sarex/iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

++ deploy zitadel to a dedicated postgresql 17

Browse Source
This commit is contained in:
Kochetkov S 2026-07-14 16:04:32 +03:00
parent 9f582bdc84
commit 6beaa1bbbf
8 changed files with 137 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
clusters/d8-ugmk-prod/infrastructure/kustomization.yaml
View File

@ -5,6 +5,7 @@ resources:
- ../../../infrastructure/rabbitmq
- ../../../infrastructure/camunda
- ../../../infrastructure/vault
- ../../../infrastructure/postgresql
- ../../../infrastructure/zitadel
patches:
- path: ./patches/kafka.yaml
@ -55,6 +56,18 @@ patches:
version: v1
kind: Namespace
name: vault
- path: ./patches/postgresql.yaml
target:
group: helm.toolkit.fluxcd.io
version: v2
kind: HelmRelease
name: postgresql
namespace: postgresql
- path: ./patches/postgresql-namespace-delete.yaml
target:
version: v1
kind: Namespace
name: postgresql
- path: ./patches/zitadel.yaml
target:
group: helm.toolkit.fluxcd.io

12
clusters/d8-ugmk-prod/infrastructure/patches/camunda.yaml
View File

@ -178,7 +178,7 @@ spec:
automountServiceAccountToken: true
persistence:
size: 10Gi
storageClass: local-path
storageClass: nfs01
identityKeycloak:
postgresql:
auth:
@ -187,7 +187,7 @@ spec:
automountServiceAccountToken: true
persistence:
size: 10Gi
storageClass: local-path
storageClass: nfs01
vaultEnv:
enabled: true
role: camunda
@ -203,7 +203,7 @@ spec:
path: secrets/data/camunda/postgresql
key: password
global:
storageClass: local-path
storageClass: nfs01
tolerations: []
postgresql:
auth:
@ -212,12 +212,12 @@ spec:
automountServiceAccountToken: true
persistence:
size: 10Gi
storageClass: local-path
storageClass: nfs01
elasticsearch:
master:
persistence:
size: 10Gi
storageClass: local-path
storageClass: nfs01
tolerations: []
metrics:
enabled: false
@ -236,7 +236,7 @@ spec:
- name: regcred
tolerations: []
zeebe:
pvcStorageClassName: local-path
pvcStorageClassName: nfs01
image:
pullSecrets:
- name: regcred

4
clusters/d8-ugmk-prod/infrastructure/patches/kafka.yaml
View File

@ -26,7 +26,7 @@ spec:
global:
imagePullSecrets:
- regcred
defaultStorageClass: local-path
defaultStorageClass: nfs01
image:
pullSecrets:
- regcred
@ -35,7 +35,7 @@ spec:
automountServiceAccountToken: true
persistence:
size: 8Gi
storageClass: local-path
storageClass: nfs01
overrideConfiguration:
offsets.topic.replication.factor: 1
transaction.state.log.replication.factor: 1

5
clusters/d8-ugmk-prod/infrastructure/patches/postgresql-namespace-delete.yaml Normal file
View File

@ -0,0 +1,5 @@
apiVersion: v1
kind: Namespace
metadata:
name: postgresql
$patch: delete

104
clusters/d8-ugmk-prod/infrastructure/patches/postgresql.yaml Normal file
View File

@ -0,0 +1,104 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: postgresql
namespace: zitadel
spec:
interval: 5m
timeout: 2h
install:
timeout: 2h
remediation:
retries: 3
upgrade:
timeout: 2h
remediation:
retries: 3
values:
global:
security:
allowInsecureImages: true
defaultStorageClass: nfs01
postgresql:
auth:
username: ""
database: ""
secretKeys:
userPasswordKey: "postgres-password"
auth:
username: ""
database: ""
secretKeys:
userPasswordKey: "postgres-password"
image:
registry: cr.yandex/crp3ccidau046kdj8g9q
repository: contour/postgresql
tag: 17.0.7
pullPolicy: Always
metrics:
enabled: false
prometheusRule:
enabled: false
primary:
automountServiceAccountToken: true
containerSecurityContext:
readOnlyRootFilesystem: false
persistence:
storageClass: nfs01
size: 20Gi
customLivenessProbe:
exec:
command:
- /bin/sh
- -c
- exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432
initialDelaySeconds: 30
periodSeconds: 10
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 6
customReadinessProbe:
exec:
command:
- /bin/sh
- -c
- exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432
initialDelaySeconds: 5
periodSeconds: 10
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 6
customStartupProbe:
exec:
command:
- /bin/sh
- -c
- exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432
initialDelaySeconds: 30
periodSeconds: 10
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 6
nodeSelector:
node.deckhouse.io/group: generic
tolerations: []
contour:
enabled: true
adminUser: "postgres"
vault:
enabled: true
role: postgresql
authPath: auth/kubernetes
secretPath: secrets/data/postgresql/admin
secretKey: postgres-password
usersSecretPath: secrets/data/postgresql/users
sharedPreloadLibraries: "timescaledb,pg_stat_statements"
databases:
- name: zitadel
user: zitadel
passwordKey: zitadel
extensions: []
restoreFromDump: false

2
clusters/d8-ugmk-prod/infrastructure/patches/rabbitmq.yaml
View File

@ -83,7 +83,7 @@ spec:
requests:
memory: 1Gi
persistence:
storageClass: local-path
storageClass: nfs01
size: 10Gi
auth:
securePassword: true

2
clusters/d8-ugmk-prod/infrastructure/patches/vault.yaml
View File

@ -37,4 +37,4 @@ spec:
node.deckhouse.io/group: generic
tolerations: []
dataStorage:
storageClass: local-path
storageClass: nfs01

6
clusters/d8-ugmk-prod/infrastructure/patches/zitadel.yaml
View File

@ -6,6 +6,9 @@ metadata:
spec:
interval: 5m
timeout: 10m
dependsOn:
- name: postgresql
namespace: zitadel
postRenderers:
- kustomize:
patches:
@ -110,6 +113,7 @@ spec:
debug:
enabled: false
postgresqlSecret:
create: false
vault:
enabled: true
role: zitadel
@ -132,7 +136,7 @@ spec:
- name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED
value: "true"
- name: ZITADEL_DATABASE_POSTGRES_HOST
value: "10.222.255.162"
value: "postgresql.zitadel.svc.cluster.local"
- name: ZITADEL_DATABASE_POSTGRES_PORT
value: "5432"
- name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME