From 238e2bc0c663f5a7686e217ed67b9bb666c56e0d Mon Sep 17 00:00:00 2001 From: Kjeld Schouten-Lebbing Date: Sat, 11 Sep 2021 20:58:37 +0200 Subject: [PATCH] chore: Use bitnami instead of stock postgresql container (#960) * chore: Setup all apps to use bitnami instead of stock postgresql container * Actually don't bump major as there is no breaking change (as people using it will default to the migration initscript) --- charts/incubator/sogo/SCALE/ix_values.yaml | 35 ++-- charts/incubator/sogo/values.yaml | 4 +- charts/stable/authelia/SCALE/ix_values.yaml | 4 +- charts/stable/authelia/values.yaml | 4 +- charts/stable/fireflyiii/SCALE/ix_values.yaml | 4 +- charts/stable/fireflyiii/values.yaml | 4 +- charts/stable/nextcloud/SCALE/ix_values.yaml | 4 +- charts/stable/nextcloud/values.yaml | 5 +- charts/stable/postgresql/Chart.yaml | 4 +- charts/stable/postgresql/SCALE/ix_values.yaml | 32 +++- charts/stable/postgresql/SCALE/questions.yaml | 160 +++++++++++++++++- charts/stable/postgresql/values.yaml | 54 +++++- .../stable/vaultwarden/SCALE/ix_values.yaml | 4 +- charts/stable/vaultwarden/values.yaml | 4 +- 14 files changed, 279 insertions(+), 43 deletions(-) diff --git a/charts/incubator/sogo/SCALE/ix_values.yaml b/charts/incubator/sogo/SCALE/ix_values.yaml index e87411e5ed4..da105cc2b26 100644 --- a/charts/incubator/sogo/SCALE/ix_values.yaml +++ b/charts/incubator/sogo/SCALE/ix_values.yaml @@ -9,24 +9,33 @@ image: tag: v5.2.0@sha256:8fc7bb87b77d76d929bcd36403d4f27878fa3e99f5448fb05ed64829078665a4 postgresqlImage: - repository: postgres + repository: bitnami/postgresql pullPolicy: IfNotPresent - tag: 13.4-alpine@sha256:a70babcd0e8f86272c35d6efcf8070c597c1f31b3d19727eece213a09929dd55 + tag: 13.4.0@sha256:7fff0f7e827cd8e1daa3adbf0ca3f19e21006023c0f6d1c2d835718961516a87 initContainers: - - name: init-postgresdb - image: "{{ .Values.postgresqlImage.repository}}:{{ .Values.postgresqlImage.tag }}" + migrate-db: + image: "{{ .Values.alpineImage.repository}}:{{ .Values.alpineImage.tag }}" + securityContext: + runAsUser: 0 + privileged: true + allowPrivilegeEscalation: true + runAsNonRoot: false command: - - "sh" - - "-c" - - "until pg_isready -U sogo -h ${pghost} ; do sleep 2 ; done" + - /bin/sh + - -cx + - | + echo 'trying to migrate old db to new location...' + mkdir -p /bitnami/postgresql/data + mv -f /bitnami/postgresql/old/* /bitnami/postgresql/data/ || true + chown -R {{ .Values.podSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} /bitnami/postgresql/data + chmod 775 /bitnami/postgresql/data imagePullPolicy: IfNotPresent - env: - - name: pghost - valueFrom: - secretKeyRef: - name: dbcreds - key: plainhost + volumeMounts: + - name: db + mountPath: /bitnami/postgresql/old + - name: data + mountPath: /bitnami/postgresql # Enabled postgres diff --git a/charts/incubator/sogo/values.yaml b/charts/incubator/sogo/values.yaml index d88063fe49e..4829d9751da 100644 --- a/charts/incubator/sogo/values.yaml +++ b/charts/incubator/sogo/values.yaml @@ -5,9 +5,9 @@ image: tag: v5.2.0@sha256:8fc7bb87b77d76d929bcd36403d4f27878fa3e99f5448fb05ed64829078665a4 postgresqlImage: - repository: postgres + repository: bitnami/postgresql pullPolicy: IfNotPresent - tag: 13.4-alpine@sha256:a70babcd0e8f86272c35d6efcf8070c597c1f31b3d19727eece213a09929dd55 + tag: 