++ deploy zitadel to a dedicated postgresql 17

clusters/d8-ugmk-prod/infrastructure/kustomization.yaml

@@ -5,6 +5,7 @@ resources:
   - ../../../infrastructure/rabbitmq
   - ../../../infrastructure/camunda
   - ../../../infrastructure/vault
+  - ../../../infrastructure/postgresql
   - ../../../infrastructure/zitadel
 patches:
   - path: ./patches/kafka.yaml
@@ -55,6 +56,18 @@ patches:
       version: v1
       kind: Namespace
       name: vault
+  - path: ./patches/postgresql.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: postgresql
+      namespace: postgresql
+  - path: ./patches/postgresql-namespace-delete.yaml
+    target:
+      version: v1
+      kind: Namespace
+      name: postgresql
   - path: ./patches/zitadel.yaml
     target:
       group: helm.toolkit.fluxcd.io

clusters/d8-ugmk-prod/infrastructure/patches/camunda.yaml

@@ -178,7 +178,7 @@ spec:
         automountServiceAccountToken: true
         persistence:
           size: 10Gi
-          storageClass: local-path
+          storageClass: nfs01
     identityKeycloak:
       postgresql:
         auth:
@@ -187,7 +187,7 @@ spec:
           automountServiceAccountToken: true
           persistence:
             size: 10Gi
-            storageClass: local-path
+            storageClass: nfs01
       vaultEnv:
         enabled: true
         role: camunda
@@ -203,7 +203,7 @@ spec:
             path: secrets/data/camunda/postgresql
             key: password
       global:
-        storageClass: local-path
+        storageClass: nfs01
       tolerations: []
     postgresql:
       auth:
@@ -212,12 +212,12 @@ spec:
         automountServiceAccountToken: true
         persistence:
           size: 10Gi
-          storageClass: local-path
+          storageClass: nfs01
     elasticsearch:
       master:
         persistence:
           size: 10Gi
-          storageClass: local-path
+          storageClass: nfs01
         tolerations: []
       metrics:
         enabled: false
@@ -236,7 +236,7 @@ spec:
           - name: regcred
       tolerations: []
     zeebe:
-      pvcStorageClassName: local-path
+      pvcStorageClassName: nfs01
       image:
         pullSecrets:
           - name: regcred

clusters/d8-ugmk-prod/infrastructure/patches/kafka.yaml

@@ -26,7 +26,7 @@ spec:
     global:
       imagePullSecrets:
         - regcred
-      defaultStorageClass: local-path
+      defaultStorageClass: nfs01
     image:
       pullSecrets:
         - regcred
@@ -35,7 +35,7 @@ spec:
       automountServiceAccountToken: true
       persistence:
         size: 8Gi
-        storageClass: local-path
+        storageClass: nfs01
       overrideConfiguration:
         offsets.topic.replication.factor: 1
         transaction.state.log.replication.factor: 1

clusters/d8-ugmk-prod/infrastructure/patches/postgresql-namespace-delete.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: postgresql
+$patch: delete

clusters/d8-ugmk-prod/infrastructure/patches/postgresql.yaml

@@ -0,0 +1,104 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: postgresql
+  namespace: zitadel
+spec:
+  interval: 5m
+  timeout: 2h
+
+  install:
+    timeout: 2h
+    remediation:
+      retries: 3
+
+  upgrade:
+    timeout: 2h
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      security:
+        allowInsecureImages: true
+      defaultStorageClass: nfs01
+      postgresql:
+        auth:
+          username: ""
+          database: ""
+          secretKeys:
+            userPasswordKey: "postgres-password"
+    auth:
+      username: ""
+      database: ""
+      secretKeys:
+        userPasswordKey: "postgres-password"
+    image:
+      registry: cr.yandex/crp3ccidau046kdj8g9q
+      repository: contour/postgresql
+      tag: 17.0.7
+      pullPolicy: Always
+    metrics:
+      enabled: false
+      prometheusRule:
+        enabled: false
+    primary:
+      automountServiceAccountToken: true
+      containerSecurityContext:
+        readOnlyRootFilesystem: false
+      persistence:
+        storageClass: nfs01
+        size: 20Gi
+      customLivenessProbe:
+        exec:
+          command:
+            - /bin/sh
+            - -c
+            - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432
+        initialDelaySeconds: 30
+        periodSeconds: 10
+        timeoutSeconds: 5
+        successThreshold: 1
+        failureThreshold: 6
+      customReadinessProbe:
+        exec:
+          command:
+            - /bin/sh
+            - -c
+            - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432
+        initialDelaySeconds: 5
+        periodSeconds: 10
+        timeoutSeconds: 5
+        successThreshold: 1
+        failureThreshold: 6
+      customStartupProbe:
+        exec:
+          command:
+            - /bin/sh
+            - -c
+            - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432
+        initialDelaySeconds: 30
+        periodSeconds: 10
+        timeoutSeconds: 5
+        successThreshold: 1
+        failureThreshold: 6
+      nodeSelector:
+        node.deckhouse.io/group: generic
+      tolerations: []
+    contour:
+      enabled: true
+      adminUser: "postgres"
+      vault:
+        enabled: true
+        role: postgresql
+        authPath: auth/kubernetes
+        secretPath: secrets/data/postgresql/admin
+        secretKey: postgres-password
+        usersSecretPath: secrets/data/postgresql/users
+      sharedPreloadLibraries: "timescaledb,pg_stat_statements"
+      databases:
+        - name: zitadel
+          user: zitadel
+          passwordKey: zitadel
+          extensions: []
+          restoreFromDump: false

clusters/d8-ugmk-prod/infrastructure/patches/rabbitmq.yaml

@@ -83,7 +83,7 @@ spec:
       requests:
         memory: 1Gi
     persistence:
-      storageClass: local-path
+      storageClass: nfs01
       size: 10Gi
     auth:
       securePassword: true

clusters/d8-ugmk-prod/infrastructure/patches/vault.yaml

@@ -37,4 +37,4 @@ spec:
         node.deckhouse.io/group: generic
       tolerations: []
       dataStorage:
-        storageClass: local-path
+        storageClass: nfs01

clusters/d8-ugmk-prod/infrastructure/patches/zitadel.yaml

@@ -6,6 +6,9 @@ metadata:
 spec:
   interval: 5m
   timeout: 10m
+  dependsOn:
+    - name: postgresql
+      namespace: zitadel
   postRenderers:
     - kustomize:
         patches:
@@ -110,6 +113,7 @@ spec:
       debug:
         enabled: false
     postgresqlSecret:
+      create: false
       vault:
         enabled: true
         role: zitadel
@@ -132,7 +136,7 @@ spec:
       - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED
         value: "true"
       - name: ZITADEL_DATABASE_POSTGRES_HOST
-        value: "10.222.255.162"
+        value: "postgresql.zitadel.svc.cluster.local"
       - name: ZITADEL_DATABASE_POSTGRES_PORT
         value: "5432"
       - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME