From 3de7dcfa995075044dfef6bc84989bf73182acdd Mon Sep 17 00:00:00 2001 From: Mykola Date: Thu, 18 Jun 2026 12:40:17 +0300 Subject: [PATCH 1/3] fead: add CNPG --- deploy/k8s/business/business-configmap.yaml | 2 ++ deploy/k8s/business/business-deploy.yaml | 20 +++++++++++ deploy/k8s/guest/deployment.yaml | 21 ++++++++++++ deploy/k8s/infra/cnpg.yaml | 15 ++++++++ deploy/k8s/infra/kustomization.yaml | 4 ++- deploy/k8s/infra/migrator-job.yaml | 34 +++++++++++++++++++ .../k8s/operators/business/kustomization.yaml | 6 ++++ deploy/k8s/operators/guest/kustomization.yaml | 4 +++ deploy/k8s/operators/kustomization.yaml | 6 ++++ internal/business/handler/business/handler.go | 5 ++- ...60617205326_grant_business_permissions.sql | 18 ++++++++++ 11 files changed, 133 insertions(+), 2 deletions(-) create mode 100644 deploy/k8s/infra/cnpg.yaml create mode 100644 deploy/k8s/operators/business/kustomization.yaml create mode 100644 deploy/k8s/operators/guest/kustomization.yaml create mode 100644 deploy/k8s/operators/kustomization.yaml create mode 100644 migrations/20260617205326_grant_business_permissions.sql diff --git a/deploy/k8s/business/business-configmap.yaml b/deploy/k8s/business/business-configmap.yaml index 9fc25f35..802a8655 100644 --- a/deploy/k8s/business/business-configmap.yaml +++ b/deploy/k8s/business/business-configmap.yaml @@ -10,3 +10,5 @@ data: BUSINESS_HTTP_SERVER_ALLOWED_METHODS: "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" BUSINESS_HTTP_SERVER_ALLOWED_HEADERS: "Origin,Content-Type,Accept,Authorization" BUSINESS_HTTP_SERVER_EXPOSE_HEADERS: "Content-Length" + REDIS_HOST: "redis" + REDIS_PORT: "6379" \ No newline at end of file diff --git a/deploy/k8s/business/business-deploy.yaml b/deploy/k8s/business/business-deploy.yaml index 1d4adad7..880b80ba 100644 --- a/deploy/k8s/business/business-deploy.yaml +++ b/deploy/k8s/business/business-deploy.yaml @@ -37,6 +37,26 @@ spec: name: share-bite-business-config - secretRef: name: share-bite-secrets + env: + - name: POSTGRES_HOST + value: share-bite-cnpg-rw + - name: POSTGRES_PORT + value: "5432" + - name: POSTGRES_DB + valueFrom: + secretKeyRef: + name: share-bite-cnpg-app + key: dbname + - name: POSTGRES_USER + valueFrom: + secretKeyRef: + name: share-bite-cnpg-app + key: username + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: share-bite-cnpg-app + key: password readinessProbe: httpGet: path: /business/ready diff --git a/deploy/k8s/guest/deployment.yaml b/deploy/k8s/guest/deployment.yaml index ced9e0d5..506817da 100644 --- a/deploy/k8s/guest/deployment.yaml +++ b/deploy/k8s/guest/deployment.yaml @@ -15,6 +15,7 @@ spec: spec: securityContext: runAsNonRoot: true + runAsUser: 1000 seccompProfile: type: RuntimeDefault containers: @@ -36,6 +37,26 @@ spec: name: guest-api-config - secretRef: name: share-bite-secrets + env: + - name: POSTGRES_HOST + value: share-bite-cnpg-rw + - name: POSTGRES_PORT + value: "5432" + - name: POSTGRES_DB + valueFrom: + secretKeyRef: + name: share-bite-cnpg-app + key: dbname + - name: POSTGRES_USER + valueFrom: + secretKeyRef: + name: share-bite-cnpg-app + key: username + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: share-bite-cnpg-app + key: password livenessProbe: httpGet: path: /health diff --git a/deploy/k8s/infra/cnpg.yaml b/deploy/k8s/infra/cnpg.yaml new file mode 100644 index 00000000..5f6b4fd1 --- /dev/null +++ b/deploy/k8s/infra/cnpg.yaml @@ -0,0 +1,15 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + name: share-bite-cnpg + namespace: share-bite-local +spec: + imageName: ghcr.io/cloudnative-pg/postgresql:18 + instances: 2 + enableSuperuserAccess: true + bootstrap: + initdb: + database: share_bite + owner: share + storage: + size: 2Gi \ No newline at end of file diff --git a/deploy/k8s/infra/kustomization.yaml b/deploy/k8s/infra/kustomization.yaml index f36aa40f..71d44293 100644 --- a/deploy/k8s/infra/kustomization.yaml +++ b/deploy/k8s/infra/kustomization.yaml @@ -3,7 +3,9 @@ kind: Kustomization resources: - namespace.yaml - configmap.yaml -- postgres.yaml +- cnpg.yaml +# for StatefulSet - use postgres.yaml instead of cnpg.yaml +#- postgres.yaml - redis.yaml - secret.yaml - migrator-job.yaml diff --git a/deploy/k8s/infra/migrator-job.yaml b/deploy/k8s/infra/migrator-job.yaml index eea5efcb..719357ed 100644 --- a/deploy/k8s/infra/migrator-job.yaml +++ b/deploy/k8s/infra/migrator-job.yaml @@ -41,6 +41,23 @@ spec: name: share-bite-infra-config - secretRef: name: share-bite-secrets + env: + - name: POSTGRES_HOST + value: share-bite-cnpg-rw + - name: POSTGRES_PORT + value: "5432" + - name: POSTGRES_DB + value: share_bite + - name: POSTGRES_USER + valueFrom: + secretKeyRef: + name: share-bite-cnpg-superuser + key: username + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: share-bite-cnpg-superuser + key: password containers: - name: migrator image: migrator:latest @@ -58,3 +75,20 @@ spec: name: share-bite-infra-config - secretRef: name: share-bite-secrets + env: + - name: POSTGRES_HOST + value: share-bite-cnpg-rw + - name: POSTGRES_PORT + value: "5432" + - name: POSTGRES_DB + value: share_bite + - name: POSTGRES_USER + valueFrom: + secretKeyRef: + name: share-bite-cnpg-superuser + key: username + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: share-bite-cnpg-superuser + key: password diff --git a/deploy/k8s/operators/business/kustomization.yaml b/deploy/k8s/operators/business/kustomization.yaml new file mode 100644 index 00000000..7b307f46 --- /dev/null +++ b/deploy/k8s/operators/business/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - crd.yaml + - operator-deployment.yaml + - rbac.yaml \ No newline at end of file diff --git a/deploy/k8s/operators/guest/kustomization.yaml b/deploy/k8s/operators/guest/kustomization.yaml new file mode 100644 index 00000000..902c20bc --- /dev/null +++ b/deploy/k8s/operators/guest/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - crd.yaml \ No newline at end of file diff --git a/deploy/k8s/operators/kustomization.yaml b/deploy/k8s/operators/kustomization.yaml new file mode 100644 index 00000000..2e51ec3f --- /dev/null +++ b/deploy/k8s/operators/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.22/releases/cnpg-1.22.1.yaml + - ./business + - ./guest \ No newline at end of file diff --git a/internal/business/handler/business/handler.go b/internal/business/handler/business/handler.go index afc81080..c0568a46 100644 --- a/internal/business/handler/business/handler.go +++ b/internal/business/handler/business/handler.go @@ -186,7 +186,10 @@ func (h *handler) ready(c *gin.Context) { _, err := h.service.ListLocationTags(ctx) if err != nil { - c.JSON(http.StatusServiceUnavailable, gin.H{"error": "service not ready"}) + c.JSON(http.StatusServiceUnavailable, gin.H{ + "error": "service not ready", + "details": err.Error(), + }) return } diff --git a/migrations/20260617205326_grant_business_permissions.sql b/migrations/20260617205326_grant_business_permissions.sql new file mode 100644 index 00000000..68f3e36d --- /dev/null +++ b/migrations/20260617205326_grant_business_permissions.sql @@ -0,0 +1,18 @@ +-- +goose Up +GRANT USAGE ON SCHEMA business TO share; +GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA business TO share; + +GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA business TO share; + +ALTER DEFAULT PRIVILEGES IN SCHEMA business GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO share; + +ALTER DEFAULT PRIVILEGES IN SCHEMA business GRANT USAGE, SELECT ON SEQUENCES TO share; + + +-- +goose Down +ALTER DEFAULT PRIVILEGES IN SCHEMA business REVOKE SELECT, INSERT, UPDATE, DELETE ON TABLES FROM share; +ALTER DEFAULT PRIVILEGES IN SCHEMA business REVOKE USAGE, SELECT ON SEQUENCES FROM share; + +REVOKE SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA business FROM share; +REVOKE USAGE, SELECT ON ALL SEQUENCES IN SCHEMA business FROM share; +REVOKE USAGE ON SCHEMA business FROM share; \ No newline at end of file From f1278b8e06371873790c7d21786715c3257a7a0e Mon Sep 17 00:00:00 2001 From: Mykola Date: Thu, 18 Jun 2026 13:03:54 +0300 Subject: [PATCH 2/3] fix: fix rabbit comms --- deploy/k8s/infra/migrator-job.yaml | 2 ++ deploy/k8s/operators/kustomization.yaml | 2 +- internal/business/handler/business/handler.go | 1 - 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/deploy/k8s/infra/migrator-job.yaml b/deploy/k8s/infra/migrator-job.yaml index 719357ed..72d450be 100644 --- a/deploy/k8s/infra/migrator-job.yaml +++ b/deploy/k8s/infra/migrator-job.yaml @@ -19,6 +19,7 @@ spec: runAsGroup: 1000 runAsNonRoot: true allowPrivilegeEscalation: false + readOnlyRootFilesystem: true capabilities: drop: - ALL @@ -67,6 +68,7 @@ spec: runAsGroup: 1000 runAsNonRoot: true allowPrivilegeEscalation: false + readOnlyRootFilesystem: true capabilities: drop: - ALL diff --git a/deploy/k8s/operators/kustomization.yaml b/deploy/k8s/operators/kustomization.yaml index 2e51ec3f..d49dff60 100644 --- a/deploy/k8s/operators/kustomization.yaml +++ b/deploy/k8s/operators/kustomization.yaml @@ -1,6 +1,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.22/releases/cnpg-1.22.1.yaml + - https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.29/releases/cnpg-1.29.0.yaml - ./business - ./guest \ No newline at end of file diff --git a/internal/business/handler/business/handler.go b/internal/business/handler/business/handler.go index c0568a46..f12930d4 100644 --- a/internal/business/handler/business/handler.go +++ b/internal/business/handler/business/handler.go @@ -188,7 +188,6 @@ func (h *handler) ready(c *gin.Context) { if err != nil { c.JSON(http.StatusServiceUnavailable, gin.H{ "error": "service not ready", - "details": err.Error(), }) return } From 84aa327ba284f438194c4e84557cb8e66ee93708 Mon Sep 17 00:00:00 2001 From: Mykola Date: Fri, 19 Jun 2026 11:37:19 +0300 Subject: [PATCH 3/3] fix: business-operator build fixed --- build/Dockerfile.business-operator | 7 +++++++ deploy/k8s/operators/business/example.yaml | 4 ++-- deploy/k8s/operators/business/kustomization.yaml | 1 + deploy/k8s/operators/business/operator-deployment.yaml | 1 - 4 files changed, 10 insertions(+), 3 deletions(-) diff --git a/build/Dockerfile.business-operator b/build/Dockerfile.business-operator index c4af8aa8..0cf01ea1 100644 --- a/build/Dockerfile.business-operator +++ b/build/Dockerfile.business-operator @@ -11,6 +11,13 @@ RUN CGO_ENABLED=0 go build -o app ./cmd/business-operator FROM alpine:3.20 +RUN addgroup -g 1000 operatorgroup && \ + adduser -D -u 1000 -G operatorgroup operatoruser + +WORKDIR /app + COPY --from=builder /app/app . +USER 1000:1000 + CMD ["./app"] \ No newline at end of file diff --git a/deploy/k8s/operators/business/example.yaml b/deploy/k8s/operators/business/example.yaml index 807027da..26b8abed 100644 --- a/deploy/k8s/operators/business/example.yaml +++ b/deploy/k8s/operators/business/example.yaml @@ -2,8 +2,8 @@ apiVersion: business.sharebite.dev/v1alpha1 kind: BusinessAppProfile metadata: name: business-api-example - namespace: default + namespace: share-bite-local spec: - replicas: 2 + replicas: 3 enabled: true deploymentName: business-api \ No newline at end of file diff --git a/deploy/k8s/operators/business/kustomization.yaml b/deploy/k8s/operators/business/kustomization.yaml index 7b307f46..500670b4 100644 --- a/deploy/k8s/operators/business/kustomization.yaml +++ b/deploy/k8s/operators/business/kustomization.yaml @@ -1,5 +1,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization +namespace: share-bite-local resources: - crd.yaml - operator-deployment.yaml diff --git a/deploy/k8s/operators/business/operator-deployment.yaml b/deploy/k8s/operators/business/operator-deployment.yaml index 79e9283a..364dea44 100644 --- a/deploy/k8s/operators/business/operator-deployment.yaml +++ b/deploy/k8s/operators/business/operator-deployment.yaml @@ -2,7 +2,6 @@ apiVersion: apps/v1 kind: Deployment metadata: name: business-operator - namespace: default spec: replicas: 1 selector: