External database configuration (#225)

This patch makes all the database settings configurable.

fixes: https://github.com/spiffe/helm-charts/issues/37

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>

.github/tests/charts.json

@@ -13,5 +13,15 @@
     "name": "ingress-nginx",
     "repo": "https://kubernetes.github.io/ingress-nginx",
     "version": "4.6.1"
+  },
+  {
+    "name": "mysql",
+    "repo": "https://charts.bitnami.com/bitnami",
+    "version": "9.7.2"
+  },
+  {
+    "name": "postgresql",
+    "repo": "https://charts.bitnami.com/bitnami",
+    "version": "12.2.2"
   }
 ]

.github/tests/production-external-mysql/install.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+set -xe
+
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH=$(dirname "$SCRIPT")
+
+DB=spire
+DBUSER=spire
+DBPW=$(uuidgen)
+DBROOTPW=$(uuidgen)
+
+# Generate random settings to make sure things come up with random settings.
+cat <<EOF > /tmp/$$-db-values.yaml
+auth:
+  database: ${DB}
+  username: ${DBUSER}
+  password: ${DBPW}
+  rootPassword: ${DBROOTPW}
+EOF
+
+cat <<EOF > /tmp/$$-spire-values.yaml
+spire-server:
+  dataStore:
+    sql:
+      databaseType: mysql
+      databaseName: ${DB}
+      username: ${DBUSER}
+      password: ${DBPW}
+      host: mysql
+      port: 3306
+      options:
+      - parseTime: true
+EOF
+
+helm install mysql mysql --namespace "spire-server" --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \
+  --values "${SCRIPTPATH}/mysql-values.yaml" \
+  --values /tmp/$$-db-values.yaml --wait
+
+helm install \
+  --namespace "spire-server" \
+  --values /tmp/$$-spire-values.yaml \
+  --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
+  spire charts/spire --wait
+
+helm test spire --namespace "spire-server"

.github/tests/production-external-mysql/mysql-values.yaml

@@ -0,0 +1,7 @@
+primary:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: [ALL]
+    seccompProfile:
+      type: RuntimeDefault

.github/tests/production-external-mysql/post-install.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../common.sh"
+
+print_helm_releases
+print_spire_workload_status spire-server spire-system
+
+if [[ "$1" -ne 0 ]]; then
+  get_namespace_details spire-server
+  get_namespace_details spire-system
+fi

.github/tests/production-external-mysql/pre-install.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+kubectl create namespace spire-system
+kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
+kubectl create namespace spire-server
+kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted

.github/tests/production-external-postgresql/install.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+set -xe
+
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH=$(dirname "$SCRIPT")
+
+DB=$(uuidgen)
+DBUSER=$(uuidgen)
+DBPW=$(uuidgen)
+DBPGPW=$(uuidgen)
+
+# Generate random settings to make sure things come up with random settings.
+cat > /tmp/$$-db-values.yaml <<EOF
+auth:
+  database: ${DB}
+  username: ${DBUSER}
+  password: ${DBPW}
+  postgresPassword: ${DBPGPW}
+EOF
+
+cat > /tmp/$$-spire-values.yaml <<EOF
+spire-server:
+  dataStore:
+    sql:
+      databaseType: postgres
+      databaseName: ${DB}
+      username: ${DBUSER}
+      password: ${DBPW}
+      host: postgresql
+      port: 5432
+      options:
+      - sslmode: disable
+EOF
+
+helm install postgresql postgresql --namespace "spire-server" --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \
+  --values "${SCRIPTPATH}/postgresql-values.yaml" \
+  --values /tmp/$$-db-values.yaml --wait
+
+helm install \
+  --namespace "spire-server" \
+  --values /tmp/$$-spire-values.yaml \
+  --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
+  spire charts/spire --wait
+
+helm test spire --namespace "spire-server"

.github/tests/production-external-postgresql/post-install.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../common.sh"
+
+print_helm_releases
+print_spire_workload_status spire-server spire-system
+
+if [[ "$1" -ne 0 ]]; then
+  get_namespace_details spire-server
+  get_namespace_details spire-system
+fi

.github/tests/production-external-postgresql/postgresql-values.yaml

@@ -0,0 +1,8 @@
+primary:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    runAsNonRoot: true
+    capabilities:
+      drop: [ALL]
+    seccompProfile:
+      type: RuntimeDefault

.github/tests/production-external-postgresql/pre-install.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+kubectl create namespace spire-system
+kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
+kubectl create namespace spire-server
+kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted