Mercurial > code > home > repos > pomerium
changeset 17:768a373ff151
add postgres for session storage
| author | drewp@bigasterisk.com |
|---|---|
| date | Sun, 09 Apr 2023 16:35:33 -0700 |
| parents | d8b3c6fa64a3 |
| children | ae78ba22c2b1 |
| files | 20-kube/06-postgres.yaml 20-kube/10-pom-pom.yaml 20-kube/skaffold.yaml |
| diffstat | 3 files changed, 100 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/20-kube/06-postgres.yaml Sun Apr 09 16:35:33 2023 -0700 @@ -0,0 +1,96 @@ +apiVersion: v1 +kind: PersistentVolume +metadata: + name: pomerium-db-data + labels: + type: local +spec: + storageClassName: manual + hostPath: + path: "/opt/pomerium-db" + capacity: + storage: 50Gi + accessModes: + - ReadWriteOnce + persistentVolumeReclaimPolicy: Retain + claimRef: + namespace: pomerium + name: pomerium-db-data +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + namespace: pomerium + name: pomerium-db-data +spec: + storageClassName: "" + volumeName: "pomerium-db-data" + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 50Gi +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: pomerium + name: pomerium-db +spec: + replicas: 1 + strategy: {type: Recreate} + selector: + matchLabels: + app: pomerium-db + template: + metadata: + labels: + app: pomerium-db + annotations: + prometheus.io/scrape: "false" + spec: + volumes: + - name: pomerium-db-data + persistentVolumeClaim: + claimName: pomerium-db-data + containers: + # see /my/serv/photoprism/deploy.yaml for exporter example (for mariadb) + - name: pomerium-db + image: postgres:14.2-alpine3.15 + env: + - {name: POSTGRES_PASSWORD, value: admin} + - {name: POSTGRES_DB, value: pomerium} + ports: + - containerPort: 5432 + volumeMounts: + - name: pomerium-db-data + mountPath: /var/lib/postgresql/data + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: "kubernetes.io/hostname" + operator: In + values: ["ditto"] +--- +apiVersion: v1 +kind: Service +metadata: + namespace: pomerium + name: pomerium-db +spec: + ports: + - port: 5432 + targetPort: 5432 + selector: + app: pomerium-db +--- +apiVersion: v1 +kind: Secret +metadata: + namespace: pomerium + name: postgres-connection-key +type: Opaque +stringData: + connection: postgresql://pom:pom@pomerium-db/pomerium
--- a/20-kube/10-pom-pom.yaml Sun Apr 09 14:09:15 2023 -0700 +++ b/20-kube/10-pom-pom.yaml Sun Apr 09 16:35:33 2023 -0700 @@ -15,6 +15,9 @@ # adds name+locale to user details - profile secret: pomerium/idp + storage: + postgres: + secret: pomerium/postgres-connection-key # Note pom won't start up if this cert doesn't exist, so you have to run once # with it commented out, then after cert success, run again with it enabled.