roles: harbor, postgresql update

.github/workflows/setup-k3s-with-existed-vhost.yml

@@ -7,6 +7,10 @@ on:
 env:
   DNS_AK: ${{ secrets.DNS_AK }}
   DNS_SK: ${{ secrets.DNS_SK }}
+  AWS_AK: ${{ secrets.AWS_ACCESS_KEY }}
+  AWS_SK: ${{ secrets.AWS_SECRET_KEY }}
+  ALI_AK: ${{ secrets.ALI_AK }}
+  ALI_SK: ${{ secrets.ALI_SK }}
   SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
   SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
   OIDC_ADMIN_PASSWORD: ${{ secrets.OIDC_ADMIN_PASSWORD }}
@@ -45,6 +49,8 @@ jobs:
           ansible_ssh_user=root
           ansible_ssh_private_key_file=~/.ssh/id_rsa
           ansible_host_key_checking=False
+          ali_ak=$ALI_AK
+          ali_sk=$ALI_SK
           dns_ak=$DNS_AK
           dns_sk=$DNS_SK
           ingress_ip=8.130.11.192

playbook/roles/harbor/files/setup-with-ali-oss.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+
+ak=$1
+sk=$2
+domain=$3
+namespace=$4
+secret_name=$5
+redis_passwd=$6
+pg_db_password=$7
+
+cat > harbor-config.yaml << EOF
+expose:
+  type: ingress
+  tls:
+    enabled: true
+    certSource: secret
+    secret:
+      secretName: $secret_name
+      notarySecretName: $secret_name
+  ingress:
+    hosts:
+      core: artifact.${domain}
+      notary: notary.${domain}
+    className: "nginx"
+database:
+  type: external
+  external:
+    host: "postgresql.database.svc.cluster.local"
+    port: "5432"
+    username: "user"
+    password: "$pg_db_password"
+    coreDatabase: "registry"
+    notaryServerDatabase: "notary_server"
+    notarySignerDatabase: "notary_signer"
+redis:
+  type: external
+  external:
+    addr: "redis-master.redis.svc.cluster.local:6379"
+    password: "$redis_password"
+persistence:
+  imageChartStorage:
+    type: oss
+    oss:
+      accesskeyid: $ak
+      accesskeysecret: $sk
+      region: "oss-cn-wulanchabu"
+      bucket: "artifact-s3"
+      endpoint: "oss-cn-wulanchabu.aliyuncs.com"
+externalURL: https://artifact.${domain}
+EOF
+
+export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+helm repo add harbor https://helm.goharbor.io
+helm repo update
+helm upgrade --install artifact harbor/harbor -f harbor-config.yaml -n $namespace

playbook/roles/harbor/files/setup-with-aws-s3.sh

@@ -1,8 +1,10 @@
 #!/bin/bash
 
-domain=$1
-ak=$2
-sk=$3
+ak=$1
+sk=$2
+domain=$3
+namespace=$4
+secret_name=$5
 
 cat > harbor-config.yaml << EOF
 expose:
@@ -11,8 +13,8 @@ expose:
     enabled: true
     certSource: secret
     secret:
-      secretName: "harbor-tls"
-      notarySecretName: "harbor-tls"
+      secretName: $secret_name
+      notarySecretName: $secret_name
   ingress:
     hosts:
       core: artifact.${domain}
@@ -30,9 +32,6 @@ externalURL: https://artifact.${domain}
 EOF
 
 export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
-kubectl create namespace artifact
-kubectl delete secret harbor-tls -n artifact
-kubectl create secret tls harbor-tls --cert=/etc/ssl/${domain}.pem --key=/etc/ssl/${domain}.key -n artifact
 helm repo add harbor https://helm.goharbor.io
 helm repo update
-helm upgrade --install artifact harbor/harbor -f harbor-config.yaml -n artifact
+helm upgrade --install artifact harbor/harbor -f harbor-config.yaml -n $namespace

playbook/roles/harbor/meta/main.yml

@@ -1,4 +1,5 @@
 dependencies:
+  - role: redis
   - role: postgresql
   - role: cert-manager
   - role: secret-manger

playbook/roles/harbor/tasks/main.yml

@@ -1,16 +1,32 @@
-playbook/roles/harbor/tasks/main.yml- name: get db password
-  shell: 'kubectl get secret --namespace database postgresql -o jsonpath="{.data.postgres-password}" | base64 -d'
-  register: command_raw
+- name: get redis password
+  shell: 'kubectl get secret --namespace redis redis -o jsonpath="{.data.redis-password}" | base64 -d'
+  register: redis_command_raw
   when: inventory_hostname in groups[group][0]
 
 - name: set fact join command
   set_fact:
-    keycloak_db_password : "{{ command_raw.stdout }}"
+    redis_password : "{{ redis_command_raw.stdout }}"
+
+- name: get db password
+  shell: 'kubectl get secret --namespace database postgresql -o jsonpath="{.data.postgres-password}" | base64 -d'
+  register: db_command_raw
+  when: inventory_hostname in groups[group][0]
+
+- name: set fact join command
+  set_fact:
+    pg_db_password : "{{ db_command_raw.stdout }}"
   when: inventory_hostname in groups[group][0]
 
 #- name: Show Debug Info
 #  debug: var=command_raw verbosity=0
 
 - name: Setup harbor Server
-  script: files/setup.sh {{ hostvars[groups[group][0]].keycloak_db_password }} {{ admin_password }} {{ domain }} {{ secret }} {{ namespace }}
+  script: files/setup-with-aws-s3.sh \
+                         {{ ali_ak }} \
+                         {{ ali_sk }} \
+                         {{ domain }} \
+                         {{ namespace }} \
+                         {{ tls.secret_name }} \
+                         {{ hostvars[groups[group][0]].redis_password }} \
+                         {{ hostvars[groups[group][0]].pd_db_password }} 
   when: inventory_hostname in groups[group]

playbook/roles/postgresql/files/post-setup.sh

@@ -3,3 +3,9 @@ export namespace=$1
 export POSTGRES_PASSWORD=$(kubectl get secret --namespace $namespace postgresql -o jsonpath="{.data.postgres-password}" | base64 -d)
 
 kubectl run postgresql-client --rm --tty -i --restart='Never' --namespace $namespace --image docker.io/bitnami/postgresql:15.2.0-debian-11-r11 --env="PGPASSWORD=$POSTGRES_PASSWORD" --command -- psql --host postgresql -U postgres -d postgres -p 5432 -w -c "CREATE DATABASE keycloak;" || echo true
+
+kubectl run postgresql-client --rm --tty -i --restart='Never' --namespace $namespace --image docker.io/bitnami/postgresql:15.2.0-debian-11-r11 --env="PGPASSWORD=$POSTGRES_PASSWORD" --command -- psql --host postgresql -U postgres -d postgres -p 5432 -w -c "CREATE DATABASE registry;" || echo true
+
+kubectl run postgresql-client --rm --tty -i --restart='Never' --namespace $namespace --image docker.io/bitnami/postgresql:15.2.0-debian-11-r11 --env="PGPASSWORD=$POSTGRES_PASSWORD" --command -- psql --host postgresql -U postgres -d postgres -p 5432 -w -c "CREATE DATABASE notary_server;" || echo true
+
+kubectl run postgresql-client --rm --tty -i --restart='Never' --namespace $namespace --image docker.io/bitnami/postgresql:15.2.0-debian-11-r11 --env="PGPASSWORD=$POSTGRES_PASSWORD" --command -- psql --host postgresql -U postgres -d postgres -p 5432 -w -c "CREATE DATABASE notary_signer;" || echo true