Skip to content

Commit 0c84d03

Browse files
easyCZroboquat
easyCZ
authored and
roboquat
committed
[openfga] Configure cloud-sql-proxy sidecar
1 parent d5e03f2 commit 0c84d03

File tree

3 files changed

+132
-65
lines changed

3 files changed

+132
-65
lines changed

‎install/installer/pkg/components/openfga/constants.go

+2
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,6 @@ const (
2121
ImageTag = "v0.3.1"
2222

2323
ContainerName = "openfga"
24+
25+
CloudSQLProxyPort = 3306
2426
)

‎install/installer/pkg/components/openfga/deployment.go

+121-65
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,11 @@
55
package openfga
66

77
import (
8+
"fmt"
9+
810
"github.com/gitpod-io/gitpod/installer/pkg/cluster"
911
"github.com/gitpod-io/gitpod/installer/pkg/common"
12+
"github.com/gitpod-io/gitpod/installer/pkg/components/database/cloudsql"
1013

1114
appsv1 "k8s.io/api/apps/v1"
1215
corev1 "k8s.io/api/core/v1"
@@ -20,6 +23,122 @@ import (
2023
func deployment(ctx *common.RenderContext) ([]runtime.Object, error) {
2124
labels := common.CustomizeLabel(ctx, Component, common.TypeMetaDeployment)
2225

26+
cfg := getExperimentalOpenFGAConfig(ctx)
27+
if cfg == nil || !cfg.Enabled {
28+
return nil, nil
29+
}
30+
31+
containers := []corev1.Container{
32+
{
33+
Name: ContainerName,
34+
Image: ctx.ImageName(common.ThirdPartyContainerRepo(ctx.Config.Repository, RegistryRepo), RegistryImage, ImageTag),
35+
ImagePullPolicy: corev1.PullIfNotPresent,
36+
Args: []string{
37+
"run",
38+
"--log-format=json",
39+
"--log-level=warn",
40+
},
41+
Env: common.CustomizeEnvvar(ctx, Component, common.MergeEnv(
42+
common.DefaultEnv(&ctx.Config),
43+
)),
44+
Ports: []corev1.ContainerPort{
45+
{
46+
ContainerPort: ContainerGRPCPort,
47+
Name: ContainerGRPCName,
48+
Protocol: *common.TCPProtocol,
49+
},
50+
{
51+
ContainerPort: ContainerHTTPPort,
52+
Name: ContainerHTTPName,
53+
Protocol: *common.TCPProtocol,
54+
},
55+
{
56+
ContainerPort: ContainerPlaygroundPort,
57+
Name: ContainerPlaygroundName,
58+
Protocol: *common.TCPProtocol,
59+
},
60+
},
61+
Resources: common.ResourceRequirements(ctx, Component, ContainerName, corev1.ResourceRequirements{
62+
Requests: corev1.ResourceList{
63+
"cpu": resource.MustParse("1m"),
64+
"memory": resource.MustParse("30Mi"),
65+
},
66+
}),
67+
SecurityContext: &corev1.SecurityContext{
68+
RunAsGroup: pointer.Int64(65532),
69+
RunAsNonRoot: pointer.Bool(true),
70+
RunAsUser: pointer.Int64(65532),
71+
},
72+
LivenessProbe: &corev1.Probe{
73+
ProbeHandler: corev1.ProbeHandler{
74+
HTTPGet: &corev1.HTTPGetAction{
75+
Path: "/healthz",
76+
Port: intstr.IntOrString{IntVal: ContainerHTTPPort},
77+
Scheme: corev1.URISchemeHTTP,
78+
},
79+
},
80+
FailureThreshold: 3,
81+
SuccessThreshold: 1,
82+
TimeoutSeconds: 1,
83+
},
84+
ReadinessProbe: &corev1.Probe{
85+
ProbeHandler: corev1.ProbeHandler{
86+
HTTPGet: &corev1.HTTPGetAction{
87+
Path: "/healthz",
88+
Port: intstr.IntOrString{IntVal: ContainerHTTPPort},
89+
Scheme: corev1.URISchemeHTTP,
90+
},
91+
},
92+
FailureThreshold: 3,
93+
SuccessThreshold: 1,
94+
TimeoutSeconds: 1,
95+
},
96+
},
97+
}
98+
99+
var volumes []corev1.Volume
100+
101+
if cfg.CloudSQL != nil {
102+
containers = append(containers, corev1.Container{
103+
Name: "cloud-sql-proxy",
104+
SecurityContext: &corev1.SecurityContext{
105+
Privileged: pointer.Bool(false),
106+
RunAsNonRoot: pointer.Bool(false),
107+
AllowPrivilegeEscalation: pointer.Bool(false),
108+
},
109+
Image: ctx.ImageName(cloudsql.ImageRepo, cloudsql.ImageName, cloudsql.ImageVersion),
110+
Command: []string{
111+
"/cloud_sql_proxy",
112+
"-dir=/cloudsql",
113+
fmt.Sprintf("-instances=%s=tcp:0.0.0.0:%d", cfg.CloudSQL.Instance, CloudSQLProxyPort),
114+
"-credential_file=/credentials/credentials.json",
115+
},
116+
Ports: []corev1.ContainerPort{{
117+
ContainerPort: CloudSQLProxyPort,
118+
}},
119+
VolumeMounts: []corev1.VolumeMount{{
120+
MountPath: "/cloudsql",
121+
Name: "cloudsql",
122+
}, {
123+
MountPath: "/credentials",
124+
Name: "gcloud-sql-token",
125+
}},
126+
Env: common.CustomizeEnvvar(ctx, Component, []corev1.EnvVar{}),
127+
})
128+
129+
volumes = append(volumes, []corev1.Volume{
130+
{
131+
Name: "cloudsql",
132+
VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{}},
133+
}, {
134+
Name: "gcloud-sql-token",
135+
VolumeSource: corev1.VolumeSource{Secret: &corev1.SecretVolumeSource{
136+
SecretName: cfg.CloudSQL.ProxySecretRef,
137+
}},
138+
},
139+
}...)
140+
}
141+
23142
return []runtime.Object{
24143
&appsv1.Deployment{
25144
TypeMeta: common.TypeMetaDeployment,
@@ -51,71 +170,8 @@ func deployment(ctx *common.RenderContext) ([]runtime.Object, error) {
51170
SecurityContext: &corev1.PodSecurityContext{
52171
RunAsNonRoot: pointer.Bool(false),
53172
},
54-
Containers: []corev1.Container{{
55-
Name: ContainerName,
56-
Image: ctx.ImageName(common.ThirdPartyContainerRepo(ctx.Config.Repository, RegistryRepo), RegistryImage, ImageTag),
57-
ImagePullPolicy: corev1.PullIfNotPresent,
58-
Args: []string{
59-
"run",
60-
"--log-format=json",
61-
"--log-level=warn",
62-
},
63-
Env: common.CustomizeEnvvar(ctx, Component, common.MergeEnv(
64-
common.DefaultEnv(&ctx.Config),
65-
)),
66-
Ports: []corev1.ContainerPort{
67-
{
68-
ContainerPort: ContainerGRPCPort,
69-
Name: ContainerGRPCName,
70-
Protocol: *common.TCPProtocol,
71-
},
72-
{
73-
ContainerPort: ContainerHTTPPort,
74-
Name: ContainerHTTPName,
75-
Protocol: *common.TCPProtocol,
76-
},
77-
{
78-
ContainerPort: ContainerPlaygroundPort,
79-
Name: ContainerPlaygroundName,
80-
Protocol: *common.TCPProtocol,
81-
},
82-
},
83-
Resources: common.ResourceRequirements(ctx, Component, ContainerName, corev1.ResourceRequirements{
84-
Requests: corev1.ResourceList{
85-
"cpu": resource.MustParse("1m"),
86-
"memory": resource.MustParse("30Mi"),
87-
},
88-
}),
89-
SecurityContext: &corev1.SecurityContext{
90-
RunAsGroup: pointer.Int64(65532),
91-
RunAsNonRoot: pointer.Bool(true),
92-
RunAsUser: pointer.Int64(65532),
93-
},
94-
LivenessProbe: &corev1.Probe{
95-
ProbeHandler: corev1.ProbeHandler{
96-
HTTPGet: &corev1.HTTPGetAction{
97-
Path: "/healthz",
98-
Port: intstr.IntOrString{IntVal: ContainerHTTPPort},
99-
Scheme: corev1.URISchemeHTTP,
100-
},
101-
},
102-
FailureThreshold: 3,
103-
SuccessThreshold: 1,
104-
TimeoutSeconds: 1,
105-
},
106-
ReadinessProbe: &corev1.Probe{
107-
ProbeHandler: corev1.ProbeHandler{
108-
HTTPGet: &corev1.HTTPGetAction{
109-
Path: "/healthz",
110-
Port: intstr.IntOrString{IntVal: ContainerHTTPPort},
111-
Scheme: corev1.URISchemeHTTP,
112-
},
113-
},
114-
FailureThreshold: 3,
115-
SuccessThreshold: 1,
116-
TimeoutSeconds: 1,
117-
},
118-
}},
173+
Containers: containers,
174+
Volumes: volumes,
119175
},
120176
},
121177
},

‎install/installer/pkg/config/v1/experimental/experimental.go

+9
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,15 @@ type IAMConfig struct {
190190

191191
type OpenFGAConfig struct {
192192
Enabled bool `json:"enabled"`
193+
194+
CloudSQL *struct {
195+
Instance string `json:"instance"`
196+
Database string `json:"database"`
197+
// Credentials for CloudSQL proxy to authenticate with GCP
198+
ProxySecretRef string `json:"proxySecretRef"`
199+
// Username/Password to authenticate with the database
200+
DatabaseSecretRef string `json:"databaseSecretRef"`
201+
} `json:"cloudSql,omitempty"`
193202
}
194203

195204
type WebAppConfig struct {

0 commit comments

Comments
 (0)