wip: helmfileify

2025-06-02 22:25:06 +02:00
parent 65d65ea126
commit a0a0f8586d
73 changed files with 1491 additions and 121 deletions
@@ -0,0 +1,41 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: staging-openfga-migrate
+  labels:
+    helm.sh/chart: openfga-0.2.12
+    app.kubernetes.io/name: openfga
+    app.kubernetes.io/instance: staging
+    app.kubernetes.io/version: "v1.5.9"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    helm.sh/hook: post-install, post-upgrade, post-rollback, post-delete
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-5"
+spec:
+  template:
+    metadata:
+      annotations:
+        helm.sh/hook: post-install, post-upgrade, post-rollback, post-delete
+        helm.sh/hook-delete-policy: before-hook-creation
+        helm.sh/hook-weight: "-5"
+    spec:
+      serviceAccountName: staging-openfga
+      containers:
+        - name: migrate-database
+          securityContext:
+            {}
+          image: "openfga/openfga:v1.5.9"
+          args: ["migrate"]
+          env:
+            - name: OPENFGA_DATASTORE_ENGINE
+              value: "postgres"
+            - name: OPENFGA_DATASTORE_URI
+              valueFrom:
+                secretKeyRef:
+                  name: "staging-openfga-db-superuser"
+                  key: "uri"
+          resources:
+            {}
+      restartPolicy: Never
+  backoffLimit: 1
@@ -0,0 +1,40 @@
+{{- if .Values.clusterConfig.argo.enabled }}
+{{- range .Values.openfga.envs }}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: {{ . }}-openfga 
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    namespace: openfga
+    server: 'https://kubernetes.default.svc'
+  sources:
+  - repoURL: {{ .Values.clusterConfig.manifests }}
+    targetRevision: HEAD
+    path: helmfiles/openfga
+    plugin:
+      name: helmfile
+      env:
+      - name: CLUSTER_NAME
+        value: {{ .Values.clusterConfig.cluster }}
+  project: sys
+  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        component: aux
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      # - ServerSideApply=true
+    {{- if .Values.openfga.autosync }}
+    automated:
+      prune: true
+      # selfHeal: false
+    {{- end }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,19 @@
+apiVersion: v1
+stringData:
+  postgres-password: blT6zzv37KyFvzb1Ct3bhfAwPxhTG2fBO1EiIASQWI4wnEOB8AOWvmVa2sogGexr
+  uri:  postgres://postgres:blT6zzv37KyFvzb1Ct3bhfAwPxhTG2fBO1EiIASQWI4wnEOB8AOWvmVa2sogGexr@prod-openfga-rw.openfga.svc.cluster.local:5432/postgres?sslmode=disable
+kind: Secret
+metadata:
+  name: prod-openfga-postgresql
+  namespace: openfga
+type: Opaque
+---
+apiVersion: v1
+stringData:
+  postgres-password: iAnMHs3eEuQM0D4jeAP1dwEoLWUBSwNXwhBuPDOgmfoeZ58iV0zogQ77U3GNUbwa
+  uri:  postgres://postgres:iAnMHs3eEuQM0D4jeAP1dwEoLWUBSwNXwhBuPDOgmfoeZ58iV0zogQ77U3GNUbwa@staging-openfga-rw.openfga.svc.cluster.local:5432/postgres?sslmode=disable
+kind: Secret
+metadata:
+  name: staging-openfga-postgresql
+  namespace: openfga
+type: Opaque