x5K?vgG=glV-7>n^-s(#en8;}>o%+OPdy_bbN(S~E<3`mZ>4 z`>SG=!RazJokRM_`?;|En#a&kQ`>G=o{m843u{2wy}?`Qv{ zJF(lu6#s|_Ev9HRJ&b|ze^teR*|0V%Me?0gE&S&n;16FvKO>BB+=i=$S2fTZapb90 zs-bQ8y+LC`lUQjSsA3Aq&9ce(DYVk@7B0Ug8K=dw3M>onwHbKq@h4#3-1!VtJ|m1# z*1`$=wV0ym3Z7kl%F4=6Qc@zK2?dS!-g^(h!NHg?VSZNcfu*$+v?s!7?+-& zF6psbkQGi^cio|tiKie!3m1wh6mpoC_Fx?M-4}Sjv}2)cmCUVOs~V}}+je!l>2x&S za9R_P93$O*0{g_6A({@Ot}O@29rwUx7x`90#0#xI8mF z_vYuVcM_NohoEGmtCXg9&`^|xk`Mlaf~T%R)w&<7n(rQHLhz7848G zjX3%Y?@hl`US>m4{(&o|Smb3Hk_-&j!!=Mq=oo#>7|#-AhebM;@LHaqRHi#UoL_Ry9Zr)<&_dn zD-w>$LV>2Ea8O!y{h@_RdoUjqXS&-ug><8ZN*k_3($Vp4x;ox;IvQ^{8jYqU;lqZ& zKf3!G*qZL4E_XYMU%MUo&s>9=%}dSDUE$!=1Ftv?!*4qk;S>9tq1}T`HOQhyjWm54 zji#s3C;9?J1bWQ6#X6GwH!4ZKzJ3S_GNu!kFa{e@0yiHzst)sy@s6m%aYQu6buG*@ zWR1PSrY>hhOcUH=N}Ko3eGAor`t=`(<4-sd5s{I`fw>rwZm-=Q2p=D9y{hRN&ph*t zdVUP?j@BqAo_L~In6wrw*nNj03q=!l<5|0Qt$RO;Db_4Mo>&$qoWWajt@q=xJ32PY-qKCeCU>r{x<=C#-WU{!{(kz!tLqx(8Gv(mu=+gQ_jH9#$vtBvqBLO5i0skr6CJL+*SWl5uCpf9XS=+_pdBx<9m4r zT$45t)>V|0#+cWQ#&bM*YPbE8zE8$9vnAM*>G|si%UlG^yXi zFqBwRdEy>MfqvQRQ=&RZ;CParO(-o(AzsTBP)30@&p-Xk26A*rF0q47%tc|7cH=86 z`csa;3m*YRb=a7-6+%y>29eN#UD%ZXT7X;S@V}NuHm3x1_G)mz>m#ny8jV6IR@N15 zSzY-`U!N!%21ag9>555siCp~$LkgVT(21P-r%gMZ=j++>8Vs{r9yCSwm!9&0RxvaA zJIPbrvohOpo;$EK&pysWN5!v-cN(jj;{qlwZ`zUH>dMO$S^w`ZiHy0p;V>yWJ@zg< z0bm|POa^3GJpTCYgjtEKn5vRKC47!~?HT=H^0dhV?`92=2Hr>Pyd-Yjlb4*mDrVA- z<_|xs547T;nv@oMkG8)Y4AIXO=!B(hAqppbZ7RR(6vzSzK>Vfask_=p16hi4eG}6)i*2_~LpnCXzdOEU2hWZ@c!&$2!M;7bKg?@tNIDPS8qM zX~GSYe7H?ONQBx~RGLKy?yoUu+l?9CD4QY4o1|S)N z9)KeW0ADQ^)7Fc`o?`zU($Kj+D|`6u)Ju!wNQyxRvrDjRgBIS}Z|_s{=H+zsMESPchjc{n(Qf}sM@V5B1vmok#fk=dV!)dPyVtv2fAU^a zrJXamB|RJtjk#FY+&x0o@#eJp8cN^r`f>TR4UH{DbF}RCDsBm#L~+)iM|(tGc#%O-t1C zRdy1v=62^kUb-K;NV-yuUt`KiMAIzDJqe{U6oVeb%;k-Ax)$B_QE_K@P`FXIBhL$x z@1m?7E@wd@41r6n3iDI?9lr#;BnSoY@|5~ zPYFA}2!&+xO(4m0ytT!&jp*WFsU1vfd1(+IeZ(1^NkGR8kb^ua(%8zt=|Md z4vkTzMLap#c4>?CG-|3U8xpc2+bnG#aLMO+%fLQbbVyK&WZgd(5Bv z+#vD}9%lcHcQIYZ=@D}`*@g|d_KOwGDEIkSlH7f}xrnZ5F}tUen~+>4nLqqu!*=a8 z84Rx%`toU$QbPX2*7(y7t{qjR1eoS7*?66#1UH3{(%7nMgH|bVoIy5Lk6_Q4tf?OS9O2mt0UR*bSTw1p`w^XZLiu-| zHVrf(ixs@VJy%u=3B7n0O}iEclqc&}Sg~K4z;C^Y786xy-Ni*mco0O^|3r1n*ih*- zpfUAplc7&cp|5u$<3%#h>K;EO1x4SjvHZ2`U8T~xuRk7NlDo)}Rm!)Z0svu=+@1+z zZZ2P-@Ys<>)?35!t}KNgryGbLax{@Z_P$DqPG6nr!9GR!l9Hj2hw=Hnc_SCCG@`te zd*QJIbi?tcGsWA>FMcyk@uaqEAyhgo!pgN3{I^Glq$c-<01I5>4$tAlG&0x22K${| zph&jGE@JT4zi3JTs^(vVvF@?`)5I58%(j3DaoC;Y>;1MX2zM>dYFQx%@-3NGw09oI z%7dWXo&E8cqA~Kb?tLVuLjZM#a_FLd#TLOGPX_t7nrRgGCJIw#{cQ-})%XBF(d^4?`_$X;zNq0UVp;hcH__6h*pyG}{EZ*nM zouHS`BebkR$2&X96Ixa2t0#|9W0T04zta>!dU(fRKe2A-Fe9iR8d z6;72(UmyW0I(Xvk@B?h>9?RBK2!Cl#2)$ydVb3dhmwJgL55FD0wZJZ`HQ?OAJ`BCe zOEcEkHTSfXXGpC09=^09weSpP2o3a@1ppwZs!}L4>~vz+$i^jsS6+FoM#;u0bX}5q z5j*G&78F2JErXcHM9^7BOX zyw}_|qN{+Q^zy1Cn9>w585@%24Y#k-?w=y12wEWV>#j)=btr|&uKg+NWPtJNsU`>Yvc)ed89-Atd8jF?@Q5| zX}LMC*&&6?B$cfxbGk+a&k;B&LEE%A@E&2_dBJHm0+=h#m~H|uBOB8drFFf^CS zp)nN9w=1#W*S&(i zH|HzC1R1jjoBC^2Wr4tu%mnm~GMP6f0BF=bV*~%yK@5 z8FMk)U{YGaLCP)Gsi>OGZs&J!q^(9Gv1jL$y{7rR7dQU**B&MWcB2)eSgr{XnLmN<%$04?*f#O6tF++Fh1h+uAP7}#&bce6`o zH5VhB`e6_IiUwrLSI5(KbjoAmF_?zA<EZ9O+wJ(oCxB3Ae|j znkwnpR@-3{JOPVhmu3z7%a;NASK%@yX(73)Pqao6{_y8HIr?a5XgTHeDv{GOMUj-W zhwU190u_nH5`^v-<%IR+^EJKBalwB@{l(aEYUqEvO_}g6&)pM;P!=ovCLPA~^sA7GbS8u-=%G&dkJ`!? zESJG#y~Iq}rlz&#Et1Wi@Z4dYfI7>cR%IpVk3DAy+xi6E>4DBoC*`IfQhj8%t$bjC z4r?PWdzszmCZ`6rF~1GZq>_L`g26CA>a;Q(P4V>qP)%4jMzT8=p&7+8{CXqXgXb0F z4sU3bpdTEynoTpzN1{Jwb1r>Mxov)bXFQ+6%sM+?yuDt2+s;qZ{hr*n)qOI&}u%$3C4uJj1V{Xy>!z5Cs7k>nXLtw`=m>YNsSc$-Zb6$kT}Fwv|t` zwRKVCMQY`}p#)a*YAsV|itlA}${p0pnzivN7d8%`C!!504s7OC6 zSlTsDs413}pSe4XTFLKobuUQAG@WzLs5*E`?5>$*3qG#j>zJZVr4m^WfGl477ysx# z$FFV%pOPk0dy?)CTJWb6Q*lBQhsc}M7Ig0EfBkkzcXEntK|6K{>lTdqX1VoscoW0s z=gBttSIC6gptsQArhZ8me)EKTmhu?p0AFu%#|iyPE`u;ASberFOz&e3!nn%_BkehJ zL~$n($x7WOtUR2~hs<`G-Ih_lZ$l0+V^jH}`7sae+&yN|%e5FvV4oueKSDx9UB=~9 zvwRgzNEsIP{?Rmel_e)|5v>nZMo@O=SJ)^3>?O?gnlyNTYWQZiH<pAkpq^rFecCK34D9}6=aKLsM-Z?+jH z2Eb6|O(=U7lETTjC2Ig>;ZL!EcR_O@+6Ke{R>yILeBB(92&cLP^Xorpp0z==RSlB3 zUcb<`gW&*@Edq7t#M}-zD8v*j+5u$QG0qxga!`7i*B?3f{O}RAw%HL2OxdS5**!yE z$iKeUnpfWFV2a;m6yqPo*zW#e9uwV|2q~U=qZDV^KcSRse#Y&=^JsIIc7O=z+QXz0 zg#XM-9-#AwT1WL^H&$mT2ay}~orE_s+B$*H0b%~t7}LhDc5Qs`65SkIQZ9sN6UDIo zmJnMp5S*#{qmBNjnk8uxtzO#AFnhBvOSk zbHI6t05lR{921bcpvc&gvO@i!(QTtAk?0;$)IBDA`guG!T6j3UTpwB?BWLV&WbfBl zbQQXZ==i7ki~*f06m<2L%*g3DVD+LWE6RLyrua=w3ixblxWnO_*N7@XB&ZuWj08TY zk^ZCKTWUPoM#zygvYSwa@!X?$mxFMseO9lCsGx{V0};BGRYGi`)}h7#)+GRueC zd{=*V7ZOf(bycz`&HvbFI7!MXU{HjJt@lT7-rYqX7#$Td63Jie*zfw(MqGfUf+p(M zUOx7j&wVd!cGw;>D^k#}`R_e&Xt9P^3zjk{tEkdmT*{I%TD^9HPW|Je;|HpjkYsw8 zqwYq~RGiO_>viwB4B~ZiC!YzNb>zegvvLa6r|tQy;NT~HLqD@(?yJ(NICHLjs}Mz( ztQDqKuSfd$5=6R}47;Mjr0t_!w7?b&es_9ijR7|Xfx>8=hdsq~>7^YII+9*sb$9J3 zkk3J){I?S8{uVpLd$7MFVWDo(`M8ZiIFbPRt%wSchxPA)p04r+AzF;kWxQ>F zgLZ2zEK__(pO=H?YYLj;2K}4JVR^-*6AZb()#$qL3X%=QIVdg<4^-3)F(4;DogOrG zHZ9Sj%AdISYR`4B0j?cOt0;I&RNC$)3Hne}TSexkT4LK=xEM68U;6Rvz#=(sA^Za? zVP$Ln?hF=(R<5ZE&^i_O^@N6fr+iXXe zza@yxebz`T`aZWOEXd1Oc&@JsHG3$Kbqj4J2V2paBuzhS|} zLR<*_bhbT+!V}kV8{F2u*h_5g-GUob%M=EOAm5v;0Gv@D3FQ-nQt_5g%50{^Tt?y9 z`ce(UhY3c%^`Yn<9v%h;2NOEYcmPOf<ghRVap0<4DVP9Qh9M93(hP z166ppAFbfw1$6jYT(Q}R-r_K0ZYOk*Spq#VCq-9>nuA0`4al(ihcRfCPd#D3BrbkVk5dVxU{^c&|Jc#pX@T9;SqL#Vwd+9V z`{2VO>!Wk1bW;FivwJQSe0|H77c@#zlJ>r(BxLw zp;M$PzEj9ok~bUnz1ar3fsN$u&zpX)JoUomxShOed{`drs~&I2AJ|*jao1ge(m#d- z%x_MG_vQep{jzqF?t2W7y|4-QQ{mQ%^GgUo@f1p@wLb#K^HC8q(pBXiLXaCGc+p?Lb>qv(L6_+LUfL_vwgBC*$vt2Gb2~2 zO_V+i^c8fc+OjpoBSbRs6NZ>QOjlG32J-$IcsucQ9`mX)jxBr6eL%bZzF$(7?Xm`T zo|-{?L)v3fP5-%e*YBu#Z5t@tHD{$QI;`E6fvD{v1=NgkAJy*d$kq=F|pn^83|GQ@JVlD zYML;MdAzMP)t9hHs}5g-Vw)LL<-eIr9TB%~_r>AjCOs2O4#ASeL91)-Jf%mZupZS6 zlfhvT-6_TyVRmoU9~BfHT`i2CpEY#V&gRLeRRPjb9V81*bb%9=r^EJ3uT-p}bi(a?+JOvw9sPd*e!V z;%*#K(jW_fO1|A-#7<6}e=aNTus_X3QHWjlDanX{+SmG58gN@SP2fbY-qB7+G;Xfi zf}T&I)X(qyh=MyLIr|z#a@!cD{QWBR%&z3u{M-u}e%m;K9!B4Gi~0TO)HR&dAFGyr zePQl?;uHK53O>SwghTA2QZz58I8}r0CvJSI;#IZ^ZNYRkGZXO0&7xPCj1845qRqbL#&CrWy9uoyf-)W zLt2X-!%E7^NbUm>`%pV zja3VjV+92oZQh>Tt?gwKdol;3G~YxeHCvrj8% z*|C3Bp9))E1RWBjV9*o`U)Dx5u0e`o^(zeyj|!=$xV|cH?gE*>_;`C$m&qRczr~>4 zFGCG_FBJ$DS||J-9F9lNJOI{;prHjRN$%`f^m_a%26dmqW z>)vkAZLZs9E{%t~zzJfw>w_vX(*3Qp+YXn%j202gG!TR-gu=)GgQ2}VcymJCQVNLo z6$UW+C3cfoHm%pAp|9kck8#Pg?-6&}p3t6SKM#h(06}H{=O`UHbazU3)F(+u(CZFu zPkqoM0B&DvTcAO&R%r+#m3Z~Z z+cOR&nw{Me4ARRi#U9(>>B*%RzdSH}fCuFr2i$+0SM(B<*)uX2)R|jAdI&`BT+d+v z)LH-lT)xSut{K6JSbCSmaO-P)+4D#FpbX+Cw72^zdjs9>e)PCtAn+o8ebPenDm8;) znC(1Cd49%?R>x@?%)Kj-A_Ee{Z+D-S1&TvO4?@rK1o-u6?5DtHJMK$%1Pu7)&98Bf zVy>=GlrYg!vR8)#nQ_~OY_h8L&S=(FerbC|$`pw;me?7Iz?)qtPm}C$pr;aR8^~&V z9><77Ve#nD!|KAWK2>E7Ve$r5Tj?-);K+i0a%CE^vVX%ClJ~|yg)D|Uv0H4<`%0_+ zSO>N2zdHm(zXiKE=fkMT1uJL_EPOiYhY}aI--1h%&crq|5M%_nm0Z%C;~P3<0ltf)QVF^|ghP<*W3NET1wj=G*n}q4D2T%KJ&SqkiX- zI7Iu6yNPx?=^X%U*M1`^LyYZLse~(XKCj50E6aF~GUk=?u|MTRpOLR*g-@4di|*Tp zk8Lv^;IO%20qFNL-Ui;Jb#ha=iEQ0fx$h)ru-}D7&psQQ;keKLs?NxGqjTKh{Y_A@ z$E1`BiC&{;#ePUzQfz3pyK=0>%8Iq^r>5)KmH_8X~ddOj*W$@jp<#?aE z=$v=KJ?-3%yj#x-Lx>FrAph2cNT5+RTd6I>gAMy7ZOn#aWn&gPBXuYq~V+ex?^=6_VciODgv+=(LSJQe2B% zY>gv%^l(D`axGHw)x@LB=G&5K(;5qaN6-j~e|ZE4Q|u3!l?yDszxt|Xx_;4-iNt$l zqGX}Q;Ieixp+m-3TB^t&!ulJ_?l<~9 zcy2MQa3&|QS7WG`yDX=*B>=1%t>&8p)3fq+4|<&c^Z56~^Bf@EFf@B73GN+V_BiOl z;~cRq^AzWJ$w#yU){T|2=&Ns6fK^GKieEe%8p9O9%P-AvJx;3Ky-IPa z`$uUf7krQfSpCaU6tf7^@K~4Cy2x8QAEdE!cq@3RlVD%mTl8gW4%e{uUH}Qquwdv2 zUC_%Tob5j4Q-oMvI06o@_}C!fXnJ=Mfk6Z5yQ0Z+Qaur44QVn#DGu{fyMcS+A9WD zR+R=Up@27Gsf)^ZUFU27eA&)cUQRA=4V}&i&0a*!q<(<0K$SfJqb@U?IA_kZuG*jm z-&FIMiiQy)AVbDPnDm|dilFyG-dQlwdaEjVe}2GDxqKgsMkWY$x?sHLSp90ks)OH- zQP)AlrA%4F5?Q1vG0Ug{vU8n7{pV2$;9eC_PSN{@_9ltcEy$@y`96xy{Em$mVMHtd zJgvE#ng^mjqwW<(9k_EVf}QX=#OEn0k9FL`7}xcu;!e+a>}5Ayk&Fa@8E$%~gktd` z(;T@1=brU#4B(M@7^2j+{Yo>cXLg|amO^af} z%CoEvia-~NWEwKlRF>|1T0x(yDH)pQOXAX(&ur@4dD#ML7ZKdMFygs}7yBexa^FmC z(kiK(@<&jVs3Irw7rFz}HRa^dZ-XHzv$=le22-l!2I_F|K%ze^mEeF8Z~q8$?y1PH z{VEQ+`!s8EkIe2MO(zf#@k!-XQq>c2{l4uIJsF-PQXG|OA9PP~D zVemCAU%-J32qLEy-(-%(#TlQ}(0ak6hBEtlo4{M%p zvm|Ym!!*NRCFN{H`1w~?dn!}>$N3EWo5r-L9SHl9N;hcywLUH5MvF~ zE@`M2HR4U4JF$g*2lU@~stkaSuc_GJ_eptc5mNr1WYELHmy-SGv&zmxzI^iwl^UlJ zB+t?8=iZUjy;yeDt)(;>>MQHfE9zjB59laD!dn$0N8I_w|sx~s3 zi@>c|%Kg`P-C3oG6p;rUFzf+REZTJr^pDzaAltRab_`z_0H~I}?-Y|L!aMkZa*+3Q zyC{^Y<$2(?4Coc}(~e!J%-ui-8MY?-DJCzbXLT{b1JrPEAB(fQej9Ms4@Qc;hHk`6 zE8SBDC%gHECsbecx@|(iD8r{BGY5XSng>pAAO($H@~c#pz*|S(tBNax`-TRf+jNE% z2+;nJ{7HmZV-T+OMufh|K6)vZ8LeD9ES2O;nrS69TmqMO%rUFB{3=Ico!{~1x8HD4 z#VPta8-3?(0o?Sw4XE-YZ-oE8?IMr0UYj}>iS@)86c?DPd5oXd+5d$GhiQB9tqp&M zHX{)c;Hb#+WXZjuD6VCYAQMF`&s zj>XHo2ykPnGvJARJ$J(HNPJy-PXE??j!|`7IYgUiiZ*8Y`=85%OX7S)!mj>er%mp& zVqnp>)@Y*2FJG8(KW!#z+iI;JK#aJ?4KNcZY_qc+{hP7RpQ6%y)4!}z?$U~6``f)y zJm_M}+!N%?!bc6Bens1SLHS%eK*PoR}Mq2|O_CF;Ry1J@MT4eR+Bh^slcJx}B_X2TMB}Idj>f7j`98hgbXwbTF`ANN7|38xx`s0qn$#YP+jw63KkXzVZD?QcB*9 zqOERB4M}#&r_sdSOr~3CQW?zXp2Y;cc6n-D&Q)^qrdVAPHRe|~9pkf~8N~8-By%UP zEo!rJ7ArQqeU6#CDVy(g83H^<91fV&g#9gxD6;B!YK4$}Id+P(@!nBIeq6I!$> zq%6cW1Gfl%s4OeMW`CFsFnFc-q@HHgApvs`g&Ar?)ypsUSw)wY4=A6#=LkR_FXu-` zM;{m*74jtbTwaDG;3HB11&4++!>)oA04?;5Nz0~jz;VvA*6?F7jfb4VUjS9%-F3DZ za+mwvRa|0GRJPZL?`L4ot?gamMf&{w;muq0{?mt#0@6@$7O|FJMR}DxN1P&wv#=gw z-KT7xmK)^6rSStVwkh?W{X?K&U}BEu3cR;&OOOb;@opI*8Xt>Vi{Z>zQ@{JXmvVwb zA=u+`JrLc&p#c2wR6ul8nUm9`=;n1n{p<&*vMHyjWc?J%_CrnX5ff`q%W8}x`|d`6 z-)_<6VvTjro=B-I>)yST53CI7gyez}Em5l%AH>axL7<5%4&M2%Io#UVX%kl#_=w$w zj4RNkM7s%bT4V1Abt{a|bUs-_c#Z5|z95POh|r8wo}0`I_QLHqLt#m&(rHrhWBCTw zMd=OdL(%(N{)~8Boqfn^Q=zAO9Q`Ssi?e_)U0I?UY`@5KXV6N#U>zVBVuMFYXhvCX z$L-Xnq_C2)S$!TwU62fm*oW;V8bv^>?f(1%uJrBbDA%1m0lRr<+^()%)7uKhJ^e!J z8?bmJfC5dLu;Nq@cZC)Ub0|4&)oc=Mpbc3Wf#g?w%K37;4{hWu?!r&1t8D;E$Wjj4 zu@lr#B7m+(n5>l&0MZ6WUZKP$eo+`fiV)3Rxq;p{?+Bx z$m?dj5%Wh?=V;*YC0|)ugJFTdP#lQ4{##7M8F|^#U_dI-WcKU)910GX3yf4WvM(6< zxOue1K#Ov`T>jMD_&Z@YVk4gX`P~V43qAk)-Ny-thy$~nbWR5t0_9^8A_8g7>>-y_ zEc^Qx9hK@h5~^JjdLO|1$>xX`CV49ATv<1c3J7CXDhO!>Gv59Qyp8^I;s>Dl%ZAl3h{On|9)r%~YTs3GzJ`&D?;qcvF z*&4Pp@L=GU*P1I03j{(JQV1FZQCC&jnE55n3u&>0cf~pI&}|M{UIn#>sZcYS;Q~d) znn20}_)wGPh$;GIxr`=Mhg~;5kwcCqgl7fAq(f7460L}2!fEe#{+h&9X|x=ybyhmj zCfR)KsaOGC>f}R~wQC3XU){t8dH#slWaYq6*J#CNPDC{uMreuj3cR5Z1-e8>^z=$A zIle*d*=+=n0V2%7KLrG`HDIK&1v#~-+|T*93On@uC8K+A1%qeZtNc-52o9l6Ps#$k zQd$Kg0|;9TIq!12 zRssm4h)T|-&7)p#fnDC%m0X>0 zG3PmFd$;N|+-A2o65{}S>U3PyzZJo;wqQiaK%j^G8KUZepd^-GWYw7_vZa&4Oqm}H$P}W`c!V2t;TnKV<61_gwYjsB1=E_Dv zLBq$Hu@36!{oXm!1%otIWwLA?T~yICQl^0G8*#x<+2NFGU!>p*tVvU*0FqEI3pjns zNTI1#&R_x-4Iq&bQP7Wy!-ydid)ncBe}r_*2XX14LVxPDl~1Mzg?bsJ7bv@>Ru~>0 z+OsjEB$dvEf3;8OuU@mKdp$7u?O+*k6Iri7IjAZ#24R{V)gW0I$EG@B6TK(q1F6ib zt!9+SmelncXrusqaD8c@V7q{7PANetSDYe~Zn z^V*a)dU|@!54%aLV1bZP{U<=zjP-lN*8W)f7T;k}?g%{`)uo!vN_}2lPx_q8e)>Ky z0j6b(^`>A*jW8VTY0Ft#w@p7j~qGTE+mqpX97-$mza&|D$jFA9i4kI5n{7rEM$58zNi2l z`&#T0z~KK03eNhC6?^>!PU0Td7hLrB)I{ZQ)`E0rPXsct&6cuFb@E%IUwb>>);21m z{erdBFLt5XvZx-We!L(*1YRt~!m*Abd4mbB4Wb_M9#U3TIEJJOydbaeomoCoY5_cG z#;tn}Dk`YS$*L&_+##&1YDKz8En=KOod9vAVEpkNtFs zrP2i#vs0>MGz*1Fh)>$Fp5T9;WeRmmh!Dgx5IhZ(VW2Cvp&BM4SvSq;ZA=!Wh>PV)2+4g$&m&YnpYJIOx>bfb$?vk^K02 zdc2EsKP@VZ;gPhw@lv+&__DG^&WR-9Eh`xS)7hSMlf@eRw?4=m5^zR5#Im|#i3St@m>Lgnw@xBBY z0Pi?SAfiZDDfTyBXI_1Za1n2s2GDTC=;ma9zoDZ&ctMGgoZOvM%nGtTQa}}NH{+Nw z#Btg8LIge?WVxJWtlT4^fNs;wrNv7s?)NkQm;a}SZ z14lo-CHLV9&(f@x&oGU8Jy(E{$>{f5eUgmEE^v2j0e?MQMaIDhEE=Hd>Fbr$PE1@5 zDK3?k`WDaVNDBiE@0Z!0i8uVMTP-{ui-OjYOu{$9YmT>16h+Tpo%j&Z_y`&vFX(SH zB-Ax7#II4=UK7Cbq`zC9WPbTx)KKu@q%RyEErmci5kmB=27lvm_3-($EZ=65jwh24 zm*`PBThez|>I|<}mynv~XGYK45fvhEy&$jO6zhKewMQnyJ8Orm zQOU&^-~+--m?VC(T#3KMI-Vv(u4lXlak9u-*LX8qMM6MzkzibK#8U+!rZFa4hb9^;#qJ zr5_f3ElYZ#*tNzTNZ0HmK9G*BOsM^gy@I>M4IJ2bfI>_K<154%WlIH*_(w|TL$npO zl{DE2ygIDA8yDbCaLUR|sSH<~);$_`VkL!ztNZ~tA-{dm zw*=Mi)USSsyjUD-&bd&eD;co#il84bEfDf@TOBotv(TmgyYh#Iz8gKB0b`<5?)LfntlXYl}t2{claO%<@a@khlH@O-i(n| zfnw!`-XOh?g0zT_@TF`lb0?wH!A+U|p$0zb3shev! zJ(!x~3i@pB{jy^Bz|Xy@G8Lbm15rr*(l)2N=o)INTQ60wIR{$p8|jUcbzrzNNTBHz zySlscC8Now;P5~b>7QOy9sy0tFB5PtYjw2u)&X|X1xEYN!Tzw!pZr38OgaUmj7S0= zu}GZmSX&gb{LkU0-!k|xBZNe^y_VC1(>d{>rwfS8p0SX>cPV}zCTbKI3^|VqLyn;! zqWJU?+D88ch0FRwS5N_o*)f%{Y?^nE`gBaIF2f}XZYAeeOlZ3wB%Y5-!V$Q%rcCe% zj7Q?)%05j6z#*182k{ieufKDEl{(^MVI}B(4~_EU>Vkz%Kx5JZRi92DN52#+3^eK{ zQG0+~*n4}8lSpwrs6*%-j72Px-JJg$zI{loy6O?FA~g8 z&k+Wejx{x-yX@@=+oe|-WV%K)g0tGDep5{U;C%Tq>%1|fZf$RUo3(neHuRQVU5{5N z&0H{N6?NDw@%82fztQlP{;;tn^6A~fO1=GEEUh~1s5F~ba>i;A%yTvtqmX#9=*R`ND0Rtdzd#-*0&^GkJdctcBYl#rC6Ft{h~ESRVA2>9x;p! zA0(}r`97+i=|BFPbkvWBKCK;e<)O!ZzMoE-ziR_-QaUQ7SDc<(PiWCp_Y7Q?oZjns zfV!E`c3Ny?0hV50BmNZ~M%IV*zl3h|u_WVy_J6aXpp%Je_CY7|d)^g+b$!Lskut9r;sG=O;nBZ!yeeHd24}zCrP!i_06A+;k&jfW)_e-eSOf`vZX9 zfKw?Q6w!gpcRJQ@D=;3;|VK>@L5oK*o znRMqS>}uLt8JF|nBe{9G5}N1EMzdG#!-ba2SM~Sh&@P0AH!&$vI19#MWuMKdiUCjH z2zBl%KMG8Mq1Q|+{(7riF4^>2T>*TlGc1sGco#jv=+sRU6>BfruVOL|R`$)f-eq~! z_4eLqxMWl^o z%-3?XD(4G3@*(@av>#CuaO`yOOpjrf47cxx*-t7e|Pa?Uw9n!{8 zM{j?4Pt5dVr{!Je38qYUcAVn*>d;7inNrWpa`(-r7IE{z`hcm~{W?tu7?^AqV)icrenlb=tp^B`Rb-a?OIWQ>y zn|CHEGI82LHhJQ6=OE)BQSQ{C$KwQ$^SyYZ`x-tL9*0C%ADL|TEbM95jwfs-n^l>= z>3^nba?AH$Pwx9i}{9R^7CZ&~0znsa1#-~?~(+rO9IZd?Vr&aaSHUICor`9dQ$jfQa zAGx6@t~?{WSgr)kxc)ot$Nx$8cX?Sq3t?GjGk(CgQ0P9?v+}OFbaJ;e_LSJL2DXSu zwRAOwsQ(zb|L^qSBczkrD3FZ_xzH#_u!FCn@FK&au%Y>qfL2EQ)|LH!91F)Nwf@=M zDYO5`4iD*n%kqJ*(EhIJp`CB@);Ni%BnymPQ>+Juu)+)nUwVjVIO=)!ze{<1_P_tM z=1AOgoq&GqeZXTUhs2!<9Zg;p((66~pH9^m7dyYL0vd#PT39txVFR;G<(fXf1`WDPA~s4K|nzw|9@k7*WaE! z@E0<)L&uZyHp{HoNn0wx!c>g1o9owBa(Gf(Y0T6Na*spy%4&1|IVgd@5@r2s1HfL= zKzd{R;n-;8HP3h)<{v)YLHiBsaWt6VPV#XT_}B;MReFAdI~%yCF9-ir5*M8pF&cX74_O>mUeHSJqLQdo*B13_kLpe zf#}>a9`&DR0ekQX07(HfL^`TxT5y-Sj@8lHTCEEC0l#3W%J$9;PxHT`t2z5`aL|=b za&C7ca^I^H7nWl)TAcdF-&51Ac7(7mYd!S8li#C$?+W+B>tEXxvxBKh+>!+rBz5Q~ z51xDeQjzjwB;!7vPDu(`Y#506{PT~`|C>j^syogv@8VQfmOStxk6RTvQ&|{R137Q(w7n|dT2S-){ z-RGMhc=N zX+Aj{Kl``(>N!a_D#g}@9%V{f{f59l7pHfVV3+kj_3ZNVU^2Eqp(#E>K0X5gv!7C# z+tBCNeyCsA;!aKg*Z! zOCiR!_2D3A$D}5+D=LbOO(*Y!ENM0iDYw}+EOVl6BNcx5@Bxkxg64yF78)UHIVY;( z35bMFm{MA@VLP`<%<55%8f6P!+4b4Ph|F+N*T{Yf;>n|Brde7@R=r?vNtiel@!Mma}CMLp;NL_y#v z0@4VGWSXQXNRADXC1()HG{FEOSwbs0$0oGICS!t@oM~v1k~0#T+;Dd_=Y5~&jyuM^ zKkiq52%~D(4r|Rd*Ic`*%4q+jgU)^p&b}P0M2$KyCS){(mcw3X0FqAEy0DaZaIrCH)q18W)bt|6+{! z-Tef)g>yCMn_|_i_sCz>+jpt2+>^J+RvPTg2zNXS1}Ag<6&1xlcbb|43d(zPjY)Q> zRZrV`*~oV;aKoh$lhl_bEt<4f|1LIsoLFA*tf-!7r9rrh9dY!Zk(~Ls)aaFZ%gmGi6^D}>kMOie5 z-D+H5>)+1Od|zm!67g;-9h_n-#$p6|^R_a%VqS9{dSL)h$aNl@UhHji`)vvM&A7 zs_r!GT(kG|qtZ-EP8~w%j+Yg_jiCM8FIPgVU0K>i)?Zo`L(0`K?M0!)5GLdJB3B#d-fOfs(yUmixIXXzE#2=0mVn<(3huC6{b4k{$}!udx)75~Y3g z@#m+s42{z(MB4<}y`s@RGYRj7zO8_ppgDezGEyyVgm7dBD}&xCz#pC zt6*^Lt~=Z?H0&J0bU6wmDw$B9J>qa2n~NXM1U=aD>wF^TizRq)N6XpjpC z9NHNl(k)kqQwdwIw-+q?46NcESWq&^ytvtl9GjJF7YumY<;G}@zm3sgJ_AZ*yc6{L zo`8BfWR)iAHwnht1xyF6`Z%M##99wJ=La@L%zkc(Mb8(C!U9TQg{^&MOREFXm#Bvo zP+4&T*pW_yNc&< zLwe7_dkB~dd(L7_Qy(ouZ|wxrZen72fpyFxgPowLZ)L_;(@~XL!dqL3%6+G8p|s!c z&pi&p!5U35#c{{FjOEbE&fik|gW@zBP0k@HK70ej=id28*&L5;zJx_NdOVAdY}OHy z${|*BE&KQ^Y8eU~&?F0G7ugl6dpQJ~vQE;`$Ioj+1Mer>fAm6nbh2^2o^g!E-?vc7 zI>SZGFw#wo4_4c}(G;2KDRI-=YcrD}S>OTxeHB;L({WUEE;sVh^T&&Ryye+!PO>dP zfIi)G?U8|yVKU=e1z+u>1FC{@Q?pl#i;1J1U)r6{r09MqVmT%;krqmJ+}hq05X+F- zwrwfBpHJ0K+mPM~m?-D~ud1l^EXavS$}J__3RjM|FF>@5L9;1Dp3N2klpsm{VI8xV z1T))r*`e9;pjOVp-d5!Ux2E_Q+A1qKSi#1^07A58qp-y>+p1k|Dmt8c*zSFz{vj|^ z`Hvk3?Iv=5N{zAEBdL8jmHpQ##>X$ODj&VqwrtF~9?!wadb3U93;?5`O z;_Ks{id>(^R!Y_1S3vJ6{(yYybxOX7Zl$C#J@1V*?Y}Jdi|R^Ya&!Z)jM#I6S2C*O zLoQNRY^E#@F*f0!7L0D#8;UG3Sg=R9fay+rX}efJ%YvHLHlK?!QQzJ-2aR4dB;&o7 zZeJS5_$XMs%=!hKKu-PaXujjlkT-Hpahoz#H}h&0iWTX$Idx+XtoJp_bC6YbX{FVb zl}LX~akqEe<1FAFRAglNfGJVoE;`<0uybu0RkhKY{6cp>d2FMs@xENHYIOj>e2Qo9 zSjk3bEEA*c#9b<(u2d0HJu|oHl3O+Ap5vrogX(JVFpoI+jti*O?TX73ZyGpb>u96> z^hunCsch?%jh)v>@sx|h;IgkGhj}uDnH2ZFpCB+U?fVk(jwnxW0}FbpC+&5w9#Y`P zyK@(M!dX%ra1s_U6=r?k+~!;rd~t@d?UwNTw@t~S@AI@f-=mzTL4JOgr!VI)e#}9FJw@VcYp>5CMD`IvEjLZz_AWk7%Jqz{0l6_Wt1jQD;ME8&A ztPGXv$AUH1zeJiIv(&fPhgVw;PxLOmEq}Xb?c=+osfS%-5)>4+@oqj}^L(%(NHE92 zPQi|$Ct>}tBy^e>a7WNR>tS8`Dko$t=5n>zv;wz&iE)^QnmQ>f=M(g;1E!e88?GiX>P#(t|e1 zQTmx0Kb~vixK}$F`Qk%!4sN)@Vre5*#~?E@MPj%U*(#7NIKVljnai2$nk&&96ECv* zNjkf*vdYar$TCu_sney+!^XAu5uB17S2gv38{W4$-XQMn@71p@Qb!h+Anqjd;a>f1 z#`;$PXY*)_4Z6sw6zA`4X1_rj7#J|Z6@$H6SW&ORp55`Hb|pGPbH=W4VC8r(ebx8i zYM?jLzx^EO>zfO75M44)=;fJsk5N=fOxu8^8X3nFw5dwf?SB*BS>CYsJv_9bx^U?* z<#VCLai^mpa$GC$?ZwfxzqWN&`;f?SH9dnI2GS*1K2JBBi`0xegs8D6q2$W1n;U|= zC>?{M@ZoG*`;CIC43&%N5mGQw;LkDNUvJQL#k1JGdJv7_r2`!z4`#J zcm=?+0GlIYM)X2>skdF!A|uK1aR~5+!+e{Ni&BS_$%oMl4qcpB;q~@}_ZeAL=dgV) z4%i(5tUxX5<&RI+$oAaKOVwNsyr>Mccrrif1>2+SDki91i<5TGE8o}1sK`yzm>D37 zS;*F0?d+TvQ1WuJONVfpCO7=kz^$&kBiR`nV%QNEqO#=5T|%CRdwrJG_;GIKG^Vm% z3w({jL-mJHk>DmknIX#x^x>C`=&FeQ-jgrMUH0`kT3pDgfSRLja*~f;#DMkmXdkMBEW??=0j%t;g z%4FtPJL)E+;6%PA`Pb$q`sKAI|3 zVw{Gasd%|gLHP!1XkX#e0|f_Or#-$7OBQ|Kk1FxcBP6l&{(`ss$}8!MJ!=0blT9vM zqW4o|iSuk=NLVBeZqvsa)(u0n=vm$gv1t$Li}rB01N>toZJX6fskbU@_p{|$2RaxF z99eoqN?j2<_|6BrTZC};%a&~L)Wg8E+U3l29nuG9?_zzmEG<(C!vX*`t*&Wipwn6& z*zI3%1lamN43~)zDtQ%1|o@XP%# z%M?3jZkLV{mdIS}4i)glXZLPGZA#GO)d9M!lOi}=ega_x8-VAo4B$-CjgpZX+PT<6*BstgAq#IzBX)Q74@3Tn95}BVD!{dA9_T4E zMzhi`H=j6?TG1sJAZxQ;Sn!vf!3BtK1Vc$xIl*x^_#C{lUcQ|#1yySda+S3^d}4@P zl^SWYXm%#|BrA~6)MMu^0dk;+>ZhGwN#;Nq9M^AGds>XcvU-vyR z6c`VtZ`*eU(91hw_qD1Y57bQepLfJ2?_D0LtL@*`jpye>fP{x3ik4|;nQgOYcYiRq zoX-j6AOaWiD&>iDQ_c;y!Os^$30T=+%cIsYQCasTijZmC3)``*;~vZs>a6obl5)P>6R{79X&dB8B`9r7+Df- zLv0a3>ClQ)O&@;_a@+i>n$HmBdX`6~D%o*)_k2lcnyqAz*->MR)7n&0=K+CZX2@ud zz1DH<<6TV`Q7hAsMTS4?b@snbEMqaVR~s1;d>o0-X7y&AIW=QxV{+!-i7*yJje7nB zIqW}o-0Eg<*WmY!_@dIqOj^%1;Q~ekGjrUIyCN}Va{lekEPZw}Q=z%GTDJB-Um59v zlostv$M8`MQEf524V#fk?A6BWEQS}Uj*PrqO!PrJUQlv8i zZtLi%{#d#GZ_``TMCKcwTiX9+lx+V<_?3fMu1J&ze57dj;6s9b!VJ+PjZBOan7QR;T=GH2OW8P1?N=UYFFInbZlkZgL#ZZ#*4O+0SU3# zG~1?RG5a^?2pZd%a&jyUw^l}lT<>D3ePX2gPQy$N_MLGt1xlOM9+AVlt@Vc8$oLC~ zb{>SfZt_)Lkvg%aYf-e>rD$)5G5wscrFzJ*(tN#z3odP{ZobtGFFHH+3Du3-N{=1_ zce^%gYtfe^bnC7{;wFB`>_Gs;Ze&=^71i6bsWNmGtBqAJA`{Of^b3_YwDYBn145gZovnL4*o+uOMuN~Tr;*pW}YsV-p(tmRHNy&w3TfReswmfvsfqMe}N4B-}G{}W?Fb~7IstUA>h26 zV)xru$~OfCY>0!m288z!Iulvk$Tk5NgVOt&X5ecJYY)St7fIeuYl#er;*XJvSfD#J zQ{E=)4(0qTnQVe*Le7P27?@}1gV^?2O^z&&WTPbO%U@u4Bpm8C6m2W~tV(#`z8NDD zrC8zV5em!ZDsybF3%gpie-n%SQ`4i+@OStb4j*mKl7-dam;a{23Lz@$D9qPwJyD0= z!2giWf9}LDMSgVpfoIEAR`WusVlXWOGs&l6Iha-&r&X;YjQT81QBARWYTff1S$4Tv zVC{ZQMo>(0$uUlc8CQRB^fzKj@GTl4_xD83nf+$d0r!oB&tAiCUj=?482ix$E(e&mV?m)(O>me)3xJ2&AvQdTE|HG^m_Y1Q8 za|Z&!i{7&eGslIUQH|A)IaC$#=QZWF7KS248#MJa^GY~1mq+nW?M}tSy%T{88x0@E z$$k&-J!-uH7-VU&k|I_rH+0ru?nHkfPm7rTcI={5!44;;N)|X&)Vg29L&#wl*DzV*JBGerF4hU+E{A|*yxWx-x(m-7^;|{v>gc;uFfR$0u3YMGF8^-j00DP z7apjAt0Rjjp(vA{Ep^~<*Vs?OUo$@M;Dde7{FM?|!4@YlXprW5rkP59Pti{)`g9q? z9^!IK%&Bp8C^R%H^4Ey(cW+^@T_8LM5!ReIk1w=cybkDC6F`Lor z3gI1}?0_>~OCaB)ptwQaVnDJ<_AQqr`*XMTbe~Jgdi51gh~a*4>htT?o!_3w`T!>fH1%+h0VA z?zfDs&7bw)(Xmi|BfE1`iO=-w6k<)64J2B;Unq|?;1-#m8hG^6< zhA<`NBFEdG(L&!c#kX?~EIV1Re68h$sCOjo=#eJJJ&2+H#r<7thWY;WRZZIp3wh}+ zP6q`6o)Y)H94 zJ2s0yXh5R;Xs7>|5}TsRf{OB!#MP7eJc;hQDAk>YPmcu~WcL^jh5iYS{0q;)o0OAP z_2wX6Ye2|);lOMAL#n2g)g4y0=9R6{7`xTMtuUI3>}M4`$;f(%+0E8jT)MsbY)K(v7o$=ra#;C%e^CV{+q&tINEw+-Oj;U3Q5pNp)N z&^9tCk(*0R%3hBL9-6|3;>0-lDhv?mHp-9i`|88{wml%N&0e^^xx&vBAK4R~@OqF# zuN)|Jwu@YXHyz%VMsw71fZN=oJ)sDq8)YZS>h^3(%|5%K?byw!Y7p!jW#Pr8qDM^5fDrfeZ zI)n~I5WMr07?SfmgxBz~e8C~%e_{Vn^!I`ky}=Z+qW3aF?v2v!eRi*mdME|{m+s8R z!(zeKu8M48#dGZ(P#kfCYdCu)e<&O>J1B_zY=LWdk?i%=TKUF6t-fDaDZ#Y9eBES^ zVQG0q0+g4KZC!cazd2pEHA6pD`VEz7fEsp!Suu^ek#&`Z2a0wpJuH3Cwx1w4klQ-L zbC%(%gGZ%e$Wac#o4qUB1~_Jz$xRc5;Om@`3!cb#5nn>1Zty?+*iOn~0zB%O^$8~j ze6DC%JF6)-4B=*&X=I4Xq~=Zd=^nYm#odst7sTx)iFn|QDigU5%TULF!bH|XS< z-ws1KyS*|R`km%m)aIpc;~ejZb(zgmH%|No$t=IgGH!N8sUAve-*qa;YU#qqt{x~C zT5&CE^v*MI>-Dz-<;(0Q%lR5=zYgs}SGLQO?;)?cNKa06Xz8xlI_SS2*%NW3!&)x4$@U~48Ay4p zfOT>8mGF)MSWuvHlp$I1JF&*{%ST!o=G?bA-dN;mlG=4BN%#U4Q7^{=rYPuZ5DhAB zgRzB=P>2DK0)?ilxm$ed>%zh|P&ra(86n@{m;F6LOUtuxWF={@8dBu`r+jPfohMGx zt}Id+t}6I0lrt8kUpzZo+_gEx4D+p<$!%!KO@7Q+0ZN?XUAo0UKdCq}XdIDvJ(xO- zV}YpU14yX{H5jw6f?lo}OhJKftqDWsdy6Dn>qW7ldx%@U^)onuY(o*}lFlUWd?`SiwfNT<GSUg0CPmxTWuL#50>Dr-$(_-^;(_z#K_`4|4O>*v2XE| z<;OlIWk(y|#Uuvz-9UBQ18!LMMV6&&ykAJmZm*M`2m}aXbEQ?RW{u{hqs-9_v-i2s z+%iIz@y8A-2)|gT|8X%Jg+!$46wjCH%`D&P=S_K<+vj)So%N!H|!mTjaRf!y$CHJHWLg2 z-+B^*FXSwg_Hn=@#YR`$JC726iqM7(HQvM@{%7PR)oFTgDwrU9A(BOq|Eu`^ex}`+ z60B&;W`Q6Msjr;pqr8t+#)LRTy)_9RjwILnlursqD$t^ynp~Z!ja_weFUt(2UPtGZ z8X>^CjswaH6xVDHIWB&|=3=+Vxm~)D|DNv>v0MXI)`z2oNR2w?`c!=rT#m5-Lvq1OIpZuU)<*k*8wQH#)5o$g7s#JJet31`j1}H~S3q3lelZ z;zryffD8IihyiF&(Q>d5qkU3d|y(hvf^DD|&BlD9Q zW_uMAjk&2-{XzgBDoH0>L(@2azgbLpiQp{ma2mLq8I;N0`^Qn-_qDsA>+z7P`WxdI zx$iJ>f!{sm5#6_&9=9&7-{BE62&E6JSdz17d$eDol||Hd%bjdG^x`CsLXteirb-&I zS5=hMRfPFb$=to%I-PF(Eo)9atA`2>!B~5x2JUvgU%TJ40 z%X&qU&vH&Jmhuct3%Z)(?F9gVpI>_a?7Oh_<@$BKo}c)XtDIePI_ffIR0-KT`V%hS zWQdrqq>NB2t18U7d&)LWzUD=K&TF-2jVytmPcOJD%VXo#28z-GD9K1d1(4*~XWzB2 zHhO!>E?ZLco!w_uJ9}f}7sS?LOKRrIa_3Q)yS?R6&Z{l%>Q~amyu529MYyIux3zb8 z>nIiXO!UZlG^BdvNIB61cawe&afloIbE+)qPAPC*sd~>GM-hiQ_N?z!$=?Kp1nqQ; z0!w?RXs=u~<D-_Wjz(7j2bLGgq{*nyV zKOd8I5eo#dW+^^=zl~;TYq~et8%N5(!OfxR&m{GWSr$4mz$INuuQSey`MhP>0}69lK{6r!%A>w&6s+u+PX^-S%| zjtBqkl0Dq|IU#EW$OV$fz12|Cifiy2IKSVE+T0ogTB${@DtOYIpAJSEj;pMlXge|x zCfDOmgdE}}p=(>fN^Ud z`!?P1UG3FH=M{Uv<$jeMFImZ9BuY-It|xP*0SE^Weame;^2dkO(gKD+Rja~Je1)dF z!?pQvbgGZsEbbIJIPE1S3QDpX0ZuwY^tRU|%q(rr*jc|&b?w|1U%(k;9*~~4yMQ$V z(d^9sL^Epz?F?Jr@a^5M_VpGhE}5bq?U#L&{|RRz9b6$t3SROu6OXn{LB$FNyY*^f=uKRdK^X*BGgm>4OJ4;PJ{LAZmLxKS*)PsFS)XqV|8um=Cf z8Gm+<(Fkr=PhGYzKYHRw_H;5{ym`${v7j;|&+;Z5?4U>NwT`tf{5HD)a~Yji8`~`d z=JMnrUQKSO_?m9yx4O!q}<;FO4dpG*R#Z#19RAFq1|QsA>@DsV+KzWG}iZZM1<$OR~z%% z3s)$F;VXE@*R)MMzkU<&8=i6m4*#-Y5@5-*ALod|3)9MLi{(2LFCc>Q`7_zJI63SM ziwa*$K&Mh%ya)x4_oisbcwfFE@9qGQ5d0Tp{{cq!%gx*4rUQ(#Dv1mX&RZq>lAd>j9gMPYkHhyRCy{U+ft+cmHM9#IA)sMBU# zZSR{8I?4(t;Jv1VAZNKaNXs2ZavXFaQ~51kXeM6H%cn&phdkl-wt&7G5k80Tr~we`KHRPyq!nNz&3kI;-~JRi!8{SfJ-6MzQx5^T%*{PLO- z9W35swD8AX*|O&`)~|RL%>b9wu9H7ssnDEQBA=ojA^oq=J; zi$eS*OmH}j*<@j^jR5JiQmb{hjgQ(x>m`4S-B;G_8g;jMl?2jVgOV93*Pd+=z+bC@# zwI5QX#;4~)MEkk~!kE2f>8K?waF!kCt zlnKnqg)I&HR}Duww}DN)(!U``dFjZo?r-eEn!i|$FF!^$irrP>Yfl(1@bk(~M&A00 z+Wt0v24Y_4R3ImzeB=bvV%V8!Gk$6c7GyVeeWST~Xgy_9lE>dGo5_RLr88gQc*bL; z%Gs&-h2(}8T#~_sskHj)@Q;IK>k(_oFW@F#t2Jv#ctJ1Hu^=WTTx{ z*oDQ!CKAFOZwIO}%t0P_Z5i^wFW;t|-%QP)^FQrm@bk(09*sGd%uG8N%#D>vWZxz3 z*)9^Sc$ysf)G5z17shr=j?lKki?^;VJhIj+Wn?;(h?sxxe@fLlkMa6xXouMsX!G?; zN9&=|zVNI(O_k@FnW1`~8I1D8ME9yI-~>uI6kvXf82R?ruAA8%ZALK4uj?2t%NlMz zlD+c_tvFgpM1oajbo=$*|ILRScH#T;tY8f<-zE2g^%_qK{3}bk-=_QCpi_xiUz+=O z)ka60q5MIQ4s8P8*N7$ULWy0m>4>W5;HqcckO7{K{Krwjj&{PQmQlWhJ|&wk@(AHf z4?c0Em8I`MdKMm0ZfC~as97?{U24ZoyaYR1VR9ekOy~s@c~R{Df#~qksuFkfM>m*_Ys94J-ySUIrC(f!lOYU;Yz%^faH^A>!Xl6l;jn0`fy z)cgt^6Jbvb#uxlPuj`m?Xr|IY~Q2Wp}fjp&vtW7sG1~u-kEJPhPx+;>YJ_Pz;o&&!Fe-oe7f72W7lUsuBC zm`z;sUK&I1;%VI5qga4rd!PI<{(s-Ie%#@_s9YxQLFx39FB)ujqVeRs6U zNHO%+Mlf4z^|A}vtDdwt6N~YYUDxrub1xkr2*u|#88EhU%nx2TycnwLQ8+L`vOQUM zT2))e98Fr*Phs+UkDN#bGdtpo+FAW;J`b+&v%7$ul@y=R$&G)Gc z{+Kxa(GlUeqpMR;T_c-r!`bS6#Ed1ZKJm|KhdXIcpMRzAN9b=L7E?8BYYM~tlmc6K zv8RsNXKQAC@svkJ-XZ!R%2VvqL&dM3&QAhcO*S)~yI9se&dBZ4J>*zI9s6~LNAN<$ zD2mrK&{==<6i}h04h`vcq-=1&&Xk&rJaZD642P4chdi8IWB)F$9gTpaCq5x6+Nc}1 zMK&W6=|qozQlXX~>!6!-)+}-O{|e39BSGG;$ryPArJn#JskHtBkus-H``mEUK`^Ff zcpb|2C@%XzSois6LK|!}?-)=iI=5DFHWD6D`A4xAo56v}pb4)Y08gtSb}ebq7HgF;sDX;_ECR90-z!2O%pKv&!4P{pR78~GRziotZGf> zO1T5uKiEcYd(Xed9HnkZ9s3@@4%gSTfIn;$jsHxcdS_HFoq6O|pwZy<2HGp}KZKA{ zGce?ekbCSyP57G03xRO218T99zV)^KoQ)ECt?iwlXgr+klHa zxzfi`J^V9z19coN%+nlEU~EKKD3Yolh|^C4Q`_H>wHs;V+AY`xZYr`3jT(ng^nHU) zL3VUxMfvXrXQ(8tSiX_@9@Y|K=u^X#s1QAw=m>dsqu0R$2^)>Zg9%4SZJTOxTRSs9vvU5xp55=oOPht24Dka7V~dD@x?ou7mJLq$kz8I-)qWSyG#i9m#~O@ zfXsM1x^>e0Jt?c9D3i$u4DRPs=xLWU>O&M_do1y? z)dcmVllv)7Q^F&QqnWw0fw26EJV{+j>39Uz$#^*!oAME?AV zI>SBV-B$^AOUvRut*0#r3Mi3m(oe;Z#=}2r9chm@y2hw9!+r;wjXkj)t?wddM0cSa zru!@ijWtoUd@iMo75oQ#!ai6Dt$1-GUDYFH=a0!wb8jzcG9$lqMDV=W77(^29Wi20 zY~N1O7BFTKNG12jc@JbVH^FO-&%=(waFXZqdHIh|2{K+(v96|Bq+ zJ19xndL`PbN&4zPs-$qZB{w$zoL#G>{)iFny($PWC>QO$Xo2mM$k|btBQ05*>oYKD`Qc^Ar%yq(vX_2p-Um_x zT59Gv6SMoV>vM_w+*-j&@Ugc74hoK>AO@EU5KOL#@aH z#4Sr@M6<(jZdBuOlz!Brc2VEa+F@@8xbnHUm!4iVAHam1$zN7l8zb;Bd(YrFKHY`J zy@rQ!Sv4r>iI~MX@SU+!s%Snq4(!-6sJ?+bS_rBCdGT?3(xmpO)-_+HZ2vl3hj%9p zbIy7jvj;zDc#Do4%P!7IH~nsY#5J>&iWtqFt46sWZ72xNOpkDV>_D`dn8|VZn0|Q3 z-v{;yCv4Lf%;Oq0$B;{73TqJHQv9ncTw8smkoay`6Xi4I79wVmqQB69&NbF7kuh(hv>kZiKkd%c<`H91Vhu4*s+*GTqXFkQ6rW4^208 z{GU*G{@>b~wy~LM2J?_ugIF3p_vO}NmMGb78=&4p$NWu*G(*SMWoTUBkfw&57drmG z|3#S%U-ME+t@>q$E-G^2I<+<;RX5zQkN#Bk$jbOdxDnEAQJfDwltDsU5!~M+9O#MZ_gYI7+j6{qB$ys8=&RksxS>z9i+h{9EvtuT6T zyn++UCJuWj>B}rtDvZla%>FsN_XXEG!$n+(^w;X?Q5V{}H(@un!M1IOIr@>k-@M}_ zwrm}>cYR|27w__pP#0;|Y671td3@=Bzr9S@k9g4fgvDg1eQCs)RJRJ=81d#I{kQfG zd_3lu*wruxJtlaWoXx%=7_T)L7Yr8naX0Q7Gro(vH^s7Ztbcsa!E5u#HpI6%;4a?4 zD}UAZw{xvKc;E5SstUYrZ6xI)JPB65crTVD*sns=8;J-|?^= zx3VMDDQTA8DLSPE^=Z~ljPmvc`gR>3pQOYyw6s?j+9vjbNs_ZmpfC44Azz>@!s-+c zrmod=QQmg=CGX}?^kVaZ>o=VSk8bBg`fq_l7 zHc_%!XBzNP<)kqADO?Ter92I;TD`V%O6H>>@(qluVAS?=q~8%7p`|ta2_$jgIU&e% zyIUDz@^hIF6N}VrmZExRJN2C;pO5CO3~2M2qSciUA^9qNC>Z;*1t*6G3M1<`T?FR4 z!9$W4e`w_%E>inTEI)z55qSg2vu*|ypT-m}qQqB4sf*UdoI^;AP`vhId@4mODPNWk z!5Jx4_MMX1!51ML_5_7v)vxG9v68}=;2t9$n{z{z{3CDg1ToVu{?Mv2a9`i6B+M8` ziZ75K=e$OqoBAb5_xMX9e#oU{p}Kn#YGOh!1qWDWo0B83%W-JhzP0ZH5e{%3^KoSn zv;E9+M3}2PmztFnc;;!5v2ClxuK3etD;j<3OW2-XAJb=WEtj)Vn)usg*|PKNg>vg(e~vt>49{2KlY9G@#Hv{e-_6iH zhRupu_S6wSV$7*@MaE73_6~6e=#E{Dn<)z z=a%ya(?&_Hs>lWEPtU;q1=d+Ha~F7bx(Os^KNo;#(%bAyj96w@a-ukY9wKDlLPRxO zrgR#e7{5qvMM{wYAnk+-fvddV0RfME{2#z8*52b&jo&ix*%VTeD?bP E0*M|S*8l(j literal 0 HcmV?d00001 From 61e40e74ccb79836cf6e57d26c6c592ca7245433 Mon Sep 17 00:00:00 2001 From: mcgin314 Date: Wed, 16 Apr 2025 14:53:58 -0400 Subject: [PATCH 13/67] Remove unused image --- simple-arch.svg | 36 ------------------------------------ 1 file changed, 36 deletions(-) delete mode 100644 simple-arch.svg diff --git a/simple-arch.svg b/simple-arch.svg deleted file mode 100644 index e354988..0000000 --- a/simple-arch.svg +++ /dev/null @@ -1,36 +0,0 @@ - - - - - -
- - - From 10f6aebbe45fa9ef7af1f93c424ee7ecebe97af2 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Thu, 17 Apr 2025 17:41:08 -0400 Subject: [PATCH 14/67] add eecr_account_id --- README.md | 36 ++++++++++++++++++++++++--------- copy_images.tf | 21 ++++++++++--------- main.tf | 55 +++++++++++++++++++++++++------------------------- variables.tf | 43 ++++----------------------------------- 4 files changed, 70 insertions(+), 85 deletions(-) diff --git a/README.md b/README.md index 738e52e..c15a899 100644 --- a/README.md +++ b/README.md @@ -76,39 +76,55 @@ Common issues and solutions: | Name | Version | |------|---------| -| [helm](#provider\_helm) | 2.17.0 | +| [aws](#provider\_aws) | ~> 5.14 | +| [aws.eecr](#provider\_aws.eecr) | ~> 5.14 | +| [helm](#provider\_helm) | ~> 2.11 | +| [kubernetes](#provider\_kubernetes) | ~> 2.23 | +| [random](#provider\_random) | ~> 3.6 | ## Modules | Name | Source | Version | |------|--------|---------| | [images](#module\_images) | git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/ | tf-upgrade | -| [ingress\_resources](#module\_ingress\_resources) | git@github.e.it.census.gov:SCT-Engineering/tfmod-istio-service-ingress.git | main | +| [ingress\_resources](#module\_ingress\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-istio-service-ingress.git | n/a | +| [keycloak\_db\_config](#module\_keycloak\_db\_config) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a | +| [post\_install](#module\_post\_install) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a | +| [pre\_install](#module\_pre\_install) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a | +| [service\_account](#module\_service\_account) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//service-account | n/a | ## Resources | Name | Type | |------|------| | [helm_release.keycloak](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | +| [helm_release.keycloak-db](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | +| [kubernetes_namespace.keycloak](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource | +| [random_uuid.user_secret](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/uuid) | resource | +| [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | +| [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | +| [kubernetes_secret.db-secrets](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/data-sources/secret) | data source | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [account\_id](#input\_account\_id) | aws account number | `string` | `""` | no | +| [admin\_email](#input\_admin\_email) | The email address of the admin of the default realm. | `string` | `"luther.coleman.mcginty@census.gov"` | no | | [cluster\_domain](#input\_cluster\_domain) | The domain name used to reference ingresses for the cluster. | `string` | n/a | yes | | [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes | -| [default\_storage\_class](#input\_default\_storage\_class) | The default storage class to use for persistent volumes | `string` | `"gp3-encrypted"` | no | -| [keycloak\_database](#input\_keycloak\_database) | The name of the database to create in the RDS instance. | `string` | `"keycloak"` | no | -| [keycloak\_password](#input\_keycloak\_password) | The initial password for the database. | `string` | `"keycloak"` | no | -| [keycloak\_tag](#input\_keycloak\_tag) | The image tag associated with the keycloak\_chart\_version | `string` | `"22.0.1-debian-11-r30"` | no | +| [default\_realm](#input\_default\_realm) | The default realm to use to configure the environment. | `string` | `"cluster-user"` | no | +| [eecr\_account\_id](#input\_eecr\_account\_id) | enterpirse ecr source aws account number | `string` | `""` | no | +| [keycloak\_chart\_version](#input\_keycloak\_chart\_version) | The version of the helm chart to install | `string` | `"7.0.1"` | no | +| [keycloak\_hostname](#input\_keycloak\_hostname) | The hostname used to access the keycloak service. | `string` | `"keycloak"` | no | +| [keycloak\_namespace](#input\_keycloak\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no | +| [keycloak\_tag](#input\_keycloak\_tag) | The image tag associated with the keycloak\_chart\_version | `string` | `"26.0.7"` | no | | [keycloak\_user](#input\_keycloak\_user) | The username for the database. | `string` | `"keycloak"` | no | -| [namespace](#input\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no | +| [kubectl\_image\_tag](#input\_kubectl\_image\_tag) | Version tag for the docker image to use to execute kubectl commands. | `string` | `"1.25.2-debian-11-r3"` | no | +| [postgresql\_chart\_version](#input\_postgresql\_chart\_version) | The helm chart version of postgresql to use. | `string` | `"16.5.1"` | no | | [postgresql\_tag](#input\_postgresql\_tag) | The tag of the postgresql image to use. | `string` | `"17.4.0"` | no | | [profile](#input\_profile) | AWS config profile used to upload images into ECR | `string` | `""` | no | -| [region](#input\_region) | region name | `string` | `"us-gov-east-1"` | no | | [service\_name](#input\_service\_name) | The name of the service to be deployed in the EKS cluster. | `string` | `"service"` | no | -| [telemetry\_namespace](#input\_telemetry\_namespace) | The namespace used for telemetry. | `string` | `"namespace"` | no | ## Outputs @@ -123,4 +139,6 @@ Common issues and solutions: | [namespace](#output\_namespace) | The namespace in which keycloak gets installed in. | | [provider\_config](#output\_provider\_config) | Add provider configuration block for easier consumption | | [public\_endpoint](#output\_public\_endpoint) | The endpoint at which keycloak can be reached from outside the cluster. | +| [user\_auth\_realm](#output\_user\_auth\_realm) | The URL for discovering keycloak services. | +| [user\_secret](#output\_user\_secret) | The name of the secret containing the sso user for accessing keycloak. | diff --git a/copy_images.tf b/copy_images.tf index ecc3638..90d5fd7 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -49,17 +49,18 @@ module "images" { force_delete = true lifecycle_policy_keep_count = 5 - # source_username = data.aws_ecr_authorization_token.ecr_token.user_name - # source_password = data.aws_ecr_authorization_token.ecr_token.password + source_username = data.aws_ecr_authorization_token.ecr_token.user_name + source_password = data.aws_ecr_authorization_token.ecr_token.password - # destination_username = data.aws_ecr_authorization_token.token.user_name - # destination_password = data.aws_ecr_authorization_token.token.password + destination_username = data.aws_ecr_authorization_token.token.user_name + destination_password = data.aws_ecr_authorization_token.token.password } -# data "aws_ecr_authorization_token" "ecr_token" { -# registry_id = var.account_id -# } +data "aws_ecr_authorization_token" "ecr_token" { + provider = aws.eecr + registry_id = var.eecr_account_id +} -# data "aws_ecr_authorization_token" "token" { -# registry_id = var.account_id -# } +data "aws_ecr_authorization_token" "token" { + registry_id = var.account_id +} diff --git a/main.tf b/main.tf index 6757444..8713fb3 100644 --- a/main.tf +++ b/main.tf @@ -2,11 +2,8 @@ resource "random_uuid" "user_secret" {} locals { - public_hostname = format("%v.%v", var.keycloak_hostname, var.cluster_domain) public_port_number = "80" - public_url = format("https://%v:%v/", local.public_hostname, local.public_port_number) - internal_port_number = "8080" admin_internal_port_number = "9000" user_client_id = "sso.user" @@ -71,14 +68,16 @@ resource "kubernetes_namespace" "keycloak" { } module "service_account" { - source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//service-account" + # tflint-ignore: terraform_module_pinned_source + source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//service-account" - namespace = kubernetes_namespace.keycloak.metadata[0].name + namespace = kubernetes_namespace.keycloak.metadata[0].name } module "pre_install" { - source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job" - + # tflint-ignore: terraform_module_pinned_source + source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job" + namespace = kubernetes_namespace.keycloak.metadata[0].name service_account_name = module.service_account.service_account_name job_name = "keycloak-config-secret-job" @@ -90,20 +89,20 @@ module "pre_install" { } resource "helm_release" "keycloak-db" { - chart = "postgresql" - version = var.postgresql_chart_version - name = "keycloak-db" - namespace = kubernetes_namespace.keycloak.metadata[0].name - repository = "oci://registry-1.docker.io/bitnamicharts" - values = [file("${path.module}/keycloak-db-values.yaml")] - wait = true - timeout = 300 + chart = "postgresql" + version = var.postgresql_chart_version + name = "keycloak-db" + namespace = kubernetes_namespace.keycloak.metadata[0].name + repository = "oci://registry-1.docker.io/bitnamicharts" + values = [file("${path.module}/keycloak-db-values.yaml")] + wait = true + timeout = 300 depends_on = [ data.kubernetes_secret.db-secrets, module.images ] - + set { name = "image.registry" value = module.images.images[local.postgresql_key].dest_registry @@ -127,10 +126,11 @@ data "kubernetes_secret" "db-secrets" { } module "keycloak_db_config" { - source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job" + # tflint-ignore: terraform_module_pinned_source + source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job" + + depends_on = [helm_release.keycloak-db] - depends_on = [ helm_release.keycloak-db ] - namespace = kubernetes_namespace.keycloak.metadata[0].name service_account_name = module.service_account.service_account_name job_name = "keycloak-db-config-job" @@ -148,8 +148,8 @@ resource "helm_release" "keycloak" { version = var.keycloak_chart_version repository = "https://codecentric.github.io/helm-charts" timeout = 300 - depends_on = [ helm_release.keycloak-db ] - + depends_on = [helm_release.keycloak-db] + values = [templatefile("${path.module}/keycloak-server-values.yaml", { hostname = format("https://%v.%v", var.keycloak_hostname, var.cluster_domain) @@ -159,7 +159,7 @@ resource "helm_release" "keycloak" { })] set { - name = "image.repository" + name = "image.repository" value = format("%v/%v", module.images.images[local.keycloak_key].dest_registry, module.images.images[local.keycloak_key].dest_repository @@ -173,9 +173,9 @@ resource "helm_release" "keycloak" { } module "ingress_resources" { - # depends_on = [helm_release.keycloak] + depends_on = [helm_release.keycloak] # tflint-ignore: terraform_module_pinned_source - source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-istio-service-ingress.git?ref=main" + source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-istio-service-ingress.git" public_hostname = var.service_name public_domain = var.cluster_domain service_name = "keycloak-keycloakx-http" @@ -184,8 +184,9 @@ module "ingress_resources" { } module "post_install" { - depends_on = [ helm_release.keycloak ] - source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job" + depends_on = [helm_release.keycloak] + # tflint-ignore: terraform_module_pinned_source + source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job" namespace = kubernetes_namespace.keycloak.metadata[0].name service_account_name = module.service_account.service_account_name @@ -195,4 +196,4 @@ module "post_install" { init_img = module.images.images[local.kubectl_key].dest_full_path timeout = "10m" -} \ No newline at end of file +} diff --git a/variables.tf b/variables.tf index 616c45f..e8d46f0 100644 --- a/variables.tf +++ b/variables.tf @@ -15,10 +15,10 @@ variable "cluster_name" { type = string } -variable "default_storage_class" { - description = "The default storage class to use for persistent volumes" +variable "eecr_account_id" { + description = "enterpirse ecr source aws account number" type = string - default = "gp3-encrypted" + default = "" } variable "keycloak_namespace" { @@ -45,24 +45,6 @@ variable "keycloak_user" { default = "keycloak" } -variable "namespace" { - description = "The namespace which will be created and into which keycloak will be deployed." - type = string - default = "keycloak" -} - -variable "keycloak_postgres_db_hostname" { - description = "The hostname of the postgres database for keycloak to use." - type = string - default = "keycloak-db" -} - -variable "keycloak_user" { - description = "The username for the database." - type = string - default = "17.4.0" -} - variable "profile" { description = "AWS config profile used to upload images into ECR" type = string @@ -75,24 +57,12 @@ variable "keycloak_hostname" { default = "keycloak" } -variable "default_storage_class" { - description = "The default storage class to use for persistent volumes" - type = string - default = "us-gov-east-1" -} - variable "service_name" { description = "The name of the service to be deployed in the EKS cluster." type = string default = "service" } -variable "telemetry_namespace" { - description = "The namespace used for telemetry." - type = string - default = "namespace" -} - variable "postgresql_chart_version" { description = "The helm chart version of postgresql to use." type = string @@ -107,13 +77,8 @@ variable "postgresql_tag" { variable "kubectl_image_tag" { description = "Version tag for the docker image to use to execute kubectl commands." - default = "1.25.2-debian-11-r3" -} - -variable "external_database_password" { - description = "The password for the external_database_username user." type = string - default = "I am a great, thoughtful and extremely well respected password. Vegetable. Phrenologist. Ethiopia." + default = "1.25.2-debian-11-r3" } variable "default_realm" { From 089a9360c2b9e6eb102b2194e31e8d2bada9bf04 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Thu, 17 Apr 2025 22:18:45 -0400 Subject: [PATCH 15/67] use ssh until tfmod-config-job is public --- README.md | 11 +-- copy_images.tf | 18 ++--- .../keycloak-gatekeeper.png | Bin main.tf | 12 ++-- variables.tf | 65 ++++++++++-------- 5 files changed, 58 insertions(+), 48 deletions(-) rename keycloak-gatekeeper.png => docs/keycloak-gatekeeper.png (100%) diff --git a/README.md b/README.md index c15a899..ce8d6ad 100644 --- a/README.md +++ b/README.md @@ -88,10 +88,10 @@ Common issues and solutions: |------|--------|---------| | [images](#module\_images) | git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/ | tf-upgrade | | [ingress\_resources](#module\_ingress\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-istio-service-ingress.git | n/a | -| [keycloak\_db\_config](#module\_keycloak\_db\_config) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a | -| [post\_install](#module\_post\_install) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a | -| [pre\_install](#module\_pre\_install) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a | -| [service\_account](#module\_service\_account) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//service-account | n/a | +| [keycloak\_db\_config](#module\_keycloak\_db\_config) | git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job | n/a | +| [post\_install](#module\_post\_install) | git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job | n/a | +| [pre\_install](#module\_pre\_install) | git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job | n/a | +| [service\_account](#module\_service\_account) | git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//service-account | n/a | ## Resources @@ -120,11 +120,12 @@ Common issues and solutions: | [keycloak\_namespace](#input\_keycloak\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no | | [keycloak\_tag](#input\_keycloak\_tag) | The image tag associated with the keycloak\_chart\_version | `string` | `"26.0.7"` | no | | [keycloak\_user](#input\_keycloak\_user) | The username for the database. | `string` | `"keycloak"` | no | -| [kubectl\_image\_tag](#input\_kubectl\_image\_tag) | Version tag for the docker image to use to execute kubectl commands. | `string` | `"1.25.2-debian-11-r3"` | no | | [postgresql\_chart\_version](#input\_postgresql\_chart\_version) | The helm chart version of postgresql to use. | `string` | `"16.5.1"` | no | | [postgresql\_tag](#input\_postgresql\_tag) | The tag of the postgresql image to use. | `string` | `"17.4.0"` | no | | [profile](#input\_profile) | AWS config profile used to upload images into ECR | `string` | `""` | no | +| [region](#input\_region) | AWS region | `string` | n/a | yes | | [service\_name](#input\_service\_name) | The name of the service to be deployed in the EKS cluster. | `string` | `"service"` | no | +| [utilities\_tag](#input\_utilities\_tag) | Version tag for the docker image to use to execute kubectl commands. | `string` | `"1.0.3"` | no | ## Outputs diff --git a/copy_images.tf b/copy_images.tf index 90d5fd7..88dd5e1 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -2,8 +2,8 @@ locals { keycloak_name = "keycloak/keycloak" keycloak_key = format("%v#%v", local.keycloak_name, var.keycloak_tag) postgresql_key = format("%v#%v", "bitnami/postgresql", var.postgresql_tag) - kubectl_key = format("%v#%v", "bitnami/kubectl-debian", var.kubectl_image_tag) - # ent_ecr_source = format("%v.%v.%v.%v", var.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images") + kubectl_key = format("%v#%v", "bitnami/kubectl-debian", var.utilities_tag) + ent_ecr_source = format("%v.%v.%v.%v", var.eecr_account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images") image_config = [ { @@ -11,7 +11,7 @@ locals { dest_path = null name = "keycloak/keycloak" source_image = "keycloak/keycloak" - source_registry = "quay.io" + source_registry = format("%v/%v", local.ent_ecr_source, "quay") source_tag = var.keycloak_tag tag = var.keycloak_tag }, @@ -19,8 +19,8 @@ locals { enabled = true dest_path = null name = "bitnami/postgresql" - source_image = "bitnami/postgresql" - source_registry = "public.ecr.aws" + source_image = "postgresql/postgresql" + source_registry = format("%v/%v", local.ent_ecr_source, "ironbank") source_tag = var.postgresql_tag tag = var.postgresql_tag }, @@ -28,10 +28,10 @@ locals { enabled = true dest_path = null name = "bitnami/kubectl-debian" - source_image = "bitnami/kubectl" - source_registry = "docker.io" - source_tag = var.kubectl_image_tag - tag = var.kubectl_image_tag + source_image = "big-bang/utilities" + source_registry = format("%v/%v", local.ent_ecr_source, "ironbank") + source_tag = var.utilities_tag + tag = var.utilities_tag }, ] } diff --git a/keycloak-gatekeeper.png b/docs/keycloak-gatekeeper.png similarity index 100% rename from keycloak-gatekeeper.png rename to docs/keycloak-gatekeeper.png diff --git a/main.tf b/main.tf index 8713fb3..945c7f3 100644 --- a/main.tf +++ b/main.tf @@ -68,15 +68,17 @@ resource "kubernetes_namespace" "keycloak" { } module "service_account" { + # source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//service-account" # tflint-ignore: terraform_module_pinned_source - source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//service-account" + source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//service-account" namespace = kubernetes_namespace.keycloak.metadata[0].name } module "pre_install" { + # source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job" # tflint-ignore: terraform_module_pinned_source - source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job" + source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job" namespace = kubernetes_namespace.keycloak.metadata[0].name service_account_name = module.service_account.service_account_name @@ -126,8 +128,9 @@ data "kubernetes_secret" "db-secrets" { } module "keycloak_db_config" { + # source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job" # tflint-ignore: terraform_module_pinned_source - source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job" + source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job" depends_on = [helm_release.keycloak-db] @@ -185,8 +188,9 @@ module "ingress_resources" { module "post_install" { depends_on = [helm_release.keycloak] + # source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job" # tflint-ignore: terraform_module_pinned_source - source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job" + source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job" namespace = kubernetes_namespace.keycloak.metadata[0].name service_account_name = module.service_account.service_account_name diff --git a/variables.tf b/variables.tf index e8d46f0..6a1d6df 100644 --- a/variables.tf +++ b/variables.tf @@ -1,10 +1,16 @@ -# tflint-ignore: terraform_unused_declarations + variable "account_id" { description = "aws account number" type = string default = "" } +variable "admin_email" { + description = "The email address of the admin of the default realm." + type = string + default = "luther.coleman.mcginty@census.gov" +} + variable "cluster_domain" { description = "The domain name used to reference ingresses for the cluster." type = string @@ -15,22 +21,34 @@ variable "cluster_name" { type = string } +variable "default_realm" { + description = "The default realm to use to configure the environment." + type = string + default = "cluster-user" +} + variable "eecr_account_id" { description = "enterpirse ecr source aws account number" type = string default = "" } -variable "keycloak_namespace" { - description = "The namespace which will be created and into which keycloak will be deployed." +variable "keycloak_chart_version" { + description = "The version of the helm chart to install" + type = string + default = "7.0.1" +} + +variable "keycloak_hostname" { + description = "The hostname used to access the keycloak service." type = string default = "keycloak" } -variable "keycloak_chart_version" { - description = "The version of the helm chart to install" +variable "keycloak_namespace" { + description = "The namespace which will be created and into which keycloak will be deployed." type = string - default = "7.0.1" + default = "keycloak" } variable "keycloak_tag" { @@ -45,22 +63,16 @@ variable "keycloak_user" { default = "keycloak" } -variable "profile" { - description = "AWS config profile used to upload images into ECR" - type = string - default = "" -} - -variable "keycloak_hostname" { - description = "The hostname used to access the keycloak service." +variable "utilities_tag" { + description = "Version tag for the docker image to use to execute kubectl commands." type = string - default = "keycloak" + default = "1.0.3" } -variable "service_name" { - description = "The name of the service to be deployed in the EKS cluster." +variable "profile" { + description = "AWS config profile used to upload images into ECR" type = string - default = "service" + default = "" } variable "postgresql_chart_version" { @@ -75,20 +87,13 @@ variable "postgresql_tag" { default = "17.4.0" } -variable "kubectl_image_tag" { - description = "Version tag for the docker image to use to execute kubectl commands." - type = string - default = "1.25.2-debian-11-r3" -} - -variable "default_realm" { - description = "The default realm to use to configure the environment." +variable "region" { + description = "AWS region" type = string - default = "cluster-user" } -variable "admin_email" { - description = "The email address of the admin of the default realm." +variable "service_name" { + description = "The name of the service to be deployed in the EKS cluster." type = string - default = "luther.coleman.mcginty@census.gov" + default = "service" } From 4e45a238d409981edd7aa5c61719ae641a245148 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Thu, 17 Apr 2025 22:29:22 -0400 Subject: [PATCH 16/67] minor --- README.md | 4 ++-- variables.tf | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index ce8d6ad..21d6064 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ Terraform module for deploying and configuring Keycloak on EKS clusters. Keycloak is a temporary OIDC solution to our clusters for enabling SSO login to the three web applications core to observability with the platform, ie. the Kubernetes Dashboard, Grafana and Kiali. Eventually, Keycloak will be replaced with OKTA provided OIDC, once TCO is ready for supporting this integration. Keycloak works in concert with GoGatekeeper that serves as an OIDC proxy fronting the web applications and validating the tokens originating from Keycloak. In our current configuration, we have a single generic user named `user` that acts as a master key for authenticating with Keycloak in the `cluster-user` realm, which is created by this module, and may access any of these applications. To retrieve the generic user password, run the following command: `kubectl get secret -n keycloak keycloak-user-creds -o jsonpath="{.data.password}" | base64 --decode ; echo` ### Explanation of architecture -![Explanation of architecture](./keycloak-gatekeeper.png "Explanation of architecture") +![Explanation of architecture](./docs/keycloak-gatekeeper.png "Explanation of architecture") ## Prerequisites - Kubernetes cluster (EKS) @@ -110,7 +110,7 @@ Common issues and solutions: | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [account\_id](#input\_account\_id) | aws account number | `string` | `""` | no | -| [admin\_email](#input\_admin\_email) | The email address of the admin of the default realm. | `string` | `"luther.coleman.mcginty@census.gov"` | no | +| [admin\_email](#input\_admin\_email) | The email address of the admin of the default realm. | `string` | `"email@example.com"` | no | | [cluster\_domain](#input\_cluster\_domain) | The domain name used to reference ingresses for the cluster. | `string` | n/a | yes | | [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes | | [default\_realm](#input\_default\_realm) | The default realm to use to configure the environment. | `string` | `"cluster-user"` | no | diff --git a/variables.tf b/variables.tf index 6a1d6df..1fc28da 100644 --- a/variables.tf +++ b/variables.tf @@ -8,7 +8,7 @@ variable "account_id" { variable "admin_email" { description = "The email address of the admin of the default realm." type = string - default = "luther.coleman.mcginty@census.gov" + default = "email@example.com" } variable "cluster_domain" { From 8ea70bbde8643949ab01aa53abcec6388ca03bed Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Thu, 17 Apr 2025 23:34:51 -0400 Subject: [PATCH 17/67] dynamic version --- README.md | 3 +++ version.tf | 27 +++++++++++++++++++++++++-- 2 files changed, 28 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 21d6064..c31a937 100644 --- a/README.md +++ b/README.md @@ -80,6 +80,7 @@ Common issues and solutions: | [aws.eecr](#provider\_aws.eecr) | ~> 5.14 | | [helm](#provider\_helm) | ~> 2.11 | | [kubernetes](#provider\_kubernetes) | ~> 2.23 | +| [null](#provider\_null) | ~> 3.2 | | [random](#provider\_random) | ~> 3.6 | ## Modules @@ -100,6 +101,8 @@ Common issues and solutions: | [helm_release.keycloak](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | | [helm_release.keycloak-db](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | | [kubernetes_namespace.keycloak](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource | +| [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | +| [null_resource.module_name](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | | [random_uuid.user_secret](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/uuid) | resource | | [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | | [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | diff --git a/version.tf b/version.tf index 47c6f5c..85dfd58 100644 --- a/version.tf +++ b/version.tf @@ -1,4 +1,27 @@ +resource "null_resource" "git_version" { + triggers = { + # Force this to run on every apply to get the latest tag value + always_run = timestamp() + } + + provisioner "local-exec" { + command = "git describe --tags --abbrev=0 2>/dev/null || echo 'unknown' > ${path.module}/.git_tag" + on_failure = continue + } +} + +resource "null_resource" "module_name" { + triggers = { + module_path = path.module + } + + provisioner "local-exec" { + command = "basename $(pwd) > ${path.module}/.module_name" + on_failure = continue + } +} + locals { - module_name = "tfmod-keycloak" - module_version = "0.1.0" + module_name = fileexists("${path.module}/.module_name") ? trimspace(file("${path.module}/.module_name")) : "tfmod-keycloak" + module_version = fileexists("${path.module}/.git_tag") ? trimspace(file("${path.module}/.git_tag")) : "latest" } From 2b53ec1c356e4800bc55df527e571d4532d1dd51 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 18 Apr 2025 15:14:06 -0400 Subject: [PATCH 18/67] remove eecr data item as it is in the provider --- README.md | 2 -- copy_images.tf | 7 +------ 2 files changed, 1 insertion(+), 8 deletions(-) diff --git a/README.md b/README.md index c31a937..1c69fe7 100644 --- a/README.md +++ b/README.md @@ -77,7 +77,6 @@ Common issues and solutions: | Name | Version | |------|---------| | [aws](#provider\_aws) | ~> 5.14 | -| [aws.eecr](#provider\_aws.eecr) | ~> 5.14 | | [helm](#provider\_helm) | ~> 2.11 | | [kubernetes](#provider\_kubernetes) | ~> 2.23 | | [null](#provider\_null) | ~> 3.2 | @@ -104,7 +103,6 @@ Common issues and solutions: | [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | | [null_resource.module_name](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | | [random_uuid.user_secret](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/uuid) | resource | -| [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | | [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | | [kubernetes_secret.db-secrets](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/data-sources/secret) | data source | diff --git a/copy_images.tf b/copy_images.tf index 88dd5e1..16a8b3a 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -19,7 +19,7 @@ locals { enabled = true dest_path = null name = "bitnami/postgresql" - source_image = "postgresql/postgresql" + source_image = "opensource/postgresql/postgresql" source_registry = format("%v/%v", local.ent_ecr_source, "ironbank") source_tag = var.postgresql_tag tag = var.postgresql_tag @@ -56,11 +56,6 @@ module "images" { destination_password = data.aws_ecr_authorization_token.token.password } -data "aws_ecr_authorization_token" "ecr_token" { - provider = aws.eecr - registry_id = var.eecr_account_id -} - data "aws_ecr_authorization_token" "token" { registry_id = var.account_id } From a071fc03150bfa6fa53d3ef47148dcf52e564224 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 18 Apr 2025 15:40:49 -0400 Subject: [PATCH 19/67] use alpine --- copy_images.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/copy_images.tf b/copy_images.tf index 16a8b3a..370c838 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -19,7 +19,7 @@ locals { enabled = true dest_path = null name = "bitnami/postgresql" - source_image = "opensource/postgresql/postgresql" + source_image = "opensource/postgresql/postgresql-alpine" source_registry = format("%v/%v", local.ent_ecr_source, "ironbank") source_tag = var.postgresql_tag tag = var.postgresql_tag From c54c6c33abd0baad2bfae52942c6f25ff796b8b4 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 18 Apr 2025 15:42:16 -0400 Subject: [PATCH 20/67] fix source image path --- copy_images.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/copy_images.tf b/copy_images.tf index 370c838..d7435fb 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -19,7 +19,7 @@ locals { enabled = true dest_path = null name = "bitnami/postgresql" - source_image = "opensource/postgresql/postgresql-alpine" + source_image = "opensource/postgres/postgresql-alpine" source_registry = format("%v/%v", local.ent_ecr_source, "ironbank") source_tag = var.postgresql_tag tag = var.postgresql_tag From ed1f417c390451db6f787cb87ea03e72019c6b44 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 18 Apr 2025 16:11:35 -0400 Subject: [PATCH 21/67] not apline --- copy_images.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/copy_images.tf b/copy_images.tf index d7435fb..0e946dd 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -19,7 +19,7 @@ locals { enabled = true dest_path = null name = "bitnami/postgresql" - source_image = "opensource/postgres/postgresql-alpine" + source_image = "opensource/postgres/postgresql" source_registry = format("%v/%v", local.ent_ecr_source, "ironbank") source_tag = var.postgresql_tag tag = var.postgresql_tag From 89d6eed93e527e1765b313b1e8197b82ed232ab7 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 18 Apr 2025 16:31:58 -0400 Subject: [PATCH 22/67] update module sources --- README.md | 6 +++--- main.tf | 18 +++++++++--------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index 1c69fe7..2934864 100644 --- a/README.md +++ b/README.md @@ -89,9 +89,9 @@ Common issues and solutions: | [images](#module\_images) | git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/ | tf-upgrade | | [ingress\_resources](#module\_ingress\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-istio-service-ingress.git | n/a | | [keycloak\_db\_config](#module\_keycloak\_db\_config) | git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job | n/a | -| [post\_install](#module\_post\_install) | git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job | n/a | -| [pre\_install](#module\_pre\_install) | git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job | n/a | -| [service\_account](#module\_service\_account) | git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//service-account | n/a | +| [post\_install](#module\_post\_install) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a | +| [pre\_install](#module\_pre\_install) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a | +| [service\_account](#module\_service\_account) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//service-account | n/a | ## Resources diff --git a/main.tf b/main.tf index 945c7f3..7550123 100644 --- a/main.tf +++ b/main.tf @@ -52,7 +52,7 @@ EOF do_kubectl_cp /tmp/db_config.sql keycloak-db-postgresql-0 /tmp/db_config.sql do_kubectl exec -n keycloak -t keycloak-db-postgresql-0 -c postgresql -- \ /opt/bitnami/postgresql/bin/psql \ - postgresql://postgres:${data.kubernetes_secret.db-secrets.data.password}@keycloak-db-postgresql.keycloak.svc.cluster.local:5432/keycloak \ + postgresql://postgres:${data.kubernetes_secret.db-secrets.data.password}@keycloak-db-postgresql.${var.keycloak_namespace}.svc.cluster.local:5432/keycloak \ -f /tmp/db_config.sql echo "End DB Config Job" CONFIG @@ -68,17 +68,17 @@ resource "kubernetes_namespace" "keycloak" { } module "service_account" { - # source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//service-account" # tflint-ignore: terraform_module_pinned_source - source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//service-account" + source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//service-account" + # source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//service-account" namespace = kubernetes_namespace.keycloak.metadata[0].name } module "pre_install" { - # source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job" # tflint-ignore: terraform_module_pinned_source - source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job" + source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job" + # source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job" namespace = kubernetes_namespace.keycloak.metadata[0].name service_account_name = module.service_account.service_account_name @@ -95,7 +95,7 @@ resource "helm_release" "keycloak-db" { version = var.postgresql_chart_version name = "keycloak-db" namespace = kubernetes_namespace.keycloak.metadata[0].name - repository = "oci://registry-1.docker.io/bitnamicharts" + repository = "${path.module}/charts/postgresql" values = [file("${path.module}/keycloak-db-values.yaml")] wait = true timeout = 300 @@ -149,7 +149,7 @@ resource "helm_release" "keycloak" { name = "keycloak" namespace = kubernetes_namespace.keycloak.metadata[0].name version = var.keycloak_chart_version - repository = "https://codecentric.github.io/helm-charts" + repository = "${path.module}/charts/keycloakx" timeout = 300 depends_on = [helm_release.keycloak-db] @@ -188,9 +188,9 @@ module "ingress_resources" { module "post_install" { depends_on = [helm_release.keycloak] - # source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job" # tflint-ignore: terraform_module_pinned_source - source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job" + source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job" + # source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job" namespace = kubernetes_namespace.keycloak.metadata[0].name service_account_name = module.service_account.service_account_name From e88d6ae3771e362861778eca84faecd920c414fa Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 18 Apr 2025 16:49:10 -0400 Subject: [PATCH 23/67] match chart version --- README.md | 2 +- variables.tf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 2934864..7de1e73 100644 --- a/README.md +++ b/README.md @@ -121,7 +121,7 @@ Common issues and solutions: | [keycloak\_namespace](#input\_keycloak\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no | | [keycloak\_tag](#input\_keycloak\_tag) | The image tag associated with the keycloak\_chart\_version | `string` | `"26.0.7"` | no | | [keycloak\_user](#input\_keycloak\_user) | The username for the database. | `string` | `"keycloak"` | no | -| [postgresql\_chart\_version](#input\_postgresql\_chart\_version) | The helm chart version of postgresql to use. | `string` | `"16.5.1"` | no | +| [postgresql\_chart\_version](#input\_postgresql\_chart\_version) | The helm chart version of postgresql to use. | `string` | `"17.4.0"` | no | | [postgresql\_tag](#input\_postgresql\_tag) | The tag of the postgresql image to use. | `string` | `"17.4.0"` | no | | [profile](#input\_profile) | AWS config profile used to upload images into ECR | `string` | `""` | no | | [region](#input\_region) | AWS region | `string` | n/a | yes | diff --git a/variables.tf b/variables.tf index 1fc28da..58fe88a 100644 --- a/variables.tf +++ b/variables.tf @@ -78,7 +78,7 @@ variable "profile" { variable "postgresql_chart_version" { description = "The helm chart version of postgresql to use." type = string - default = "16.5.1" + default = "17.4.0" } variable "postgresql_tag" { From 448db6e6f54ce1ef3824f210d3c70dcfd5416cb7 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 18 Apr 2025 16:52:26 -0400 Subject: [PATCH 24/67] fix chart paths --- main.