13.4.0@sha256:7fff0f7e827cd8e1daa3adbf0ca3f19e21006023c0f6d1c2d835718961516a87 # -- services service: diff --git a/charts/stable/authelia/SCALE/ix_values.yaml b/charts/stable/authelia/SCALE/ix_values.yaml index a0103098c56..2db4f588788 100644 --- a/charts/stable/authelia/SCALE/ix_values.yaml +++ b/charts/stable/authelia/SCALE/ix_values.yaml @@ -10,9 +10,9 @@ image: tag: "4.30.4"@sha256:42 postgresqlImage: - repository: postgres + repository: bitnami/postgresql pullPolicy: IfNotPresent - tag: 13.4-alpine@sha256:42 + tag: 13.4.0@sha256:7fff0f7e827cd8e1daa3adbf0ca3f19e21006023c0f6d1c2d835718961516a87 enableServiceLinks: false diff --git a/charts/stable/authelia/values.yaml b/charts/stable/authelia/values.yaml index 0d1162ecd87..78c4bab063e 100644 --- a/charts/stable/authelia/values.yaml +++ b/charts/stable/authelia/values.yaml @@ -19,9 +19,9 @@ podSecurityContext: fsGroupChangePolicy: "OnRootMismatch" postgresqlImage: - repository: docker.io/postgres + repository: bitnami/postgresql pullPolicy: IfNotPresent - tag: 13.4-alpine@sha256:a70babcd0e8f86272c35d6efcf8070c597c1f31b3d19727eece213a09929dd55 + tag: 13.4.0@sha256:7fff0f7e827cd8e1daa3adbf0ca3f19e21006023c0f6d1c2d835718961516a87 command: ["authelia"] args: ["--config=/configuration.yaml"] diff --git a/charts/stable/fireflyiii/SCALE/ix_values.yaml b/charts/stable/fireflyiii/SCALE/ix_values.yaml index 5a99d90384c..072fa19dc89 100644 --- a/charts/stable/fireflyiii/SCALE/ix_values.yaml +++ b/charts/stable/fireflyiii/SCALE/ix_values.yaml @@ -11,9 +11,9 @@ image: postgresqlImage: - repository: postgres + repository: bitnami/postgresql pullPolicy: IfNotPresent - tag: 13.4-alpine@sha256:a70babcd0e8f86272c35d6efcf8070c597c1f31b3d19727eece213a09929dd55 + tag: 13.4.0@sha256:7fff0f7e827cd8e1daa3adbf0ca3f19e21006023c0f6d1c2d835718961516a87 initContainers: init-postgresdb: diff --git a/charts/stable/fireflyiii/values.yaml b/charts/stable/fireflyiii/values.yaml index c0c536683cb..23554f85f2a 100644 --- a/charts/stable/fireflyiii/values.yaml +++ b/charts/stable/fireflyiii/values.yaml @@ -7,9 +7,9 @@ image: postgresqlImage: - repository: postgres + repository: bitnami/postgresql pullPolicy: IfNotPresent - tag: 13.4-alpine@sha256:a70babcd0e8f86272c35d6efcf8070c597c1f31b3d19727eece213a09929dd55 + tag: 13.4.0@sha256:7fff0f7e827cd8e1daa3adbf0ca3f19e21006023c0f6d1c2d835718961516a87 securityContext: privileged: false diff --git a/charts/stable/nextcloud/SCALE/ix_values.yaml b/charts/stable/nextcloud/SCALE/ix_values.yaml index 06f38fe33e0..5b0d161fd4f 100644 --- a/charts/stable/nextcloud/SCALE/ix_values.yaml +++ b/charts/stable/nextcloud/SCALE/ix_values.yaml @@ -10,9 +10,9 @@ image: tag: 22.1.1@sha256:99d94124b2024c9f7f38dc12144a92bc0d68d110bcfd374169ebb7e8df0adf8e postgresqlImage: - repository: postgres + repository: bitnami/postgresql pullPolicy: IfNotPresent - tag: 13.4-alpine@sha256:a70babcd0e8f86272c35d6efcf8070c597c1f31b3d19727eece213a09929dd55 + tag: 13.4.0@sha256:7fff0f7e827cd8e1daa3adbf0ca3f19e21006023c0f6d1c2d835718961516a87 strategy: type: Recreate diff --git a/charts/stable/nextcloud/values.yaml b/charts/stable/nextcloud/values.yaml index ecae3149a01..7fc86b5a063 100644 --- a/charts/stable/nextcloud/values.yaml +++ b/charts/stable/nextcloud/values.yaml @@ -13,10 +13,9 @@ podSecurityContext: fsGroupChangePolicy: "OnRootMismatch" postgresqlImage: - repository: docker.io/postgres + repository: bitnami/postgresql pullPolicy: IfNotPresent - tag: "13.1"@sha256:42 - + tag: 13.4.0@sha256:7fff0f7e827cd8e1daa3adbf0ca3f19e21006023c0f6d1c2d835718961516a87 service: main: ports: diff --git a/charts/stable/postgresql/Chart.yaml b/charts/stable/postgresql/Chart.yaml index 0b4640022c0..d03b0f4bb34 100644 --- a/charts/stable/postgresql/Chart.yaml +++ b/charts/stable/postgresql/Chart.yaml @@ -3,7 +3,7 @@ appVersion: "13.4" dependencies: - name: common repository: https://truecharts.org/ - version: 7.0.0 + version: 7.0.2 deprecated: false description: PostgresSQL home: https://github.com/truecharts/apps/tree/master/stable/postgres @@ -25,4 +25,4 @@ name: postgresql sources: - https://www.postgresql.org/ type: application -version: 2.0.0 +version: 2.1.0 diff --git a/charts/stable/postgresql/SCALE/ix_values.yaml b/charts/stable/postgresql/SCALE/ix_values.yaml index 69f4444d98d..6fddd921907 100644 --- a/charts/stable/postgresql/SCALE/ix_values.yaml +++ b/charts/stable/postgresql/SCALE/ix_values.yaml @@ -5,11 +5,39 @@ ## image: - repository: docker.io/postgres + repository: bitnami/postgresql pullPolicy: IfNotPresent - tag: "13.4"@sha256:42 + tag: 13.4.0@sha256:7fff0f7e827cd8e1daa3adbf0ca3f19e21006023c0f6d1c2d835718961516a87 +initContainers: + migrate-db: + image: "{{ .Values.alpineImage.repository}}:{{ .Values.alpineImage.tag }}" + securityContext: + runAsUser: 0 + privileged: true + allowPrivilegeEscalation: true + runAsNonRoot: false + command: + - /bin/sh + - -cx + - | + echo 'trying to migrate old db to new location...' + chown -R {{ .Values.podSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} /bitnami/postgresql/data /bitnami/postgresql/old + chmod 775 /bitnami/postgresql/data/ bitnami/postgresql/data /bitnami/postgresql/old + mkdir -p /bitnami/postgresql/data + mkdir -p /bitnami/postgresql/conf + mv -f /bitnami/postgresql/old/* /bitnami/postgresql/data/ || true + mv -f /bitnami/postgresql/data/pg_hba.conf /bitnami/postgresql/conf/pg_hba.conf || true + chown -R {{ .Values.podSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} /bitnami/postgresql/data + chmod 775 /bitnami/postgresql/data + imagePullPolicy: IfNotPresent + volumeMounts: + - name: db + mountPath: /bitnami/postgresql/old + - name: data + mountPath: /bitnami/postgresql + envValueFrom: POSTGRES_PASSWORD: secretKeyRef: diff --git a/charts/stable/postgresql/SCALE/questions.yaml b/charts/stable/postgresql/SCALE/questions.yaml index ecb55dac7a1..8f4f9363b9e 100644 --- a/charts/stable/postgresql/SCALE/questions.yaml +++ b/charts/stable/postgresql/SCALE/questions.yaml @@ -457,7 +457,118 @@ questions: type: dict attrs: - variable: db - label: "App db Storage" + label: "Old db Storage" + description: "Stores the old Application Database." + schema: + type: dict + hidden: true + attrs: + - variable: enabled + label: "Enable the storage" + schema: + type: boolean + default: true + - variable: type + label: "(Advanced) Type of Storage" + description: "Sets the persistence type" + schema: + type: string + default: "pvc" + enum: + - value: "pvc" + description: "pvc" + - value: "emptyDir" + description: "emptyDir" + - value: "hostPath" + description: "hostPath" + - variable: storageClass + label: "(Advanced) storageClass" + description: " Warning: Anything other than SCALE-ZFS will break rollback!" + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: "SCALE-ZFS" + - variable: setPermissions + label: "Automatic Permissions" + description: "Automatically set permissions on install" + schema: + show_if: [["type", "=", "hostPath"]] + type: boolean + default: true + - variable: readOnly + label: "readOnly" + schema: + type: boolean + default: false + - variable: hostPath + label: "hostPath" + description: "Path inside the container the storage is mounted" + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: hostPathType + label: "hostPath Type" + schema: + show_if: [["type", "=", "hostPath"]] + type: string + default: "" + enum: + - value: "" + description: "Default" + - value: "DirectoryOrCreate" + description: "DirectoryOrCreate" + - value: "Directory" + description: "Directory" + - value: "FileOrCreate" + description: "FileOrCreate" + - value: "File" + description: "File" + - value: "Socket" + description: "Socket" + - value: "CharDevice" + description: "CharDevice" + - value: "BlockDevice" + description: "BlockDevice" + - variable: mountPath + label: "mountPath" + description: "Path inside the container the storage is mounted" + schema: + type: string + default: "/var/lib/postgresql/data" + hidden: true + - variable: medium + label: "EmptyDir Medium" + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: "Default" + - value: "Memory" + description: "Memory" + - variable: accessMode + label: "Access Mode (Advanced)" + description: "Allow or disallow multiple PVC's writhing to the same PV" + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: "ReadWriteOnce" + enum: + - value: "ReadWriteOnce" + description: "ReadWriteOnce" + - value: "ReadOnlyMany" + description: "ReadOnlyMany" + - value: "ReadWriteMany" + description: "ReadWriteMany" + - variable: size + label: "Size quotum of storage" + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: "100Gi" + - variable: data + label: "App data Storage" description: "Stores the Application Database." schema: type: dict @@ -533,7 +644,7 @@ questions: description: "Path inside the container the storage is mounted" schema: type: string - default: "/var/lib/postgresql/data" + default: "/bitnami/postgresql" hidden: true - variable: medium label: "EmptyDir Medium" @@ -993,6 +1104,51 @@ questions: schema: type: boolean default: false + + - variable: podSecurityContext + group: "Security and Permissions" + label: "Pod Security Context" + schema: + type: dict + attrs: + - variable: runAsUser + label: "runAsUser" + description: "The UserID of the user running the application" + schema: + type: int + default: 568 + - variable: runAsGroup + label: "runAsGroup" + description: The groupID this App of the user running the application" + schema: + type: int + default: 0 + - variable: fsGroup + label: "fsGroup" + description: "The group that should own ALL storage." + schema: + type: int + default: 568 + - variable: supplementalGroups + label: "supplemental Groups" + schema: + type: list + default: [] + items: + - variable: supplementalGroupsEntry + label: "supplemental Group" + schema: + type: int + - variable: fsGroupChangePolicy + label: "When should we take ownership?" + schema: + type: string + default: "OnRootMismatch" + enum: + - value: "OnRootMismatch" + description: "OnRootMismatch" + - value: "Always" + description: "Always" - variable: resources group: "Resources and Devices" label: "" diff --git a/charts/stable/postgresql/values.yaml b/charts/stable/postgresql/values.yaml index a0c12777bce..05647109ef1 100644 --- a/charts/stable/postgresql/values.yaml +++ b/charts/stable/postgresql/values.yaml @@ -1,7 +1,7 @@ image: - repository: docker.io/postgres + repository: bitnami/postgresql pullPolicy: IfNotPresent - tag: 13.4@sha256:97e5e91582e89514277912d4b7c95bceabdede3482e32395bcb40099abd9c506 + tag: 13.4.0@sha256:7fff0f7e827cd8e1daa3adbf0ca3f19e21006023c0f6d1c2d835718961516a87 service: @@ -14,19 +14,63 @@ service: ## TODO: Fix the backup-on-upgrade system enableUpgradeBackup: false +initContainers: + migrate-db: + image: "{{ .Values.alpineImage.repository}}:{{ .Values.alpineImage.tag }}" + securityContext: + runAsUser: 0 + privileged: true + allowPrivilegeEscalation: true + runAsNonRoot: false + command: + - /bin/sh + - -cx + - | + echo 'trying to migrate old db to new location...' + mkdir -p /bitnami/postgresql/data + mv -f /bitnami/postgresql/old/* /bitnami/postgresql/data/ || true + chown -R {{ .Values.podSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} /bitnami/postgresql/data + chmod 775 /bitnami/postgresql/data + imagePullPolicy: IfNotPresent + volumeMounts: + - name: db + mountPath: /bitnami/postgresql/old + - name: data + mountPath: /bitnami/postgresql + + +securityContext: + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + runAsNonRoot: false + +podSecurityContext: + runAsUser: 568 + runAsGroup: 0 + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: "OnRootMismatch" + persistence: db: enabled: true - mountPath: "/var/lib/postgresql/data" + mountPath: "/bitnami/postgresql/old" type: pvc accessMode: ReadWriteOnce - size: "100Gi" + size: "999Gi" + data: + enabled: true + mountPath: "/bitnami/postgresql" + type: pvc + accessMode: ReadWriteOnce + size: "999Gi" dbbackups: enabled: true mountPath: "/dbbackups" type: pvc accessMode: ReadWriteOnce - size: "100Gi" + size: "999Gi" postgresqlPassword: "testpass" postgresqlUsername: "test" diff --git a/charts/stable/vaultwarden/SCALE/ix_values.yaml b/charts/stable/vaultwarden/SCALE/ix_values.yaml index 97c85a1dd70..20b76533e34 100644 --- a/charts/stable/vaultwarden/SCALE/ix_values.yaml +++ b/charts/stable/vaultwarden/SCALE/ix_values.yaml @@ -10,9 +10,9 @@ image: tag: v1.22.2@sha256:8693c057298731f507128a395395172d60093be9b299f6bf9e5c35512a74d457 postgresqlImage: - repository: postgres + repository: bitnami/postgresql pullPolicy: IfNotPresent - tag: 13.4-alpine@sha256:a70babcd0e8f86272c35d6efcf8070c597c1f31b3d19727eece213a09929dd55 + tag: 13.4.0@sha256:7fff0f7e827cd8e1daa3adbf0ca3f19e21006023c0f6d1c2d835718961516a87 envTpl: diff --git a/charts/stable/vaultwarden/values.yaml b/charts/stable/vaultwarden/values.yaml index 05c4c82fe57..1847cead080 100644 --- a/charts/stable/vaultwarden/values.yaml +++ b/charts/stable/vaultwarden/values.yaml @@ -19,9 +19,9 @@ podSecurityContext: fsGroupChangePolicy: "OnRootMismatch" postgresqlImage: - repository: postgres + repository: bitnami/postgresql pullPolicy: IfNotPresent - tag: 13.4-alpine@sha256:a70babcd0e8f86272c35d6efcf8070c597c1f31b3d19727eece213a09929dd55 + tag: 13.4.0@sha256:7fff0f7e827cd8e1daa3adbf0ca3f19e21006023c0f6d1c2d835718961516a87 service: