354 lines
14 KiB
C#
354 lines
14 KiB
C#
using System.Text;
|
|
using EntKube.Clusters.Domain;
|
|
using k8s;
|
|
using k8s.Models;
|
|
using Microsoft.Extensions.Logging;
|
|
|
|
namespace EntKube.Clusters.Features.AdoptCluster.Components.CloudNativePG;
|
|
|
|
/// <summary>
|
|
/// Installs CloudNativePG (CNPG) operator via Helm. The operator manages the full
|
|
/// lifecycle of PostgreSQL databases on Kubernetes — provisioning, HA failover,
|
|
/// automated backups, point-in-time recovery, and rolling updates.
|
|
///
|
|
/// What gets deployed:
|
|
/// 1. cnpg-system namespace with the CNPG operator controller
|
|
/// 2. All required CRDs (Cluster, Backup, ScheduledBackup, Pooler, etc.)
|
|
/// 3. Webhook configuration for validating/mutating PostgreSQL clusters
|
|
///
|
|
/// Configuration keys:
|
|
/// - "operatorReplicas": Number of operator controller replicas (default: 1)
|
|
/// - "monitoringEnabled": Whether to create ServiceMonitor for Prometheus scraping
|
|
///
|
|
/// Note: This installs the OPERATOR only. Actual PostgreSQL clusters are provisioned
|
|
/// separately via the Provisioning service (per-tenant databases).
|
|
/// </summary>
|
|
public class CloudNativePGInstaller : IComponentInstaller
|
|
{
|
|
private readonly ILogger<CloudNativePGInstaller> logger;
|
|
|
|
private const string DefaultVersion = "0.22.0";
|
|
private const string DefaultNamespace = "cnpg-system";
|
|
private const string HelmRepo = "https://cloudnative-pg.github.io/charts";
|
|
|
|
public string ComponentName => "cnpg";
|
|
|
|
public CloudNativePGInstaller(ILogger<CloudNativePGInstaller> logger)
|
|
{
|
|
this.logger = logger;
|
|
}
|
|
|
|
public async Task<InstallResult> InstallAsync(KubernetesCluster cluster, ComponentInstallOptions options, CancellationToken ct = default)
|
|
{
|
|
string version = options.Version ?? DefaultVersion;
|
|
string targetNamespace = options.Namespace ?? DefaultNamespace;
|
|
bool monitoringEnabled = options.Parameters?.TryGetValue("monitoringEnabled", out string? monVal) == true
|
|
&& monVal == "true";
|
|
List<string> actions = new();
|
|
|
|
string tempKubeConfig = Path.Combine(Path.GetTempPath(), $"entkube-cnpg-{Guid.NewGuid()}.kubeconfig");
|
|
|
|
try
|
|
{
|
|
await File.WriteAllTextAsync(tempKubeConfig, cluster.KubeConfig, ct);
|
|
|
|
// Ensure the namespace exists with management labels.
|
|
|
|
Kubernetes client = BuildClient(cluster);
|
|
await EnsureNamespaceWithLabels(client, targetNamespace, ct);
|
|
actions.Add($"Ensured namespace '{targetNamespace}' with management labels");
|
|
|
|
// Install CNPG operator via Helm. The chart includes all CRDs,
|
|
// the controller deployment, webhook configuration, and RBAC.
|
|
|
|
string monitoringFlag = monitoringEnabled
|
|
? "--set monitoring.podMonitorEnabled=true --set monitoring.grafanaDashboard.create=true"
|
|
: "--set monitoring.podMonitorEnabled=false";
|
|
|
|
await RunCommand("helm",
|
|
$"upgrade --install cnpg cloudnative-pg " +
|
|
$"--repo {HelmRepo} --version {version} " +
|
|
$"--namespace {targetNamespace} " +
|
|
$"--kubeconfig \"{tempKubeConfig}\" --kube-context \"{cluster.ContextName}\" " +
|
|
$"--set replicaCount=1 " +
|
|
$"--set resources.requests.cpu=100m " +
|
|
$"--set resources.requests.memory=256Mi " +
|
|
$"--set resources.limits.cpu=500m " +
|
|
$"--set resources.limits.memory=512Mi " +
|
|
$"{monitoringFlag} " +
|
|
$"--wait --timeout 10m",
|
|
ct);
|
|
actions.Add($"Helm install cnpg operator v{version}");
|
|
|
|
// If the user selected a storage bucket for WAL/backup, create a
|
|
// Kubernetes secret with the bucket credentials so CNPG clusters can
|
|
// reference it for Barman object store (S3-based WAL archiving).
|
|
|
|
if (options.Parameters?.TryGetValue("walBucketId", out string? walBucketIdVal) == true
|
|
&& !string.IsNullOrEmpty(walBucketIdVal) && Guid.TryParse(walBucketIdVal, out Guid walBucketId))
|
|
{
|
|
StorageBucket? walBucket = cluster.StorageBuckets.FirstOrDefault(b => b.Id == walBucketId);
|
|
|
|
if (walBucket is not null)
|
|
{
|
|
await EnsureBackupStorageSecret(client, targetNamespace, walBucket, ct);
|
|
actions.Add($"Created backup storage secret 'cnpg-backup-creds' with bucket '{walBucket.Name}'");
|
|
actions.Add($"CNPG clusters can use: endpointURL={walBucket.Endpoint}, bucket={walBucket.Name}, secret=cnpg-backup-creds");
|
|
logger.LogInformation("Created CNPG backup storage secret for bucket '{BucketName}'", walBucket.Name);
|
|
}
|
|
}
|
|
|
|
logger.LogInformation("CloudNativePG Operator {Version} installed on cluster {Cluster}",
|
|
version, cluster.Name);
|
|
|
|
return new InstallResult(
|
|
Success: true,
|
|
ComponentName: ComponentName,
|
|
Message: $"CloudNativePG Operator {version} installed",
|
|
Actions: actions);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
logger.LogError(ex, "Failed to install CNPG on cluster {Cluster}", cluster.Name);
|
|
actions.Add($"Error: {ex.Message}");
|
|
|
|
return new InstallResult(
|
|
Success: false,
|
|
ComponentName: ComponentName,
|
|
Message: $"Failed to install CloudNativePG: {ex.Message}",
|
|
Actions: actions);
|
|
}
|
|
finally
|
|
{
|
|
if (File.Exists(tempKubeConfig))
|
|
{
|
|
File.Delete(tempKubeConfig);
|
|
}
|
|
}
|
|
}
|
|
|
|
/// <summary>
|
|
/// Reconfigures CNPG operator. Supports:
|
|
/// - "operatorReplicas": number of operator replicas
|
|
/// - "monitoringEnabled": enable/disable Prometheus monitoring
|
|
/// </summary>
|
|
public async Task<InstallResult> ConfigureAsync(KubernetesCluster cluster, ComponentConfiguration configuration, CancellationToken ct = default)
|
|
{
|
|
string targetNamespace = configuration.Namespace ?? DefaultNamespace;
|
|
List<string> actions = new();
|
|
|
|
string tempKubeConfig = Path.Combine(Path.GetTempPath(), $"entkube-cnpg-cfg-{Guid.NewGuid()}.kubeconfig");
|
|
|
|
try
|
|
{
|
|
await File.WriteAllTextAsync(tempKubeConfig, cluster.KubeConfig, ct);
|
|
|
|
List<string> setFlags = new();
|
|
|
|
if (configuration.Values.TryGetValue("operatorReplicas", out string? replicas))
|
|
{
|
|
setFlags.Add($"--set replicaCount={replicas}");
|
|
}
|
|
|
|
if (configuration.Values.TryGetValue("monitoringEnabled", out string? monitoring))
|
|
{
|
|
setFlags.Add($"--set monitoring.podMonitorEnabled={monitoring}");
|
|
setFlags.Add($"--set monitoring.grafanaDashboard.create={monitoring}");
|
|
}
|
|
|
|
await RunCommand("helm",
|
|
$"upgrade cnpg cloudnative-pg --repo {HelmRepo} " +
|
|
$"--namespace {targetNamespace} " +
|
|
$"--kubeconfig \"{tempKubeConfig}\" --kube-context \"{cluster.ContextName}\" " +
|
|
$"--reuse-values {string.Join(" ", setFlags)} --wait --timeout 5m",
|
|
ct);
|
|
|
|
actions.Add($"Reconfigured CNPG: {string.Join(", ", configuration.Values.Select(kv => $"{kv.Key}={kv.Value}"))}");
|
|
|
|
return new InstallResult(
|
|
Success: true,
|
|
ComponentName: ComponentName,
|
|
Message: "CloudNativePG operator reconfigured",
|
|
Actions: actions);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
logger.LogError(ex, "Failed to reconfigure CNPG on cluster {Cluster}", cluster.Name);
|
|
return new InstallResult(
|
|
Success: false,
|
|
ComponentName: ComponentName,
|
|
Message: $"Failed to reconfigure CloudNativePG: {ex.Message}",
|
|
Actions: new List<string> { $"Error: {ex.Message}" });
|
|
}
|
|
finally
|
|
{
|
|
if (File.Exists(tempKubeConfig))
|
|
{
|
|
File.Delete(tempKubeConfig);
|
|
}
|
|
}
|
|
}
|
|
|
|
/// <summary>
|
|
/// Uninstalls CloudNativePG operator from the cluster. Warning: existing
|
|
/// PostgreSQL Cluster resources will become unmanaged.
|
|
/// </summary>
|
|
public async Task<InstallResult> UninstallAsync(KubernetesCluster cluster, ComponentInstallOptions options, CancellationToken ct = default)
|
|
{
|
|
string targetNamespace = options.Namespace ?? DefaultNamespace;
|
|
List<string> actions = new();
|
|
|
|
string tempKubeConfig = Path.Combine(Path.GetTempPath(), $"entkube-cnpg-rm-{Guid.NewGuid()}.kubeconfig");
|
|
|
|
try
|
|
{
|
|
await File.WriteAllTextAsync(tempKubeConfig, cluster.KubeConfig, ct);
|
|
|
|
await RunCommand("helm",
|
|
$"uninstall cnpg --namespace {targetNamespace} " +
|
|
$"--kubeconfig \"{tempKubeConfig}\" --kube-context \"{cluster.ContextName}\" " +
|
|
$"--wait --timeout 5m",
|
|
ct);
|
|
actions.Add("Helm uninstall cnpg");
|
|
|
|
logger.LogInformation("CloudNativePG uninstalled from cluster {Cluster}", cluster.Name);
|
|
|
|
return new InstallResult(
|
|
Success: true,
|
|
ComponentName: ComponentName,
|
|
Message: "CloudNativePG operator uninstalled successfully",
|
|
Actions: actions);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
logger.LogError(ex, "Failed to uninstall CloudNativePG from cluster {Cluster}", cluster.Name);
|
|
return new InstallResult(
|
|
Success: false,
|
|
ComponentName: ComponentName,
|
|
Message: $"Failed to uninstall CloudNativePG: {ex.Message}",
|
|
Actions: new List<string> { $"Error: {ex.Message}" });
|
|
}
|
|
finally
|
|
{
|
|
if (File.Exists(tempKubeConfig))
|
|
{
|
|
File.Delete(tempKubeConfig);
|
|
}
|
|
}
|
|
}
|
|
|
|
private async Task EnsureNamespaceWithLabels(Kubernetes client, string namespaceName, CancellationToken ct)
|
|
{
|
|
try
|
|
{
|
|
await client.CoreV1.ReadNamespaceAsync(namespaceName, cancellationToken: ct);
|
|
}
|
|
catch (k8s.Autorest.HttpOperationException ex) when (ex.Response.StatusCode == System.Net.HttpStatusCode.NotFound)
|
|
{
|
|
V1Namespace ns = new()
|
|
{
|
|
Metadata = new V1ObjectMeta
|
|
{
|
|
Name = namespaceName,
|
|
Labels = new Dictionary<string, string>
|
|
{
|
|
["app.kubernetes.io/managed-by"] = "entkube",
|
|
["app.kubernetes.io/part-of"] = "cnpg-platform"
|
|
}
|
|
}
|
|
};
|
|
await client.CoreV1.CreateNamespaceAsync(ns, cancellationToken: ct);
|
|
}
|
|
}
|
|
|
|
private async Task<string> RunCommand(string fileName, string arguments, CancellationToken ct)
|
|
{
|
|
System.Diagnostics.ProcessStartInfo psi = new(fileName, arguments)
|
|
{
|
|
RedirectStandardOutput = true,
|
|
RedirectStandardError = true,
|
|
UseShellExecute = false
|
|
};
|
|
|
|
using System.Diagnostics.Process? process = System.Diagnostics.Process.Start(psi);
|
|
|
|
if (process is null)
|
|
{
|
|
throw new InvalidOperationException($"Failed to start {fileName}");
|
|
}
|
|
|
|
string output = await process.StandardOutput.ReadToEndAsync(ct);
|
|
string error = await process.StandardError.ReadToEndAsync(ct);
|
|
await process.WaitForExitAsync(ct);
|
|
|
|
if (process.ExitCode != 0)
|
|
{
|
|
throw new InvalidOperationException($"{fileName} failed (exit {process.ExitCode}): {error}");
|
|
}
|
|
|
|
return output;
|
|
}
|
|
|
|
private static Kubernetes BuildClient(KubernetesCluster cluster)
|
|
{
|
|
byte[] kubeConfigBytes = Encoding.UTF8.GetBytes(cluster.KubeConfig);
|
|
using MemoryStream stream = new(kubeConfigBytes);
|
|
KubernetesClientConfiguration config = KubernetesClientConfiguration.BuildConfigFromConfigFile(stream, cluster.ContextName);
|
|
return new Kubernetes(config);
|
|
}
|
|
|
|
/// <summary>
|
|
/// Creates or updates a Kubernetes Secret with S3 bucket credentials that
|
|
/// CNPG clusters can reference for Barman object store (WAL archiving and
|
|
/// base backups). The secret keys match what CNPG expects:
|
|
/// - ACCESS_KEY_ID: S3 access key
|
|
/// - ACCESS_SECRET_KEY: S3 secret key
|
|
/// - BUCKET_NAME: target bucket name
|
|
/// - ENDPOINT_URL: S3 endpoint URL
|
|
/// </summary>
|
|
private async Task EnsureBackupStorageSecret(
|
|
Kubernetes client, string namespaceName, StorageBucket bucket, CancellationToken ct)
|
|
{
|
|
Dictionary<string, byte[]> secretData = new()
|
|
{
|
|
["ACCESS_KEY_ID"] = Encoding.UTF8.GetBytes(bucket.AccessKey),
|
|
["ACCESS_SECRET_KEY"] = Encoding.UTF8.GetBytes(bucket.SecretKey),
|
|
["BUCKET_NAME"] = Encoding.UTF8.GetBytes(bucket.Name),
|
|
["ENDPOINT_URL"] = Encoding.UTF8.GetBytes(bucket.Endpoint)
|
|
};
|
|
|
|
// Include the S3 region when available. External S3 providers like
|
|
// Cleura require a region for AWS Signature V4 authentication in
|
|
// barman-cloud. Without it, WAL archiving fails silently.
|
|
|
|
if (!string.IsNullOrWhiteSpace(bucket.Region))
|
|
{
|
|
secretData["AWS_DEFAULT_REGION"] = Encoding.UTF8.GetBytes(bucket.Region);
|
|
}
|
|
|
|
V1Secret secret = new()
|
|
{
|
|
Metadata = new V1ObjectMeta
|
|
{
|
|
Name = "cnpg-backup-creds",
|
|
NamespaceProperty = namespaceName,
|
|
Labels = new Dictionary<string, string>
|
|
{
|
|
["app.kubernetes.io/managed-by"] = "entkube",
|
|
["app.kubernetes.io/component"] = "cnpg-backup"
|
|
}
|
|
},
|
|
Data = secretData
|
|
};
|
|
|
|
try
|
|
{
|
|
await client.CoreV1.ReplaceNamespacedSecretAsync(secret, "cnpg-backup-creds", namespaceName, cancellationToken: ct);
|
|
}
|
|
catch (k8s.Autorest.HttpOperationException ex) when (ex.Response.StatusCode == System.Net.HttpStatusCode.NotFound)
|
|
{
|
|
await client.CoreV1.CreateNamespacedSecretAsync(secret, namespaceName, cancellationToken: ct);
|
|
}
|
|
}
|
|
}
|