SpecterOps-Nemesis/helm/nemesis/templates/postgres.yaml

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: postgrespw-role
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: postgrespw-role-binding
subjects:
- kind: ServiceAccount
  name: postgrespw-service-account
roleRef:
  kind: Role
  name: postgrespw-role
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: postgrespw-service-account
---
# Since the postgres PVC is "retain", if we update password and redeploy, the old password will still be in the database.
apiVersion: batch/v1
kind: Job
metadata:
  name: update-postgres-password
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-weight": "5"
    "helm.sh/hook-delete-policy": hook-succeeded
spec:
  template:
    spec:
      restartPolicy: Never
      serviceAccountName: postgrespw-service-account
      containers:
      - name: kubectl-exec
        image: bitnami/kubectl:latest
        env:
          - name: POSTGRES_USER
            valueFrom:
              secretKeyRef:
                  name: {{ .Values.postgres.existingSecret }}
                  key: postgres-user
          - name: POSTGRES_PASSWORD
            valueFrom:
              secretKeyRef:
                  name: {{ .Values.postgres.existingSecret }}
                  key: postgres-password
        command: ["/bin/bash", "-c"]
        args:
          - >
            kubectl exec $(kubectl get pod --selector=app=postgres -o jsonpath={.items[0].metadata.name}) -- psql -U $POSTGRES_USER -c "ALTER USER $POSTGRES_USER PASSWORD '$POSTGRES_PASSWORD';" nemesis
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: postgres-nemesis-schema
  labels:
    app: postgres-nemesis-schema
data:
  nemesis.sql: |
    {{ .Files.Get "files/postgres/nemesis.sql" | nindent 4 }}
---
{{ if eq .Values.operation.environment "production" }}
kind: PersistentVolume
apiVersion: v1
metadata:
  name: postgres-pv-volume
  labels:
    type: local
    app: postgres
spec:
  storageClassName: manual
  capacity:
    storage: {{ .Values.postgres.storage }}
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  hostPath:
    path: "/mnt/data/postgres/"
    # path: "/postgres-data/"
{{ end }}
---
{{- if eq .Values.operation.environment "production" }}
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: postgres-pv-claim
  labels:
    app: postgres
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: {{ .Values.postgres.storage }}
  volumeName: postgres-pv-volume
{{- end }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
        - name: postgres
          image: "{{ .Values.postgres.image.repository }}:{{ .Values.postgres.image.tag }}"
          imagePullPolicy: {{ .Values.postgres.image.pullPolicy }}
          ports:
            - containerPort: 5432
          env:
            - name: POSTGRES_DB
              value: nemesis
            - name: POSTGRES_USER
              valueFrom:
                secretKeyRef:
                    name: {{ .Values.postgres.existingSecret }}
                    key: postgres-user
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                    name: {{ .Values.postgres.existingSecret }}
                    key: postgres-password
          volumeMounts:
            - mountPath: /var/lib/postgresql/data
              name: postgredb
            - name: postgres-nemesis-schema
              mountPath: /docker-entrypoint-initdb.d/nemesis.sql
              subPath: nemesis.sql
              readOnly: true
      volumes:
        - name: postgres-nemesis-schema
          configMap:
            name: postgres-nemesis-schema

        {{- if eq .Values.operation.environment "production"}}
        # Have data persist across runs (for prod)
        - name: postgredb
          persistentVolumeClaim:
            claimName: postgres-pv-claim
        {{- else }}
        # Use to have the DB wiped on each reboot (for dev)
        - name: postgredb
          emptyDir: {}
        {{- end }}
---
apiVersion: v1
kind: Service
metadata:
  name: postgres
  labels:
    app: postgres
spec:
  type: {{ .Values.postgres.service.type }}
  selector:
    app: postgres
  ports:
    - port: {{ .Values.postgres.service.port }}
      targetPort: 5432
      {{- if .Values.postgres.service.nodePort }}
      nodePort: {{ .Values.postgres.service.nodePort }}
      {{- end }}