32e4bc657a
Образ contour/postgresql — официальный postgres с обёрткой contour, bitnami-переменные TLS и extended-конфиг он игнорирует: ssl, сертификат, ssl_min_protocol_version и hba_file передаются через -c; readOnlyRootFilesystem: false и пробы pg_isready как у infrastructure/postgresql/uralkal.
89 lines
2.0 KiB
YAML
89 lines
2.0 KiB
YAML
---
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: pg-tls
|
|
namespace: postgres-tls-test
|
|
spec:
|
|
interval: 10m
|
|
timeout: 15m
|
|
chart:
|
|
spec:
|
|
chart: postgresql-contour
|
|
version: "17.0.7"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: yc-oci-charts
|
|
namespace: flux-system
|
|
interval: 10m
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
fullnameOverride: pg-tls
|
|
global:
|
|
security:
|
|
allowInsecureImages: true
|
|
defaultStorageClass: local-path
|
|
imagePullSecrets:
|
|
- regcred
|
|
image:
|
|
registry: cr.yandex/crp3ccidau046kdj8g9q
|
|
repository: contour/postgresql
|
|
tag: 17.0.7
|
|
auth:
|
|
username: notes
|
|
database: notes
|
|
metrics:
|
|
enabled: false
|
|
tls:
|
|
enabled: true
|
|
autoGenerated: true
|
|
primary:
|
|
persistence:
|
|
storageClass: local-path
|
|
size: 1Gi
|
|
nodeSelector:
|
|
dedicated: generic
|
|
containerSecurityContext:
|
|
readOnlyRootFilesystem: false
|
|
args:
|
|
- postgres
|
|
- -c
|
|
- ssl=on
|
|
- -c
|
|
- ssl_cert_file=/opt/bitnami/postgresql/certs/tls.crt
|
|
- -c
|
|
- ssl_key_file=/opt/bitnami/postgresql/certs/tls.key
|
|
- -c
|
|
- ssl_min_protocol_version=TLSv1.2
|
|
- -c
|
|
- hba_file=/bitnami/postgresql/conf/pg_hba.conf
|
|
customLivenessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- exec pg_isready -h 127.0.0.1 -p 5432
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 6
|
|
customReadinessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- exec pg_isready -h 127.0.0.1 -p 5432
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 6
|
|
pgHbaConfiguration: |
|
|
local all all scram-sha-256
|
|
hostssl all all 0.0.0.0/0 scram-sha-256
|
|
hostssl all all ::/0 scram-sha-256
|