Un Talos européen de qualité - Part VI - Base de données et sauvegardes

1
module "kube_database" {
2
  source = "../../modules/kube/database"
3

4
  talos_backup_cluster_name  = local.cluster_name
5
  talos_backup_public_key    = var.talos_etcd_backup_age
6
  talos_backup_s3_endpoint   = "https://${local.s3_endpoint}"
7
  talos_backup_s3_region     = local.s3_region
8
  talos_backup_s3_bucket     = local.cluster_name
9
  talos_backup_s3_access_key = var.talos_etcd_backup_s3_username
10
  talos_backup_s3_secret_key = var.talos_etcd_backup_s3_password
11
}

1
// ...
2

3
variable "talos_etcd_backup_age" {
4
  type      = string
5
  sensitive = true
6
}
7

8
variable "talos_etcd_backup_s3_username" {
9
  type = string
10
}
11

12
variable "talos_etcd_backup_s3_password" {
13
  type      = string
14
  sensitive = true
15
}

# ...

export TF_VAR_talos_etcd_backup_age=$(bw_field username talos_etcd_backup_age)
export TF_VAR_talos_etcd_backup_s3_username=$(bw_field username talos_etcd_backup_s3)
export TF_VAR_talos_etcd_backup_s3_password=$(bw_field password talos_etcd_backup_s3)

1
// ...
2

3
variable "talos_backup_cluster_name" {
4
  description = "The name of the cluster"
5
  type        = string
6
}
7

8
variable "talos_backup_public_key" {
9
  description = "The age public key for encryption of the backup"
10
  type        = string
11
}
12

13
variable "talos_backup_s3_endpoint" {
14
  description = "The endpoint of the S3 compatible storage"
15
  type        = string
16
}
17

18
variable "talos_backup_s3_access_key" {
19
  description = "The access key for the S3 compatible storage"
20
  type        = string
21
}
22

23
variable "talos_backup_s3_secret_key" {
24
  description = "The secret key for the S3 compatible storage"
25
  type        = string
26
  sensitive   = true
27
}
28

29
variable "talos_backup_s3_region" {
30
  description = "The region of the S3 compatible storage"
31
  type        = string
32
}
33

34
variable "talos_backup_s3_bucket" {
35
  description = "The bucket of the S3 compatible storage"
36
  type        = string
37
}

1
resource "kubernetes_cron_job_v1" "talos_backup" {
2
  metadata {
3
    name      = "talos-backup"
4
    namespace = "kube-system"
5
  }
6

7
  spec {
8
    schedule = "@hourly"
9

10
    job_template {
11
      metadata {
12
        name = "talos-backup"
13
      }
14
      spec {
15
        template {
16
          metadata {
17
            name = "talos-backup"
18
          }
19
          spec {
20
            container {
21
              name              = "talos-backup"
22
              image             = "ghcr.io/siderolabs/talos-backup:latest"
23
              working_dir       = "/tmp"
24
              image_pull_policy = "IfNotPresent"
25

26
              env {
27
                name  = "AWS_ACCESS_KEY_ID"
28
                value = var.talos_backup_s3_access_key
29
              }
30
              env {
31
                name = "AWS_SECRET_ACCESS_KEY"
32
                value_from {
33
                  secret_key_ref {
34
                    name = kubernetes_secret_v1.talos_s3_secrets.metadata[0].name
35
                    key  = "s3_secret_key"
36
                  }
37
                }
38
              }
39
              env {
40
                name  = "AWS_REGION"
41
                value = var.talos_backup_s3_region
42
              }
43
              env {
44
                name  = "CUSTOM_S3_ENDPOINT"
45
                value = var.talos_backup_s3_endpoint
46
              }
47
              env {
48
                name  = "BUCKET"
49
                value = var.talos_backup_s3_bucket
50
              }
51
              env {
52
                name  = "CLUSTER_NAME"
53
                value = var.talos_backup_cluster_name
54
              }
55
              env {
56
                name  = "S3_PREFIX"
57
                value = "etcd"
58
              }
59
              env {
60
                name  = "AGE_X25519_PUBLIC_KEY"
61
                value = var.talos_backup_public_key
62
              }
63
              env {
64
                name  = "ENABLE_COMPRESSION"
65
                value = "true"
66
              }
67

68
              security_context {
69
                run_as_user                = 1000
70
                run_as_group               = 1000
71
                allow_privilege_escalation = false
72
                run_as_non_root            = true
73

74
                capabilities {
75
                  drop = ["ALL"]
76
                }
77
                seccomp_profile {
78
                  type = "RuntimeDefault"
79
                }
80
              }
81

82
              command = ["/talos-backup"]
83

84
              volume_mount {
85
                mount_path = "/tmp"
86
                name       = "tmp"
87
              }
88
              volume_mount {
89
                mount_path = "/.talos"
90
                name       = "talos"
91
              }
92
              volume_mount {
93
                mount_path = "/var/run/secrets/talos.dev"
94
                name       = "talos-secrets"
95
              }
96
            }
97

98
            restart_policy = "OnFailure"
99

100
            volume {
101
              name = "tmp"
102
              empty_dir {}
103
            }
104
            volume {
105
              name = "talos"
106
              empty_dir {}
107
            }
108
            volume {
109
              name = "talos-secrets"
110
              secret {
111
                secret_name = kubernetes_manifest.talos_backup_service_account.manifest.metadata.name
112
              }
113
            }
114
          }
115
        }
116
      }
117
    }
118
  }
119
}
120

121
resource "kubernetes_secret_v1" "talos_s3_secrets" {
122
  metadata {
123
    name      = "talos-s3-secrets"
124
    namespace = "kube-system"
125
  }
126
  data = {
127
    s3_secret_key = var.talos_backup_s3_secret_key
128
  }
129
}
130

131
resource "kubernetes_manifest" "talos_backup_service_account" {
132
  manifest = {
133
    apiVersion = "talos.dev/v1alpha1"
134
    kind       = "ServiceAccount"
135
    metadata = {
136
      name      = "talos-backup-secrets"
137
      namespace = "kube-system"
138
    }
139
    spec = {
140
      roles = ["os:etcd:backup"]
141
    }
142
  }
143
}

1
module "kube_database" {
2
  // ...
3

4
  dragonfly_password = var.dragonfly_password
5
}

1
// ...
2

3
variable "dragonfly_password" {
4
  type      = string
5
  sensitive = true
6
}

# ...

export TF_VAR_dragonfly_password=$(bw_field password dragonfly_password)

1
// ...
2

3
variable "dragonfly_password" {
4
  description = "The password for the dragonfly"
5
  type        = string
6
  sensitive   = true
7
}

1
resource "kubernetes_namespace_v1" "dragonfly" {
2
  metadata {
3
    name = "dragonfly"
4
  }
5
}
6

7
resource "kubernetes_secret_v1" "dragonfly_auth" {
8
  metadata {
9
    name      = "dragonfly-auth"
10
    namespace = kubernetes_namespace_v1.dragonfly.metadata[0].name
11
  }
12
  data = {
13
    dragonfly-password = var.dragonfly_password
14
  }
15
}
16

17
resource "helm_release" "dragonfly" {
18
  repository = "oci://ghcr.io/dragonflydb/dragonfly/helm"
19
  chart      = "dragonfly"
20
  version    = "v1.36.0"
21

22
  name        = "dragonfly"
23
  namespace   = kubernetes_namespace_v1.dragonfly.metadata[0].name
24
  max_history = 2
25

26
  set = [
27
    {
28
      name  = "replicaCount"
29
      value = "2"
30
    },
31
    {
32
      name  = "passwordFromSecret.enable"
33
      value = "true"
34
    },
35
    {
36
      name  = "passwordFromSecret.existingSecret.name"
37
      value = kubernetes_secret_v1.dragonfly_auth.metadata[0].name
38
    },
39
    {
40
      name  = "passwordFromSecret.existingSecret.key"
41
      value = "dragonfly-password"
42
    },
43
    {
44
      name  = "tolerations[0].key"
45
      value = "node-role.kubernetes.io/storage"
46
    },
47
    {
48
      name  = "tolerations[0].operator"
49
      value = "Exists"
50
    },
51
    {
52
      name  = "nodeSelector.node\\.kubernetes\\.io/role"
53
      value = "storage"
54
    },
55
    {
56
      name  = "storage.enabled"
57
      value = "true"
58
    },
59
    {
60
      name  = "storage.storageClassName"
61
      value = "longhorn-crypto-local"
62
    },
63
    {
64
      name  = "storage.requests"
65
      value = "2Gi"
66
    },
67
    {
68
      name  = "serviceMonitor.enabled"
69
      value = "true"
70
    }
71
  ]
72
}

1
module "kube_database" {
2
  // ...
3

4
  cnpg_cluster_name  = local.cluster_name
5
  cnpg_pg_version = "18.1-standard-trixie"
6

7
  cnpg_backup_s3_endpoint   = "https://${local.s3_endpoint}"
8
  cnpg_backup_s3_access_key = var.cnpg_backup_s3_username
9
  cnpg_backup_s3_secret_key = var.cnpg_backup_s3_password
10
  cnpg_backup_s3_bucket     = local.cluster_name
11
}

1
// ...
2

3
variable "cnpg_backup_s3_username" {
4
  type = string
5
}
6

7
variable "cnpg_backup_s3_password" {
8
  type      = string
9
  sensitive = true
10
}

# ...

export TF_VAR_cnpg_backup_s3_username=$(bw_field username cnpg_backup_s3)
export TF_VAR_cnpg_backup_s3_password=$(bw_field password cnpg_backup_s3)

1
// ...
2

3
variable "cnpg_cluster_name" {
4
  description = "The name of the cluster"
5
  type        = string
6
}
7

8
variable "cnpg_pg_version" {
9
  description = "The version of the PostgreSQL"
10
  type        = string
11
}
12

13
variable "cnpg_backup_s3_endpoint" {
14
  description = "The endpoint of the S3 compatible storage"
15
  type        = string
16
}
17

18
variable "cnpg_backup_s3_access_key" {
19
  description = "The access key for the S3 compatible storage"
20
  type        = string
21
}
22

23
variable "cnpg_backup_s3_secret_key" {
24
  description = "The secret key for the S3 compatible storage"
25
  type        = string
26
  sensitive   = true
27
}
28

29
variable "cnpg_backup_s3_bucket" {
30
  description = "The bucket of the S3 compatible storage"
31
  type        = string
32
}

1
resource "kubernetes_namespace_v1" "postgres" {
2
  metadata {
3
    name = "postgres"
4
  }
5
}
6

7
resource "kubernetes_manifest" "cnpg_cluster_default" {
8
  manifest = {
9
    apiVersion = "postgresql.cnpg.io/v1"
10
    kind       = "Cluster"
11
    metadata = {
12
      name      = var.cnpg_cluster_name
13
      namespace = kubernetes_namespace_v1.postgres.metadata[0].name
14
    }
15
    spec = {
16
      imageName   = "ghcr.io/cloudnative-pg/postgresql:${var.cnpg_pg_version}"
17
      description = "PostgreSQL dev"
18
      instances   = 2
19

20
      bootstrap = {
21
        initdb = {
22
          database = "app"
23
          owner    = "app"
24
        }
25
      }
26

27
      enableSuperuserAccess = true
28

29
      storage = {
30
        size         = "8Gi"
31
        storageClass = "longhorn-crypto-local"
32
      }
33

34
      affinity = {
35
        tolerations = [
36
          {
37
            key      = "node-role.kubernetes.io/storage"
38
            operator = "Exists"
39
          }
40
        ]
41
        nodeSelector = {
42
          "node.kubernetes.io/role" = "storage"
43
        }
44
      }
45

46
      plugins = [
47
        {
48
          name          = "barman-cloud.cloudnative-pg.io"
49
          isWALArchiver = true
50
          parameters = {
51
            serverName       = var.cnpg_cluster_name
52
            barmanObjectName = kubernetes_manifest.cnpg_object_store_backup_default.manifest.metadata.name
53
          }
54
        }
55
      ]
56
    }
57
  }
58
}
59

60
resource "kubernetes_manifest" "cnpg_pod_monitor" {
61
  manifest = {
62
    apiVersion = "monitoring.coreos.com/v1"
63
    kind       = "PodMonitor"
64
    metadata = {
65
      name      = "${var.cnpg_cluster_name}-cluster"
66
      namespace = kubernetes_namespace_v1.postgres.metadata[0].name
67
    }
68
    spec = {
69
      podMetricsEndpoints = [
70
        {
71
          port = "metrics"
72
        }
73
      ]
74
      selector = {
75
        matchLabels = {
76
          "cnpg.io/cluster" = var.cnpg_cluster_name
77
        }
78
      }
79
    }
80
  }
81
}
82

83
resource "kubernetes_secret_v1" "cnpg_backup_s3" {
84
  metadata {
85
    name      = "backup-s3"
86
    namespace = kubernetes_namespace_v1.postgres.metadata[0].name
87
  }
88
  data = {
89
    ACCESS_KEY_ID     = var.cnpg_backup_s3_access_key
90
    ACCESS_SECRET_KEY = var.cnpg_backup_s3_secret_key
91
  }
92
}
93

94
resource "kubernetes_manifest" "cnpg_object_store_backup_default" {
95
  manifest = {
96
    apiVersion = "barmancloud.cnpg.io/v1"
97
    kind       = "ObjectStore"
98
    metadata = {
99
      name      = "${var.cnpg_cluster_name}-backup"
100
      namespace = kubernetes_namespace_v1.postgres.metadata[0].name
101
    }
102
    spec = {
103
      retentionPolicy = "30d"
104
      configuration = {
105
        endpointURL     = var.cnpg_backup_s3_endpoint
106
        destinationPath = "s3://${var.cnpg_backup_s3_bucket}/cnpg/"
107
        data = {
108
          compression = "bzip2"
109
          encryption  = "AES256"
110
        }
111
        wal = {
112
          compression = "bzip2"
113
          encryption  = "AES256"
114
        }
115
        s3Credentials = {
116
          accessKeyId = {
117
            name = kubernetes_secret_v1.cnpg_backup_s3.metadata[0].name
118
            key  = "ACCESS_KEY_ID"
119
          }
120
          secretAccessKey = {
121
            name = kubernetes_secret_v1.cnpg_backup_s3.metadata[0].name
122
            key  = "ACCESS_SECRET_KEY"
123
          }
124
        }
125
      }
126
    }
127
  }
128
}
129

130
resource "kubernetes_manifest" "cnpg_scheduled_backup_barman_default" {
131
  manifest = {
132
    apiVersion = "postgresql.cnpg.io/v1"
133
    kind       = "ScheduledBackup"
134
    metadata = {
135
      name      = "${var.cnpg_cluster_name}-barman"
136
      namespace = kubernetes_namespace_v1.postgres.metadata[0].name
137
    }
138
    spec = {
139
      method               = "plugin"
140
      schedule             = "@daily"
141
      backupOwnerReference = "self"
142
      immediate            = true
143
      cluster = {
144
        name = kubernetes_manifest.cnpg_cluster_default.manifest.metadata.name
145
      }
146
      pluginConfiguration = {
147
        name = "barman-cloud.cloudnative-pg.io"
148
      }
149
    }
150
  }
151
}

1
module "kube_database" {
2
  // ...
3

4
  internal_domain    = local.internal_domain
5
  pgadmin_email      = "admin@ohmytalos.io"
6
}

1
// ...
2

3
variable "internal_domain" {
4
  description = "The internal domain"
5
  type        = string
6
}
7

8
variable "pgadmin_email" {
9
  description = "The email of the admin pgAdmin user"
10
  type        = string
11
}

1
resource "kubernetes_namespace_v1" "pgadmin" {
2
  metadata {
3
    name = "pgadmin"
4
  }
5
}
6

7
resource "helm_release" "pgadmin" {
8
  repository = "https://helm.runix.net"
9
  chart      = "pgadmin4"
10
  version    = "1.57.0"
11

12
  name        = "pgadmin"
13
  namespace   = kubernetes_namespace_v1.pgadmin.metadata[0].name
14
  max_history = 2
15

16
  set = [
17
    {
18
      name  = "strategy.type"
19
      value = "Recreate"
20
    },
21
    {
22
      name  = "env.email"
23
      value = var.pgadmin_email
24
    },
25
    {
26
      name  = "persistentVolume.storageClass"
27
      value = "longhorn-crypto"
28
    }
29
  ]
30
}
31

32
resource "kubernetes_manifest" "traefik_ingress_route_pgadmin" {
33
  manifest = {
34
    apiVersion = "traefik.io/v1alpha1"
35
    kind       = "IngressRoute"
36
    metadata = {
37
      name      = "pgadmin"
38
      namespace = kubernetes_namespace_v1.pgadmin.metadata[0].name
39
    }
40
    spec = {
41
      entryPoints = ["internal"]
42
      routes = [
43
        {
44
          match = "Host(`pga.${var.internal_domain}`)"
45
          kind  = "Rule"
46
          services = [
47
            {
48
              name = "pgadmin-pgadmin4"
49
              port = "http"
50
            }
51
          ]
52
        }
53
      ]
54
    }
55
  }
56
}