Remove tini usage in backup-restore-sidecar and use post-exec-cmds.

control-plane/README.md

@@ -26,7 +26,6 @@ The `control-plane-defaults` folder contains defaults that are used by multiple
 | metal_control_plane_namespace                  |           | The target namespace of all deployed kubernetes resources of the metal-control-plane |
 | metal_control_plane_image_pull_policy          |           | Global value for an ImagePullPolicy that will be used for Kubernetes entities        |
 
-
 ## Roles
 
 | Role Name                                                  | Description                                                                                                                     |

control-plane/roles/postgres-backup-restore/tasks/main.yml

@@ -12,7 +12,19 @@
       - postgres_backup_restore_sidecar_image_name is defined
       - postgres_backup_restore_sidecar_image_tag is defined
 
+- name: Migration to separate backup volume (since pre- and post-cmds)
+  k8s:
+    definition:
+      apiVersion: apps/v1
+      kind: StatefulSet
+      metadata:
+        name: "{{ postgres_name }}"
+        namespace: "{{ postgres_namespace }}"
+    state: absent
+  when: "(lookup('k8s', api_version='apps/v1', kind='StatefulSet', resource_name=postgres_name, namespace=postgres_namespace) | default({}, true)).get('spec', {}).get('volumeClaimTemplates', []) | length == 1"
+
 - name: Deploy postgres (backup-restore)
   k8s:
     definition: "{{ lookup('template', 'postgres.yaml') }}"
     namespace: "{{ postgres_namespace }}"
+    apply: yes

