From 57b3aece1ff394f9b27c765fd2d2f8e278b32bf0 Mon Sep 17 00:00:00 2001 From: Marcus Date: Tue, 13 Feb 2018 16:26:44 +0100 Subject: [PATCH] Fixes gnocchi with postgresql deployment if running on different hosts a) The db-init method ignores the configured admin password. This seems to work if db-init was scheduled to the same host as postgresql is running on but fails on a remote connection. This change sets the PGPASSWORD variable to the provided admin password. b) Fixed liveness and readiness probe for postgresql While this seems to work it continously outputs the message "psql: FATAL: role "root" does not exist" This change adds the admin username as argument to pg_isready to stop this message. Update: Making the linter happy ;-) Change-Id: I59b47a8724065d08203c29172c15350aaa785203 Closes-Bug: #1749177 --- gnocchi/templates/bin/_db-init.sh.tpl | 16 ++++-------- gnocchi/templates/job-db-init-indexer.yaml | 6 ++++- gnocchi/templates/secret-db-indexer.yaml | 30 ++++++++++++++++++++++ gnocchi/templates/secret-db.yaml | 3 +-- gnocchi/values.yaml | 4 +++ postgresql/templates/statefulset.yaml | 4 +++ postgresql/values.yaml | 2 +- 7 files changed, 50 insertions(+), 15 deletions(-) create mode 100644 gnocchi/templates/secret-db-indexer.yaml diff --git a/gnocchi/templates/bin/_db-init.sh.tpl b/gnocchi/templates/bin/_db-init.sh.tpl index 39736f02..e3715d68 100644 --- a/gnocchi/templates/bin/_db-init.sh.tpl +++ b/gnocchi/templates/bin/_db-init.sh.tpl @@ -24,22 +24,15 @@ pgsql_superuser_cmd () { if [[ ! -z $2 ]]; then EXPORT PGDATABASE=$2 fi - - psql \ - -h ${DB_FQDN} \ - -p ${DB_PORT} \ - -U ${ROOT_DB_USER} \ - --command="${DB_COMMAND}" -} - -pgsql_superuser_cmd () { - DB_COMMAND="$1" - + if [[ ! -z "${ROOT_DB_PASS}" ]]; then + export PGPASSWORD="${ROOT_DB_PASS}" + fi psql \ -h ${DB_FQDN} \ -p ${DB_PORT} \ -U ${ROOT_DB_USER} \ --command="${DB_COMMAND}" + unset PGPASSWORD } if [[ ! -v ROOT_DB_CONNECTION ]]; then @@ -95,3 +88,4 @@ pgsql_superuser_cmd "SELECT * FROM pg_roles WHERE rolname = '$DB_USER';" | tail #give permissions to user pgsql_superuser_cmd "GRANT ALL PRIVILEGES ON DATABASE $DB_NAME to $DB_USER;" + diff --git a/gnocchi/templates/job-db-init-indexer.yaml b/gnocchi/templates/job-db-init-indexer.yaml index daa03e01..f0c18c06 100644 --- a/gnocchi/templates/job-db-init-indexer.yaml +++ b/gnocchi/templates/job-db-init-indexer.yaml @@ -46,7 +46,7 @@ spec: - name: ROOT_DB_CONNECTION valueFrom: secretKeyRef: - name: {{ .Values.secrets.oslo_db.admin }} + name: {{ .Values.secrets.oslo_db_indexer.admin }} key: DB_CONNECTION_INDEXER - name: OPENSTACK_CONFIG_FILE value: /etc/gnocchi/gnocchi.conf @@ -60,6 +60,8 @@ spec: - name: gnocchi-etc mountPath: /etc/gnocchi/gnocchi.conf subPath: gnocchi.conf + - name: pod-etc-gnocchi + mountPath: /etc/gnocchi - name: gnocchi-bin mountPath: /tmp/db-init.sh subPath: db-init.sh @@ -69,6 +71,8 @@ spec: configMap: name: gnocchi-etc defaultMode: 0444 + - name: pod-etc-gnocchi + emptyDir: {} - name: gnocchi-bin configMap: name: gnocchi-bin diff --git a/gnocchi/templates/secret-db-indexer.yaml b/gnocchi/templates/secret-db-indexer.yaml new file mode 100644 index 00000000..1b36359f --- /dev/null +++ b/gnocchi/templates/secret-db-indexer.yaml @@ -0,0 +1,30 @@ +{{/* +Copyright 2017 The Openstack-Helm Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if .Values.manifests.secret_db_indexer }} +{{- $envAll := . }} +{{- range $key1, $userClass := tuple "admin" "gnocchi" }} +{{- $secretName := index $envAll.Values.secrets.oslo_db_indexer $userClass }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ $secretName }} +type: Opaque +data: + DB_CONNECTION_INDEXER: {{ tuple "oslo_db_postgresql" "internal" $userClass "postgresql" $envAll | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" | b64enc }} +{{- end }} +{{- end }} diff --git a/gnocchi/templates/secret-db.yaml b/gnocchi/templates/secret-db.yaml index a3a5498e..81516d7d 100644 --- a/gnocchi/templates/secret-db.yaml +++ b/gnocchi/templates/secret-db.yaml @@ -25,7 +25,6 @@ metadata: name: {{ $secretName }} type: Opaque data: - DB_CONNECTION_INDEXER: {{ tuple "oslo_db_postgresql" "internal" $userClass "postgresql" $envAll | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" | b64enc }} - DB_CONNECTION_API: {{ tuple "oslo_db" "internal" $userClass "mysql" $envAll | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" | b64enc }} + DB_CONNECTION: {{ tuple "oslo_db" "internal" $userClass "mysql" $envAll | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" | b64enc -}} {{- end }} {{- end }} diff --git a/gnocchi/values.yaml b/gnocchi/values.yaml index 3612176c..36e91ea7 100644 --- a/gnocchi/values.yaml +++ b/gnocchi/values.yaml @@ -349,6 +349,9 @@ secrets: oslo_db: admin: gnocchi-db-admin gnocchi: gnocchi-db-user + oslo_db_indexer: + admin: gnocchi-db-indexer-admin + gnocchi: gnocchi-db-indexer-user rbd: gnocchi-rbd-keyring # typically overriden by environmental @@ -460,6 +463,7 @@ manifests: job_clean: true job_db_init_indexer: true job_db_init: true + secret_db_indexer: true job_db_sync: true job_ks_endpoints: true job_ks_service: true diff --git a/postgresql/templates/statefulset.yaml b/postgresql/templates/statefulset.yaml index 341be96e..28219369 100644 --- a/postgresql/templates/statefulset.yaml +++ b/postgresql/templates/statefulset.yaml @@ -62,12 +62,16 @@ spec: exec: command: - pg_isready + - -U + - {{ .Values.endpoints.postgresql.auth.admin.username }} initialDelaySeconds: 20 timeoutSeconds: 5 readinessProbe: exec: command: - pg_isready + - -U + - {{ .Values.endpoints.postgresql.auth.admin.username }} initialDelaySeconds: 20 timeoutSeconds: 5 {{ tuple $envAll $envAll.Values.pod.resources.server | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} diff --git a/postgresql/values.yaml b/postgresql/values.yaml index 148ed549..2b04ba51 100644 --- a/postgresql/values.yaml +++ b/postgresql/values.yaml @@ -73,7 +73,7 @@ endpoints: auth: admin: username: postgres - password: sergtsop + password: password hosts: default: postgresql host_fqdn_override: