37 lines
1.5 KiB
Bash
Executable File
37 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# PostgreSQL for this overlay: plain manifests, one replica on a PVC, password generated once and kept.
|
|
# Notes: ../README.md
|
|
set -euo pipefail
|
|
ADDON_DIR="$(cd "$(dirname "$0")" && pwd)" # its manifest sits beside it
|
|
cd "${RIG_CTRL:?run it through rig: bash ctrl/addons.sh install}"
|
|
|
|
source ./lib/config.sh
|
|
load_config
|
|
|
|
K="kubectl --context ${KUBECONTEXT}"
|
|
NS="${DATA_NAMESPACE:-data}"
|
|
|
|
$K get namespace "$NS" >/dev/null 2>&1 || $K create namespace "$NS"
|
|
|
|
# The password is generated once and then left alone, so re-running this does
|
|
# not rotate the credential out from under whatever is already connected.
|
|
if $K get secret -n "$NS" postgres >/dev/null 2>&1; then
|
|
echo " secret exists, keeping the current password"
|
|
else
|
|
password=$(head -c 18 /dev/urandom | base64 | tr -d '/+=' | head -c 24)
|
|
$K create secret generic postgres -n "$NS" \
|
|
--from-literal=POSTGRES_DB="${POSTGRES_DB:-postgres}" \
|
|
--from-literal=POSTGRES_USER="${POSTGRES_USER:-postgres}" \
|
|
--from-literal=POSTGRES_PASSWORD="$password" >/dev/null
|
|
echo " generated a password (read it back with the command printed below)"
|
|
fi
|
|
|
|
echo " applying manifests"
|
|
render_manifest "$ADDON_DIR/postgres.yaml" | $K apply -n "$NS" -f - >/dev/null
|
|
|
|
echo " waiting for postgres..."
|
|
$K rollout status deployment/postgres -n "$NS" --timeout=240s
|
|
|
|
echo " in-cluster: postgres.${NS}.svc.cluster.local:5432"
|
|
echo " password: kubectl --context ${KUBECONTEXT} -n ${NS} get secret postgres -o jsonpath='{.data.POSTGRES_PASSWORD}' | base64 -d"
|