update lakekeeper/0.11.0

- chart 0.8.1 → 0.11.0 (appVersion 0.10.4 → 0.12.2)
- deps: postgres 1.5.8 → 1.5.13, openfga 0.2.44 → 0.2.62
- ingress: Kong → APISIX (use-regex + path /.*, cluster-issuer)
- openfga.playground 비활성화 (preshared 인증 패닉 방지)
- breaking=false, custom-values 키 전부 호환

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
wbsong111
2026-06-15 09:13:31 +09:00
parent 1ab3d4d31c
commit f4d287abef
217 changed files with 23584 additions and 0 deletions
@@ -0,0 +1,62 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "postgres.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "postgres.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "postgres.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "postgres.labels" -}}
helm.sh/chart: {{ include "postgres.chart" . }}
{{ include "postgres.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "postgres.selectorLabels" -}}
app.kubernetes.io/name: {{ include "postgres.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/*
Create the name of the service account to use
*/}}
{{- define "postgres.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "postgres.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}
@@ -0,0 +1,11 @@
{{- if .Values.customConfig }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "postgres.fullname" . }}-customconfig
labels:
{{- include "postgres.labels" . | nindent 4 }}
data:
postgresql.conf: |
{{- .Values.customConfig | nindent 4 }}
{{- end }}
@@ -0,0 +1,13 @@
{{- if .Values.customScripts }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "postgres.fullname" . }}-customscripts
labels:
{{- include "postgres.labels" . | nindent 4 }}
data:
{{- range $name, $value := .Values.customScripts }}
{{- $name | nindent 2 }}: |
{{- $value | nindent 4 }}
{{- end }}
{{- end }}
@@ -0,0 +1,25 @@
{{- with .Values.networkPolicy }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ include "postgres.fullname" $ }}
spec:
podSelector:
matchLabels:
{{- include "postgres.selectorLabels" $ | nindent 6 }}
policyTypes:
{{- if .ingress }}
- Ingress
{{- end }}
{{- if .egress }}
- Egress
{{- end }}
{{- with .ingress }}
ingress:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .egress }}
egress:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}
@@ -0,0 +1,35 @@
{{- if .Values.useDeployment }}
{{- $createPvc := and (empty .Values.storage.persistentVolumeClaimName) (.Values.storage.requestedSize) }}
{{- if $createPvc }}
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ include "postgres.fullname" . }}
labels:
{{- include "postgres.labels" . | nindent 4 }}
{{- with .Values.storage.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- if or .Values.storage.keepPvc .Values.storage.annotations }}
annotations:
{{- if .Values.storage.keepPvc }}
"helm.sh/resource-policy": keep
{{- end }}
{{- with .Values.storage.annotations }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}
spec:
{{- with .Values.storage }}
accessModes:
{{- toYaml .accessModes | nindent 4 }}
volumeMode: Filesystem
resources:
requests:
storage: {{ .requestedSize }}
{{- if .className }}
storageClassName: {{ .className }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
@@ -0,0 +1,43 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "postgres.fullname" . }}-scripts
labels:
{{- include "postgres.labels" . | nindent 4 }}
data:
01-init-userdb.sh: |
#!/bin/sh
create_user()
{
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" -v USERDBNAME="$POSTGRES_DB" -v USERDBUSER="$USERDB_USER" -v USERDBPASSWORD="'$USERDB_PASSWORD'" <<-EOSQL
CREATE USER :USERDBUSER WITH PASSWORD :USERDBPASSWORD;
GRANT ALL PRIVILEGES ON DATABASE :USERDBNAME TO :USERDBUSER;
ALTER DATABASE :USERDBNAME OWNER TO :USERDBUSER;
EOSQL
}
set -e
if [ ! -z "$POSTGRES_DB" ] && [ ! -z "$USERDB_USER" ] && [ ! -z "$USERDB_PASSWORD" ]; then
create_user
fi
init.sh: |
#!/bin/sh
echo "Start initialization"
echo "Copy init-userdb script"
cp /initscripts/01-init-userdb.sh /scripts
if [ -d /extrascripts ]; then
echo "Copy extra scripts"
cp /extrascripts/* /scripts
fi
if [ -d /customscripts ]; then
echo "Copy custom scripts"
cp /customscripts/* /scripts
fi
if [ -d /customconfig ]; then
echo "Create postgres config"
cat /customconfig/* >>/configs/postgresql.conf
fi
if [ -d /extraconfigs ]; then
echo "Add extra configs to postgres config"
cat /extraconfigs/* >>/configs/postgresql.conf
fi
echo "Initialization done."
@@ -0,0 +1,31 @@
{{- $rootSet := and (not .Values.settings.existingSecret) ((.Values.settings.superuserPassword).value) }}
{{- $userDatabaseSet := and (.Values.userDatabase) (not .Values.userDatabase.existingSecret) }}
{{- if or ($rootSet) ($userDatabaseSet) }}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "postgres.fullname" . }}
labels:
{{- include "postgres.labels" . | nindent 4 }}
type: Opaque
data:
{{- with .Values.settings }}
{{- if (.superuser).value }}
POSTGRES_USER: {{ .superuser.value | b64enc }}
{{- end }}
{{- if (.superuserPassword).value }}
POSTGRES_PASSWORD: {{ .superuserPassword.value | b64enc }}
{{- end }}
{{- end }}
{{- with .Values.userDatabase }}
{{- if not .existingSecret }}
{{- $_ := required "Values: userDatabase.name is mandatory if userDatabase is specified without existing secret" .name }}
POSTGRES_DB: {{ required "Values: userDatabase.name.value is mandatory if userDatabase is specified without existingSecret." .name.value | b64enc }}
{{- if (.user).value}}
USERDB_USER: {{ .user.value | b64enc }}
{{- $_ := required "Values: userDatabase.password is mandatory if userDatabase is specified without existing secret" .password }}
USERDB_PASSWORD: {{ required "Values: userDatabase.password.value is mandatory if userDatabase.user is specified without existingSecret." .password.value | b64enc }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
@@ -0,0 +1,34 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "postgres.fullname" . }}
labels:
{{- include "postgres.labels" . | nindent 4 }}
{{- with .Values.service.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .Values.service.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
type: {{ .Values.service.type }}
ports:
- port: {{ .Values.service.port }}
targetPort: postgres
protocol: TCP
name: postgres
{{- if and ( or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort") ) (.Values.service.nodePort) }}
nodePort: {{ .Values.service.nodePort }}
{{- end }}
{{- if and (eq .Values.service.type "LoadBalancer") (.Values.service.loadBalancerIP) }}
loadBalancerIP: {{ .Values.service.loadBalancerIP }}
{{- end }}
{{- if and (eq .Values.service.type "LoadBalancer") (.Values.service.loadBalancerSourceRanges) }}
loadBalancerSourceRanges: {{- toYaml .Values.service.loadBalancerSourceRanges | nindent 4 }}
{{- end }}
{{- if .Values.service.clusterIP }}
clusterIP: {{ .Values.service.clusterIP }}
{{- end }}
selector:
{{- include "postgres.selectorLabels" . | nindent 4 }}
@@ -0,0 +1,12 @@
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "postgres.serviceAccountName" . }}
labels:
{{- include "postgres.labels" . | nindent 4 }}
{{- with .Values.serviceAccount.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}
@@ -0,0 +1,379 @@
{{- $usedeployment := .Values.useDeployment }}
{{- $fullname := include "postgres.fullname" . }}
apiVersion: apps/v1
{{- if $usedeployment }}
kind: Deployment
{{- else }}
kind: StatefulSet
{{- end }}
metadata:
name: {{ $fullname }}
labels:
{{- include "postgres.labels" . | nindent 4 }}
{{- with .Values.customLabels }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .Values.customAnnotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
replicas: 1
{{- if .Values.revisionHistoryLimit }}
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
{{- end }}
{{- if not $usedeployment }}
serviceName: {{ $fullname }}
podManagementPolicy: {{ .Values.podManagementPolicy }}
updateStrategy:
type: {{ .Values.updateStrategyType }}
{{- if or .Values.storage.persistentVolumeClaimRetentionPolicy.whenDeleted .Values.storage.persistentVolumeClaimRetentionPolicy.whenScaled }}
persistentVolumeClaimRetentionPolicy:
{{- with .Values.storage.persistentVolumeClaimRetentionPolicy.whenDeleted }}
whenDeleted: {{ . }}
{{- end }}
{{- with .Values.storage.persistentVolumeClaimRetentionPolicy.whenScaled }}
whenScaled: {{ . }}
{{- end }}
{{- end }}
{{- else }}
strategy:
type: Recreate
{{- end }}
selector:
matchLabels:
{{- include "postgres.selectorLabels" . | nindent 6 }}
template:
metadata:
annotations:
checksum/customconfig: {{ include (print $.Template.BasePath "/customconfig.yaml") . | sha256sum }}
checksum/secureconfig: {{ include (print $.Template.BasePath "/secureconfig.yaml") . | sha256sum }}
checksum/customscripts: {{ include (print $.Template.BasePath "/customscripts.yaml") . | sha256sum }}
checksum/scripts: {{ include (print $.Template.BasePath "/scripts.yaml") . | sha256sum }}
{{- with .Values.podAnnotations }}
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "postgres.selectorLabels" . | nindent 8 }}
{{- with .Values.podLabels }}
{{- toYaml . | nindent 8 }}
{{- end }}
spec:
{{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName }}
{{- end }}
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "postgres.serviceAccountName" . }}
{{- with .Values.podSecurityContext }}
securityContext:
{{- toYaml . | nindent 8 }}
{{- end }}
initContainers:
- name: {{ .Chart.Name }}-init
{{- with .Values.securityContext }}
securityContext:
{{- toYaml . | nindent 12 }}
{{- end }}
image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
volumeMounts:
{{- if .Values.extraScripts }}
- mountPath: /extrascripts
name: extrascripts-volume
{{- end }}
{{- if .Values.customScripts }}
- mountPath: /customscripts
name: customscripts-volume
{{- end }}
{{- if .Values.extraSecretConfigs }}
- mountPath: /extraconfigs
name: extraconfigs-volume
{{- end }}
{{- if .Values.customConfig }}
- mountPath: /customconfig
name: customconfig-volume
{{- end }}
- mountPath: /initscripts
name: initscripts
- mountPath: /scripts
name: scripts
- mountPath: /configs
name: configs
command: [ "/initscripts/init.sh" ]
{{- with .Values.initResources }}
resources:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.extraInitContainers }}
{{- toYaml . | nindent 8 }}
{{- end }}
containers:
- name: {{ .Chart.Name }}
{{- with .Values.securityContext }}
securityContext:
{{- toYaml . | nindent 12 }}
{{- end }}
image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
ports:
- name: postgres
containerPort: 5432
protocol: TCP
env:
{{- if or (and (.Values.settings.existingSecret) ((.Values.settings.superuser).secretKey)) ((.Values.settings.superuser).value) }}
- name: POSTGRES_USER
valueFrom:
secretKeyRef:
name: {{ default (include "postgres.fullname" .) .Values.settings.existingSecret }}
key: {{ default "POSTGRES_USER" (.Values.settings.superuser).secretKey }}
{{- end }}
{{- if or (.Values.settings.existingSecret) ((.Values.settings.superuserPassword).value) }}
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: {{ default (include "postgres.fullname" .) .Values.settings.existingSecret }}
key: {{ default "POSTGRES_PASSWORD" (.Values.settings.superuserPassword).secretKey }}
{{- end }}
{{- with .Values.userDatabase }}
- name: POSTGRES_DB
valueFrom:
secretKeyRef:
name: {{ default (include "postgres.fullname" $) .existingSecret }}
key: {{ default "POSTGRES_DB" .name.secretKey }}
- name: USERDB_USER
valueFrom:
secretKeyRef:
name: {{ default (include "postgres.fullname" $) .existingSecret }}
key: {{ default "USERDB_USER" .user.secretKey }}
- name: USERDB_PASSWORD
valueFrom:
secretKeyRef:
name: {{ default (include "postgres.fullname" $) .existingSecret }}
key: {{ default "USERDB_PASSWORD" .password.secretKey }}
{{- end }}
- name: PGDATA
value: {{ printf "%s/%s" .Values.settings.dataDir .Values.settings.pgDir | quote }}
{{- if .Values.settings.authMethod }}
- name: POSTGRES_HOST_AUTH_METHOD
value: {{ .Values.settings.authMethod | quote }}
{{- end }}
{{- if .Values.settings.initDbArgs }}
- name: POSTGRES_INITDB_ARGS
value: {{ .Values.settings.initDbArgs | quote }}
{{- end }}
{{- with .Values.env }}
{{- toYaml . | nindent 12 }}
{{- end }}
{{- range .Values.extraEnvSecrets }}
envFrom:
- secretRef:
name: {{ . }}
{{- end }}
{{- if .Values.customStartupProbe }}
startupProbe:
{{- toYaml .Values.customStartupProbe | nindent 12 }}
{{- else }}
{{- if .Values.startupProbe.enabled }}
startupProbe:
exec:
command:
- sh
- -c
- pg_isready -h localhost
{{- with .Values.startupProbe }}
initialDelaySeconds: {{ .initialDelaySeconds }}
timeoutSeconds: {{ .timeoutSeconds }}
failureThreshold: {{ .failureThreshold }}
successThreshold: {{ .successThreshold }}
periodSeconds: {{ .periodSeconds }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.customLivenessProbe }}
livenessProbe:
{{- toYaml .Values.customLivenessProbe | nindent 12 }}
{{- else }}
{{- if .Values.livenessProbe.enabled }}
livenessProbe:
exec:
command:
- sh
- -c
- pg_isready -h localhost
{{- with .Values.livenessProbe }}
initialDelaySeconds: {{ .initialDelaySeconds }}
timeoutSeconds: {{ .timeoutSeconds }}
failureThreshold: {{ .failureThreshold }}
successThreshold: {{ .successThreshold }}
periodSeconds: {{ .periodSeconds }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.customReadinessProbe }}
readinessProbe:
{{- toYaml .Values.customReadinessProbe | nindent 12 }}
{{- else }}
{{- if .Values.readinessProbe.enabled }}
readinessProbe:
exec:
command:
- sh
- -c
- pg_isready -h localhost
{{- with .Values.readinessProbe }}
initialDelaySeconds: {{ .initialDelaySeconds }}
timeoutSeconds: {{ .timeoutSeconds }}
failureThreshold: {{ .failureThreshold }}
successThreshold: {{ .successThreshold }}
periodSeconds: {{ .periodSeconds }}
{{- end }}
{{- end }}
{{- end }}
{{- with .Values.resources }}
resources:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- if .Values.args }}
args:
{{- range .Values.args }}
- {{ . }}
{{- end }}
{{- end }}
volumeMounts:
- mountPath: /var/run
name: run
- mountPath: /tmp
name: tmp
- mountPath: {{ .Values.settings.dataDir }}
name: {{ .Values.storage.volumeName }}
- mountPath: /docker-entrypoint-initdb.d
name: scripts
- mountPath: /etc/postgresql
name: configs
{{- range $secret := .Values.extraSecrets }}
- name: {{ $secret.name }}
mountPath: {{ $secret.mountPath }}
{{- end }}
{{- range $config := .Values.extraConfigs }}
- name: {{ $config.name }}
mountPath: {{ $config.mountPath }}
{{- end }}
{{- range $storage := .Values.extraStorage }}
- name: {{ $storage.name }}
mountPath: {{ $storage.mountPath }}
{{- end }}
{{- with .Values.extraContainers }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.affinity }}
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.topologySpreadConstraints }}
topologySpreadConstraints:
{{- toYaml . | nindent 8 }}
{{- end }}
volumes:
- name: run
emptyDir: {}
- name: tmp
emptyDir: {}
- name: scripts
emptyDir: {}
- name: configs
emptyDir: {}
- name: initscripts
configMap:
name: {{ $fullname }}-scripts
defaultMode: 0555
{{- if .Values.extraScripts }}
- name: extrascripts-volume
configMap:
name: {{ .Values.extraScripts }}
defaultMode: 0555
{{- end }}
{{- if .Values.customScripts }}
- name: customscripts-volume
configMap:
name: {{ $fullname }}-customscripts
defaultMode: 0555
{{- end }}
{{- if .Values.extraSecretConfigs }}
- name: extraconfigs-volume
secret:
secretName: {{ .Values.extraSecretConfigs }}
{{- end }}
{{- if .Values.customConfig }}
- name: customconfig-volume
configMap:
name: {{ $fullname }}-customconfig
{{- end }}
{{- range $secret := .Values.extraSecrets }}
- name: {{ $secret.name }}
secret:
secretName: {{ $secret.name }}
defaultMode: {{ $secret.defaultMode | default 0440 }}
{{- end }}
{{- range $config := .Values.extraConfigs }}
- name: {{ $config.name }}
configMap:
name: {{ $config.name }}
defaultMode: {{ $config.defaultMode | default 0440 }}
{{- end }}
{{- range $storage := .Values.extraStorage }}
- name: {{ $storage.name }}
persistentVolumeClaim:
claimName: {{ $storage.pvcName }}
{{- end }}
{{- with .Values.storage }}
{{- $createPvc := and (empty .persistentVolumeClaimName) .requestedSize }}
{{- if not $createPvc }}
- name: {{ .volumeName }}
{{- if .persistentVolumeClaimName }}
persistentVolumeClaim:
claimName: {{ .persistentVolumeClaimName }}
{{- else }}
emptyDir: {}
{{- end }}
{{- else }}
{{- if $usedeployment }}
- name: {{ .volumeName }}
persistentVolumeClaim:
claimName: {{ $fullname }}
{{- else }}
volumeClaimTemplates:
- metadata:
name: {{ .volumeName }}
{{- with .labels }}
labels:
{{- toYaml . | nindent 10 }}
{{- end }}
{{- with .annotations }}
annotations:
{{- toYaml . | nindent 10 }}
{{- end }}
spec:
{{- with .accessModes }}
accessModes:
{{- toYaml . | nindent 10 }}
{{- end }}
{{- if .className }}
storageClassName: {{ .className }}
{{- end }}
resources:
requests:
storage: {{ .requestedSize }}
{{- end }}
{{- end }}
{{- end }}