From 57b3aece1ff394f9b27c765fd2d2f8e278b32bf0 Mon Sep 17 00:00:00 2001 From: Marcus Date: Tue, 13 Feb 2018 16:26:44 +0100 Subject: [PATCH] Fixes gnocchi with postgresql deployment if running on different hosts a) The db-init method ignores the configured admin password. This seems to work if db-init was scheduled to the same host as postgresql is running on but fails on a remote connection. This change sets the PGPASSWORD variable to the provided admin password. b) Fixed liveness and readiness probe for postgresql While this seems to work it continously outputs the message "psql: FATAL: role "root" does not exist" This change adds the admin username as argument to pg_isready to stop this message. Update: Making the linter happy ;-) Change-Id: I59b47a8724065d08203c29172c15350aaa785203 Closes-Bug: #1749177 --- gnocchi/templates/bin/_db-init.sh.tpl | 16 ++++-------- gnocchi/templates/job-db-init-indexer.yaml | 6 ++++- gnocchi/templates/secret-db-indexer.yaml | 30 ++++++++++++++++++++++ gnocchi/templates/secret-db.yaml | 3 +-- gnocchi/values.yaml | 4 +++ postgresql/templates/statefulset.yaml | 4 +++ postgresql/values.yaml | 2 +- 7 files changed, 50 insertions(+), 15 deletions(-) create mode 100644 gnocchi/templates/secret-db-indexer.yaml diff --git a/gnocchi/templates/bin/_db-init.sh.tpl b/gnocchi/templates/bin/_db-init.sh.tpl index 39736f02da..e3715d6859 100644 --- a/gnocchi/templates/bin/_db-init.sh.tpl +++ b/gnocchi/templates/bin/_db-init.sh.tpl @@ -24,22 +24,15 @@ pgsql_superuser_cmd () { if [[ ! -z $2 ]]; then EXPORT PGDATABASE=$2 fi - - psql \ - -h ${DB_FQDN} \ - -p ${DB_PORT} \ - -U ${ROOT_DB_USER} \ - --command="${DB_COMMAND}" -} - -pgsql_superuser_cmd () { - DB_COMMAND="$1" - + if [[ ! -z "${ROOT_DB_PASS}" ]]; then + export PGPASSWORD="${ROOT_DB_PASS}" + fi psql \ -h ${DB_FQDN} \ -p ${DB_PORT} \ -U ${ROOT_DB_USER} \ --command="${DB_COMMAND}" + unset PGPASSWORD } if [[ ! -v ROOT_DB_CONNECTION ]]; then @@ -95,3 +88,4 @@ pgsql_superuser_cmd "SELECT * FROM pg_roles WHERE rolname = '$DB_USER';" | tail #give permissions to user pgsql_superuser_cmd "GRANT ALL PRIVILEGES ON DATABASE $DB_NAME to $DB_USER;" + diff --git a/gnocchi/templates/job-db-init-indexer.yaml b/gnocchi/templates/job-db-init-indexer.yaml index daa03e01d0..f0c18c06a1 100644 --- a/gnocchi/templates/job-db-init-indexer.yaml +++ b/gnocchi/templates/job-db-init-indexer.yaml @@ -46,7 +46,7 @@ spec: - name: ROOT_DB_CONNECTION valueFrom: secretKeyRef: - name: {{ .Values.secrets.oslo_db.admin }} + name: {{ .Values.secrets.oslo_db_indexer.admin }} key: DB_CONNECTION_INDEXER - name: OPENSTACK_CONFIG_FILE value: /etc/gnocchi/gnocchi.conf @@ -60,6 +60,8 @@ spec: - name: gnocchi-etc mountPath: /etc/gnocchi/gnocchi.conf subPath: gnocchi.conf + - name: pod-etc-gnocchi + mountPath: /etc/gnocchi - name: gnocchi-bin mountPath: /tmp/db-init.sh subPath: db-init.sh @@ -69,6 +71,8 @@ spec: configMap: name: gnocchi-etc defaultMode: 0444 + - name: pod-etc-gnocchi + emptyDir: {} - name: gnocchi-bin configMap: name: gnocchi-bin diff --git a/gnocchi/templates/secret-db-indexer.yaml b/gnocchi/templates/secret-db-indexer.yaml new file mode 100644 index 0000000000..1b36359f49 --- /dev/null +++ b/gnocchi/templates/secret-db-indexer.yaml @@ -0,0 +1,30 @@ +{{/* +Copyright 2017 The Openstack-Helm Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if .Values.manifests.secret_db_indexer }} +{{- $envAll := . }} +{{- range $key1, $userClass := tuple "admin" "gnocchi" }} +{{- $secretName := index $envAll.Values.secrets.oslo_db_indexer $userClass }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ $secretName }} +type: Opaque +data: + DB_CONNECTION_INDEXER: {{ tuple "oslo_db_postgresql" "internal" $userClass "postgresql" $envAll | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" | b64enc }} +{{- end }} +{{- end }} diff --git a/gnocchi/templates/secret-db.yaml b/gnocchi/templates/secret-db.yaml index a3a5498e1b..81516d7d9b 100644 --- a/gnocchi/templates/secret-db.yaml +++ b/gnocchi/templates/secret-db.yaml @@ -25,7 +25,6 @@ metadata: name: {{ $secretName }} type: Opaque data: - DB_CONNECTION_INDEXER: {{ tuple "oslo_db_postgresql" "internal" $userClass "postgresql" $envAll | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" | b64enc }} - DB_CONNECTION_API: {{ tuple "oslo_db" "internal" $userClass "mysql" $envAll | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" | b64enc }} + DB_CONNECTION: {{ tuple "oslo_db" "internal" $userClass "mysql" $envAll | include "helm-toolkit.endpoints.authenticated_endpoint_uri_lookup" | b64enc -}} {{- end }} {{- end }} diff --git a/gnocchi/values.yaml b/gnocchi/values.yaml index 3612176cfc..36e91ea77c 100644 --- a/gnocchi/values.yaml +++ b/gnocchi/values.yaml @@ -349,6 +349,9 @@ secrets: oslo_db: admin: gnocchi-db-admin gnocchi: gnocchi-db-user + oslo_db_indexer: + admin: gnocchi-db-indexer-admin + gnocchi: gnocchi-db-indexer-user rbd: gnocchi-rbd-keyring # typically overriden by environmental @@ -460,6 +463,7 @@ manifests: job_clean: true job_db_init_indexer: true job_db_init: true + secret_db_indexer: true job_db_sync: true job_ks_endpoints: true job_ks_service: true diff --git a/postgresql/templates/statefulset.yaml b/postgresql/templates/statefulset.yaml index 341be96e32..282193694a 100644 --- a/postgresql/templates/statefulset.yaml +++ b/postgresql/templates/statefulset.yaml @@ -62,12 +62,16 @@ spec: exec: command: - pg_isready + - -U + - {{ .Values.endpoints.postgresql.auth.admin.username }} initialDelaySeconds: 20 timeoutSeconds: 5 readinessProbe: exec: command: - pg_isready + - -U + - {{ .Values.endpoints.postgresql.auth.admin.username }} initialDelaySeconds: 20 timeoutSeconds: 5 {{ tuple $envAll $envAll.Values.pod.resources.server | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} diff --git a/postgresql/values.yaml b/postgresql/values.yaml index 148ed54918..2b04ba51ae 100644 --- a/postgresql/values.yaml +++ b/postgresql/values.yaml @@ -73,7 +73,7 @@ endpoints: auth: admin: username: postgres - password: sergtsop + password: password hosts: default: postgresql host_fqdn_override: