feat: CDKTF | migrate longhorn to cdktf
This commit is contained in:
308
postgres/index.ts
Normal file
308
postgres/index.ts
Normal file
@@ -0,0 +1,308 @@
|
||||
import { HelmProvider } from "@cdktf/provider-helm/lib/provider";
|
||||
import { Release } from "@cdktf/provider-helm/lib/release";
|
||||
import { Manifest } from "@cdktf/provider-kubernetes/lib/manifest";
|
||||
import { KubernetesProvider } from "@cdktf/provider-kubernetes/lib/provider";
|
||||
import { Construct } from "constructs";
|
||||
|
||||
type PostgresClusterOptions = {
|
||||
providers: {
|
||||
kubernetes: KubernetesProvider;
|
||||
helm: HelmProvider;
|
||||
};
|
||||
name: string;
|
||||
namespace: string;
|
||||
storageClass: string;
|
||||
users: string[];
|
||||
primaryUser: string;
|
||||
initSecretName: string;
|
||||
};
|
||||
|
||||
export class PostgresCluster extends Construct {
|
||||
constructor(scope: Construct, id: string, options: PostgresClusterOptions) {
|
||||
super(scope, id);
|
||||
|
||||
const { kubernetes, helm } = options.providers;
|
||||
|
||||
new Release(this, "cnpg-operator", {
|
||||
provider: helm,
|
||||
repository: "https://cloudnative-pg.github.io/charts",
|
||||
chart: "cloudnative-pg",
|
||||
name: "postgres-system",
|
||||
namespace: options.namespace,
|
||||
});
|
||||
|
||||
const certManagerApiVersion = "cert-manager.io/v1";
|
||||
|
||||
const certNames = {
|
||||
server: "postgres-server-cert",
|
||||
client: "postgres-client-cert",
|
||||
};
|
||||
|
||||
const caNames = {
|
||||
server: "postgres-server-ca",
|
||||
client: "postgres-client-ca",
|
||||
};
|
||||
|
||||
// Self-signed issuer for creating CA certificates
|
||||
new Manifest(this, "selfsigned-issuer", {
|
||||
provider: kubernetes,
|
||||
manifest: {
|
||||
apiVersion: certManagerApiVersion,
|
||||
kind: "Issuer",
|
||||
metadata: {
|
||||
name: "selfsigned-issuer",
|
||||
namespace: options.namespace,
|
||||
},
|
||||
spec: {
|
||||
selfSigned: {},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
// Server CA certificate
|
||||
new Manifest(this, "server-ca-cert", {
|
||||
provider: kubernetes,
|
||||
manifest: {
|
||||
apiVersion: certManagerApiVersion,
|
||||
kind: "Certificate",
|
||||
metadata: {
|
||||
name: "server-ca",
|
||||
namespace: options.namespace,
|
||||
},
|
||||
spec: {
|
||||
isCA: true,
|
||||
commonName: caNames.server,
|
||||
secretName: caNames.server,
|
||||
privateKey: {
|
||||
algorithm: "ECDSA",
|
||||
size: 384,
|
||||
},
|
||||
issuerRef: {
|
||||
name: "selfsigned-issuer",
|
||||
kind: "Issuer",
|
||||
group: "cert-manager.io",
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
// Issuer using the server CA
|
||||
new Manifest(this, "server-ca-issuer", {
|
||||
provider: kubernetes,
|
||||
manifest: {
|
||||
apiVersion: certManagerApiVersion,
|
||||
kind: "Issuer",
|
||||
metadata: {
|
||||
name: `${caNames.server}-issuer`,
|
||||
namespace: options.namespace,
|
||||
},
|
||||
spec: {
|
||||
ca: {
|
||||
secretName: caNames.server,
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
// Secret for server certificate
|
||||
new Manifest(this, "server-ca-cert-secret", {
|
||||
provider: kubernetes,
|
||||
manifest: {
|
||||
apiVersion: "v1",
|
||||
kind: "Secret",
|
||||
metadata: {
|
||||
name: certNames.server,
|
||||
namespace: options.namespace,
|
||||
labels: {
|
||||
"cnpg.io/reload": "",
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
// Server certificate
|
||||
new Manifest(this, "server-cert", {
|
||||
provider: kubernetes,
|
||||
manifest: {
|
||||
apiVersion: certManagerApiVersion,
|
||||
kind: "Certificate",
|
||||
metadata: {
|
||||
name: certNames.server,
|
||||
namespace: options.namespace,
|
||||
},
|
||||
spec: {
|
||||
secretName: certNames.server,
|
||||
usages: ["server auth"],
|
||||
dnsNames: [
|
||||
"postgres-cluster-rw.postgres-system.svc.cluster.local",
|
||||
"postgres-cluster-ro.postgres-system.svc.cluster.local",
|
||||
"postgres-cluster-r.postgres-system.svc.cluster.local",
|
||||
"postgres.dogar.dev",
|
||||
],
|
||||
issuerRef: {
|
||||
name: `${caNames.server}-issuer`,
|
||||
kind: "Issuer",
|
||||
group: "cert-manager.io",
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
// Client CA certificate
|
||||
new Manifest(this, "client-ca", {
|
||||
provider: kubernetes,
|
||||
manifest: {
|
||||
apiVersion: certManagerApiVersion,
|
||||
kind: "Certificate",
|
||||
metadata: {
|
||||
name: "client-ca",
|
||||
namespace: options.namespace,
|
||||
},
|
||||
spec: {
|
||||
isCA: true,
|
||||
commonName: caNames.client,
|
||||
secretName: caNames.client,
|
||||
privateKey: {
|
||||
algorithm: "ECDSA",
|
||||
size: 256,
|
||||
},
|
||||
issuerRef: {
|
||||
name: "selfsigned-issuer",
|
||||
kind: "Issuer",
|
||||
group: "cert-manager.io",
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
// Issuer using the client CA
|
||||
new Manifest(this, "client-ca-issuer", {
|
||||
provider: kubernetes,
|
||||
manifest: {
|
||||
apiVersion: certManagerApiVersion,
|
||||
kind: "Issuer",
|
||||
metadata: {
|
||||
name: `${caNames.client}-issuer`,
|
||||
namespace: options.namespace,
|
||||
},
|
||||
spec: {
|
||||
ca: {
|
||||
secretName: caNames.client,
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
// Secret for client certificate
|
||||
new Manifest(this, `${certNames.client}-secret`, {
|
||||
provider: kubernetes,
|
||||
manifest: {
|
||||
apiVersion: "v1",
|
||||
kind: "Secret",
|
||||
metadata: {
|
||||
name: certNames.client,
|
||||
namespace: options.namespace,
|
||||
labels: {
|
||||
"cnpg.io/reload": "",
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
// Client certificate for streaming replica
|
||||
new Manifest(this, "streaming-replica-cert", {
|
||||
provider: kubernetes,
|
||||
manifest: {
|
||||
apiVersion: certManagerApiVersion,
|
||||
kind: "Certificate",
|
||||
metadata: {
|
||||
name: certNames.client,
|
||||
namespace: options.namespace,
|
||||
},
|
||||
spec: {
|
||||
secretName: certNames.client,
|
||||
usages: ["client auth"],
|
||||
commonName: "streaming_replica",
|
||||
issuerRef: {
|
||||
name: "postgres-client-ca-issuer",
|
||||
kind: "Issuer",
|
||||
group: "cert-manager.io",
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
// Client certificates for users
|
||||
options.users.forEach(
|
||||
(user) =>
|
||||
new Manifest(this, `${user}-client-cert`, {
|
||||
provider: kubernetes,
|
||||
manifest: {
|
||||
apiVersion: certManagerApiVersion,
|
||||
kind: "Certificate",
|
||||
metadata: {
|
||||
name: `${user}-client-cert`,
|
||||
namespace: options.namespace,
|
||||
},
|
||||
spec: {
|
||||
secretName: `${user}-client-cert`,
|
||||
usages: ["client auth"],
|
||||
commonName: user,
|
||||
issuerRef: {
|
||||
name: "postgres-client-ca-issuer",
|
||||
kind: "Issuer",
|
||||
group: "cert-manager.io",
|
||||
},
|
||||
},
|
||||
},
|
||||
}),
|
||||
);
|
||||
|
||||
new Manifest(this, "postgres-cluster", {
|
||||
provider: kubernetes,
|
||||
manifest: {
|
||||
apiVersion: "postgresql.cnpg.io/v1",
|
||||
kind: "Cluster",
|
||||
metadata: {
|
||||
name: options.name,
|
||||
namespace: options.namespace,
|
||||
},
|
||||
spec: {
|
||||
instances: 3,
|
||||
maxSyncReplicas: 0,
|
||||
primaryUpdateStrategy: "unsupervised",
|
||||
certificates: {
|
||||
serverCASecret: certNames.server,
|
||||
serverTLSSecret: certNames.server,
|
||||
clientCASecret: certNames.client,
|
||||
replicationTLSSecret: certNames.client,
|
||||
},
|
||||
postgresql: {
|
||||
pg_hba: [
|
||||
`hostssl all ${options.primaryUser} all cert`,
|
||||
"hostssl sameuser all all cert",
|
||||
],
|
||||
},
|
||||
enableSuperuserAccess: false,
|
||||
bootstrap: {
|
||||
initdb: {
|
||||
database: "postgres",
|
||||
secret: {
|
||||
name: options.initSecretName,
|
||||
},
|
||||
postInitSQL: [`CREATE USER ${options.primaryUser} SUPERUSER;`],
|
||||
},
|
||||
},
|
||||
storage: {
|
||||
size: "10Gi",
|
||||
storageClass: options.storageClass,
|
||||
},
|
||||
walStorage: {
|
||||
size: "10Gi",
|
||||
storageClass: options.storageClass,
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user