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/main.tf b/main.tf index 7550123..0576e7d 100644 --- a/main.tf +++ b/main.tf @@ -95,7 +95,7 @@ resource "helm_release" "keycloak-db" { version = var.postgresql_chart_version name = "keycloak-db" namespace = kubernetes_namespace.keycloak.metadata[0].name - repository = "${path.module}/charts/postgresql" + repository = "${path.module}/charts" values = [file("${path.module}/keycloak-db-values.yaml")] wait = true timeout = 300 @@ -149,7 +149,7 @@ resource "helm_release" "keycloak" { name = "keycloak" namespace = kubernetes_namespace.keycloak.metadata[0].name version = var.keycloak_chart_version - repository = "${path.module}/charts/keycloakx" + repository = "${path.module}/charts" timeout = 300 depends_on = [helm_release.keycloak-db] From 19fda3bbf4b22c0349806f35409c68741f177f4b Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 18 Apr 2025 17:55:15 -0400 Subject: [PATCH 25/67] tweaks --- README.md | 2 +- copy_images.tf | 2 +- keycloak-db-values.yaml | 34 ++++++++++++++++++++++++---------- keycloak-server-values.yaml | 8 ++++---- 4 files changed, 30 insertions(+), 16 deletions(-) diff --git a/README.md b/README.md index 7de1e73..97d28f6 100644 --- a/README.md +++ b/README.md @@ -86,7 +86,7 @@ Common issues and solutions: | Name | Source | Version | |------|--------|---------| -| [images](#module\_images) | git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/ | tf-upgrade | +| [images](#module\_images) | git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git/ | tf-upgrade | | [ingress\_resources](#module\_ingress\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-istio-service-ingress.git | n/a | | [keycloak\_db\_config](#module\_keycloak\_db\_config) | git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job | n/a | | [post\_install](#module\_post\_install) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a | diff --git a/copy_images.tf b/copy_images.tf index 0e946dd..987e60e 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -37,7 +37,7 @@ locals { } module "images" { - source = "git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/?ref=tf-upgrade" + source = "git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git/?ref=tf-upgrade" profile = var.profile application_name = var.cluster_name diff --git a/keycloak-db-values.yaml b/keycloak-db-values.yaml index cf0eb44..ef6aa90 100644 --- a/keycloak-db-values.yaml +++ b/keycloak-db-values.yaml @@ -3,26 +3,26 @@ global: security: allowInsecureImages: true postgresql: - # architecture: replication + architecture: replication auth: database: keycloak - existingSecret: 'keycloak-db-creds' + existingSecret: keycloak-db-creds secretKeys: adminPasswordKey: password userPasswordKey: postgres-password replicationPasswordKey: replication-password image: - registry: - repository: - tag: + registry: + repository: + tag: primary: resources: requests: - memory: "128Mi" - cpu: "100m" + cpu: 100m + memory: 128Mi limits: - memory: "2Gi" - cpu: "2000m" + cpu: 2000m + memory: 2Gi readReplicas: resources: requests: @@ -30,4 +30,18 @@ readReplicas: memory: 128Mi limits: cpu: 2000m - memory: 2Gi \ No newline at end of file + memory: 2Gi +metrics: + enabled: true +persistence: + enabled: true + +# PostgreSQL autoscaling settings +postgresql: + resources: + requests: + cpu: 500m + memory: 1Gi + limits: + cpu: 1000m + memory: 2Gi diff --git a/keycloak-server-values.yaml b/keycloak-server-values.yaml index 6fe67b7..1dd0101 100644 --- a/keycloak-server-values.yaml +++ b/keycloak-server-values.yaml @@ -38,11 +38,11 @@ extraEnv: | # enabled: true resources: requests: - cpu: "500m" - memory: "1024Mi" + cpu: 500m + memory: 1024Mi limits: - cpu: "1" - memory: "4096Mi" + cpu: 1 + memory: 4096Mi database: vendor: postgres From 62d1a68ff9f83e0037eeb93b319e3d346d5793f3 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 18 Apr 2025 17:57:21 -0400 Subject: [PATCH 26/67] cleanup actions --- .github/workflows/terraform-ci.yml | 104 ----------------------- .github/workflows/terraform-release.yaml | 4 +- 2 files changed, 2 insertions(+), 106 deletions(-) delete mode 100644 .github/workflows/terraform-ci.yml diff --git a/.github/workflows/terraform-ci.yml b/.github/workflows/terraform-ci.yml deleted file mode 100644 index cf3f91c..0000000 --- a/.github/workflows/terraform-ci.yml +++ /dev/null @@ -1,104 +0,0 @@ -name: 'Terraform Module CI' - -on: - push: - branches: - - main - paths: - - '**/*.tf' - pull_request: - branches: - - main - paths: - - '**/*.tf' - workflow_dispatch: - -permissions: - contents: read - pull-requests: write - -jobs: - validate: - name: 'Validate Module' - runs-on: self-hosted - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Setup Terraform - uses: hashicorp/setup-terraform@v2 - with: - terraform_version: 1.5.0 - - - name: Terraform Init - run: | - terraform init -backend=false - - - name: Terraform Format - run: | - terraform fmt -check - - - name: Terraform Validate - run: | - terraform validate - - - name: Run tflint - uses: terraform-linters/setup-tflint@v3 - if: github.event_name == 'pull_request' - - - name: Lint Terraform - if: github.event_name == 'pull_request' - run: | - tflint --format compact - - - name: Run Checkov - uses: bridgecrewio/checkov-action@master - with: - directory: . - framework: terraform - skip_check: CKV_AWS_115,CKV_AWS_116 - quiet: true - soft_fail: true - output_format: sarif - output_file: checkov-results.sarif - - release: - name: 'Create Release' - needs: validate - if: github.ref == 'refs/heads/main' && github.event_name == 'push' - runs-on: self-hosted - permissions: - contents: write - - steps: - - uses: actions/checkout@v3 - with: - fetch-depth: 0 - - - name: Setup Python - uses: actions/setup-python@v4 - with: - python-version: '3.9' - - - name: Install Commitizen - run: | - pip install commitizen - - - name: Bump Version and Generate Changelog - id: cz - run: | - cz bump --yes - echo "new_version=$(cz version --project)" >> $GITHUB_OUTPUT - echo "changelog=$(cz changelog --dry-run)" >> $GITHUB_OUTPUT - - - name: Create Release - uses: actions/create-release@v1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - tag_name: v${{ steps.cz.outputs.new_version }} - release_name: Release v${{ steps.cz.outputs.new_version }} - draft: false - prerelease: false - body: ${{ steps.cz.outputs.changelog }} diff --git a/.github/workflows/terraform-release.yaml b/.github/workflows/terraform-release.yaml index 04b96db..9ca6d77 100644 --- a/.github/workflows/terraform-release.yaml +++ b/.github/workflows/terraform-release.yaml @@ -1,4 +1,4 @@ -name: Terraform CI/CD +name: Terraform Release Module on: workflow_dispatch: pull_request: @@ -7,7 +7,7 @@ on: - main jobs: terraform-ci-cd: - runs-on: 229685449397 + runs-on: "229685449397" permissions: contents: write From 8b71e0714f820aa2e6f43782353b9768ab59e228 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 18 Apr 2025 17:59:30 -0400 Subject: [PATCH 27/67] fix source path --- README.md | 2 +- main.tf | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 97d28f6..d0f9778 100644 --- a/README.md +++ b/README.md @@ -88,7 +88,7 @@ Common issues and solutions: |------|--------|---------| | [images](#module\_images) | git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git/ | tf-upgrade | | [ingress\_resources](#module\_ingress\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-istio-service-ingress.git | n/a | -| [keycloak\_db\_config](#module\_keycloak\_db\_config) | git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job | n/a | +| [keycloak\_db\_config](#module\_keycloak\_db\_config) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a | | [post\_install](#module\_post\_install) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a | | [pre\_install](#module\_pre\_install) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a | | [service\_account](#module\_service\_account) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//service-account | n/a | diff --git a/main.tf b/main.tf index 0576e7d..73ae8ae 100644 --- a/main.tf +++ b/main.tf @@ -128,9 +128,9 @@ data "kubernetes_secret" "db-secrets" { } module "keycloak_db_config" { - # source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job" # tflint-ignore: terraform_module_pinned_source - source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job" + source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job" + # source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job" depends_on = [helm_release.keycloak-db] From 837dfca19f370b9ae388ae36558ce812670882fe Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 18 Apr 2025 21:16:40 -0400 Subject: [PATCH 28/67] update copy images for eecr pulling --- README.md | 2 ++ copy_images.tf | 11 +++++++++++ 2 files changed, 13 insertions(+) diff --git a/README.md b/README.md index d0f9778..6630bca 100644 --- a/README.md +++ b/README.md @@ -77,6 +77,7 @@ Common issues and solutions: | Name | Version | |------|---------| | [aws](#provider\_aws) | ~> 5.14 | +| [aws.eecr](#provider\_aws.eecr) | ~> 5.14 | | [helm](#provider\_helm) | ~> 2.11 | | [kubernetes](#provider\_kubernetes) | ~> 2.23 | | [null](#provider\_null) | ~> 3.2 | @@ -103,6 +104,7 @@ Common issues and solutions: | [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | | [null_resource.module_name](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | | [random_uuid.user_secret](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/uuid) | resource | +| [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | | [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | | [kubernetes_secret.db-secrets](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/data-sources/secret) | data source | diff --git a/copy_images.tf b/copy_images.tf index 987e60e..84773ea 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -59,3 +59,14 @@ module "images" { data "aws_ecr_authorization_token" "token" { registry_id = var.account_id } + +data "aws_ecr_authorization_token" "ecr_token" { + provider = aws.eecr + registry_id = var.eecr_info.account_id +} + +provider "aws" { + alias = "eecr" + profile = var.eecr_info.profile + region = var.eecr_info.region +} From 4ce2682d4751e7617c493ced97e1de13458e1bf4 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 18 Apr 2025 21:34:42 -0400 Subject: [PATCH 29/67] update var and ent_ecr_source --- README.md | 2 +- copy_images.tf | 2 +- variables.tf | 18 ++++++++++++++---- 3 files changed, 16 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 6630bca..cf0dbf2 100644 --- a/README.md +++ b/README.md @@ -117,7 +117,7 @@ Common issues and solutions: | [cluster\_domain](#input\_cluster\_domain) | The domain name used to reference ingresses for the cluster. | `string` | n/a | yes | | [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes | | [default\_realm](#input\_default\_realm) | The default realm to use to configure the environment. | `string` | `"cluster-user"` | no | -| [eecr\_account\_id](#input\_eecr\_account\_id) | enterpirse ecr source aws account number | `string` | `""` | no | +| [eecr\_info](#input\_eecr\_info) | Enterprise ECR source information | 
object({
    account_id = string
    alias      = string
    profile    = string
    region     = string
  })
| 
{
  "account_id": "269222635945",
  "alias": "lab-gov-shared-nonprod",
  "profile": "269222635945-lab-gov-shared-nonprod",
  "region": "us-gov-east-1"
}
| no | | [keycloak\_chart\_version](#input\_keycloak\_chart\_version) | The version of the helm chart to install | `string` | `"7.0.1"` | no | | [keycloak\_hostname](#input\_keycloak\_hostname) | The hostname used to access the keycloak service. | `string` | `"keycloak"` | no | | [keycloak\_namespace](#input\_keycloak\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no | diff --git a/copy_images.tf b/copy_images.tf index 84773ea..a6ffbcb 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -3,7 +3,7 @@ locals { keycloak_key = format("%v#%v", local.keycloak_name, var.keycloak_tag) postgresql_key = format("%v#%v", "bitnami/postgresql", var.postgresql_tag) kubectl_key = format("%v#%v", "bitnami/kubectl-debian", var.utilities_tag) - ent_ecr_source = format("%v.%v.%v.%v", var.eecr_account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images") + ent_ecr_source = format("%v.%v.%v.%v", var.eecr_info.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images") image_config = [ { diff --git a/variables.tf b/variables.tf index 58fe88a..a84453f 100644 --- a/variables.tf +++ b/variables.tf @@ -27,10 +27,20 @@ variable "default_realm" { default = "cluster-user" } -variable "eecr_account_id" { - description = "enterpirse ecr source aws account number" - type = string - default = "" +variable "eecr_info" { + description = "Enterprise ECR source information" + type = object({ + account_id = string + alias = string + profile = string + region = string + }) + default = { + account_id = "269222635945" + alias = "lab-gov-shared-nonprod" + profile = "269222635945-lab-gov-shared-nonprod" + region = "us-gov-east-1" + } } variable "keycloak_chart_version" { From 3aa0dde0ae35fe199218b68d177d5c27e20e0c61 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 18 Apr 2025 22:34:32 -0400 Subject: [PATCH 30/67] disable metrics --- keycloak-db-values.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/keycloak-db-values.yaml b/keycloak-db-values.yaml index ef6aa90..849d847 100644 --- a/keycloak-db-values.yaml +++ b/keycloak-db-values.yaml @@ -31,8 +31,9 @@ readReplicas: limits: cpu: 2000m memory: 2Gi +# To enable metrics we need to pull in the posgresql-exporter image metrics: - enabled: true + enabled: false persistence: enabled: true From 6acb857631179874dd5a5c619668ac8c086ea548 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Sat, 19 Apr 2025 18:16:41 -0400 Subject: [PATCH 31/67] use different postgres image --- copy_images.tf | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/copy_images.tf b/copy_images.tf index a6ffbcb..aa8e84d 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -16,11 +16,12 @@ locals { tag = var.keycloak_tag }, { - enabled = true - dest_path = null - name = "bitnami/postgresql" - source_image = "opensource/postgres/postgresql" - source_registry = format("%v/%v", local.ent_ecr_source, "ironbank") + enabled = true + dest_path = null + name = "bitnami/postgresql" + # USE DIFFERENT IMAGE + source_image = "bitnami/postgresql" + source_registry = "public.ecr.aws" source_tag = var.postgresql_tag tag = var.postgresql_tag }, From 9c49f3d4ed75c51bc1b4f47afce1681666607b8c Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Sun, 20 Apr 2025 16:04:29 -0400 Subject: [PATCH 32/67] try mixing eecr and non-eecr --- copy_images.tf | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/copy_images.tf b/copy_images.tf index aa8e84d..7efe5e5 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -14,6 +14,8 @@ locals { source_registry = format("%v/%v", local.ent_ecr_source, "quay") source_tag = var.keycloak_tag tag = var.keycloak_tag + source_username = data.aws_ecr_authorization_token.ecr_token.user_name + source_password = data.aws_ecr_authorization_token.ecr_token.password }, { enabled = true @@ -33,6 +35,8 @@ locals { source_registry = format("%v/%v", local.ent_ecr_source, "ironbank") source_tag = var.utilities_tag tag = var.utilities_tag + source_username = data.aws_ecr_authorization_token.ecr_token.user_name + source_password = data.aws_ecr_authorization_token.ecr_token.password }, ] } @@ -50,8 +54,8 @@ module "images" { force_delete = true lifecycle_policy_keep_count = 5 - source_username = data.aws_ecr_authorization_token.ecr_token.user_name - source_password = data.aws_ecr_authorization_token.ecr_token.password + source_username = local.image_config.source_username || "" + source_password = local.image_config.source_password || "" destination_username = data.aws_ecr_authorization_token.token.user_name destination_password = data.aws_ecr_authorization_token.token.password From 90e5582ee8641f5449522379e00f79810b4eef21 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Sun, 20 Apr 2025 16:10:17 -0400 Subject: [PATCH 33/67] use try --- copy_images.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/copy_images.tf b/copy_images.tf index 7efe5e5..48bfc4c 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -54,8 +54,8 @@ module "images" { force_delete = true lifecycle_policy_keep_count = 5 - source_username = local.image_config.source_username || "" - source_password = local.image_config.source_password || "" + source_username = try(local.image_config.source_username, data.aws_ecr_authorization_token.token.user_name) + source_password = try(local.image_config.source_password, data.aws_ecr_authorization_token.token.password) destination_username = data.aws_ecr_authorization_token.token.user_name destination_password = data.aws_ecr_authorization_token.token.password From 020f65f62707035db49d1d3842b9fafd0b0dd7a3 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Sun, 20 Apr 2025 16:16:57 -0400 Subject: [PATCH 34/67] pass it in explicit --- copy_images.tf | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/copy_images.tf b/copy_images.tf index 48bfc4c..004b8cb 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -26,6 +26,8 @@ locals { source_registry = "public.ecr.aws" source_tag = var.postgresql_tag tag = var.postgresql_tag + source_username = data.aws_ecr_authorization_token.token.user_name + source_password = data.aws_ecr_authorization_token.token.password }, { enabled = true @@ -54,8 +56,8 @@ module "images" { force_delete = true lifecycle_policy_keep_count = 5 - source_username = try(local.image_config.source_username, data.aws_ecr_authorization_token.token.user_name) - source_password = try(local.image_config.source_password, data.aws_ecr_authorization_token.token.password) + source_username = try(local.image_config.source_username) + source_password = try(local.image_config.source_password) destination_username = data.aws_ecr_authorization_token.token.user_name destination_password = data.aws_ecr_authorization_token.token.password From 7c03991a1fa692d1b77384bb6a49c0837823be96 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Sun, 20 Apr 2025 16:20:20 -0400 Subject: [PATCH 35/67] not try --- copy_images.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/copy_images.tf b/copy_images.tf index 004b8cb..d64455f 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -56,8 +56,8 @@ module "images" { force_delete = true lifecycle_policy_keep_count = 5 - source_username = try(local.image_config.source_username) - source_password = try(local.image_config.source_password) + source_username = local.image_config.source_username + source_password = local.image_config.source_password destination_username = data.aws_ecr_authorization_token.token.user_name destination_password = data.aws_ecr_authorization_token.token.password From 4b47af73249b5a15bdee0da0f25328c27080cb33 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Sun, 20 Apr 2025 16:23:00 -0400 Subject: [PATCH 36/67] null --- copy_images.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/copy_images.tf b/copy_images.tf index d64455f..9198bac 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -26,8 +26,8 @@ locals { source_registry = "public.ecr.aws" source_tag = var.postgresql_tag tag = var.postgresql_tag - source_username = data.aws_ecr_authorization_token.token.user_name - source_password = data.aws_ecr_authorization_token.token.password + source_username = null + source_password = null }, { enabled = true From 66e16386447816f81677da6c9c8da57167882403 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Sun, 20 Apr 2025 16:25:53 -0400 Subject: [PATCH 37/67] maybe --- copy_images.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/copy_images.tf b/copy_images.tf index 9198bac..e269303 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -56,8 +56,8 @@ module "images" { force_delete = true lifecycle_policy_keep_count = 5 - source_username = local.image_config.source_username - source_password = local.image_config.source_password + source_username = !local.image_config.source_username ? data.aws_ecr_authorization_token.token.user_name : "" + source_password = !local.image_config.source_password ? data.aws_ecr_authorization_token.token.password : "" destination_username = data.aws_ecr_authorization_token.token.user_name destination_password = data.aws_ecr_authorization_token.token.password From a8fa59184b072787c72306cc1678e04f03aa2d92 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Sun, 20 Apr 2025 16:35:23 -0400 Subject: [PATCH 38/67] maybe --- copy_images.tf | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/copy_images.tf b/copy_images.tf index e269303..21a6668 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -26,8 +26,8 @@ locals { source_registry = "public.ecr.aws" source_tag = var.postgresql_tag tag = var.postgresql_tag - source_username = null - source_password = null + source_username = data.aws_ecr_authorization_token.token.user_name + source_password = data.aws_ecr_authorization_token.token.passwordgst }, { enabled = true @@ -56,8 +56,8 @@ module "images" { force_delete = true lifecycle_policy_keep_count = 5 - source_username = !local.image_config.source_username ? data.aws_ecr_authorization_token.token.user_name : "" - source_password = !local.image_config.source_password ? data.aws_ecr_authorization_token.token.password : "" + source_username = local.image_config.source_username + source_password = local.image_config.source_password destination_username = data.aws_ecr_authorization_token.token.user_name destination_password = data.aws_ecr_authorization_token.token.password From a209441e0a3ba5ac2467006ec460bc541ecc9a4e Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Sun, 20 Apr 2025 16:36:32 -0400 Subject: [PATCH 39/67] typo --- copy_images.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/copy_images.tf b/copy_images.tf index 21a6668..d64455f 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -27,7 +27,7 @@ locals { source_tag = var.postgresql_tag tag = var.postgresql_tag source_username = data.aws_ecr_authorization_token.token.user_name - source_password = data.aws_ecr_authorization_token.token.passwordgst + source_password = data.aws_ecr_authorization_token.token.password }, { enabled = true From c92b19478780cf8d5f30b8b2f5783bff08e9c851 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Sun, 20 Apr 2025 16:47:47 -0400 Subject: [PATCH 40/67] module will use creds --- copy_images.tf | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/copy_images.tf b/copy_images.tf index d64455f..1888004 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -18,10 +18,9 @@ locals { source_password = data.aws_ecr_authorization_token.ecr_token.password }, { - enabled = true - dest_path = null - name = "bitnami/postgresql" - # USE DIFFERENT IMAGE + enabled = true + dest_path = null + name = "bitnami/postgresql" source_image = "bitnami/postgresql" source_registry = "public.ecr.aws" source_tag = var.postgresql_tag @@ -56,9 +55,6 @@ module "images" { force_delete = true lifecycle_policy_keep_count = 5 - source_username = local.image_config.source_username - source_password = local.image_config.source_password - destination_username = data.aws_ecr_authorization_token.token.user_name destination_password = data.aws_ecr_authorization_token.token.password } From 20e4bcb45eb223cd1fa9ded67a19ebb097771e43 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Sun, 20 Apr 2025 16:52:10 -0400 Subject: [PATCH 41/67] source and dest creds --- copy_images.tf | 63 ++++++++++++++++++++++++++------------------------ 1 file changed, 33 insertions(+), 30 deletions(-) diff --git a/copy_images.tf b/copy_images.tf index 1888004..411dc4f 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -7,37 +7,43 @@ locals { image_config = [ { - enabled = true - dest_path = null - name = "keycloak/keycloak" - source_image = "keycloak/keycloak" - source_registry = format("%v/%v", local.ent_ecr_source, "quay") - source_tag = var.keycloak_tag - tag = var.keycloak_tag - source_username = data.aws_ecr_authorization_token.ecr_token.user_name - source_password = data.aws_ecr_authorization_token.ecr_token.password + enabled = true + dest_path = null + name = "keycloak/keycloak" + source_image = "keycloak/keycloak" + source_registry = format("%v/%v", local.ent_ecr_source, "quay") + source_tag = var.keycloak_tag + tag = var.keycloak_tag + source_username = data.aws_ecr_authorization_token.ecr_token.user_name + source_password = data.aws_ecr_authorization_token.ecr_token.password + destination_username = data.aws_ecr_authorization_token.token.user_name + destination_password = data.aws_ecr_authorization_token.token.password }, { - enabled = true - dest_path = null - name = "bitnami/postgresql" - source_image = "bitnami/postgresql" - source_registry = "public.ecr.aws" - source_tag = var.postgresql_tag - tag = var.postgresql_tag - source_username = data.aws_ecr_authorization_token.token.user_name - source_password = data.aws_ecr_authorization_token.token.password + enabled = true + dest_path = null + name = "bitnami/postgresql" + source_image = "bitnami/postgresql" + source_registry = "public.ecr.aws" + source_tag = var.postgresql_tag + tag = var.postgresql_tag + source_username = data.aws_ecr_authorization_token.token.user_name + source_password = data.aws_ecr_authorization_token.token.password + destination_username = data.aws_ecr_authorization_token.token.user_name + destination_password = data.aws_ecr_authorization_token.token.password }, { - enabled = true - dest_path = null - name = "bitnami/kubectl-debian" - source_image = "big-bang/utilities" - source_registry = format("%v/%v", local.ent_ecr_source, "ironbank") - source_tag = var.utilities_tag - tag = var.utilities_tag - source_username = data.aws_ecr_authorization_token.ecr_token.user_name - source_password = data.aws_ecr_authorization_token.ecr_token.password + enabled = true + dest_path = null + name = "bitnami/kubectl-debian" + source_image = "big-bang/utilities" + source_registry = format("%v/%v", local.ent_ecr_source, "ironbank") + source_tag = var.utilities_tag + tag = var.utilities_tag + source_username = data.aws_ecr_authorization_token.ecr_token.user_name + source_password = data.aws_ecr_authorization_token.ecr_token.password + destination_username = data.aws_ecr_authorization_token.token.user_name + destination_password = data.aws_ecr_authorization_token.token.password }, ] } @@ -54,9 +60,6 @@ module "images" { lifecycle_policy_all = true force_delete = true lifecycle_policy_keep_count = 5 - - destination_username = data.aws_ecr_authorization_token.token.user_name - destination_password = data.aws_ecr_authorization_token.token.password } data "aws_ecr_authorization_token" "token" { From fc11c6aca7a8a919eb6121f86d8a6ab30df3f99e Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Sun, 20 Apr 2025 16:54:11 -0400 Subject: [PATCH 42/67] skip --- copy_images.tf | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/copy_images.tf b/copy_images.tf index 411dc4f..84a61ab 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -20,17 +20,13 @@ locals { destination_password = data.aws_ecr_authorization_token.token.password }, { - enabled = true - dest_path = null - name = "bitnami/postgresql" - source_image = "bitnami/postgresql" - source_registry = "public.ecr.aws" - source_tag = var.postgresql_tag - tag = var.postgresql_tag - source_username = data.aws_ecr_authorization_token.token.user_name - source_password = data.aws_ecr_authorization_token.token.password - destination_username = data.aws_ecr_authorization_token.token.user_name - destination_password = data.aws_ecr_authorization_token.token.password + enabled = true + dest_path = null + name = "bitnami/postgresql" + source_image = "bitnami/postgresql" + source_registry = "public.ecr.aws" + source_tag = var.postgresql_tag + tag = var.postgresql_tag }, { enabled = true From 7e6b17cdb3342402941bbfa30fd940a953d6ab10 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 12:24:33 -0400 Subject: [PATCH 43/67] use correct upstream images --- copy_images.tf | 53 +++++++++++++++++++++++------------------ keycloak-db-values.yaml | 2 +- terraform-release.yaml | 40 +++++++++++++++++++++++++++++++ terraform-validate.yaml | 42 ++++++++++++++++++++++++++++++++ 4 files changed, 113 insertions(+), 24 deletions(-) create mode 100644 terraform-release.yaml create mode 100644 terraform-validate.yaml diff --git a/copy_images.tf b/copy_images.tf index 84a61ab..794a3a9 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -7,39 +7,40 @@ locals { image_config = [ { - enabled = true - dest_path = null - name = "keycloak/keycloak" - source_image = "keycloak/keycloak" - source_registry = format("%v/%v", local.ent_ecr_source, "quay") - source_tag = var.keycloak_tag - tag = var.keycloak_tag - source_username = data.aws_ecr_authorization_token.ecr_token.user_name - source_password = data.aws_ecr_authorization_token.ecr_token.password - destination_username = data.aws_ecr_authorization_token.token.user_name - destination_password = data.aws_ecr_authorization_token.token.password + enabled = true + dest_path = null + name = "keycloak/keycloak" + source_image = "keycloak/keycloak" + source_registry = format("%v/%v", local.ent_ecr_source, "quay") + source_tag = var.keycloak_tag + tag = var.keycloak_tag }, { enabled = true dest_path = null name = "bitnami/postgresql" source_image = "bitnami/postgresql" - source_registry = "public.ecr.aws" + source_registry = format("%v/%v", local.ent_ecr_source, "docker-io") + source_tag = var.postgresql_tag + tag = var.postgresql_tag + }, + { + enabled = true + dest_path = null + name = "bitnami/postgres-exporter" + source_image = "bitnami/postgres-exporter" + source_registry = format("%v/%v", local.ent_ecr_source, "docker-io") source_tag = var.postgresql_tag tag = var.postgresql_tag }, { - enabled = true - dest_path = null - name = "bitnami/kubectl-debian" - source_image = "big-bang/utilities" - source_registry = format("%v/%v", local.ent_ecr_source, "ironbank") - source_tag = var.utilities_tag - tag = var.utilities_tag - source_username = data.aws_ecr_authorization_token.ecr_token.user_name - source_password = data.aws_ecr_authorization_token.ecr_token.password - destination_username = data.aws_ecr_authorization_token.token.user_name - destination_password = data.aws_ecr_authorization_token.token.password + enabled = true + dest_path = null + name = "bitnami/kubectl-debian" + source_image = "big-bang/utilities" + source_registry = format("%v/%v", local.ent_ecr_source, "ironbank") + source_tag = var.utilities_tag + tag = var.utilities_tag }, ] } @@ -56,6 +57,12 @@ module "images" { lifecycle_policy_all = true force_delete = true lifecycle_policy_keep_count = 5 + + source_username = data.aws_ecr_authorization_token.ecr_token.user_name + source_password = data.aws_ecr_authorization_token.ecr_token.password + + destination_username = data.aws_ecr_authorization_token.token.user_name + destination_password = data.aws_ecr_authorization_token.token.password } data "aws_ecr_authorization_token" "token" { diff --git a/keycloak-db-values.yaml b/keycloak-db-values.yaml index 849d847..fbed636 100644 --- a/keycloak-db-values.yaml +++ b/keycloak-db-values.yaml @@ -33,7 +33,7 @@ readReplicas: memory: 2Gi # To enable metrics we need to pull in the posgresql-exporter image metrics: - enabled: false + enabled: true persistence: enabled: true diff --git a/terraform-release.yaml b/terraform-release.yaml new file mode 100644 index 0000000..3f67574 --- /dev/null +++ b/terraform-release.yaml @@ -0,0 +1,40 @@ +name: Terraform Module Release +on: + workflow_dispatch: + pull_request: + types: [closed] + branches: + - main +jobs: + terraform-release: + runs-on: "229685449397" + permissions: + contents: write + + steps: + - name: Checkout code + uses: CSVD/gh-actions-checkout@v4 + + - name: Setup GITHUB Credentials + id: github_credentials + uses: CSVD/gh-auth@main + with: + github_app_pem_file: ${{ secrets.GH_APP_PEM_FILE }} + github_app_installation_id: ${{ vars.GH_APP_INSTALLATION_ID }} + github_app_id: ${{ vars.GH_APP_ID }} + + - name: Setup GitHub CLI + run: | + # Force manual authentication since setup-git might not work with GitHub Enterprise + echo "${{ steps.github_credentials.outputs.github_token }}" > /tmp/token.txt + gh auth login --with-token --hostname "github.e.it.census.gov" < /tmp/token.txt + rm /tmp/token.txt + + # Test GitHub CLI auth status + gh auth status || echo "GitHub CLI authentication failed" + + - name: Run Release Action + uses: CSVD/releaser@main + with: + github-token: ${{ steps.github_credentials.outputs.github_token }} + working-directory: '.' diff --git a/terraform-validate.yaml b/terraform-validate.yaml new file mode 100644 index 0000000..ac349eb --- /dev/null +++ b/terraform-validate.yaml @@ -0,0 +1,42 @@ +name: Terraform Validate +on: + pull_request: + workflow_dispatch: + +jobs: + + terraform-validate: + runs-on: "229685449397" + permissions: + contents: write + steps: + - name: Checkout code + uses: CSVD/gh-actions-checkout@v4 + + - name: Setup Terraform + uses: CSVD/gh-actions-setup-terraform@v2 + with: + terraform_version: '1.10.5' + + - name: Validate Terraform Configuration + id: validate + uses: CSVD/terraform-validate@main + + - name: Check Validation/Test Results + if: always() + run: | + # Set default values if outputs are empty + IS_VALID="${{ steps.validate.outputs.is_valid }}" + TESTS_PASSED="${{ steps.validate.outputs.tests_passed }}" + + # If outputs are empty, set them to false + [ -z "$IS_VALID" ] && IS_VALID="false" + [ -z "$TESTS_PASSED" ] && TESTS_PASSED="false" + + if [[ "$IS_VALID" != "true" || "$TESTS_PASSED" != "true" ]]; then + echo "Validation or test errors found:" + echo "${{ steps.validate.outputs.stderr }}" + exit 1 + else + echo "All validations and tests passed successfully!" + fi From 71ccef660cf22e3b9ff4f7d472154c57469e4b45 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 13:17:27 -0400 Subject: [PATCH 44/67] exporter --- README.md | 1 + copy_images.tf | 5 +++-- variables.tf | 6 ++++++ 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index cf0dbf2..abd9289 100644 --- a/README.md +++ b/README.md @@ -123,6 +123,7 @@ Common issues and solutions: | [keycloak\_namespace](#input\_keycloak\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no | | [keycloak\_tag](#input\_keycloak\_tag) | The image tag associated with the keycloak\_chart\_version | `string` | `"26.0.7"` | no | | [keycloak\_user](#input\_keycloak\_user) | The username for the database. | `string` | `"keycloak"` | no | +| [postgres\_exporter\_tag](#input\_postgres\_exporter\_tag) | The tag of the postgres exporter image to use. | `string` | `"17.4.0"` | no | | [postgresql\_chart\_version](#input\_postgresql\_chart\_version) | The helm chart version of postgresql to use. | `string` | `"17.4.0"` | no | | [postgresql\_tag](#input\_postgresql\_tag) | The tag of the postgresql image to use. | `string` | `"17.4.0"` | no | | [profile](#input\_profile) | AWS config profile used to upload images into ECR | `string` | `""` | no | diff --git a/copy_images.tf b/copy_images.tf index 794a3a9..4fbcd13 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -2,6 +2,7 @@ locals { keycloak_name = "keycloak/keycloak" keycloak_key = format("%v#%v", local.keycloak_name, var.keycloak_tag) postgresql_key = format("%v#%v", "bitnami/postgresql", var.postgresql_tag) + # postgres_exporter_key = format("%v#%v", "bitnami/postgres-exporter", var.postgres_exporter_tag) kubectl_key = format("%v#%v", "bitnami/kubectl-debian", var.utilities_tag) ent_ecr_source = format("%v.%v.%v.%v", var.eecr_info.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images") @@ -30,8 +31,8 @@ locals { name = "bitnami/postgres-exporter" source_image = "bitnami/postgres-exporter" source_registry = format("%v/%v", local.ent_ecr_source, "docker-io") - source_tag = var.postgresql_tag - tag = var.postgresql_tag + source_tag = var.postgres_exporter_tag + tag = var.postgres_exporter_tag }, { enabled = true diff --git a/variables.tf b/variables.tf index a84453f..5dc83cb 100644 --- a/variables.tf +++ b/variables.tf @@ -97,6 +97,12 @@ variable "postgresql_tag" { default = "17.4.0" } +variable "postgres_exporter_tag" { + description = "The tag of the postgres exporter image to use." + type = string + default = "17.4.0" +} + variable "region" { description = "AWS region" type = string From f9fbb8ed6bef7031a303d89502c1a24354e85ab0 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 13:47:51 -0400 Subject: [PATCH 45/67] pass in registry for exporter --- keycloak-db-values.yaml | 8 +++++++- keycloak-server-values.yaml | 4 ++-- main.tf | 13 +++++++++++++ 3 files changed, 22 insertions(+), 3 deletions(-) diff --git a/keycloak-db-values.yaml b/keycloak-db-values.yaml index fbed636..9817017 100644 --- a/keycloak-db-values.yaml +++ b/keycloak-db-values.yaml @@ -1,5 +1,6 @@ # See https://github.com/bitnami/charts/tree/master/bitnami/postgresql global: + imageRegistry: ${registry} security: allowInsecureImages: true postgresql: @@ -14,7 +15,8 @@ global: image: registry: repository: - tag: + tag: ${tag} + primary: resources: requests: @@ -34,6 +36,10 @@ readReplicas: # To enable metrics we need to pull in the posgresql-exporter image metrics: enabled: true + image: + repository: ${repository} + tag: ${exporter_tag} + persistence: enabled: true diff --git a/keycloak-server-values.yaml b/keycloak-server-values.yaml index 1dd0101..3614a0c 100644 --- a/keycloak-server-values.yaml +++ b/keycloak-server-values.yaml @@ -41,8 +41,8 @@ resources: cpu: 500m memory: 1024Mi limits: - cpu: 1 - memory: 4096Mi + cpu: 500m + memory: 1024Mi database: vendor: postgres diff --git a/main.tf b/main.tf index 73ae8ae..9805d54 100644 --- a/main.tf +++ b/main.tf @@ -117,6 +117,19 @@ resource "helm_release" "keycloak-db" { name = "image.tag" value = var.postgresql_tag } + + set { + name = "metrics.image.registry" + value = module.images.images[local.postgres_exporter_key].dest_registry + } + set { + name = "metrics.image.repository" + value = module.images.images[local.postgres_exporter_key].dest_registry + } + set { + name = "metrics.image.tag" + value = var.postgres_exporter_tag + } } data "kubernetes_secret" "db-secrets" { From fba1abd6e1dcf882cb63668ae074cf7268628e23 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 13:49:27 -0400 Subject: [PATCH 46/67] set key --- copy_images.tf | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/copy_images.tf b/copy_images.tf index 4fbcd13..2c65966 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -1,10 +1,10 @@ locals { - keycloak_name = "keycloak/keycloak" - keycloak_key = format("%v#%v", local.keycloak_name, var.keycloak_tag) - postgresql_key = format("%v#%v", "bitnami/postgresql", var.postgresql_tag) - # postgres_exporter_key = format("%v#%v", "bitnami/postgres-exporter", var.postgres_exporter_tag) - kubectl_key = format("%v#%v", "bitnami/kubectl-debian", var.utilities_tag) - ent_ecr_source = format("%v.%v.%v.%v", var.eecr_info.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images") + keycloak_name = "keycloak/keycloak" + keycloak_key = format("%v#%v", local.keycloak_name, var.keycloak_tag) + postgresql_key = format("%v#%v", "bitnami/postgresql", var.postgresql_tag) + postgres_exporter_key = format("%v#%v", "bitnami/postgres-exporter", var.postgres_exporter_tag) + kubectl_key = format("%v#%v", "bitnami/kubectl-debian", var.utilities_tag) + ent_ecr_source = format("%v.%v.%v.%v", var.eecr_info.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images") image_config = [ { From 6c6f85adb9284be855f492f3058532923a2c21c3 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 13:51:30 -0400 Subject: [PATCH 47/67] don't set global registry --- keycloak-db-values.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/keycloak-db-values.yaml b/keycloak-db-values.yaml index 9817017..a055cd2 100644 --- a/keycloak-db-values.yaml +++ b/keycloak-db-values.yaml @@ -1,6 +1,5 @@ # See https://github.com/bitnami/charts/tree/master/bitnami/postgresql global: - imageRegistry: ${registry} security: allowInsecureImages: true postgresql: From be31cb7dc053506bc16280c3d92ebfd1bfd404f7 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 14:17:21 -0400 Subject: [PATCH 48/67] fix images --- keycloak-db-values.yaml | 4 ++-- main.tf | 27 +++++++++++++-------------- 2 files changed, 15 insertions(+), 16 deletions(-) diff --git a/keycloak-db-values.yaml b/keycloak-db-values.yaml index a055cd2..a224b6b 100644 --- a/keycloak-db-values.yaml +++ b/keycloak-db-values.yaml @@ -36,8 +36,8 @@ readReplicas: metrics: enabled: true image: - repository: ${repository} - tag: ${exporter_tag} + repository: + tag: persistence: enabled: true diff --git a/main.tf b/main.tf index 9805d54..093a1c8 100644 --- a/main.tf +++ b/main.tf @@ -106,29 +106,28 @@ resource "helm_release" "keycloak-db" { ] set { - name = "image.registry" - value = module.images.images[local.postgresql_key].dest_registry - } - set { - name = "image.repository" - value = module.images.images[local.postgresql_key].dest_repository + name = "image.repository" + value = format("%v/%v", + module.images.images[local.postgresql_key].dest_registry, + module.images.images[local.postgresql_key].dest_repository + ) } + set { name = "image.tag" - value = var.postgresql_tag + value = module.images.images[local.postgresql_key].tag } set { - name = "metrics.image.registry" - value = module.images.images[local.postgres_exporter_key].dest_registry - } - set { - name = "metrics.image.repository" - value = module.images.images[local.postgres_exporter_key].dest_registry + name = "metrics.image.repository" + value = format("%v/%v", + module.images.images[local.postgres_exporter_key].dest_registry, + module.images.images[local.postgres_exporter_key].dest_repository + ) } set { name = "metrics.image.tag" - value = var.postgres_exporter_tag + value = module.images.images[local.postgres_exporter_key].tag } } From 4641d50bf92628958147fb05ebe868a7a3d392ac Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 14:38:09 -0400 Subject: [PATCH 49/67] add common.errors.insecureImages for the NOTES template --- keycloak-db-values.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/keycloak-db-values.yaml b/keycloak-db-values.yaml index a224b6b..64d8a6c 100644 --- a/keycloak-db-values.yaml +++ b/keycloak-db-values.yaml @@ -16,6 +16,10 @@ image: repository: tag: ${tag} +common: + errors: + inseecureImages: true + primary: resources: requests: From 7656ffcc210fe9422df3d30b71de68422cecf31a Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 14:39:28 -0400 Subject: [PATCH 50/67] add common.errors.insecureImages for the NOTES template --- keycloak-db-values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/keycloak-db-values.yaml b/keycloak-db-values.yaml index 64d8a6c..b4ba6bb 100644 --- a/keycloak-db-values.yaml +++ b/keycloak-db-values.yaml @@ -18,7 +18,7 @@ image: common: errors: - inseecureImages: true + inseecureImages: "true" primary: resources: From 0a3073c8fd48154f3245c800a935c9a8a3f8e9f0 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 14:45:01 -0400 Subject: [PATCH 51/67] make it in the images dict --- keycloak-db-values.yaml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/keycloak-db-values.yaml b/keycloak-db-values.yaml index b4ba6bb..b9d6db9 100644 --- a/keycloak-db-values.yaml +++ b/keycloak-db-values.yaml @@ -15,10 +15,9 @@ image: registry: repository: tag: ${tag} - -common: - errors: - inseecureImages: "true" + common: + errors: + inseecureImages: "true" primary: resources: From d419856c5393ef920cd800122b02ecb8af3daccc Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 14:49:13 -0400 Subject: [PATCH 52/67] add global.imageRegistry --- keycloak-db-values.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/keycloak-db-values.yaml b/keycloak-db-values.yaml index b9d6db9..03ba4ed 100644 --- a/keycloak-db-values.yaml +++ b/keycloak-db-values.yaml @@ -1,5 +1,6 @@ # See https://github.com/bitnami/charts/tree/master/bitnami/postgresql global: + imageregistry: security: allowInsecureImages: true postgresql: From 493fbda1d38e72b95f2f5ae17892765a09495225 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 14:50:50 -0400 Subject: [PATCH 53/67] try both --- keycloak-db-values.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/keycloak-db-values.yaml b/keycloak-db-values.yaml index 03ba4ed..6a5fc8f 100644 --- a/keycloak-db-values.yaml +++ b/keycloak-db-values.yaml @@ -19,6 +19,9 @@ image: common: errors: inseecureImages: "true" +common: + errors: + inseecureImages: "true" primary: resources: From 76f4000341abb530c75092f3e9dc04eeee9474eb Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 14:57:57 -0400 Subject: [PATCH 54/67] remove common --- keycloak-db-values.yaml | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/keycloak-db-values.yaml b/keycloak-db-values.yaml index 6a5fc8f..c96ff8e 100644 --- a/keycloak-db-values.yaml +++ b/keycloak-db-values.yaml @@ -16,12 +16,6 @@ image: registry: repository: tag: ${tag} - common: - errors: - inseecureImages: "true" -common: - errors: - inseecureImages: "true" primary: resources: @@ -39,6 +33,7 @@ readReplicas: limits: cpu: 2000m memory: 2Gi + # To enable metrics we need to pull in the posgresql-exporter image metrics: enabled: true @@ -53,8 +48,8 @@ persistence: postgresql: resources: requests: - cpu: 500m - memory: 1Gi + cpu: 100m + memory: 128Mi limits: - cpu: 1000m + cpu: 2000m memory: 2Gi From 637eb11a8c76c080d256cb9dcc22acc68e8c8757 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 15:04:57 -0400 Subject: [PATCH 55/67] remove offending line from NOTES.txt --- charts/postgresql/templates/NOTES.txt | 1 - 1 file changed, 1 deletion(-) diff --git a/charts/postgresql/templates/NOTES.txt b/charts/postgresql/templates/NOTES.txt index 61c5c78..c09ddb3 100644 --- a/charts/postgresql/templates/NOTES.txt +++ b/charts/postgresql/templates/NOTES.txt @@ -118,4 +118,3 @@ WARNING: The configured password will be ignored on new installation in case whe {{- include "common.warnings.rollingTag" .Values.volumePermissions.image }} {{- include "common.warnings.resources" (dict "sections" (list "metrics" "primary" "readReplicas" "volumePermissions") "context" $) }} {{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.volumePermissions.image .Values.metrics.image) "context" $) }} -{{- include "common.errors.insecureImages" (dict "images" (list .Values.image .Values.volumePermissions.image .Values.metrics.image) "context" $) }} From fbf0cdb2f4c26705812f7292b5f86d165d364a8d Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 15:14:47 -0400 Subject: [PATCH 56/67] update values --- keycloak-db-values.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/keycloak-db-values.yaml b/keycloak-db-values.yaml index c96ff8e..40dab1d 100644 --- a/keycloak-db-values.yaml +++ b/keycloak-db-values.yaml @@ -1,6 +1,5 @@ # See https://github.com/bitnami/charts/tree/master/bitnami/postgresql global: - imageregistry: security: allowInsecureImages: true postgresql: @@ -15,7 +14,7 @@ global: image: registry: repository: - tag: ${tag} + tag: primary: resources: From 0f126726e30e6c9badad54bc915ceb83896a716b Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 15:18:27 -0400 Subject: [PATCH 57/67] no image stuff? --- keycloak-db-values.yaml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/keycloak-db-values.yaml b/keycloak-db-values.yaml index 40dab1d..235f84c 100644 --- a/keycloak-db-values.yaml +++ b/keycloak-db-values.yaml @@ -11,11 +11,6 @@ global: adminPasswordKey: password userPasswordKey: postgres-password replicationPasswordKey: replication-password -image: - registry: - repository: - tag: - primary: resources: requests: @@ -36,9 +31,6 @@ readReplicas: # To enable metrics we need to pull in the posgresql-exporter image metrics: enabled: true - image: - repository: - tag: persistence: enabled: true From 45399a8216007c30ec7bd4918a84dbff65f88737 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 15:42:59 -0400 Subject: [PATCH 58/67] ensure workflows are current --- .github/workflows/terraform-release.yaml | 4 +-- copy_images.tf | 2 +- terraform-release.yaml | 40 ---------------------- terraform-validate.yaml | 42 ------------------------ 4 files changed, 3 insertions(+), 85 deletions(-) delete mode 100644 terraform-release.yaml delete mode 100644 terraform-validate.yaml diff --git a/.github/workflows/terraform-release.yaml b/.github/workflows/terraform-release.yaml index 9ca6d77..3f67574 100644 --- a/.github/workflows/terraform-release.yaml +++ b/.github/workflows/terraform-release.yaml @@ -1,4 +1,4 @@ -name: Terraform Release Module +name: Terraform Module Release on: workflow_dispatch: pull_request: @@ -6,7 +6,7 @@ on: branches: - main jobs: - terraform-ci-cd: + terraform-release: runs-on: "229685449397" permissions: contents: write diff --git a/copy_images.tf b/copy_images.tf index 2c65966..0dd161d 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -10,7 +10,7 @@ locals { { enabled = true dest_path = null - name = "keycloak/keycloak" + name = local.keycloak_name source_image = "keycloak/keycloak" source_registry = format("%v/%v", local.ent_ecr_source, "quay") source_tag = var.keycloak_tag diff --git a/terraform-release.yaml b/terraform-release.yaml deleted file mode 100644 index 3f67574..0000000 --- a/terraform-release.yaml +++ /dev/null @@ -1,40 +0,0 @@ -name: Terraform Module Release -on: - workflow_dispatch: - pull_request: - types: [closed] - branches: - - main -jobs: - terraform-release: - runs-on: "229685449397" - permissions: - contents: write - - steps: - - name: Checkout code - uses: CSVD/gh-actions-checkout@v4 - - - name: Setup GITHUB Credentials - id: github_credentials - uses: CSVD/gh-auth@main - with: - github_app_pem_file: ${{ secrets.GH_APP_PEM_FILE }} - github_app_installation_id: ${{ vars.GH_APP_INSTALLATION_ID }} - github_app_id: ${{ vars.GH_APP_ID }} - - - name: Setup GitHub CLI - run: | - # Force manual authentication since setup-git might not work with GitHub Enterprise - echo "${{ steps.github_credentials.outputs.github_token }}" > /tmp/token.txt - gh auth login --with-token --hostname "github.e.it.census.gov" < /tmp/token.txt - rm /tmp/token.txt - - # Test GitHub CLI auth status - gh auth status || echo "GitHub CLI authentication failed" - - - name: Run Release Action - uses: CSVD/releaser@main - with: - github-token: ${{ steps.github_credentials.outputs.github_token }} - working-directory: '.' diff --git a/terraform-validate.yaml b/terraform-validate.yaml deleted file mode 100644 index ac349eb..0000000 --- a/terraform-validate.yaml +++ /dev/null @@ -1,42 +0,0 @@ -name: Terraform Validate -on: - pull_request: - workflow_dispatch: - -jobs: - - terraform-validate: - runs-on: "229685449397" - permissions: - contents: write - steps: - - name: Checkout code - uses: CSVD/gh-actions-checkout@v4 - - - name: Setup Terraform - uses: CSVD/gh-actions-setup-terraform@v2 - with: - terraform_version: '1.10.5' - - - name: Validate Terraform Configuration - id: validate - uses: CSVD/terraform-validate@main - - - name: Check Validation/Test Results - if: always() - run: | - # Set default values if outputs are empty - IS_VALID="${{ steps.validate.outputs.is_valid }}" - TESTS_PASSED="${{ steps.validate.outputs.tests_passed }}" - - # If outputs are empty, set them to false - [ -z "$IS_VALID" ] && IS_VALID="false" - [ -z "$TESTS_PASSED" ] && TESTS_PASSED="false" - - if [[ "$IS_VALID" != "true" || "$TESTS_PASSED" != "true" ]]; then - echo "Validation or test errors found:" - echo "${{ steps.validate.outputs.stderr }}" - exit 1 - else - echo "All validations and tests passed successfully!" - fi From f8303cd6fb49aad74a55b3e3a44a5768858660e6 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 15:51:16 -0400 Subject: [PATCH 59/67] add vals to overwrite defaults --- keycloak-db-values.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/keycloak-db-values.yaml b/keycloak-db-values.yaml index 235f84c..f380619 100644 --- a/keycloak-db-values.yaml +++ b/keycloak-db-values.yaml @@ -11,6 +11,18 @@ global: adminPasswordKey: password userPasswordKey: postgres-password replicationPasswordKey: replication-password + +image: + registry: + +volumePermissions: + image: + registry: + +metrics: + image: + registry: + primary: resources: requests: From b4cf4acc1e2aa93b059778feb4b3e97ed91e6b25 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 15:51:24 -0400 Subject: [PATCH 60/67] add vals to overwrite defaults --- keycloak-db-values.yaml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/keycloak-db-values.yaml b/keycloak-db-values.yaml index f380619..2aa7507 100644 --- a/keycloak-db-values.yaml +++ b/keycloak-db-values.yaml @@ -19,7 +19,9 @@ volumePermissions: image: registry: +# To enable metrics we need to pull in the posgresql-exporter image metrics: + enabled: true image: registry: @@ -40,10 +42,6 @@ readReplicas: cpu: 2000m memory: 2Gi -# To enable metrics we need to pull in the posgresql-exporter image -metrics: - enabled: true - persistence: enabled: true From 866804d92f72ab167b051afae99b9ce4120ac44e Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 18:20:21 -0400 Subject: [PATCH 61/67] update output for discovery_url --- charts/keycloakx/README.md | 3 +-- outputs.tf | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/charts/keycloakx/README.md b/charts/keycloakx/README.md index c3c4066..4ff5113 100644 --- a/charts/keycloakx/README.md +++ b/charts/keycloakx/README.md @@ -157,7 +157,7 @@ The following table lists the configurable parameters of the Keycloak-X chart an | `networkPolicy.enabled` | If true, the ingress network policy is deployed | `false` | `networkPolicy.extraFrom` | Allows to define allowed external ingress traffic (see Kubernetes doc for network policy `from` format) | `[]` | `networkPolicy.egress` | Allows to define allowed egress from Keycloak pods (see Kubernetes doc for network policy `egress` format) | `[]` -| `route.enabled` | If `true`, an OpenShift Route is created | `false` | +| `route.enabled` | If `true`, rean OpenShift Route is created | `false` | | `route.path` | Path for the Route | `/` | | `route.annotations` | Route annotations | `{}` | | `route.labels` | Additional Route labels | `{}` | @@ -593,4 +593,3 @@ Keycloak 18.0.0 allows to enable the health endpoint independently of the metric We reflect that via the new config option `health.enabled`. Please read the additional notes about [Migrating to 18.0.0](https://www.keycloak.org/docs/latest/upgrading/index.html#migrating-to-18-0-0) in the Keycloak documentation. - diff --git a/outputs.tf b/outputs.tf index 1b617ad..daa7645 100644 --- a/outputs.tf +++ b/outputs.tf @@ -24,7 +24,7 @@ output "provider_config" { output "discovery_url" { description = "The URL for discovering keycloak services." - value = "${module.ingress_resources.service_url}/auth/realms/master" + value = format("http://%v.%v.svc.cluster.local:%v/%v", var.service_name, var.keycloak_namespace, local.admin_internal_port_number, "auth/realms/master") } output "user_auth_realm" { From fb1493cffa37187b574f2f8cc7dd6f9f080d3d44 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 18:32:42 -0400 Subject: [PATCH 62/67] public plus --- outputs.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/outputs.tf b/outputs.tf index daa7645..1b617ad 100644 --- a/outputs.tf +++ b/outputs.tf @@ -24,7 +24,7 @@ output "provider_config" { output "discovery_url" { description = "The URL for discovering keycloak services." - value = format("http://%v.%v.svc.cluster.local:%v/%v", var.service_name, var.keycloak_namespace, local.admin_internal_port_number, "auth/realms/master") + value = "${module.ingress_resources.service_url}/auth/realms/master" } output "user_auth_realm" { From 55c5d0d2b568dc3668ac452389268c1199a0e8c8 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 18:40:59 -0400 Subject: [PATCH 63/67] increase timeout and wait --- main.tf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/main.tf b/main.tf index 093a1c8..c601857 100644 --- a/main.tf +++ b/main.tf @@ -162,7 +162,8 @@ resource "helm_release" "keycloak" { namespace = kubernetes_namespace.keycloak.metadata[0].name version = var.keycloak_chart_version repository = "${path.module}/charts" - timeout = 300 + timeout = 600 + wait = true depends_on = [helm_release.keycloak-db] values = [templatefile("${path.module}/keycloak-server-values.yaml", { From 69dacf7b8a00d27c5bc639544f875bc41632212d Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 19:26:15 -0400 Subject: [PATCH 64/67] update output for discovery_url --- outputs.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/outputs.tf b/outputs.tf index 1b617ad..f65e93a 100644 --- a/outputs.tf +++ b/outputs.tf @@ -24,7 +24,7 @@ output "provider_config" { output "discovery_url" { description = "The URL for discovering keycloak services." - value = "${module.ingress_resources.service_url}/auth/realms/master" + value = "${module.ingress_resources.service_url}/realms/master" } output "user_auth_realm" { From ee52fcf80586506a021a32c2fbf73ecf67d33518 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 19:52:13 -0400 Subject: [PATCH 65/67] sort vars --- variables.tf | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/variables.tf b/variables.tf index 5dc83cb..8d2e93a 100644 --- a/variables.tf +++ b/variables.tf @@ -73,12 +73,6 @@ variable "keycloak_user" { default = "keycloak" } -variable "utilities_tag" { - description = "Version tag for the docker image to use to execute kubectl commands." - type = string - default = "1.0.3" -} - variable "profile" { description = "AWS config profile used to upload images into ECR" type = string @@ -113,3 +107,8 @@ variable "service_name" { type = string default = "service" } +variable "utilities_tag" { + description = "Version tag for the docker image to use to execute kubectl commands." + type = string + default = "1.0.3" +} From 5ae08586238098b3ac973c6346d419c4c482b4e0 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 21 Apr 2025 22:57:24 -0400 Subject: [PATCH 66/67] revert --- outputs.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/outputs.tf b/outputs.tf index f65e93a..1b617ad 100644 --- a/outputs.tf +++ b/outputs.tf @@ -24,7 +24,7 @@ output "provider_config" { output "discovery_url" { description = "The URL for discovering keycloak services." - value = "${module.ingress_resources.service_url}/realms/master" + value = "${module.ingress_resources.service_url}/auth/realms/master" } output "user_auth_realm" { From aec7df61801af0b047c8ea049f9a607ed7fc307a Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Tue, 22 Apr 2025 00:04:39 -0400 Subject: [PATCH 67/67] ensure committed --- README.md | 1 - version.tf | 13 +------------ 2 files changed, 1 insertion(+), 13 deletions(-) diff --git a/README.md b/README.md index abd9289..8933914 100644 --- a/README.md +++ b/README.md @@ -102,7 +102,6 @@ Common issues and solutions: | [helm_release.keycloak-db](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | | [kubernetes_namespace.keycloak](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource | | [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | -| [null_resource.module_name](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | | [random_uuid.user_secret](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/uuid) | resource | | [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | | [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | diff --git a/version.tf b/version.tf index 85dfd58..4116be4 100644 --- a/version.tf +++ b/version.tf @@ -10,18 +10,7 @@ resource "null_resource" "git_version" { } } -resource "null_resource" "module_name" { - triggers = { - module_path = path.module - } - - provisioner "local-exec" { - command = "basename $(pwd) > ${path.module}/.module_name" - on_failure = continue - } -} - locals { - module_name = fileexists("${path.module}/.module_name") ? trimspace(file("${path.module}/.module_name")) : "tfmod-keycloak" + module_name = "tfmod-keycloak" module_version = fileexists("${path.module}/.git_tag") ? trimspace(file("${path.module}/.git_tag")) : "latest" }