(openvpn) deploy mariadb operator

Author: dtapiacl

fleet/lib/mariadb-operator/fleet.yaml

@@ -0,0 +1,16 @@
+---
+defaultNamespace: &name mariadb-system
+namespaceLabels:
+  lsst.io/discover: "true"
+labels:
+  bundle: *name
+helm:
+  chart: mariadb-operator
+  releaseName: mariadb-operator
+  repo: https://helm.mariadb.com/mariadb-operator
+  version: 0.38.1
+  waitForJobs: true
+  timeoutSeconds: 900
+  values:
+    crds:
+      enabled: true

fleet/lib/metallb-conf/overlays/ruka/ipaddresspool-openvpndb.yaml

@@ -0,0 +1,20 @@
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: openvpndb
+  namespace: metallb-system
+spec:
+  addresses:
+    - 139.229.134.140/32
+    - 139.229.134.145/32
+    - 139.229.134.146/32
+  autoAssign: false
+---
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: openvpndb
+  namespace: metallb-system
+spec:
+  ipAddressPools:
+    - openvpndb

fleet/lib/openvpn-db-pre/base/external-secret-dockerhub.yaml

@@ -0,0 +1,34 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: dockerhub-secret
+  namespace: openvpn-db
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword
+  target:
+    name: dockerhub-secret
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: |
+          {
+            "auths": {
+              "docker.io": {
+                "username": "{{ .dockerhub_username }}",
+                "password": "{{ .dockerhub_token }}",
+                "auth": "{{ printf "%s:%s" .dockerhub_username .dockerhub_token | b64enc }}"
+              }
+            }
+          }
+  data:
+    - secretKey: dockerhub_username
+      remoteRef:
+        key: lsstitadmin-docker-hub
+        property: username
+    - secretKey: dockerhub_token
+      remoteRef:
+        key: lsstitadmin-docker-hub
+        property: docker hub api token

fleet/lib/openvpn-db-pre/base/external-secret-openvpndb.yaml

@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: mariadb
+  namespace: openvpn-db
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword
+  target:
+    name: mariadb
+    creationPolicy: Owner
+  data:
+    - secretKey: mariadb-root-password
+      remoteRef:
+        key: openvpn-mariadb-credentials
+        property: mariadb-root-password
+    - secretKey: mariadb-replication-password
+      remoteRef:
+        key: openvpn-mariadb-credentials
+        property: mariadb-replication-password

fleet/lib/openvpn-db-pre/base/kustomization.yaml

@@ -0,0 +1,4 @@
+resources:
+  - external-secret-dockerhub.yaml
+  - external-secret-openvpndb.yaml
+  - mariadb-headless-service.yaml

fleet/lib/openvpn-db-pre/base/mariadb-headless-service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mariadb-galera
+  namespace: openvpn-db
+spec:
+  clusterIP: None
+  selector:
+    app.kubernetes.io/name: mariadb
+  ports:
+    - protocol: TCP
+      port: 3306
+      targetPort: 3306

fleet/lib/openvpn-db-pre/fleet.yaml

@@ -0,0 +1,6 @@
+defaultNamespace: openvpn-db
+labels:
+  bundle: openvpn-db-pre
+name: openvpn-db-pre
+kustomize:
+  dir: base

fleet/lib/openvpn-db/base/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+  - mariadb-cr.yaml

fleet/lib/openvpn-db/base/mariadb-cr.yaml

@@ -0,0 +1,148 @@
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: MariaDB
+metadata:
+  name: mariadb
+  namespace: openvpn-db
+spec:
+  replicas: 3
+  galera:
+    enabled: true
+    primary:
+      podIndex: 0
+      automaticFailover: true
+    sst: mariabackup
+  rootPasswordSecretKeyRef:
+    name: mariadb
+    key: mariadb-root-password
+  username: mariadb
+  passwordSecretKeyRef:
+    name: mariadb
+    key: mariadb-root-password
+  database: mariadb
+  image: docker.io/library/mariadb:11.4.5
+  imagePullPolicy: IfNotPresent
+  imagePullSecrets:
+    - name: dockerhub-secret
+  port: 3306
+  storage:
+    size: 5Gi
+    storageClassName: rook-ceph-block
+    volumeClaimTemplate:
+      accessModes: [ReadWriteOnce]
+      resources:
+        requests:
+          storage: 5Gi
+      storageClassName: rook-ceph-block
+  connection:
+    secretName: connection-mariadb
+    secretTemplate:
+      key: dsn
+    healthCheck:
+      interval: 10s
+      retryInterval: 3s
+    params:
+      parseTime: "true"
+  myCnf: |
+    [mariadb]
+    bind-address=*
+    default_storage_engine=InnoDB
+    binlog_format=row
+    innodb_autoinc_lock_mode=2
+    innodb_buffer_pool_size=1024M
+    max_allowed_packet=256M
+
+    [galera]
+    wsrep_on=ON
+    wsrep_provider=/usr/lib/galera/libgalera_smm.so
+    wsrep_cluster_name=mariadb-galera
+    wsrep_sst_method=mariabackup
+    wsrep_cluster_address=gcomm://mariadb-galera.openvpn-db.svc.cluster.local
+  timeZone: UTC
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: 500m
+      memory: 1Gi
+  env:
+    - name: TZ
+      value: SYSTEM
+    - name: MARIADB_ROOT_PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: mariadb
+          key: mariadb-root-password
+  podSecurityContext:
+    runAsUser: 0
+  securityContext:
+    allowPrivilegeEscalation: false
+  livenessProbe:
+    exec:
+      command:
+        - bash
+        - -c
+        - mariadb -u root -p"$MARIADB_ROOT_PASSWORD" -e "SELECT 1;"
+    periodSeconds: 10
+    timeoutSeconds: 5
+  readinessProbe:
+    exec:
+      command:
+        - bash
+        - -c
+        - mariadb -u root -p"$MARIADB_ROOT_PASSWORD" -e "SELECT 1;"
+    periodSeconds: 10
+    timeoutSeconds: 5
+  startupProbe:
+    exec:
+      command:
+        - bash
+        - -c
+        - mariadb -u root -p"$MARIADB_ROOT_PASSWORD" -e "SELECT 1;"
+    failureThreshold: 30
+    periodSeconds: 10
+    timeoutSeconds: 5
+  podDisruptionBudget:
+    maxUnavailable: 50%
+  updateStrategy:
+    type: ReplicasFirstPrimaryLast
+  service:
+    type: LoadBalancer
+    metadata:
+      annotations:
+        metallb.universe.tf/address-pool: openvpndb
+    loadBalancerIP: 139.229.134.140
+    externalTrafficPolicy: Cluster
+    sessionAffinity: None
+  primaryService:
+    type: LoadBalancer
+    metadata:
+      annotations:
+        metallb.universe.tf/address-pool: openvpndb
+    loadBalancerIP: 139.229.134.145
+    externalTrafficPolicy: Cluster
+  secondaryService:
+    type: LoadBalancer
+    metadata:
+      annotations:
+        metallb.universe.tf/address-pool: openvpndb
+    loadBalancerIP: 139.229.134.146
+    externalTrafficPolicy: Cluster
+  tolerations:
+    - key: k8s.mariadb.com/ha
+      operator: Exists
+      effect: NoSchedule
+  nodeSelector:
+    k8s.mariadb.com/node: ha
+  affinity:
+    podAntiAffinity:
+      preferredDuringSchedulingIgnoredDuringExecution:
+        - weight: 100
+          podAffinityTerm:
+            labelSelector:
+              matchLabels:
+                app.kubernetes.io/name: mariadb
+            topologyKey: kubernetes.io/hostname
+  metrics:
+    enabled: true
+  suspend: false

fleet/lib/openvpn-db/fleet.yaml

@@ -0,0 +1,15 @@
+defaultNamespace: &name openvpn-db
+labels:
+  bundle: *name
+dependsOn:
+  - name: mariadb-operator
+    namespace: mariadb-system
+  - name: openvpn-db-pre
+    namespace: openvpn-db
+kustomize:
+  dir: base
+targetCustomizations:
+  - name: ruka
+    clusterName: ruka
+    kustomize:
+      dir: overlays/ruka