Staging instance, all changes can be removed at any time

Skip to content

production/storage: Deploy read-write instance to dynamic infra

Antoine R. Dumont requested to merge migrate-rpc-storage-rw into staging

This deploys a storage read-write instance (postgresql and saam's pathslicing objstorage) which will run on the rancher agent saam.

We match saam's gunicorn resources of 128 workers with 4 replicas, 8 workers (4 threads each).

make swh-helm-diff
[swh] Comparing changes between branches production and migrate-rpc-storage-rw (per environment)...
Your branch is up to date with 'origin/production'.
[swh] Generate config in production branch for environment staging, namespace swh...
[swh] Generate config in production branch for environment staging, namespace swh-cassandra...
[swh] Generate config in production branch for environment staging, namespace swh-cassandra-next-version...
[swh] Generate config in migrate-rpc-storage-rw branch for environment staging...
[swh] Generate config in migrate-rpc-storage-rw branch for environment staging...
[swh] Generate config in migrate-rpc-storage-rw branch for environment staging...
Your branch is up to date with 'origin/production'.
[swh] Generate config in production branch for environment production, namespace swh...
[swh] Generate config in production branch for environment production, namespace swh-cassandra...
[swh] Generate config in production branch for environment production, namespace swh-cassandra-next-version...
[swh] Generate config in migrate-rpc-storage-rw branch for environment production...
[swh] Generate config in migrate-rpc-storage-rw branch for environment production...
[swh] Generate config in migrate-rpc-storage-rw branch for environment production...


------------- diff for environment staging namespace swh -------------

No differences


------------- diff for environment staging namespace swh-cassandra -------------

No differences


------------- diff for environment staging namespace swh-cassandra-next-version -------------

No differences


------------- diff for environment production namespace swh -------------

--- /tmp/swh-chart.swh.6PeBjbs4/production-swh.before   2024-01-24 11:56:11.049533522 +0100
+++ /tmp/swh-chart.swh.6PeBjbs4/production-swh.after    2024-01-24 11:56:11.549532918 +0100
@@ -5601,20 +5601,22 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
   namespace: swh
   name: objstorage-ro-saam-zfs-configuration-template
 data:
   config.yml.template: |
     objstorage:
       client_max_size: 1073741824
       cls: multiplexer
+      filters_conf:
+      - type: readonly
       objstorages:
       - cls: pathslicing
         compression: none
         root: /srv/softwareheritage/objects
         slicing: 0:2/0:5
 ---
 # Source: swh/templates/scheduler/extra-services-configmap.yaml
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -6120,20 +6122,121 @@
                   api_secret_key: ${API_SECRET_KEY_15}
                   container_name: contents
               cls: azure-prefixed
           - cls: filtered
             filters_conf:
             - type: readonly
             storage_conf:
               cls: remote
               url: http://objstorage.internal.softwareheritage.org:5003/
 ---
+# Source: swh/templates/storage/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  namespace: swh
+  name: storage-postgresql-saam-zfs-configuration-template
+data:
+  config.yml.template: |
+    storage:
+      cls: pipeline
+      steps:
+      - cls: record_references
+      - cls: postgresql
+        db: host=postgresql-storage-rw.internal.softwareheritage.org port=5432 user=swhstorage dbname=softwareheritage password=${POSTGRESQL_PASSWORD}
+        objstorage:
+          cls: multiplexer
+          objstorages:
+          - cls: pathslicing
+            compression: none
+            root: /srv/softwareheritage/objects
+            slicing: 0:2/0:5
+          - accounts:
+              "0":
+                account_name: ${ACCOUNT_NAME_0}
+                api_secret_key: ${API_SECRET_KEY_0}
+                container_name: contents
+              "1":
+                account_name: ${ACCOUNT_NAME_1}
+                api_secret_key: ${API_SECRET_KEY_1}
+                container_name: contents
+              "2":
+                account_name: ${ACCOUNT_NAME_2}
+                api_secret_key: ${API_SECRET_KEY_2}
+                container_name: contents
+              "3":
+                account_name: ${ACCOUNT_NAME_3}
+                api_secret_key: ${API_SECRET_KEY_3}
+                container_name: contents
+              "4":
+                account_name: ${ACCOUNT_NAME_4}
+                api_secret_key: ${API_SECRET_KEY_4}
+                container_name: contents
+              "5":
+                account_name: ${ACCOUNT_NAME_5}
+                api_secret_key: ${API_SECRET_KEY_5}
+                container_name: contents
+              "6":
+                account_name: ${ACCOUNT_NAME_6}
+                api_secret_key: ${API_SECRET_KEY_6}
+                container_name: contents
+              "7":
+                account_name: ${ACCOUNT_NAME_7}
+                api_secret_key: ${API_SECRET_KEY_7}
+                container_name: contents
+              "8":
+                account_name: ${ACCOUNT_NAME_8}
+                api_secret_key: ${API_SECRET_KEY_8}
+                container_name: contents
+              "9":
+                account_name: ${ACCOUNT_NAME_9}
+                api_secret_key: ${API_SECRET_KEY_9}
+                container_name: contents
+              a:
+                account_name: ${ACCOUNT_NAME_10}
+                api_secret_key: ${API_SECRET_KEY_10}
+                container_name: contents
+              b:
+                account_name: ${ACCOUNT_NAME_11}
+                api_secret_key: ${API_SECRET_KEY_11}
+                container_name: contents
+              c:
+                account_name: ${ACCOUNT_NAME_12}
+                api_secret_key: ${API_SECRET_KEY_12}
+                container_name: contents
+              d:
+                account_name: ${ACCOUNT_NAME_13}
+                api_secret_key: ${API_SECRET_KEY_13}
+                container_name: contents
+              e:
+                account_name: ${ACCOUNT_NAME_14}
+                api_secret_key: ${API_SECRET_KEY_14}
+                container_name: contents
+              f:
+                account_name: ${ACCOUNT_NAME_15}
+                api_secret_key: ${API_SECRET_KEY_15}
+                container_name: contents
+            cls: azure-prefixed
+
+        journal_writer:
+          cls: kafka
+          brokers:
+          - kafka1.internal.softwareheritage.org
+          - kafka2.internal.softwareheritage.org
+          - kafka3.internal.softwareheritage.org
+          - kafka4.internal.softwareheritage.org
+          prefix: swh.journal.objects
+          client_id: swh.storage.journal_writer.${HOSTNAME}
+          anonymize: true
+          producer_config:
+            message.max.bytes: 1000000000
+---
 # Source: swh/templates/toolbox/configmap.yaml
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: toolbox-indexer-storage-template
   namespace: swh
 data:
   config.yml.template: |
     indexer_storage:
       cls: postgresql
@@ -16626,20 +16729,30 @@
   name: storage-azure-read-only-rpc-ingress
   namespace: swh
 spec:
   type: ExternalName
   externalName: archive-production-rke2-ingress-nginx-controller.ingress-nginx.svc.cluster.local
 ---
 # Source: swh/templates/external-services/cname.yaml
 apiVersion: v1
 kind: Service
 metadata:
+  name: storage-rw-postgresql-saam-ingress
+  namespace: swh
+spec:
+  type: ExternalName
+  externalName: archive-production-rke2-ingress-nginx-controller.ingress-nginx.svc.cluster.local
+---
+# Source: swh/templates/external-services/cname.yaml
+apiVersion: v1
+kind: Service
+metadata:
   name: vault-rpc-ingress
   namespace: swh
 spec:
   type: ExternalName
   externalName: archive-production-rke2-ingress-nginx-controller.ingress-nginx.svc.cluster.local
 ---
 # Source: swh/templates/graphql/service.yaml
 apiVersion: v1
 kind: Service
 metadata:
@@ -16809,20 +16922,35 @@
   namespace: swh
 spec:
   type: ClusterIP
   selector:
     app: storage-postgresql-azure-readonly
   ports:
     - port: 5002
       targetPort: 5002
       name: rpc
 ---
+# Source: swh/templates/storage/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: storage-postgresql-saam-zfs
+  namespace: swh
+spec:
+  type: ClusterIP
+  selector:
+    app: storage-postgresql-saam-zfs
+  ports:
+    - port: 5002
+      targetPort: 5002
+      name: rpc
+---
 # Source: swh/templates/vault/rpc-service.yaml
 apiVersion: v1
 kind: Service
 metadata:
   name: vault-rpc
   namespace: swh
 spec:
   type: ClusterIP
   selector:
     app: vault-rpc
@@ -26983,21 +27111,21 @@
       app: objstorage-ro-saam-zfs
   strategy:
     type: RollingUpdate
     rollingUpdate:
       maxSurge: 1
   template:
     metadata:
       labels:
         app: objstorage-ro-saam-zfs
       annotations:
-        checksum/config: 9216d3d7df2dc2d0ec2cb467c891a45ee3f345b6ea3f491282a7e70a0da7bc08
+        checksum/config: 5637789eb305a56a89ed7eabf240d9090f10c21003846a7a56ec6cd443cc6b7c
         checksum/config-utils: 0cce256531366ac8ea2a0bde2a8f10937284a0f599f45fabe6babbbc096e179d
     spec:
       nodeSelector:
         kubernetes.io/hostname: saam
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
             - matchExpressions:
               - key: swh/objstorage-pathslicing
@@ -30063,20 +30191,396 @@
             path: "config.yml.template"
       - name: database-utils
         configMap:
           name: database-utils
           defaultMode: 0555
       - name: config-utils
         configMap:
           name: config-utils
           defaultMode: 0555
 ---
+# Source: swh/templates/storage/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: swh
+  name: storage-postgresql-saam-zfs
+  labels:
+    app: storage-postgresql-saam-zfs
+spec:
+  revisionHistoryLimit: 2
+  replicas: 4
+  selector:
+    matchLabels:
+      app: storage-postgresql-saam-zfs
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        app: storage-postgresql-saam-zfs
+      annotations:
+        checksum/config: 8011d082d6e7a1c2dbb9e7a4cdd9dc38012d002ed8792f32d189c472e8890b07
+        checksum/database-utils: 931b7f92b50eae0ecb6203c3e0e48f7c363a99ac0064451187dc12c6eaf0a793
+        checksum/config-utils: 0cce256531366ac8ea2a0bde2a8f10937284a0f599f45fabe6babbbc096e179d
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: saam
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: swh/storage-pathslicing
+                operator: In
+                values:
+                - "true"
+      priorityClassName: swh-frontend-rpc
+      initContainers:
+        - name: prepare-configuration
+          image: container-registry.softwareheritage.org/swh/infra/swh-apps/utils:20231211.1
+          imagePullPolicy: IfNotPresent
+          command:
+          - /entrypoints/prepare-configuration.sh
+          env:
+
+
+          - name: ACCOUNT_NAME_0
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 0_account_name
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: ACCOUNT_NAME_1
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 1_account_name
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: ACCOUNT_NAME_10
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 10_account_name
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: ACCOUNT_NAME_11
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 11_account_name
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: ACCOUNT_NAME_12
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 12_account_name
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: ACCOUNT_NAME_13
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 13_account_name
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: ACCOUNT_NAME_14
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 14_account_name
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: ACCOUNT_NAME_15
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 15_account_name
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: ACCOUNT_NAME_2
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 2_account_name
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: ACCOUNT_NAME_3
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 3_account_name
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: ACCOUNT_NAME_4
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 4_account_name
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: ACCOUNT_NAME_5
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 5_account_name
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: ACCOUNT_NAME_6
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 6_account_name
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: ACCOUNT_NAME_7
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 7_account_name
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: ACCOUNT_NAME_8
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 8_account_name
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: ACCOUNT_NAME_9
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 9_account_name
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: API_SECRET_KEY_0
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 0_api_secret_key
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: API_SECRET_KEY_1
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 1_api_secret_key
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: API_SECRET_KEY_10
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 10_api_secret_key
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: API_SECRET_KEY_11
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 11_api_secret_key
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: API_SECRET_KEY_12
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 12_api_secret_key
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: API_SECRET_KEY_13
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 13_api_secret_key
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: API_SECRET_KEY_14
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 14_api_secret_key
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: API_SECRET_KEY_15
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 15_api_secret_key
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: API_SECRET_KEY_2
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 2_api_secret_key
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: API_SECRET_KEY_3
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 3_api_secret_key
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: API_SECRET_KEY_4
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 4_api_secret_key
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: API_SECRET_KEY_5
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 5_api_secret_key
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: API_SECRET_KEY_6
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 6_api_secret_key
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: API_SECRET_KEY_7
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 7_api_secret_key
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: API_SECRET_KEY_8
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 8_api_secret_key
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: API_SECRET_KEY_9
+            valueFrom:
+              secretKeyRef:
+                name: swh-objstorage-config
+                key: 9_api_secret_key
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          - name: POSTGRESQL_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: swh-storage-postgresql-common-secret
+                key: postgres-swh-storage-password
+                # 'name' secret must exist & include that ^ key
+                optional: false
+          volumeMounts:
+          - name: configuration
+            mountPath: /etc/swh
+          - name: configuration-template
+            mountPath: /etc/swh/configuration-template
+          - name: config-utils
+            mountPath: /entrypoints
+            readOnly: true
+
+
+      containers:
+        - name: storage-postgresql-saam-zfs
+          resources:
+            requests:
+              memory: 1024Mi
+              cpu: 500m
+          image: container-registry.softwareheritage.org/swh/infra/swh-apps/storage:20240117.4
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 5002
+              name: rpc
+          readinessProbe:
+            httpGet:
+              path: /
+              port: rpc
+            initialDelaySeconds: 15
+            failureThreshold: 30
+            periodSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /
+              port: rpc
+            initialDelaySeconds: 10
+            periodSeconds: 5
+          command:
+          - /bin/bash
+          args:
+          - -c
+          - /opt/swh/entrypoint.sh
+          env:
+            - name: THREADS
+              value: "4"
+            - name: WORKERS
+              value: "8"
+            - name: TIMEOUT
+              value: "3600"
+            - name: STATSD_HOST
+              value: prometheus-statsd-exporter
+            - name: STATSD_PORT
+              value: "9125"
+            - name: LOG_LEVEL
+              value: "INFO"
+            - name: SWH_SENTRY_ENVIRONMENT
+              value: production
+            - name: SWH_MAIN_PACKAGE
+              value: swh.storage
+            - name: SWH_SENTRY_DSN
+              valueFrom:
+                secretKeyRef:
+                  name: common-secrets
+                  key: storage-sentry-dsn
+                  # 'name' secret should exist & include key
+                  # if the setting doesn't exist, sentry pushes will be disabled
+                  optional: true
+            - name: SWH_SENTRY_DISABLE_LOGGING_EVENTS
+              value: "true"
+          volumeMounts:
+          - name: configuration
+            mountPath: /etc/swh
+          - name: pathslicing-rw
+            mountPath: /srv/softwareheritage/objects
+            readOnly: false
+
+      volumes:
+      - name: configuration
+        emptyDir: {}
+      - name: configuration-template
+        configMap:
+          name: storage-postgresql-saam-zfs-configuration-template
+          items:
+          - key: "config.yml.template"
+            path: "config.yml.template"
+      - name: database-utils
+        configMap:
+          name: database-utils
+          defaultMode: 0555
+      - name: config-utils
+        configMap:
+          name: config-utils
+          defaultMode: 0555
+
+      - name: pathslicing-rw
+
+        hostPath:
+          path: /srv/softwareheritage/objects
+          type: Directory
+---
 # Source: swh/templates/toolbox/deployment.yaml
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: swh-toolbox
   namespace: swh
   labels:
     app: swh-toolbox
 spec:
   revisionHistoryLimit: 2
@@ -31458,20 +31962,343 @@
           - name: configuration
             emptyDir: {}
           - name: configuration-template
             configMap:
               name: scheduler-update-metrics-configuration-template
               items:
               - key: "config.yml.template"
                 path: "config.yml.template"
           restartPolicy: OnFailure
 ---
+# Source: swh/templates/storage/cronjob.yaml
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: create-object-reference-partitions-cronjob
+spec:
+  # By default, at 00:05 each first day of the month
+  schedule: "5 0 * * mon"
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          affinity:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                - matchExpressions:
+                  - key: swh/storage-pathslicing
+                    operator: In
+                    values:
+                    - "true"
+          initContainers:
+            - name: prepare-configuration
+              image: container-registry.softwareheritage.org/swh/infra/swh-apps/utils:20231211.1
+              imagePullPolicy: IfNotPresent
+              command:
+                - /entrypoints/prepare-configuration.sh
+              env:
+
+
+              - name: ACCOUNT_NAME_0
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 0_account_name
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: ACCOUNT_NAME_1
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 1_account_name
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: ACCOUNT_NAME_10
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 10_account_name
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: ACCOUNT_NAME_11
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 11_account_name
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: ACCOUNT_NAME_12
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 12_account_name
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: ACCOUNT_NAME_13
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 13_account_name
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: ACCOUNT_NAME_14
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 14_account_name
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: ACCOUNT_NAME_15
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 15_account_name
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: ACCOUNT_NAME_2
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 2_account_name
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: ACCOUNT_NAME_3
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 3_account_name
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: ACCOUNT_NAME_4
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 4_account_name
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: ACCOUNT_NAME_5
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 5_account_name
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: ACCOUNT_NAME_6
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 6_account_name
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: ACCOUNT_NAME_7
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 7_account_name
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: ACCOUNT_NAME_8
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 8_account_name
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: ACCOUNT_NAME_9
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 9_account_name
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: API_SECRET_KEY_0
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 0_api_secret_key
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: API_SECRET_KEY_1
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 1_api_secret_key
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: API_SECRET_KEY_10
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 10_api_secret_key
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: API_SECRET_KEY_11
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 11_api_secret_key
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: API_SECRET_KEY_12
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 12_api_secret_key
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: API_SECRET_KEY_13
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 13_api_secret_key
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: API_SECRET_KEY_14
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 14_api_secret_key
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: API_SECRET_KEY_15
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 15_api_secret_key
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: API_SECRET_KEY_2
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 2_api_secret_key
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: API_SECRET_KEY_3
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 3_api_secret_key
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: API_SECRET_KEY_4
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 4_api_secret_key
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: API_SECRET_KEY_5
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 5_api_secret_key
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: API_SECRET_KEY_6
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 6_api_secret_key
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: API_SECRET_KEY_7
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 7_api_secret_key
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: API_SECRET_KEY_8
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 8_api_secret_key
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: API_SECRET_KEY_9
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-objstorage-config
+                    key: 9_api_secret_key
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+              - name: POSTGRESQL_PASSWORD
+                valueFrom:
+                  secretKeyRef:
+                    name: swh-storage-postgresql-common-secret
+                    key: postgres-swh-storage-password
+                    # 'name' secret must exist & include that ^ key
+                    optional: false
+
+              volumeMounts:
+              - name: configuration
+                mountPath: /etc/swh
+              - name: configuration-template
+                mountPath: /etc/swh/configuration-template
+              - name: config-utils
+                mountPath: /entrypoints
+                readOnly: true
+          containers:
+            - name: create-object-reference-partitions
+              resources:
+                requests:
+                  memory: 512Mi
+                  cpu: 500m
+              image: container-registry.softwareheritage.org/swh/infra/swh-apps/storage:20240117.4
+              command:
+              - /opt/swh/entrypoint.sh
+              args:
+              - create-object-references-partitions
+              env:
+                - name: STATSD_HOST
+                  value: prometheus-statsd-exporter
+                - name: STATSD_PORT
+                  value: "9125"
+                - name: SWH_CONFIG_FILENAME
+                  value: /etc/swh/config.yml
+                - name: LOG_LEVEL
+                  value: INFO
+                - name: SWH_SENTRY_ENVIRONMENT
+                  value: production
+                - name: SWH_MAIN_PACKAGE
+                  value: swh.storage
+                - name: SWH_SENTRY_DSN
+                  valueFrom:
+                    secretKeyRef:
+                      name: common-secrets
+                      key: storage-sentry-dsn
+                      # if the setting doesn't exist, sentry issue pushes will be disabled
+                      optional: false
+                - name: SWH_SENTRY_DISABLE_LOGGING_EVENTS
+                  value: "true"
+              imagePullPolicy: IfNotPresent
+              volumeMounts:
+              - name: configuration
+                mountPath: /etc/swh
+          volumes:
+          - name: configuration
+            emptyDir: {}
+          - name: configuration-template
+            configMap:
+              name: storage-postgresql-saam-zfs-configuration-template
+              items:
+              - key: "config.yml.template"
+                path: "config.yml.template"
+          - name: config-utils
+            configMap:
+              name: config-utils
+              defaultMode: 0555
+          restartPolicy: OnFailure
+---
 # Source: swh/templates/web/refresh-savecodenow-statuses-cronjob.yaml
 apiVersion: batch/v1
 kind: CronJob
 metadata:
   name: web-archive-refresh-savecodenow-statuses-cronjob
   namespace: swh
 spec:
   schedule: "*/2 * * * *"
   concurrencyPolicy: Forbid
   jobTemplate:
@@ -32253,20 +33080,46 @@
     http:
       paths:
       - path: /
         pathType: Prefix
         backend:
           service:
             name: storage-postgresql-azure-readonly
             port:
               number: 5002
 ---
+# Source: swh/templates/storage/ingress.yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  namespace: swh
+  name: storage-postgresql-saam-zfs-ingress-default
+  annotations:
+    nginx.ingress.kubernetes.io/service-upstream: "true"
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.42.0.0/16,10.43.0.0/16,127.0.0.0/8,192.168.100.0/24,192.168.200.0/22
+    nginx.ingress.kubernetes.io/client-body-buffer-size: 128K
+    nginx.ingress.kubernetes.io/proxy-body-size: 4G
+    nginx.ingress.kubernetes.io/proxy-buffering: "on"
+
+spec:
+  rules:
+  - host: storage-read-write-rpc-ingress
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: storage-postgresql-saam-zfs
+            port:
+              number: 5002
+---
 # Source: swh/templates/vault/rpc-ingress.yaml
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   namespace: swh
   name: vault-rpc-ingress-default
   annotations:
     nginx.ingress.kubernetes.io/service-upstream: "true"
     nginx.ingress.kubernetes.io/whitelist-source-range: 10.42.0.0/16,10.43.0.0/16
     kubernetes.io/ingress.class: nginx


------------- diff for environment production namespace swh-cassandra -------------

--- /tmp/swh-chart.swh.6PeBjbs4/production-swh-cassandra.before 2024-01-24 11:56:11.241533289 +0100
+++ /tmp/swh-chart.swh.6PeBjbs4/production-swh-cassandra.after  2024-01-24 11:56:11.717532716 +0100
@@ -11284,20 +11284,30 @@
   name: storage-azure-read-only-rpc-ingress
   namespace: swh-cassandra
 spec:
   type: ExternalName
   externalName: archive-production-rke2-ingress-nginx-controller.ingress-nginx.svc.cluster.local
 ---
 # Source: swh/templates/external-services/cname.yaml
 apiVersion: v1
 kind: Service
 metadata:
+  name: storage-rw-postgresql-saam-ingress
+  namespace: swh-cassandra
+spec:
+  type: ExternalName
+  externalName: archive-production-rke2-ingress-nginx-controller.ingress-nginx.svc.cluster.local
+---
+# Source: swh/templates/external-services/cname.yaml
+apiVersion: v1
+kind: Service
+metadata:
   name: vault-rpc-ingress
   namespace: swh-cassandra
 spec:
   type: ExternalName
   externalName: archive-production-rke2-ingress-nginx-controller.ingress-nginx.svc.cluster.local
 ---
 # Source: swh/templates/graphql/service.yaml
 apiVersion: v1
 kind: Service
 metadata:

Refs. swh/infra/sysadm-environment#5215 (closed)

Depends on !307 (merged)

Edited by Antoine R. Dumont

Merge request reports

Loading