diff --git a/deploy/kine/mysql/Makefile b/deploy/kine/mysql/Makefile index 305aef8..3b66770 100644 --- a/deploy/kine/mysql/Makefile +++ b/deploy/kine/mysql/Makefile @@ -1,32 +1,34 @@ ROOT_DIR:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST)))) +NAME:=default +NAMESPACE:=mysql-system mariadb: mariadb-certificates mariadb-secret mariadb-deployment mariadb-certificates: - rm -rf $(ROOT_DIR)/certs && mkdir $(ROOT_DIR)/certs - cfssl gencert -initca $(ROOT_DIR)/ca-csr.json | cfssljson -bare $(ROOT_DIR)/certs/ca - @mv $(ROOT_DIR)/certs/ca.pem $(ROOT_DIR)/certs/ca.crt - @mv $(ROOT_DIR)/certs/ca-key.pem $(ROOT_DIR)/certs/ca.key - cfssl gencert -ca=$(ROOT_DIR)/certs/ca.crt -ca-key=$(ROOT_DIR)/certs/ca.key \ + rm -rf $(ROOT_DIR)/certs/$(NAME) && mkdir -p $(ROOT_DIR)/certs/$(NAME) + cfssl gencert -initca $(ROOT_DIR)/ca-csr.json | cfssljson -bare $(ROOT_DIR)/certs/$(NAME)/ca + @mv $(ROOT_DIR)/certs/$(NAME)/ca.pem $(ROOT_DIR)/certs/$(NAME)/ca.crt + @mv $(ROOT_DIR)/certs/$(NAME)/ca-key.pem $(ROOT_DIR)/certs/$(NAME)/ca.key + @NAME=$(NAME) NAMESPACE=$(NAMESPACE) envsubst < server-csr.json > $(ROOT_DIR)/certs/$(NAME)/server-csr.json + cfssl gencert -ca=$(ROOT_DIR)/certs/$(NAME)/ca.crt -ca-key=$(ROOT_DIR)/certs/$(NAME)/ca.key \ -config=$(ROOT_DIR)/config.json -profile=server \ - $(ROOT_DIR)/server-csr.json | cfssljson -bare $(ROOT_DIR)/certs/server - @mv $(ROOT_DIR)/certs/server.pem $(ROOT_DIR)/certs/server.crt - @mv $(ROOT_DIR)/certs/server-key.pem $(ROOT_DIR)/certs/server.key - chmod 644 $(ROOT_DIR)/certs/* + $(ROOT_DIR)/certs/$(NAME)/server-csr.json | cfssljson -bare $(ROOT_DIR)/certs/$(NAME)/server + @mv $(ROOT_DIR)/certs/$(NAME)/server.pem $(ROOT_DIR)/certs/$(NAME)/server.crt + @mv $(ROOT_DIR)/certs/$(NAME)/server-key.pem $(ROOT_DIR)/certs/$(NAME)/server.key + chmod 644 $(ROOT_DIR)/certs/$(NAME)/* mariadb-secret: - @kubectl create namespace kamaji-system --dry-run=client -o yaml | kubectl apply -f - - @kubectl -n kamaji-system create secret generic mysql-config \ - --from-file=$(ROOT_DIR)/certs/ca.crt --from-file=$(ROOT_DIR)/certs/ca.key \ - --from-file=$(ROOT_DIR)/certs/server.key --from-file=$(ROOT_DIR)/certs/server.crt \ + @kubectl create namespace $(NAMESPACE) --dry-run=client -o yaml | kubectl apply -f - + @kubectl -n $(NAMESPACE) create secret generic mysql-$(NAME)-config \ + --from-file=$(ROOT_DIR)/certs/$(NAME)/ca.crt --from-file=$(ROOT_DIR)/certs/$(NAME)/ca.key \ + --from-file=$(ROOT_DIR)/certs/$(NAME)/server.key --from-file=$(ROOT_DIR)/certs/$(NAME)/server.crt \ --from-file=$(ROOT_DIR)/mysql-ssl.cnf \ --from-literal=MYSQL_ROOT_PASSWORD=root \ --dry-run=client -o yaml | kubectl apply -f - mariadb-deployment: - @kubectl -n kamaji-system apply -f $(ROOT_DIR)/mariadb.yaml + @NAME=$(NAME) envsubst < $(ROOT_DIR)/mariadb.yaml | kubectl -n $(NAMESPACE) apply -f - mariadb-destroy: - @kubectl delete -n kamaji-system -f $(ROOT_DIR)/mariadb.yaml --ignore-not-found - @kubectl delete -n kamaji-system secret mysql-config --ignore-not-found - @kubectl delete -n kamaji-system secret kine-secret --ignore-not-found + @NAME=$(NAME) envsubst < $(ROOT_DIR)/mariadb.yaml | kubectl -n $(NAMESPACE) delete --ignore-not-found -f - + @kubectl delete -n $(NAMESPACE) secret mysql-$(NAME)config --ignore-not-found diff --git a/deploy/kine/mysql/certs/bronze/server-csr.json b/deploy/kine/mysql/certs/bronze/server-csr.json new file mode 100644 index 0000000..1cf8df4 --- /dev/null +++ b/deploy/kine/mysql/certs/bronze/server-csr.json @@ -0,0 +1,14 @@ +{ + "CN": "bronze.mysql-system.svc.cluster.local", + "key": { + "algo": "rsa", + "size": 2048 + }, + "hosts": [ + "127.0.0.1", + "localhost", + "bronze", + "bronze.mysql-system.svc", + "bronze.mysql-system.svc.cluster.local" + ] +} diff --git a/deploy/kine/mysql/certs/gold/server-csr.json b/deploy/kine/mysql/certs/gold/server-csr.json new file mode 100644 index 0000000..6f07590 --- /dev/null +++ b/deploy/kine/mysql/certs/gold/server-csr.json @@ -0,0 +1,14 @@ +{ + "CN": "gold.mysql-system.svc.cluster.local", + "key": { + "algo": "rsa", + "size": 2048 + }, + "hosts": [ + "127.0.0.1", + "localhost", + "gold", + "gold.mysql-system.svc", + "gold.mysql-system.svc.cluster.local" + ] +} diff --git a/deploy/kine/mysql/certs/silver/server-csr.json b/deploy/kine/mysql/certs/silver/server-csr.json new file mode 100644 index 0000000..d93a37e --- /dev/null +++ b/deploy/kine/mysql/certs/silver/server-csr.json @@ -0,0 +1,14 @@ +{ + "CN": "silver.mysql-system.svc.cluster.local", + "key": { + "algo": "rsa", + "size": 2048 + }, + "hosts": [ + "127.0.0.1", + "localhost", + "silver", + "silver.mysql-system.svc", + "silver.mysql-system.svc.cluster.local" + ] +} diff --git a/deploy/kine/mysql/mariadb.yaml b/deploy/kine/mysql/mariadb.yaml index 50c89ed..62b4896 100644 --- a/deploy/kine/mysql/mariadb.yaml +++ b/deploy/kine/mysql/mariadb.yaml @@ -1,14 +1,18 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: mariadb - namespace: + name: $NAME + labels: + db: mysql + instance: $NAME --- apiVersion: v1 kind: Service metadata: - name: mariadb - namespace: + name: $NAME + labels: + db: mysql + instance: $NAME spec: type: ClusterIP ports: @@ -17,34 +21,37 @@ spec: protocol: TCP targetPort: 3306 selector: - app: mariadb + db: mysql + instance: $NAME --- apiVersion: apps/v1 kind: Deployment metadata: - name: mariadb + name: mysql-$NAME labels: - app: mariadb + db: mysql + instance: $NAME namespace: spec: selector: matchLabels: - app: mariadb + db: mysql + instance: $NAME replicas: 1 template: metadata: - name: mariadb labels: - app: mariadb + db: mysql + instance: $NAME spec: - serviceAccountName: mariadb + serviceAccountName: $NAME volumes: - name: certs secret: - secretName: mysql-config + secretName: mysql-$NAME-config - name: data persistentVolumeClaim: - claimName: pvc-mariadb + claimName: mysql-$NAME-pvc containers: - name: mariadb image: mariadb:10.7.4 @@ -60,14 +67,16 @@ spec: - name: MYSQL_ROOT_PASSWORD valueFrom: secretKeyRef: - name: mysql-config + name: mysql-$NAME-config key: MYSQL_ROOT_PASSWORD --- apiVersion: v1 kind: PersistentVolumeClaim metadata: - name: pvc-mariadb - namespace: + name: mysql-$NAME-pvc + labels: + db: mysql + instance: $NAME spec: accessModes: - ReadWriteOnce diff --git a/deploy/kine/mysql/server-csr.json b/deploy/kine/mysql/server-csr.json index bc6a4ee..5cb906c 100644 --- a/deploy/kine/mysql/server-csr.json +++ b/deploy/kine/mysql/server-csr.json @@ -1,5 +1,5 @@ { - "CN": "mariadb.kamaji-system.svc.cluster.local", + "CN": "$NAME.