wehub-resource-sync
96 lines
3.4 KiB
YAML
96 lines
3.4 KiB
YAML
{{- if .Values.postgresql.enabled -}}
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: {{ include "deer-flow.postgresFullname" . }}
|
|
namespace: {{ include "deer-flow.namespace" . }}
|
|
labels:
|
|
{{- include "deer-flow.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: postgres
|
|
spec:
|
|
serviceName: {{ include "deer-flow.postgresFullname" . }}
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
{{- include "deer-flow.selectorLabels" . | nindent 6 }}
|
|
app.kubernetes.io/component: postgres
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{- include "deer-flow.selectorLabels" . | nindent 8 }}
|
|
app.kubernetes.io/component: postgres
|
|
spec:
|
|
{{- include "deer-flow.imagePullSecrets" . | nindent 6 }}
|
|
securityContext:
|
|
# Non-root: postgres:16 ships a `postgres` user (uid 999). The official
|
|
# entrypoint detects non-root, skips the chown/gosu dance, and runs
|
|
# initdb as 999. fsGroup 999 makes the data PVC group-writable.
|
|
runAsNonRoot: true
|
|
runAsUser: 999
|
|
runAsGroup: 999
|
|
fsGroup: 999
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: postgres
|
|
image: "{{ .Values.postgresql.image.repository }}:{{ .Values.postgresql.image.tag }}"
|
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
ports:
|
|
- name: tcp-postgres
|
|
containerPort: 5432
|
|
env:
|
|
- name: POSTGRES_USER
|
|
value: {{ .Values.postgresql.auth.username | quote }}
|
|
- name: POSTGRES_DB
|
|
value: {{ .Values.postgresql.auth.database | quote }}
|
|
- name: POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "deer-flow.databaseUrlSecret" . }}
|
|
key: postgres-password
|
|
readinessProbe:
|
|
exec:
|
|
command: ["sh", "-c", "pg_isready -U $POSTGRES_USER -d $POSTGRES_DB"]
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
exec:
|
|
command: ["sh", "-c", "pg_isready -U $POSTGRES_USER -d $POSTGRES_DB"]
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 20
|
|
{{- with .Values.postgresql.primary.resources }}
|
|
resources:
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /var/lib/postgresql/data
|
|
{{- if not .Values.postgresql.primary.persistence.enabled }}
|
|
# emptyDir fallback (testing only — data is lost on pod restart).
|
|
volumes:
|
|
- name: data
|
|
emptyDir: {}
|
|
{{- end }}
|
|
{{- if .Values.postgresql.primary.persistence.enabled }}
|
|
volumeClaimTemplates:
|
|
- metadata:
|
|
name: data
|
|
labels:
|
|
{{- include "deer-flow.labels" . | nindent 10 }}
|
|
app.kubernetes.io/component: postgres
|
|
spec:
|
|
accessModes:
|
|
- {{ .Values.postgresql.primary.persistence.accessMode | quote }}
|
|
resources:
|
|
requests:
|
|
storage: {{ .Values.postgresql.primary.persistence.size | quote }}
|
|
{{- with .Values.postgresql.primary.persistence.storageClass }}
|
|
storageClassName: {{ . | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end -}}
|