118 lines
2.9 KiB
Bash
Executable File
118 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Deploy Postgres for la-huasca in its own namespace
|
|
|
|
NAMESPACE="${NAMESPACE:-lahuasca}"
|
|
SECRET_NAME="la-huasca-db-secrets"
|
|
PVC_NAME="postgres-data"
|
|
|
|
# Generate a secure random password if secret doesn't exist yet
|
|
if ! kubectl get secret "$SECRET_NAME" -n "$NAMESPACE" >/dev/null 2>&1; then
|
|
echo "==> Generating database password ..."
|
|
PASSWORD=$(openssl rand -base64 32 | tr -d '\n')
|
|
DATABASE_URL="postgres://lahuasca:$PASSWORD@postgres.$NAMESPACE.svc.cluster.local:5432/lahuasca"
|
|
|
|
kubectl create secret generic "$SECRET_NAME" \
|
|
--namespace "$NAMESPACE" \
|
|
--from-literal=POSTGRES_USER=lahuasca \
|
|
--from-literal=POSTGRES_PASSWORD="$PASSWORD" \
|
|
--from-literal=POSTGRES_DB=lahuasca \
|
|
--from-literal=DATABASE_URL="$DATABASE_URL"
|
|
echo "==> Created $SECRET_NAME"
|
|
else
|
|
echo "==> $SECRET_NAME already exists, leaving it"
|
|
fi
|
|
|
|
# Ensure PVC exists
|
|
if ! kubectl get pvc "$PVC_NAME" -n "$NAMESPACE" >/dev/null 2>&1; then
|
|
echo "==> Creating Postgres PVC ..."
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: $PVC_NAME
|
|
namespace: $NAMESPACE
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 10Gi
|
|
EOF
|
|
fi
|
|
|
|
# Deploy Postgres
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: postgres
|
|
namespace: $NAMESPACE
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: postgres
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: postgres
|
|
spec:
|
|
containers:
|
|
- name: postgres
|
|
image: postgres:15-alpine
|
|
ports:
|
|
- containerPort: 5432
|
|
env:
|
|
- name: POSTGRES_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: $SECRET_NAME
|
|
key: POSTGRES_USER
|
|
- name: POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: $SECRET_NAME
|
|
key: POSTGRES_PASSWORD
|
|
- name: POSTGRES_DB
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: $SECRET_NAME
|
|
key: POSTGRES_DB
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /var/lib/postgresql/data
|
|
resources:
|
|
requests:
|
|
memory: "128Mi"
|
|
cpu: "100m"
|
|
limits:
|
|
memory: "512Mi"
|
|
cpu: "500m"
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: $PVC_NAME
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: postgres
|
|
namespace: $NAMESPACE
|
|
spec:
|
|
selector:
|
|
app: postgres
|
|
ports:
|
|
- port: 5432
|
|
targetPort: 5432
|
|
EOF
|
|
|
|
echo "==> Waiting for postgres to be ready ..."
|
|
kubectl rollout status deployment/postgres -n "$NAMESPACE" --timeout=120s
|
|
|
|
echo ""
|
|
echo "Postgres ready in namespace $NAMESPACE"
|
|
echo "To reveal the password:"
|
|
echo " kubectl get secret $SECRET_NAME -n $NAMESPACE -o jsonpath='{.data.DATABASE_URL}' | base64 -d"
|