control-plane/roles/postgres-backup-restore/templates/postgres.yaml

@@ -45,18 +45,8 @@ spec:
         image: {{ postgres_image_name }}:{{ postgres_image_tag }}
         imagePullPolicy: {{ postgres_image_pull_policy }}
         command:
-        - tini
-        - --
-        args:
-        - sh
-        - -c
-        - backup-restore-sidecar wait && docker-entrypoint.sh postgres
-          {% if postgres_shared_libraries_preload %}-c shared_preload_libraries={{ postgres_shared_libraries_preload | join(',') }}{% endif %}
-          {% if postgres_maintenance_work_mem %}-c maintenance_work_mem={{ postgres_maintenance_work_mem }}{% endif %}
-          {% if postgres_shared_buffers %}-c shared_buffers={{ postgres_shared_buffers }}{% endif %}
-          {% if postgres_effective_cache_size %}-c effective_cache_size={{ postgres_effective_cache_size }}{% endif %}
-          {% if postgres_work_mem %}-c work_mem={{ postgres_work_mem }}{% endif %}
-          -c max_connections={{ postgres_max_connections }}
+        - backup-restore-sidecar
+        - wait
         ports:
         - containerPort: 5432
         env:
@@ -80,6 +70,43 @@ spec:
             secretKeyRef:
               key: POSTGRES_DATA
               name: {{ postgres_name }}
+        livenessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -c
+            - exec
+            - pg_isready
+            - -U
+            - {{ postgres_user }}
+            - -h
+            - 127.0.0.1
+            - -p
+            - "5432"
+          failureThreshold: 6
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 5
+        name: postgres
+        ports:
+        - containerPort: 5432
+        readinessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -c
+            - exec
+            - pg_isready
+            - -U
+            - {{ postgres_user }}
+            - -h
+            - 127.0.0.1
+            - -p
+            - "5432"
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          timeoutSeconds: 5
         resources: {{ postgres_resources | to_json }}
         volumeMounts:
         - name: {{ postgres_name }}
@@ -89,21 +116,15 @@ spec:
           mountPath: /usr/local/bin/backup-restore-sidecar
         - name: backup-restore-sidecar-config
           mountPath: /etc/backup-restore-sidecar
-        - name: bin-provision
-          subPath: tini
-          mountPath: /usr/local/bin/tini
       - name: backup-restore-sidecar
         image: {{ postgres_image_name }}:{{ postgres_image_tag }}
         imagePullPolicy: {{ postgres_image_pull_policy }}
         command:
-        - tini
-        - --
-        args:
-        - sh
-        - -c
-        - mkdir -p /data/postgres && backup-restore-sidecar start
+        - backup-restore-sidecar
+        - start
         ports:
-        - containerPort: 2112
+        - containerPort: 8000
+          name: grpc
         env:
         - name: BACKUP_RESTORE_SIDECAR_POSTGRES_PASSWORD
           valueFrom:
@@ -137,14 +158,13 @@ spec:
         volumeMounts:
         - name: {{ postgres_name }}
           mountPath: /data
+        - mountPath: /backup
+          name: backup
         - name: bin-provision
           subPath: backup-restore-sidecar
           mountPath: /usr/local/bin/backup-restore-sidecar
         - name: backup-restore-sidecar-config
           mountPath: /etc/backup-restore-sidecar
-        - name: bin-provision
-          subPath: tini
-          mountPath: /usr/local/bin/tini
 {% if postgres_backup_restore_sidecar_provider == "gcp" %}
         - name: gcp-credentials
           mountPath: /gcp/credentials
@@ -157,7 +177,6 @@ spec:
         command:
         - cp
         - /backup-restore-sidecar
-        - /sbin/tini
         - /bin-provision
         volumeMounts:
         - name: bin-provision
@@ -166,6 +185,9 @@ spec:
       - name: {{ postgres_name }}
         persistentVolumeClaim:
           claimName: {{ postgres_name }}
+      - name: backup
+        persistentVolumeClaim:
+          claimName: backup
       - name: backup-restore-sidecar-config
         configMap:
           name: backup-restore-sidecar-config-{{ postgres_name }}
@@ -190,6 +212,17 @@ spec:
           storage: {{ postgres_storage_size }}
 {% if postgres_storage_class %}
       storageClassName: {{ postgres_storage_class }}
+{% endif %}
+  - metadata:
+      name: backup
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: {{ postgres_storage_size }}
+{% if postgres_storage_class %}
+      storageClassName: {{ postgres_storage_class }}
 {% endif %}
 ---
 apiVersion: v1
@@ -204,9 +237,12 @@ data:
     backup-provider: {{ postgres_backup_restore_sidecar_provider }}
     backup-cron-schedule: "{{ postgres_backup_restore_sidecar_backup_cron_schedule }}"
     object-prefix: {{ postgres_backup_restore_sidecar_object_prefix }}
+    compression-method: targz
 {% if postgres_backup_restore_sidecar_object_max_keep %}
     object-max-keep: {{ postgres_backup_restore_sidecar_object_max_keep }}
 {% endif %}
+    post-exec-cmds:
+      - docker-entrypoint.sh postgres {% if postgres_shared_libraries_preload %} -c shared_preload_libraries={{ postgres_shared_libraries_preload | join(',') }}{% endif %}{% if postgres_maintenance_work_mem %} -c maintenance_work_mem={{ postgres_maintenance_work_mem }}{% endif %}{% if postgres_shared_buffers %} -c shared_buffers={{ postgres_shared_buffers }}{% endif %}{% if postgres_effective_cache_size %} -c effective_cache_size={{ postgres_effective_cache_size }}{% endif %}{% if postgres_work_mem %} -c work_mem={{ postgres_work_mem }}{% endif %} -c max_connections={{ postgres_max_connections }}
 ---
 apiVersion: v1
 kind: Secret

control-plane/roles/rethinkdb-backup-restore/tasks/main.yml

@@ -19,7 +19,19 @@
     that:
       - rethinkdb_backup_restore_sidecar_image_tag is defined
 
+- name: Migration to separate backup volume (since pre- and post-cmds)
+  k8s:
+    definition:
+      apiVersion: apps/v1
+      kind: StatefulSet
+      metadata:
+        name: "{{ rethinkdb_name }}"
+        namespace: "{{ rethinkdb_namespace }}"
+    state: absent
+  when: "(lookup('k8s', api_version='apps/v1', kind='StatefulSet', resource_name=rethinkdb_name, namespace=rethinkdb_namespace) | default({}, true)).get('spec', {}).get('volumeClaimTemplates', []) | length == 1"
+
 - name: Deploy rethinkdb (backup-restore)
   k8s:
     definition: "{{ lookup('template', 'rethinkdb.yaml') }}"
     namespace: "{{ rethinkdb_namespace }}"
+    apply: yes

control-plane/roles/rethinkdb-backup-restore/templates/rethinkdb.yaml

@@ -37,13 +37,8 @@ spec:
         image: {{ rethinkdb_image_name }}:{{ rethinkdb_image_tag }}
         imagePullPolicy: {{ rethinkdb_image_pull_policy }}
         command:
-        - tini
-        - --
-        args:
-        - sh
-        - -c
-        # IMPORTANT: the --directory needs to point to the exact sidecar data dir, otherwise the database will be restored to the wrong location
-        - backup-restore-sidecar wait && rethinkdb --bind all --directory /data/rethinkdb --initial-password ${RETHINKDB_PASSWORD}
+        - backup-restore-sidecar
+        - wait
         env:
         - name: RETHINKDB_PASSWORD
           valueFrom:
@@ -62,21 +57,15 @@ spec:
           mountPath: /usr/local/bin/backup-restore-sidecar
         - name: backup-restore-sidecar-config
           mountPath: /etc/backup-restore-sidecar
-        - name: bin-provision
-          subPath: tini
-          mountPath: /usr/local/bin/tini
       - name: backup-restore-sidecar
         image: {{ rethinkdb_image_name }}:{{ rethinkdb_image_tag }}
         imagePullPolicy: {{ rethinkdb_image_pull_policy }}
         command:
-        - tini
-        - --
-        args:
-        - sh
-        - -c
-        - mkdir -p /data/rethinkdb && backup-restore-sidecar start
+        - backup-restore-sidecar
+        - start
         ports:
-        - containerPort: 2112
+        - containerPort: 8000
+          name: grpc
         env:
 {% if rethinkdb_backup_restore_sidecar_provider == "gcp" %}
         - name: BACKUP_RESTORE_SIDECAR_GCP_PROJECT
@@ -100,16 +89,15 @@ spec:
         volumeMounts:
         - mountPath: /data
           name: {{ rethinkdb_name }}
+        - mountPath: /backup
+          name: backup
         - name: rethinkdb-credentials
           mountPath: /rethinkdb-secret
         - name: backup-restore-sidecar-config
           mountPath: /etc/backup-restore-sidecar
         - name: bin-provision
           subPath: backup-restore-sidecar
           mountPath: /usr/local/bin/backup-restore-sidecar
-        - name: bin-provision
-          subPath: tini
-          mountPath: /usr/local/bin/tini
         - name: bin-provision
           subPath: rethinkdb-dump
           mountPath: /usr/local/bin/rethinkdb-dump
@@ -128,7 +116,6 @@ spec:
         command:
         - cp
         - /backup-restore-sidecar
-        - /ubuntu/tini
         - /rethinkdb/rethinkdb-dump
         - /rethinkdb/rethinkdb-restore
         - /bin-provision
@@ -139,6 +126,9 @@ spec:
       - name: {{ rethinkdb_name }}
         persistentVolumeClaim:
           claimName: {{ rethinkdb_name }}
+      - name: backup
+        persistentVolumeClaim:
+          claimName: backup
       - name: rethinkdb-credentials
         secret:
           secretName: {{ rethinkdb_name }}
@@ -169,6 +159,17 @@ spec:
           storage: {{ rethinkdb_storage_size }}
 {% if rethinkdb_storage_class %}
       storageClassName: {{ rethinkdb_storage_class }}
+{% endif %}
+  - metadata:
+      name: backup
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: {{ rethinkdb_storage_size }}
+{% if rethinkdb_storage_class %}
+      storageClassName: {{ rethinkdb_storage_class }}
 {% endif %}
 ---
 apiVersion: v1
@@ -184,6 +185,9 @@ data:
     rethinkdb-passwordfile: /rethinkdb-secret/rethinkdb-password.txt
     backup-cron-schedule: "{{ rethinkdb_backup_restore_sidecar_backup_cron_schedule }}"
     object-prefix: rethinkdb-{{ metal_control_plane_stage_name }}
+    post-exec-cmds:
+      # IMPORTANT: the --directory needs to point to the exact sidecar data dir, otherwise the database will be restored to the wrong location
+      - rethinkdb --bind all --directory /data/rethinkdb --initial-password ${RETHINKDB_PASSWORD}
 {% if rethinkdb_backup_restore_sidecar_object_max_keep %}
     object-max-keep: {{ rethinkdb_backup_restore_sidecar_object_max_keep }}
 {% endif %}