feat(cnpg): add sandbox database on shared-pg cluster

- Fix OpenSearch security plugin: change "true" string to true boolean
  in cluster.yaml to actually disable security (TLS + auth)
- Enable elasticsearch in mastodon connecting to shared-os cluster
  (port 9200, TLS disabled, single_node_cluster preset)
- Enable deploySearch hook to build search indexes
- Increase mastodon-web memory limit from 512Mi to 1Gi to fix OOMKill

argocd/apps/mastodon.yaml

@@ -36,12 +36,12 @@ spec:
 
             s3:
               enabled: true
-              hostname: minio.minio.svc.cluster.local:9000
-              endpoint: minio.minio.svc.cluster.local:9000
-              protocol: http
+              hostname: mastodon.t0rt1k.tech
+              endpoint: http://minio.minio.svc.cluster.local
+              protocol: https
               bucket: mastodon
               existingSecret: mastodon-s3
-              overridePathStyle: "true"
+              overridePathStyle: "false"
 
             web:
               resources:
@@ -50,7 +50,7 @@ spec:
                   memory: 256Mi
                 limits:
                   cpu: 500m
-                  memory: 512Mi
+                  memory: 1Gi
 
             sidekiq:
               workers:
@@ -114,12 +114,12 @@ spec:
             enabled: true
             hostname: shared-os.opensearch.svc.cluster.local
             port: 9200
-            tls: true
-            preset: small_cluster
-            existingSecret: mastodon-os
-
+            tls: false
+            preset: single_node_cluster
+            username: dummy
+            password: dummy
           ingress:
-            enabled: true
+            enabled: false
             className: traefik
             annotations:
               cert-manager.io/cluster-issuer: letsencrypt-production

argocd/apps/traefik.yaml

@@ -42,6 +42,7 @@ spec:
           - "--entryPoints.rtc-udp-roglog.address=:30004/udp"
           - "--providers.kubernetesingress.ingressclass=traefik"
           - "--providers.kubernetesingress.ingressendpoint.publishedservice=traefik/traefik"
+          - "--providers.kubernetesingress.allowexternalnameservices=true"
           - "--accesslog=true"
           - "--log.level=INFO"
 

manifests/cnpg/databases.yaml

@@ -85,4 +85,15 @@ spec:
   owner: mastodon
   cluster:
     name: shared-pg
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: sandbox
+  namespace: cnpg
+spec:
+  name: sandbox
+  owner: sandbox
+  cluster:
+    name: shared-pg
 

manifests/mastodon/ingress.yaml

@@ -0,0 +1,40 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: mastodon
+  namespace: mastodon
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  tls:
+    - secretName: mastodon-tls
+      hosts:
+        - mastodon.t0rt1k.tech
+  rules:
+    - host: mastodon.t0rt1k.tech
+      http:
+        paths:
+          - path: /mastodon/
+            pathType: Prefix
+            backend:
+              service:
+                name: minio-proxy
+                port:
+                  number: 80
+          - path: /api/v1/streaming/
+            pathType: Prefix
+            backend:
+              service:
+                name: mastodon-streaming
+                port:
+                  number: 4000
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: mastodon-web
+                port:
+                  number: 3000

manifests/mastodon/secrets.yaml

@@ -1,15 +1,5 @@
 apiVersion: v1
 kind: Secret
-metadata:
-  name: mastodon-os
-  namespace: mastodon
-type: Opaque
-stringData:
-  username: mastodon
-  password: "2&ey0J8c1pHbu%kP"
----
-apiVersion: v1
-kind: Secret
 metadata:
   name: os-ca
   namespace: mastodon

manifests/mastodon/svc-minio.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: minio-proxy
+  namespace: mastodon
+spec:
+  type: ExternalName
+  externalName: minio.minio.svc.cluster.local
+  ports:
+    - port: 80

manifests/opensearch/cluster.yaml

@@ -8,10 +8,8 @@ spec:
     version: "3.7.0"
     serviceName: shared-os
     setVMMaxMapCount: true
-  security:
-    config:
-      adminCredentialsSecret:
-        name: shared-os-admin-credentials
+    additionalConfig:
+      plugins.security.disabled: true
   nodePools:
     - component: nodes
       replicas: 3
@@ -34,14 +32,3 @@ spec:
         limits:
           cpu: 500m
           memory: 1Gi
-      probes:
-        readiness:
-          command:
-            - /bin/bash
-            - -c
-            - curl -k -u "$(cat /mnt/admin-credentials/username):$(cat /mnt/admin-credentials/password)" --silent --fail 'https://localhost:9200'
-        startup:
-          command:
-            - /bin/bash
-            - -c
-            - curl -k -u "$(cat /mnt/admin-credentials/username):$(cat /mnt/admin-credentials/password)" --silent --fail 'https://localhost:9200'