Skip to content

Commit 7679fee

Browse files
oliverguentheroliverguenther
authored
Define more options for postgresql connection (#168)
* Define more options for postgresql connection * Create seven-chefs-knock.md
1 parent a090add commit 7679fee

File tree

4 files changed

+202
-5
lines changed

4 files changed

+202
-5
lines changed

‎.changeset/seven-chefs-knock.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
"@openproject/helm-charts": minor
3+
---
4+
5+
Define more options for postgresql connection

‎charts/openproject/templates/secret_core.yaml

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,63 @@ stringData:
1616
DATABASE_PORT: "{{ .Values.postgresql.connection.port }}"
1717
DATABASE_URL: "postgresql://{{ .Values.postgresql.auth.username }}@{{ .Values.postgresql.connection.host }}:{{ .Values.postgresql.connection.port }}/{{ .Values.postgresql.auth.database }}"
1818
{{- end }}
19+
{{- if .Values.postgresql.options.pool }}
20+
OPENPROJECT_DB_POOL: {{ .Values.postgresql.options.pool | toString }}
21+
{{- end }}
22+
{{- if .Values.postgresql.options.requireAuth }}
23+
OPENPROJECT_DB_REQUIRE_AUTH: {{ .Values.postgresql.options.requireAuth | toString }}
24+
{{- end }}
25+
{{- if .Values.postgresql.options.channelBinding }}
26+
OPENPROJECT_DB_CHANNEL_BINDING: {{ .Values.postgresql.options.channelBinding | toString }}
27+
{{- end }}
28+
{{- if .Values.postgresql.options.connectTimeout }}
29+
OPENPROJECT_DB_CONNECT_TIMEOUT: {{ .Values.postgresql.options.connectTimeout | toString }}
30+
{{- end }}
31+
{{- if .Values.postgresql.options.clientEncoding }}
32+
OPENPROJECT_DB_CLIENT_ENCODING: {{ .Values.postgresql.options.clientEncoding | toString }}
33+
{{- end }}
34+
{{- if .Values.postgresql.options.keepalives }}
35+
OPENPROJECT_DB_KEEPALIVES: {{ .Values.postgresql.options.keepalives | toString }}
36+
{{- end }}
37+
{{- if .Values.postgresql.options.keepalivesIdle }}
38+
OPENPROJECT_DB_KEEPALIVES_IDLE: {{ .Values.postgresql.options.keepalivesIdle | toString }}
39+
{{- end }}
40+
{{- if .Values.postgresql.options.keepalivesInterval }}
41+
OPENPROJECT_DB_KEEPALIVES_INTERVAL: {{ .Values.postgresql.options.keepalivesInterval | toString }}
42+
{{- end }}
43+
{{- if .Values.postgresql.options.keepalivesCount }}
44+
OPENPROJECT_DB_KEEPALIVES_COUNT: {{ .Values.postgresql.options.keepalivesCount | toString }}
45+
{{- end }}
46+
{{- if .Values.postgresql.options.replication }}
47+
OPENPROJECT_DB_REPLICATION: {{ .Values.postgresql.options.replication | toString }}
48+
{{- end }}
49+
{{- if .Values.postgresql.options.gssencmode }}
50+
OPENPROJECT_DB_GSSENCMODE: {{ .Values.postgresql.options.gssencmode | toString }}
51+
{{- end }}
52+
{{- if .Values.postgresql.options.sslmode }}
53+
OPENPROJECT_DB_SSLMODE: {{ .Values.postgresql.options.sslmode | toString }}
54+
{{- end }}
55+
{{- if .Values.postgresql.options.sslcompression }}
56+
OPENPROJECT_DB_SSLCOMPRESSION: {{ .Values.postgresql.options.sslcompression | toString }}
57+
{{- end }}
58+
{{- if .Values.postgresql.options.sslcert }}
59+
OPENPROJECT_DB_SSLCERT: {{ .Values.postgresql.options.sslcert | toString }}
60+
{{- end }}
61+
{{- if .Values.postgresql.options.sslkey }}
62+
OPENPROJECT_DB_SSLKEY: {{ .Values.postgresql.options.sslkey | toString }}
63+
{{- end }}
64+
{{- if .Values.postgresql.options.sslpassword }}
65+
OPENPROJECT_DB_SSLPASSWORD: {{ .Values.postgresql.options.sslpassword | toString }}
66+
{{- end }}
67+
{{- if .Values.postgresql.options.sslrootcert }}
68+
OPENPROJECT_DB_SSLROOTCERT: {{ .Values.postgresql.options.sslrootcert | toString }}
69+
{{- end }}
70+
{{- if .Values.postgresql.options.sslcrl }}
71+
OPENPROJECT_DB_SSLCRL: {{ .Values.postgresql.options.sslcrl | toString }}
72+
{{- end }}
73+
{{- if .Values.postgresql.options.sslMinProtocolVersion }}
74+
OPENPROJECT_DB_SSL_MIN_PROTOCOL_VERSION: {{ .Values.postgresql.options.sslMinProtocolVersion | toString }}
75+
{{- end }}
1976
OPENPROJECT_SEED_ADMIN_USER_PASSWORD: {{ .Values.openproject.admin_user.password | quote }}
2077
OPENPROJECT_SEED_ADMIN_USER_PASSWORD_RESET: {{ .Values.openproject.admin_user.password_reset | quote }}
2178
OPENPROJECT_SEED_ADMIN_USER_NAME: {{ .Values.openproject.admin_user.name | quote }}

‎charts/openproject/values.yaml

Lines changed: 66 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -599,11 +599,72 @@ postgresql:
599599
#
600600
postgresPassword: ""
601601

602-
## When using the "bundled" postgresql chart, you can configure the storageClass and other settings similar to this
603-
## Ref: https://github.com/bitnami/charts/blob/main/bitnami/postgresql/values.yaml
604-
#
605-
# global:
606-
# storageClass: my-storage-class-name
602+
##
603+
# Additional connection options
604+
# See https://www.postgresql.org/docs/current/libpq-connect.html for additional details
605+
options:
606+
# Define a pool size for the Rails connection pool
607+
# https://guides.rubyonrails.org/configuring.html#database-pooling
608+
pool:
609+
610+
# Specifies the authentication method that the client requires from the server.
611+
requireAuth:
612+
613+
# This option controls the client's use of channel binding.
614+
channelBinding:
615+
616+
# Maximum time to wait while connecting, in seconds.
617+
connectTimeout:
618+
619+
# This sets the client_encoding configuration parameter for this connection.
620+
clientEncoding:
621+
622+
# Controls whether client-side TCP keepalives are used.
623+
keepalives:
624+
625+
# Controls the number of seconds of inactivity after which TCP should send a keepalive message to the server.
626+
keepalivesIdle:
627+
628+
# Controls the number of seconds after which a TCP keepalive message that is not acknowledged by the server
629+
# should be retransmitted.
630+
keepalivesInterval:
631+
632+
# Controls the number of TCP keepalives that can be lost before the client's connection to the server is
633+
# considered dead
634+
keepalivesCount:
635+
636+
# This option determines whether the connection should use the replication protocol instead of the normal
637+
# protocol.
638+
replication:
639+
640+
# This option determines whether or with what priority a secure GSS TCP/IP connection will be negotiated with the
641+
# server.
642+
gssencmode:
643+
644+
# This option determines whether or with what priority a secure SSL TCP/IP connection will be negotiated with the
645+
# server.
646+
sslmode:
647+
648+
# If set to 1, data sent over SSL connections will be compressed.
649+
sslcompression:
650+
651+
# This parameter specifies the file name of the client SSL certificate
652+
sslcert:
653+
654+
# This parameter specifies the location for the secret key used for the client certificate.
655+
sslkey:
656+
657+
# This parameter specifies the password for the secret key specified in sslkey
658+
sslpassword:
659+
660+
# This parameter specifies the name of a file containing SSL certificate authority (CA) certificate(s)
661+
sslrootcert:
662+
663+
# This parameter specifies the file name of the SSL server certificate revocation list (CRL).
664+
sslcrl:
665+
666+
# This parameter specifies the minimum SSL/TLS protocol version to allow for the connection
667+
sslMinProtocolVersion:
607668

608669
## Configure liveness and readiness probes.
609670
##

‎spec/charts/openproject/postgres_options_spec.rb

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# frozen_string_literal: true
2+
require 'spec_helper'
3+
4+
describe 'PostgreSQL options' do
5+
let(:template) { HelmTemplate.new(default_values) }
6+
7+
subject { template.dig('Secret/optest-openproject-core', 'stringData') }
8+
9+
context 'when setting extraOidcSealedSecret' do
10+
let(:default_values) do
11+
HelmTemplate.with_defaults(<<~YAML
12+
postgresql:
13+
options:
14+
pool: 5
15+
requireAuth: true
16+
channelBinding: require
17+
connectTimeout: 15
18+
clientEncoding: UTF8
19+
keepalives: 1
20+
keepalivesIdle: 30
21+
keepalivesInterval: 10
22+
keepalivesCount: 5
23+
replication: "on"
24+
gssencmode: disable
25+
sslmode: require
26+
sslcompression: 1
27+
sslMinProtocolVersion: TLSv1.2
28+
sslcert: /etc/ssl/certs/client-cert.pem
29+
sslkey: /etc/ssl/private/client-key.pem
30+
sslpassword: my-secure-password
31+
sslrootcert: /etc/ssl/certs/ca-cert.pem
32+
sslcrl: /etc/ssl/crl/server-crl.pem
33+
YAML
34+
)
35+
end
36+
37+
it 'adds that secret ref to relevant deployments', :aggregate_failures do
38+
{
39+
"OPENPROJECT_DB_POOL" => 5,
40+
"OPENPROJECT_DB_REQUIRE_AUTH" => true,
41+
"OPENPROJECT_DB_CHANNEL_BINDING" => "require",
42+
"OPENPROJECT_DB_CONNECT_TIMEOUT" => 15,
43+
"OPENPROJECT_DB_CLIENT_ENCODING" => "UTF8",
44+
"OPENPROJECT_DB_KEEPALIVES" => 1,
45+
"OPENPROJECT_DB_KEEPALIVES_IDLE" => 30,
46+
"OPENPROJECT_DB_KEEPALIVES_INTERVAL" => 10,
47+
"OPENPROJECT_DB_KEEPALIVES_COUNT" => 5,
48+
"OPENPROJECT_DB_REPLICATION" => true,
49+
"OPENPROJECT_DB_GSSENCMODE" => "disable",
50+
"OPENPROJECT_DB_SSLMODE" => "require",
51+
"OPENPROJECT_DB_SSLCOMPRESSION" => 1,
52+
"OPENPROJECT_DB_SSLCERT" => "/etc/ssl/certs/client-cert.pem",
53+
"OPENPROJECT_DB_SSLKEY" => "/etc/ssl/private/client-key.pem",
54+
"OPENPROJECT_DB_SSLPASSWORD" => "my-secure-password",
55+
"OPENPROJECT_DB_SSLROOTCERT" => "/etc/ssl/certs/ca-cert.pem",
56+
"OPENPROJECT_DB_SSLCRL" => "/etc/ssl/crl/server-crl.pem",
57+
"OPENPROJECT_DB_SSL_MIN_PROTOCOL_VERSION" => "TLSv1.2",
58+
}.each do |key, val|
59+
expect(subject[key]).to eq(val)
60+
end
61+
end
62+
end
63+
64+
context 'when setting no imagePullSecrets' do
65+
let(:default_values) do
66+
{}
67+
end
68+
69+
it 'adds the default secrets', :aggregate_failures do
70+
db_keys = subject.keys.select { |k| k.start_with?('OPENPROJECT_DB_') }
71+
expect(db_keys).to be_empty
72+
end
73+
end
74+
end

0 commit comments

Comments
 (0)