From 6beaa1bbbfac01cd206d382f1786f253926210f9 Mon Sep 17 00:00:00 2001 From: Kochetkov S Date: Tue, 14 Jul 2026 16:04:32 +0300 Subject: [PATCH] ++ deploy zitadel to a dedicated postgresql 17 --- .../infrastructure/kustomization.yaml | 13 +++ .../infrastructure/patches/camunda.yaml | 12 +- .../infrastructure/patches/kafka.yaml | 4 +- .../patches/postgresql-namespace-delete.yaml | 5 + .../infrastructure/patches/postgresql.yaml | 104 ++++++++++++++++++ .../infrastructure/patches/rabbitmq.yaml | 2 +- .../infrastructure/patches/vault.yaml | 2 +- .../infrastructure/patches/zitadel.yaml | 6 +- 8 files changed, 137 insertions(+), 11 deletions(-) create mode 100644 clusters/d8-ugmk-prod/infrastructure/patches/postgresql-namespace-delete.yaml create mode 100644 clusters/d8-ugmk-prod/infrastructure/patches/postgresql.yaml diff --git a/clusters/d8-ugmk-prod/infrastructure/kustomization.yaml b/clusters/d8-ugmk-prod/infrastructure/kustomization.yaml index ed28986..9b38ba7 100644 --- a/clusters/d8-ugmk-prod/infrastructure/kustomization.yaml +++ b/clusters/d8-ugmk-prod/infrastructure/kustomization.yaml @@ -5,6 +5,7 @@ resources: - ../../../infrastructure/rabbitmq - ../../../infrastructure/camunda - ../../../infrastructure/vault + - ../../../infrastructure/postgresql - ../../../infrastructure/zitadel patches: - path: ./patches/kafka.yaml @@ -55,6 +56,18 @@ patches: version: v1 kind: Namespace name: vault + - path: ./patches/postgresql.yaml + target: + group: helm.toolkit.fluxcd.io + version: v2 + kind: HelmRelease + name: postgresql + namespace: postgresql + - path: ./patches/postgresql-namespace-delete.yaml + target: + version: v1 + kind: Namespace + name: postgresql - path: ./patches/zitadel.yaml target: group: helm.toolkit.fluxcd.io diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/camunda.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/camunda.yaml index bb3f593..60dbda1 100644 --- a/clusters/d8-ugmk-prod/infrastructure/patches/camunda.yaml +++ b/clusters/d8-ugmk-prod/infrastructure/patches/camunda.yaml @@ -178,7 +178,7 @@ spec: automountServiceAccountToken: true persistence: size: 10Gi - storageClass: local-path + storageClass: nfs01 identityKeycloak: postgresql: auth: @@ -187,7 +187,7 @@ spec: automountServiceAccountToken: true persistence: size: 10Gi - storageClass: local-path + storageClass: nfs01 vaultEnv: enabled: true role: camunda @@ -203,7 +203,7 @@ spec: path: secrets/data/camunda/postgresql key: password global: - storageClass: local-path + storageClass: nfs01 tolerations: [] postgresql: auth: @@ -212,12 +212,12 @@ spec: automountServiceAccountToken: true persistence: size: 10Gi - storageClass: local-path + storageClass: nfs01 elasticsearch: master: persistence: size: 10Gi - storageClass: local-path + storageClass: nfs01 tolerations: [] metrics: enabled: false @@ -236,7 +236,7 @@ spec: - name: regcred tolerations: [] zeebe: - pvcStorageClassName: local-path + pvcStorageClassName: nfs01 image: pullSecrets: - name: regcred diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/kafka.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/kafka.yaml index b1e93fe..ccc40ec 100644 --- a/clusters/d8-ugmk-prod/infrastructure/patches/kafka.yaml +++ b/clusters/d8-ugmk-prod/infrastructure/patches/kafka.yaml @@ -26,7 +26,7 @@ spec: global: imagePullSecrets: - regcred - defaultStorageClass: local-path + defaultStorageClass: nfs01 image: pullSecrets: - regcred @@ -35,7 +35,7 @@ spec: automountServiceAccountToken: true persistence: size: 8Gi - storageClass: local-path + storageClass: nfs01 overrideConfiguration: offsets.topic.replication.factor: 1 transaction.state.log.replication.factor: 1 diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/postgresql-namespace-delete.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/postgresql-namespace-delete.yaml new file mode 100644 index 0000000..73e793c --- /dev/null +++ b/clusters/d8-ugmk-prod/infrastructure/patches/postgresql-namespace-delete.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: postgresql +$patch: delete diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/postgresql.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/postgresql.yaml new file mode 100644 index 0000000..672d284 --- /dev/null +++ b/clusters/d8-ugmk-prod/infrastructure/patches/postgresql.yaml @@ -0,0 +1,104 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: postgresql + namespace: zitadel +spec: + interval: 5m + timeout: 2h + + install: + timeout: 2h + remediation: + retries: 3 + + upgrade: + timeout: 2h + remediation: + retries: 3 + + values: + global: + security: + allowInsecureImages: true + defaultStorageClass: nfs01 + postgresql: + auth: + username: "" + database: "" + secretKeys: + userPasswordKey: "postgres-password" + auth: + username: "" + database: "" + secretKeys: + userPasswordKey: "postgres-password" + image: + registry: cr.yandex/crp3ccidau046kdj8g9q + repository: contour/postgresql + tag: 17.0.7 + pullPolicy: Always + metrics: + enabled: false + prometheusRule: + enabled: false + primary: + automountServiceAccountToken: true + containerSecurityContext: + readOnlyRootFilesystem: false + persistence: + storageClass: nfs01 + size: 20Gi + customLivenessProbe: + exec: + command: + - /bin/sh + - -c + - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432 + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 6 + customReadinessProbe: + exec: + command: + - /bin/sh + - -c + - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432 + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 6 + customStartupProbe: + exec: + command: + - /bin/sh + - -c + - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432 + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 6 + nodeSelector: + node.deckhouse.io/group: generic + tolerations: [] + contour: + enabled: true + adminUser: "postgres" + vault: + enabled: true + role: postgresql + authPath: auth/kubernetes + secretPath: secrets/data/postgresql/admin + secretKey: postgres-password + usersSecretPath: secrets/data/postgresql/users + sharedPreloadLibraries: "timescaledb,pg_stat_statements" + databases: + - name: zitadel + user: zitadel + passwordKey: zitadel + extensions: [] + restoreFromDump: false diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/rabbitmq.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/rabbitmq.yaml index d9e3ee6..b6e4a70 100644 --- a/clusters/d8-ugmk-prod/infrastructure/patches/rabbitmq.yaml +++ b/clusters/d8-ugmk-prod/infrastructure/patches/rabbitmq.yaml @@ -83,7 +83,7 @@ spec: requests: memory: 1Gi persistence: - storageClass: local-path + storageClass: nfs01 size: 10Gi auth: securePassword: true diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/vault.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/vault.yaml index 437a7f8..f1a5346 100644 --- a/clusters/d8-ugmk-prod/infrastructure/patches/vault.yaml +++ b/clusters/d8-ugmk-prod/infrastructure/patches/vault.yaml @@ -37,4 +37,4 @@ spec: node.deckhouse.io/group: generic tolerations: [] dataStorage: - storageClass: local-path + storageClass: nfs01 diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/zitadel.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/zitadel.yaml index 5938c29..1153847 100644 --- a/clusters/d8-ugmk-prod/infrastructure/patches/zitadel.yaml +++ b/clusters/d8-ugmk-prod/infrastructure/patches/zitadel.yaml @@ -6,6 +6,9 @@ metadata: spec: interval: 5m timeout: 10m + dependsOn: + - name: postgresql + namespace: zitadel postRenderers: - kustomize: patches: @@ -110,6 +113,7 @@ spec: debug: enabled: false postgresqlSecret: + create: false vault: enabled: true role: zitadel @@ -132,7 +136,7 @@ spec: - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED value: "true" - name: ZITADEL_DATABASE_POSTGRES_HOST - value: "10.222.255.162" + value: "postgresql.zitadel.svc.cluster.local" - name: ZITADEL_DATABASE_POSTGRES_PORT value: "5432" - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME