91 lines
3.8 KiB
YAML
91 lines
3.8 KiB
YAML
---
|
|
# Deploys the shared Postgres cluster onto k3s: install CloudNativePG (the
|
|
# operator) via a HelmChart CR, then define the actual cluster as a plain
|
|
# Cluster CR — same two-manifest pattern as roles/k3s_metallb (chart CR +
|
|
# plain config manifest), for the same reason: k3s's deploy controller
|
|
# retries a manifest referencing CRDs the HelmChart above hasn't installed
|
|
# yet instead of failing outright, so the Cluster CR doesn't need to wait on
|
|
# the operator chart finishing first.
|
|
#
|
|
# Config is layered the same way compose_stack/lxc_app layer an app's
|
|
# common/vars.yml + platform vars.yml — src/shared/postgres/ is the same
|
|
# shared service already used on Unraid/Proxmox, just deployed a third way
|
|
# here. Secrets come from the same Vault path those platforms already use
|
|
# (homelab/shared/postgres) — this is a separate physical instance, but
|
|
# reuses the path rather than inventing a k3s-specific one, same "one path
|
|
# per app-concept" convention as every other stack.
|
|
|
|
- name: Set shared-postgres source facts
|
|
ansible.builtin.set_fact:
|
|
pg_local_dir: "{{ repo_root }}/src/shared/postgres"
|
|
|
|
- name: Load portable shared-postgres variables
|
|
ansible.builtin.include_vars:
|
|
file: "{{ pg_local_dir }}/common/vars.yml"
|
|
name: pg_common_vars
|
|
|
|
- name: Load Kubernetes-specific shared-postgres variables
|
|
ansible.builtin.include_vars:
|
|
file: "{{ pg_local_dir }}/ansible/kubernetes/vars.yml"
|
|
name: pg_platform_vars
|
|
|
|
- name: Merge shared-postgres configuration
|
|
ansible.builtin.set_fact:
|
|
pg_config: >-
|
|
{{ (pg_common_vars.env_defaults | default({}))
|
|
| combine(pg_platform_vars.env_defaults | default({})) }}
|
|
|
|
- name: Look up shared-postgres superuser credentials from Vault
|
|
ansible.builtin.set_fact:
|
|
pg_vault_secrets: >-
|
|
{{ lookup('community.hashi_vault.vault_kv2_get',
|
|
k3s_postgres_vault_path,
|
|
engine_mount_point=vault_kv_mount,
|
|
url=vault_addr,
|
|
auth_method=vault_auth_method,
|
|
role_id=vault_role_id | default(omit),
|
|
secret_id=vault_secret_id | default(omit)).secret }}
|
|
no_log: true
|
|
|
|
- name: Deploy the CloudNativePG operator HelmChart manifest
|
|
ansible.builtin.template:
|
|
src: cnpg-operator.helmchart.yaml.j2
|
|
dest: /var/lib/rancher/k3s/server/manifests/cnpg-operator.yaml
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
become: true
|
|
|
|
# Namespace + Cluster CR, no secrets — safe to render even though the
|
|
# Cluster CR references the Secret below, for the same "later file, retried
|
|
# reconcile" reasoning as the Secret referencing this file's Namespace.
|
|
- name: Deploy the shared-postgres Cluster manifest
|
|
ansible.builtin.template:
|
|
src: postgres-cluster.yaml.j2
|
|
dest: /var/lib/rancher/k3s/server/manifests/shared-postgres-cluster.yaml
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
become: true
|
|
|
|
# Separate file (and mode) from the Cluster manifest above purely because
|
|
# this one carries the Vault-sourced password — everything else here is safe
|
|
# at 0644, this one isn't.
|
|
#
|
|
# The dest filename deliberately doesn't track the Secret's own name, which
|
|
# gained a `-vault` suffix (see the template's header for why). k3s's deploy
|
|
# controller records which resources each manifest *file* created and prunes
|
|
# the ones that disappear from it, so renaming the Secret inside this same
|
|
# file makes the old `shared-postgres-superuser` object get garbage-collected
|
|
# on the next run. Renaming the file too would orphan it instead: Ansible
|
|
# doesn't remove files it no longer writes, so the old manifest would sit
|
|
# there keeping the stale Secret alive.
|
|
- name: Deploy the shared-postgres superuser Secret
|
|
ansible.builtin.template:
|
|
src: postgres-superuser-secret.yaml.j2
|
|
dest: /var/lib/rancher/k3s/server/manifests/shared-postgres-superuser-secret.yaml
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
become: true
|
|
no_log: true
|