From 57b3aece1ff394f9b27c765fd2d2f8e278b32bf0 Mon Sep 17 00:00:00 2001
From: Marcus <marcus.zoller@idnt.net>
Date: Tue, 13 Feb 2018 16:26:44 +0100
Subject: [PATCH] Fixes gnocchi with postgresql deployment if running on
different hosts
a) The db-init method ignores the configured admin password.
This seems to work if db-init was scheduled to the same host as
postgresql is running on but fails on a remote connection. This change
sets the PGPASSWORD variable to the provided admin password.
b) Fixed liveness and readiness probe for postgresql
While this seems to work it continously outputs the message
"psql: FATAL: role "root" does not exist"
This change adds the admin username as argument to pg_isready
to stop this message.
Update: Making the linter happy ;-)
Change-Id: I59b47a8724065d08203c29172c15350aaa785203
Closes-Bug: #1749177
---
gnocchi/templates/bin/_db-init.sh.tpl | 16 ++++--------
gnocchi/templates/job-db-init-indexer.yaml | 6 ++++-
gnocchi/templates/secret-db-indexer.yaml | 30 ++++++++++++++++++++++
gnocchi/templates/secret-db.yaml | 3 +--
gnocchi/values.yaml | 4 +++
postgresql/templates/statefulset.yaml | 4 +++
postgresql/values.yaml | 2 +-
7 files changed, 50 insertions(+), 15 deletions(-)
create mode 100644 gnocchi/templates/secret-db-indexer.yaml
diff --git a/gnocchi/templates/bin/_db-init.sh.tpl b/gnocchi/templates/bin/_db-init.sh.tpl
index 39736f02da..e3715d6859 100644
--- a/gnocchi/templates/bin/_db-init.sh.tpl
+++ b/gnocchi/templates/bin/_db-init.sh.tpl
@@ -24,22 +24,15 @@ pgsql_superuser_cmd () {
if [[ ! -z $2 ]]; then
EXPORT PGDATABASE=$2
fi
-
- psql \
- -h ${DB_FQDN} \
- -p ${DB_PORT} \
- -U ${ROOT_DB_USER} \
- --command="${DB_COMMAND}"
-}
-
-pgsql_superuser_cmd () {
- DB_COMMAND="$1"
-
+ if [[ ! -z "${ROOT_DB_PASS}" ]]; then
+ export PGPASSWORD="${ROOT_DB_PASS}"
+ fi
psql \
-h ${DB_FQDN} \
-p ${DB_PORT} \
-U ${ROOT_DB_USER} \
--command="${DB_COMMAND}"
+ unset PGPASSWORD
}
if [[ ! -v ROOT_DB_CONNECTION ]]; then
@@ -95,3 +88,4 @@ pgsql_superuser_cmd "SELECT * FROM pg_roles WHERE rolname = '$DB_USER';" | tail
#give permissions to user
pgsql_superuser_cmd "GRANT ALL PRIVILEGES ON DATABASE $DB_NAME to $DB_USER;"
+
diff --git a/gnocchi/templates/job-db-init-indexer.yaml b/gnocchi/templates/job-db-init-indexer.yaml
index daa03e01d0..f0c18c06a1 100644
--- a/gnocchi/templates/job-db-init-indexer.yaml
+++ b/gnocchi/templates/job-db-init-indexer.yaml
@@ -46,7 +46,7 @@ spec:
- name: ROOT_DB_CONNECTION
valueFrom:
secretKeyRef:
- name: {{ .Values.secrets.oslo_db.admin }}
+ name: {{ .Values.secrets.oslo_db_indexer.admin }}
key: DB_CONNECTION_INDEXER
- name: OPENSTACK_CONFIG_FILE
value: /etc/gnocchi/gnocchi.conf
@@ -60,6 +60,8 @@ spec:
- name: gnocchi-etc
mountPath: /etc/gnocchi/gnocchi.conf
subPath: gnocchi.conf
+ - name: pod-etc-gnocchi
+ mountPath: /etc/gnocchi
- name: gnocchi-bin
mountPath: /tmp/db-init.sh
subPath: db-init.sh
@@ -69,6 +71,8 @@ spec:
configMap:
name: gnocchi-etc
defaultMode: 0444
+ - name: pod-etc-gnocchi
+ emptyDir: {}
- name: gnocchi-bin
configMap:
name: gnocchi-bin
diff --git a/gnocchi/templates/secret-db-indexer.yaml b/gnocchi/templates/secret-db-indexer.yaml
new file mode 100644
index 0000000000..1b36359f49
--- /dev/null
+++ b/gnocchi/templates/secret-db-indexer.yaml
@@ -0,0 +1,30 @@
+{{/*
+Copyright 2017 The Openstack-Helm Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- if .Values.manifests.secret_db_indexer }}
+{{- $envAll := . }}
+{{- range $key1, $userClass := tuple "admin" "gnocchi" }}
+{{- $secretName := index $envAll.Values.secrets.oslo_db_indexer $userClass }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: {{ $secretName }}
+type: Opaque
+data:
+ DB_CONNECTION_INDEXER: {{ tuple "oslo_db_postgresql" "internal" $userClass "postgresql" $envAll | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" | b64enc }}
+{{- end }}
+{{- end }}
diff --git a/gnocchi/templates/secret-db.yaml b/gnocchi/templates/secret-db.yaml
index a3a5498e1b..81516d7d9b 100644
--- a/gnocchi/templates/secret-db.yaml
+++ b/gnocchi/templates/secret-db.yaml
@@ -25,7 +25,6 @@ metadata:
name: {{ $secretName }}
type: Opaque
data:
- DB_CONNECTION_INDEXER: {{ tuple "oslo_db_postgresql" "internal" $userClass "postgresql" $envAll | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" | b64enc }}
- DB_CONNECTION_API: {{ tuple "oslo_db" "internal" $userClass "mysql" $envAll | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" | b64enc }}
+ DB_CONNECTION: {{ tuple "oslo_db" "internal" $userClass "mysql" $envAll | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" | b64enc -}}
{{- end }}
{{- end }}
diff --git a/gnocchi/values.yaml b/gnocchi/values.yaml
index 3612176cfc..36e91ea77c 100644
--- a/gnocchi/values.yaml
+++ b/gnocchi/values.yaml
@@ -349,6 +349,9 @@ secrets:
oslo_db:
admin: gnocchi-db-admin
gnocchi: gnocchi-db-user
+ oslo_db_indexer:
+ admin: gnocchi-db-indexer-admin
+ gnocchi: gnocchi-db-indexer-user
rbd: gnocchi-rbd-keyring
# typically overriden by environmental
@@ -460,6 +463,7 @@ manifests:
job_clean: true
job_db_init_indexer: true
job_db_init: true
+ secret_db_indexer: true
job_db_sync: true
job_ks_endpoints: true
job_ks_service: true
diff --git a/postgresql/templates/statefulset.yaml b/postgresql/templates/statefulset.yaml
index 341be96e32..282193694a 100644
--- a/postgresql/templates/statefulset.yaml
+++ b/postgresql/templates/statefulset.yaml
@@ -62,12 +62,16 @@ spec:
exec:
command:
- pg_isready
+ - -U
+ - {{ .Values.endpoints.postgresql.auth.admin.username }}
initialDelaySeconds: 20
timeoutSeconds: 5
readinessProbe:
exec:
command:
- pg_isready
+ - -U
+ - {{ .Values.endpoints.postgresql.auth.admin.username }}
initialDelaySeconds: 20
timeoutSeconds: 5
{{ tuple $envAll $envAll.Values.pod.resources.server | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
diff --git a/postgresql/values.yaml b/postgresql/values.yaml
index 148ed54918..2b04ba51ae 100644
--- a/postgresql/values.yaml
+++ b/postgresql/values.yaml
@@ -73,7 +73,7 @@ endpoints:
auth:
admin:
username: postgres
- password: sergtsop
+ password: password
hosts:
default: postgresql
host_fqdn_override: