From 5e5148e951bd96e70111eb3df5443fe7ad1cf3e9 Mon Sep 17 00:00:00 2001 From: ivan Date: Mon, 2 Nov 2026 13:11:16 +0500 Subject: [PATCH] =?UTF-8?q?uralkal:=20=D1=82=D0=B5=D1=81=D1=82=D0=BE=D0=B2?= =?UTF-8?q?=D1=8B=D0=B9=20PostgreSQL=20=D1=81=20TLS=20=D0=B8=20notes-backe?= =?UTF-8?q?nd=20=D1=81=20verify-full=20(=D0=BF.31,=20INFRA-3062)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ns postgres-tls-test: postgresql-contour pg-tls с tls.autoGenerated, ssl_min_protocol_version TLSv1.2, pg_hba только hostssl (local для администрирования); notes-tls на образе notes-backend с PG_SSL_MODE/PGSSLMODE=verify-full и CA из pg-tls-crt. regcred в ns создаётся вручную. --- .../uralkal/kustomization.yaml | 6 + apps/postgres-tls-test/uralkal/namespace.yaml | 5 + apps/postgres-tls-test/uralkal/notes-tls.yaml | 119 ++++++++++++++++++ .../postgres-tls-test/uralkal/postgresql.yaml | 56 +++++++++ clusters/uralkal/kustomization.yaml | 1 + 5 files changed, 187 insertions(+) create mode 100644 apps/postgres-tls-test/uralkal/kustomization.yaml create mode 100644 apps/postgres-tls-test/uralkal/namespace.yaml create mode 100644 apps/postgres-tls-test/uralkal/notes-tls.yaml create mode 100644 apps/postgres-tls-test/uralkal/postgresql.yaml diff --git a/apps/postgres-tls-test/uralkal/kustomization.yaml b/apps/postgres-tls-test/uralkal/kustomization.yaml new file mode 100644 index 0000000..b9fcc13 --- /dev/null +++ b/apps/postgres-tls-test/uralkal/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - postgresql.yaml + - notes-tls.yaml diff --git a/apps/postgres-tls-test/uralkal/namespace.yaml b/apps/postgres-tls-test/uralkal/namespace.yaml new file mode 100644 index 0000000..7db1ea5 --- /dev/null +++ b/apps/postgres-tls-test/uralkal/namespace.yaml @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: postgres-tls-test diff --git a/apps/postgres-tls-test/uralkal/notes-tls.yaml b/apps/postgres-tls-test/uralkal/notes-tls.yaml new file mode 100644 index 0000000..1a9816b --- /dev/null +++ b/apps/postgres-tls-test/uralkal/notes-tls.yaml @@ -0,0 +1,119 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: notes-tls + namespace: postgres-tls-test +spec: + interval: 10m + dependsOn: + - name: pg-tls + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + deployment: + enabled: true + name: + _default: notes-tls + replicaCount: + _default: 1 + port: + _default: 8000 + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:preprod_c00faf6e + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: notes-tls + type: + _default: ClusterIP + port: + _default: 8000 + targetPort: + _default: 8000 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: PG_HOST + value: + _default: pg-tls.postgres-tls-test.svc.cluster.local + - name: PG_PORT + value: + _default: "5432" + - name: PG_DB + value: + _default: notes + - name: PG_LOGIN + value: + _default: notes + - name: PG_SSL + value: + _default: "true" + - name: PG_SSL_MODE + value: + _default: verify-full + - name: PGSSLMODE + value: + _default: verify-full + - name: PGSSLROOTCERT + value: + _default: /etc/pg-ca/ca.crt + - name: DJANGO_USE + value: + _default: "false" + - name: TIMEOUT + value: + _default: "120" + secretEnvs: + - name: PG_PASSWORD + secretName: + _default: pg-tls + secretKey: + _default: password + volumes: + _default: + - name: pg-ca + mountPath: /etc/pg-ca + readOnly: true + secret: + secretName: pg-tls-crt + items: + - key: ca.crt + path: ca.crt diff --git a/apps/postgres-tls-test/uralkal/postgresql.yaml b/apps/postgres-tls-test/uralkal/postgresql.yaml new file mode 100644 index 0000000..9d5b4b2 --- /dev/null +++ b/apps/postgres-tls-test/uralkal/postgresql.yaml @@ -0,0 +1,56 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: pg-tls + namespace: postgres-tls-test +spec: + interval: 10m + timeout: 15m + chart: + spec: + chart: postgresql-contour + version: "17.0.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + fullnameOverride: pg-tls + global: + security: + allowInsecureImages: true + defaultStorageClass: local-path + imagePullSecrets: + - regcred + image: + registry: cr.yandex/crp3ccidau046kdj8g9q + repository: contour/postgresql + tag: 17.0.7 + auth: + username: notes + database: notes + metrics: + enabled: false + tls: + enabled: true + autoGenerated: true + primary: + persistence: + storageClass: local-path + size: 1Gi + nodeSelector: + dedicated: generic + extendedConfiguration: | + ssl_min_protocol_version = 'TLSv1.2' + pgHbaConfiguration: | + local all all scram-sha-256 + hostssl all all 0.0.0.0/0 scram-sha-256 + hostssl all all ::/0 scram-sha-256 diff --git a/clusters/uralkal/kustomization.yaml b/clusters/uralkal/kustomization.yaml index 6755dd4..495a424 100644 --- a/clusters/uralkal/kustomization.yaml +++ b/clusters/uralkal/kustomization.yaml @@ -54,6 +54,7 @@ resources: - ../../apps/pm/uralkal - ../../apps/message-hub/uralkal - ../../apps/cde/uralkal + - ../../apps/postgres-tls-test/uralkal patches: - target: