(chore): add a init container to make goalerts wait for pgsql and fix secrets

Signed-off-by: shubham singh mahar <smahar@obmondo.com>

Author: shubham singh mahar

argocd-helm-charts/goalerts/readme.md

@@ -4,51 +4,29 @@ GoAlert - open source on-call scheduling, automated escalations, and notificatio
 
 ## 1. How to setup
 
-GoAlert reads two values from an existing Secret (default name `goalert`, set via
-`goalert.existingSecret.name`):
+Goalert reads data encryption key from the secret
+you provide.
 
 | Key | What it is |
 |---|---|
-| `GOALERT_DB_URL` | Postgres connection string |
 | `GOALERT_DATA_ENCRYPTION_KEY` | Encrypts data at rest. **Back this up** - losing it makes encrypted data unrecoverable, and it must never change once set. |
 
-### Create it
+### Create it (sealed-secrets)
 
 ```bash
 NS=goalert   # your target namespace
-
-# 1. A strong data-encryption key (store a copy somewhere safe):
 ENC_KEY="$(openssl rand -base64 32)"
 
-# 2. The DB URL. If you're using the CNPG cluster this chart provisions, read it
-DB_URL="$(kubectl -n "$NS" get secret goalert-pgsql-app \
-            -o jsonpath='{.data.uri}' | base64 -d)?sslmode=require"
-
-# 3. Create the Secret:
-kubectl create secret generic goalert -n "$NS" \
-  --from-literal=GOALERT_DB_URL="$DB_URL" \
-  --from-literal=GOALERT_DATA_ENCRYPTION_KEY="$ENC_KEY"
-```
-
-Note: the CNPG cluster (and its `goalert-pgsql-app` secret) must exist first, so sync/deploy the chart once to provision the DB, then create this Secret.
-
-### GitOps (sealed-secrets)
-
-Seal the same object instead of applying it:
-
-```bash
 kubectl create secret generic goalert -n "$NS" \
-  --from-literal=GOALERT_DB_URL="$DB_URL" \
   --from-literal=GOALERT_DATA_ENCRYPTION_KEY="$ENC_KEY" \
   --dry-run=client -o yaml \
 | kubeseal --format yaml > goalert-sealed-secret.yaml
 ```
-(Offline sealing: `kubeseal --cert <controller-cert.pem>`.)
 
 ## 2. First admin user
 
 GoAlert has **no default login** - create the first admin with its CLI inside the
-pod (it uses `GOALERT_DB_URL` from the Secret above):
+pod (it reads the DB URL from the CNPG secret):
 
 ```bash
 kubectl -n "$NS" exec -it deploy/goalerts -- goalert add-user --admin --user admin
@@ -66,7 +44,9 @@ service (`:8081`) to reach the web UI.
 
 | Value | Default | Notes |
 |---|---|---|
-| `goalert.existingSecret.name` | `goalert` | Secret holding the two keys above |
+| `goalert.dbUrlSecret.name` | `<instanceName>-pgsql-app` | CNPG secret the DB URL is read from |
+| `goalert.dbUrlSecret.key` | `fqdn-uri` | Key in that secret |
+| `goalert.encryptionKeySecret.name` | `goalert` | Secret holding the encryption key |
 | `postgresql.enabled` | `false` | Bundled Postgres removed; use CNPG |
 | `global.postgresql.enabled` | `true` | Provision the CNPG cluster via kubeaid-addons |
 | `global.postgresql.instanceName` | `goalert` | → cluster `goalert-pgsql` |

argocd-helm-charts/goalerts/templates/deployment.yaml

@@ -27,23 +27,36 @@ spec:
       serviceAccountName: {{ include "goalert.serviceAccountName" . }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- if .Values.pgchecker.enabled }}
+      initContainers:
+        - name: pgchecker
+          image: "{{ .Values.pgchecker.image.repository }}:{{ .Values.pgchecker.image.tag }}"
+          imagePullPolicy: {{ .Values.pgchecker.image.pullPolicy }}
+          command:
+            - sh
+            - -c
+            - |
+              echo 'Waiting for PostgreSQL to become ready...'
+              until nc -z -w 2 {{ .Values.pgchecker.host | default (printf "%s-pgsql-rw" .Values.global.postgresql.instanceName) }} {{ .Values.pgchecker.port }}; do
+                sleep 2
+              done
+              echo 'PostgreSQL OK ✓'
+          resources:
+            {{- toYaml .Values.pgchecker.resources | nindent 12 }}
+      {{- end }}
       containers:
         - name: {{ .Chart.Name }}
           env:
-            {{- if .Values.goalert.existingSecret.name }}
-            {{- range $key, $value := .Values.goalert.existingSecret.keys }}
-            - name: {{ $key }}
+            - name: GOALERT_DB_URL
               valueFrom:
                 secretKeyRef:
-                  name: {{ $.Values.goalert.existingSecret.name }}
-                  key: {{ $value }}
-            {{- end }}
-            {{- else }}
-            - name: GOALERT_DB_URL
-              value: {{ include "goalert.databaseUrl" . | quote }}
+                  name: {{ .Values.goalert.dbUrlSecret.name }}
+                  key: {{ .Values.goalert.dbUrlSecret.key }}
             - name: GOALERT_DATA_ENCRYPTION_KEY
-              value: {{ .Values.goalert.environment.GOALERT_DATA_ENCRYPTION_KEY | quote }}
-            {{- end }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.goalert.encryptionKeySecret.name }}
+                  key: {{ .Values.goalert.encryptionKeySecret.key }}
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"

argocd-helm-charts/goalerts/values.yaml

@@ -9,14 +9,12 @@ fullnameOverride: ""
 
 # DB URL + data-encryption key come from a sealed Secret in kubeaid-config-enableit.
 goalert:
-  existingSecret:
+  dbUrlSecret:
+    name: goalert-pgsql-app
+    key: fqdn-uri
+  encryptionKeySecret:
     name: goalert
-    keys:
-      GOALERT_DB_URL: "GOALERT_DB_URL"
-      GOALERT_DATA_ENCRYPTION_KEY: "GOALERT_DATA_ENCRYPTION_KEY"
-  environment:
-    GOALERT_DB_URL: ""
-    GOALERT_DATA_ENCRYPTION_KEY: ""
+    key: GOALERT_DATA_ENCRYPTION_KEY
 
 # Postgres is a CloudNativePG cluster (see global.postgresql), not the bundled one.
 postgresql:
@@ -61,6 +59,22 @@ podSecurityContext: {}
 securityContext: {}
 replicaCount: 1
 
+# Init container that blocks GoAlert until the database accepts connections.
+pgchecker:
+  enabled: true
+  image:
+    repository: busybox
+    tag: "1.37"
+    pullPolicy: IfNotPresent
+  host: ""
+  port: 5432
+  resources:
+    requests:
+      cpu: 10m
+      memory: 16Mi
+    limits:
+      memory: 32Mi
+
 # CloudNativePG cluster (goalert-pgsql) provisioned via the kubeaid-addons subchart.
 global:
   postgresql: