mirror of
https://github.com/andwati/zitadel.git
synced 2026-11-15 18:25:13 +00:00
docs(self-hosting): use postgres for deployment docs (#9571)
# Which Problems Are Solved The Kubernetes and Knative deployment docs suggest to depend on CockroachDB installations even though we sunset the CockroachDB support with the upcoming major version. This can be annoying for users who create new environments using CockroachDB. # How the Problems Are Solved - The Kubernetes deployment is removed and points to examples in the chart repo directy. This removes redundancies that are prone to getting outdated without notice. - The Knative deployment uses commands to deploy a PostgreSQL StatefulSet instead of a CockroachDB StatefulSet. The DB command from the Knative Tutorial is used, as users are likely to be familiar with the tutorials configuration already. The static Kubernetes YAML files for the DB as well as for the Zitadel Knative service are removed altogether, as they are prone to getting outdated without notice and don't serve any purpose. # Additional Changes - The outdated and boring video guide for Knative is removed. - The Knative configuration is changed, so the first-time login becomes easier which improves DevX. - The current docker compose file doesn't work, this PR fixes it and upgrades the used Postgres to v17. # Additional Context - Closes https://github.com/zitadel/zitadel-charts/issues/322 - Replaces https://github.com/zitadel/zitadel/pull/9540 Co-authored-by: Silvan <[email protected]>
This commit is contained in:
Elio Bischof
Silvan
@@ -1,169 +0,0 @@
|
||||
# Generated file, DO NOT EDIT. Source: cloud/kubernetes/templates/cockroachdb-statefulset.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
# This service is meant to be used by clients of the database. It exposes a ClusterIP that will
|
||||
# automatically load balance connections to the different database pods.
|
||||
name: cockroachdb-public
|
||||
labels:
|
||||
app: cockroachdb
|
||||
spec:
|
||||
ports:
|
||||
# The main port, served by gRPC, serves Postgres-flavor SQL, internode
|
||||
# traffic and the cli.
|
||||
- port: 26257
|
||||
targetPort: 26257
|
||||
name: grpc
|
||||
# The secondary port serves the UI as well as health and debug endpoints.
|
||||
- port: 8080
|
||||
targetPort: 8080
|
||||
name: http
|
||||
selector:
|
||||
app: cockroachdb
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
# This service only exists to create DNS entries for each pod in the stateful
|
||||
# set such that they can resolve each other's IP addresses. It does not
|
||||
# create a load-balanced ClusterIP and should not be used directly by clients
|
||||
# in most circumstances.
|
||||
name: cockroachdb
|
||||
labels:
|
||||
app: cockroachdb
|
||||
annotations:
|
||||
# Use this annotation in addition to the actual publishNotReadyAddresses
|
||||
# field below because the annotation will stop being respected soon but the
|
||||
# field is broken in some versions of Kubernetes:
|
||||
# https://github.com/kubernetes/kubernetes/issues/58662
|
||||
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
|
||||
# Enable automatic monitoring of all instances when Prometheus is running in the cluster.
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/path: "_status/vars"
|
||||
prometheus.io/port: "8080"
|
||||
spec:
|
||||
ports:
|
||||
- port: 26257
|
||||
targetPort: 26257
|
||||
name: grpc
|
||||
- port: 8080
|
||||
targetPort: 8080
|
||||
name: http
|
||||
# We want all pods in the StatefulSet to have their addresses published for
|
||||
# the sake of the other CockroachDB pods even before they're ready, since they
|
||||
# have to be able to talk to each other in order to become ready.
|
||||
publishNotReadyAddresses: true
|
||||
clusterIP: None
|
||||
selector:
|
||||
app: cockroachdb
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: cockroachdb
|
||||
spec:
|
||||
serviceName: "cockroachdb"
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: cockroachdb
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: cockroachdb
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- cockroachdb
|
||||
topologyKey: kubernetes.io/hostname
|
||||
containers:
|
||||
- name: cockroachdb
|
||||
image: cockroachdb/cockroach:latest-v24.3
|
||||
imagePullPolicy: IfNotPresent
|
||||
# TODO: Change these to appropriate values for the hardware that you're running. You can see
|
||||
# the resources that can be allocated on each of your Kubernetes nodes by running:
|
||||
# kubectl describe nodes
|
||||
# Note that requests and limits should have identical values.
|
||||
resources:
|
||||
requests:
|
||||
cpu: "1"
|
||||
memory: "4Gi"
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: "4Gi"
|
||||
ports:
|
||||
- containerPort: 26257
|
||||
name: grpc
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
# We recommend that you do not configure a liveness probe on a production environment, as this can impact the availability of production databases.
|
||||
# livenessProbe:
|
||||
# httpGet:
|
||||
# path: "/health"
|
||||
# port: http
|
||||
# initialDelaySeconds: 30
|
||||
# periodSeconds: 5
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: "/health?ready=1"
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 5
|
||||
failureThreshold: 2
|
||||
volumeMounts:
|
||||
- name: datadir
|
||||
mountPath: /cockroach/cockroach-data
|
||||
env:
|
||||
- name: COCKROACH_CHANNEL
|
||||
value: kubernetes-insecure
|
||||
- name: GOMAXPROCS
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.cpu
|
||||
divisor: "1"
|
||||
- name: MEMORY_LIMIT_MIB
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.memory
|
||||
divisor: "1Mi"
|
||||
command:
|
||||
- "/bin/bash"
|
||||
- "-ecx"
|
||||
# The use of qualified `hostname -f` is crucial:
|
||||
# Other nodes aren't able to look up the unqualified hostname.
|
||||
- exec
|
||||
/cockroach/cockroach
|
||||
start-single-node
|
||||
--logtostderr
|
||||
--insecure
|
||||
--advertise-host $(hostname -f)
|
||||
--http-addr 0.0.0.0
|
||||
--cache $(expr $MEMORY_LIMIT_MIB / 4)MiB
|
||||
--max-sql-memory $(expr $MEMORY_LIMIT_MIB / 4)MiB
|
||||
# No pre-stop hook is required, a SIGTERM plus some time is all that's
|
||||
# needed for graceful shutdown of a node.
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes:
|
||||
- name: datadir
|
||||
persistentVolumeClaim:
|
||||
claimName: datadir
|
||||
podManagementPolicy: Parallel
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: datadir
|
||||
spec:
|
||||
accessModes:
|
||||
- "ReadWriteOnce"
|
||||
resources:
|
||||
requests:
|
||||
storage: 100Gi
|
||||
@@ -1,42 +0,0 @@
|
||||
apiVersion: serving.knative.dev/v1
|
||||
kind: Service
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: zitadel
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
client.knative.dev/user-image: ghcr.io/zitadel/zitadel:latest
|
||||
creationTimestamp: null
|
||||
spec:
|
||||
containerConcurrency: 0
|
||||
containers:
|
||||
- args:
|
||||
- admin
|
||||
- start-from-init
|
||||
- --masterkey
|
||||
- MasterkeyNeedsToHave32Characters
|
||||
env:
|
||||
- name: ZITADEL_DATABASE_COCKROACH_HOST
|
||||
value: cockroachdb
|
||||
- name: ZITADEL_EXTERNALSECURE
|
||||
value: "false"
|
||||
- name: ZITADEL_TLS_ENABLED
|
||||
value: "false"
|
||||
- name: ZITADEL_EXTERNALPORT
|
||||
value: "80"
|
||||
- name: ZITADEL_EXTERNALDOMAIN
|
||||
value: zitadel.default.127.0.0.1.sslip.io
|
||||
image: ghcr.io/zitadel/zitadel:latest
|
||||
name: user-container
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
successThreshold: 1
|
||||
tcpSocket:
|
||||
port: 0
|
||||
resources: {}
|
||||
enableServiceLinks: false
|
||||
timeoutSeconds: 300
|
||||
Reference in New Issue
Block a user