$NAMESPACE.svc.cluster.local", "key": { "algo": "rsa", "size": 2048 @@ -7,13 +7,8 @@ "hosts": [ "127.0.0.1", "localhost", - "mariadb", - "mariadb.kamaji-system", - "mariadb.kamaji-system.svc", - "mariadb.kamaji-system.svc.cluster.local", - "mysql", - "mysql.kamaji-system", - "mysql.kamaji-system.svc", - "mysql.kamaji-system.svc.cluster.local" + "$NAME", + "$NAME.$NAMESPACE.svc", + "$NAME.$NAMESPACE.svc.cluster.local" ] } diff --git a/deploy/kine/postgresql/Makefile b/deploy/kine/postgresql/Makefile index 54fbd8d..3554b04 100644 --- a/deploy/kine/postgresql/Makefile +++ b/deploy/kine/postgresql/Makefile @@ -1,15 +1,17 @@ ROOT_DIR:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST)))) +NAME:=default +NAMESPACE:=kamaji-system postgresql: cnpg-setup cnpg-deploy postgresql-secret cnpg-setup: - @kubectl apply -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/releases/cnpg-1.16.0.yaml + @kubectl apply -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/releases/cnpg-1.18.0.yaml cnpg-deploy: @kubectl -n cnpg-system rollout status deployment/cnpg-controller-manager - @kubectl create namespace kamaji-system --dry-run=client -o yaml | kubectl apply -f - - @kubectl -n kamaji-system apply -f postgresql.yaml - @while ! kubectl -n kamaji-system get secret postgresql-superuser > /dev/null 2>&1; do sleep 1; done + @kubectl create namespace $(NAMESPACE) --dry-run=client -o yaml | kubectl apply -f - + @NAME=$(NAME) envsubst < postgresql.yaml | kubectl -n $(NAMESPACE) apply -f - + @while ! kubectl -n $(NAMESPACE) get secret postgres-$(NAME)-superuser > /dev/null 2>&1; do sleep 1; done CNPG = $(shell git rev-parse --show-toplevel)/bin/kubectl-cnpg cnpg: @@ -18,10 +20,10 @@ cnpg: sh -s -- -b $(shell git rev-parse --show-toplevel)/bin postgresql-secret: cnpg - @kubectl -n kamaji-system get secret postgres-root-cert > /dev/null 2>&1 || $(CNPG) -n kamaji-system certificate postgres-root-cert \ - --cnpg-cluster postgresql \ - --cnpg-user $$(kubectl -n kamaji-system get secret postgresql-superuser -o jsonpath='{.data.username}' | base64 -d) + @kubectl -n $(NAMESPACE) get secret postgres-$(NAME)-root-cert > /dev/null 2>&1 || $(CNPG) -n $(NAMESPACE) certificate postgres-$(NAME)-root-cert \ + --cnpg-cluster postgres-$(NAME) \ + --cnpg-user $$(kubectl -n $(NAMESPACE) get secret postgres-$(NAME)-superuser -o jsonpath='{.data.username}' | base64 -d) postgresql-destroy: - @kubectl delete -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/releases/cnpg-1.16.0.yaml --ignore-not-found && \ - kubectl -n kamaji-system delete secret postgres-root-cert --ignore-not-found + @NAME=$(NAME) envsubst < postgresql.yaml | kubectl -n $(NAMESPACE) delete -f - + @kubectl -n $(NAMESPACE) delete secret postgres-$(NAME)-root-cert --ignore-not-found diff --git a/deploy/kine/postgresql/postgresql.yaml b/deploy/kine/postgresql/postgresql.yaml index 16c09eb..17fb296 100644 --- a/deploy/kine/postgresql/postgresql.yaml +++ b/deploy/kine/postgresql/postgresql.yaml @@ -1,7 +1,7 @@ apiVersion: postgresql.cnpg.io/v1 kind: Cluster metadata: - name: postgresql + name: postgres-$NAME spec: description: PostgreSQL cluster used by Kamaji along with kine instances: 3