From 4c96f7750dd8387ee87cccf87690ae101b56d0da Mon Sep 17 00:00:00 2001 From: RJ Sampson Date: Thu, 2 May 2024 12:56:05 -0600 Subject: [PATCH] feat(images): Add Postgres Bitnami Signed-off-by: RJ Sampson --- generated.tf | 9 +++ images/postgres-bitnami/README.md | 32 ++++++++ images/postgres-bitnami/config/main.tf | 19 +++++ .../config/template.apko.yaml | 51 ++++++++++++ images/postgres-bitnami/generated.tf | 13 +++ images/postgres-bitnami/main.tf | 46 +++++++++++ images/postgres-bitnami/metadata.yaml | 12 +++ images/postgres-bitnami/tests/main.tf | 79 +++++++++++++++++++ images/postgres-bitnami/tests/tls.sh | 28 +++++++ 9 files changed, 289 insertions(+) create mode 100644 images/postgres-bitnami/README.md create mode 100644 images/postgres-bitnami/config/main.tf create mode 100644 images/postgres-bitnami/config/template.apko.yaml create mode 100644 images/postgres-bitnami/generated.tf create mode 100644 images/postgres-bitnami/main.tf create mode 100644 images/postgres-bitnami/metadata.yaml create mode 100644 images/postgres-bitnami/tests/main.tf create mode 100755 images/postgres-bitnami/tests/tls.sh diff --git a/generated.tf b/generated.tf index 7d152ca623..95d808ceea 100644 --- a/generated.tf +++ b/generated.tf @@ -1043,6 +1043,11 @@ module "postgres" { target_repository = "${var.target_repository}/postgres" } +module "postgres-bitnami" { + source = "./images/postgres-bitnami" + target_repository = "${var.target_repository}/postgres-bitnami" +} + module "postgres-helm-compat" { source = "./images/postgres-helm-compat" target_repository = "${var.target_repository}/postgres-helm-compat" @@ -2336,6 +2341,10 @@ output "summary_postgres" { value = module.postgres.summary } +output "summary_postgres-bitnami" { + value = module.postgres-bitnami.summary +} + output "summary_postgres-helm-compat" { value = module.postgres-helm-compat.summary } diff --git a/images/postgres-bitnami/README.md b/images/postgres-bitnami/README.md new file mode 100644 index 0000000000..691a144fd7 --- /dev/null +++ b/images/postgres-bitnami/README.md @@ -0,0 +1,32 @@ + +# postgres-bitnami +| | | +| - | - | +| **OCI Reference** | `cgr.dev/chainguard/postgres-bitnami` | + + +* [View Image in Chainguard Academy](https://edu.chainguard.dev/chainguard/chainguard-images/reference/postgres-bitnami/overview/) +* [View Image Catalog](https://console.enforce.dev/images/catalog) for a full list of available tags. +* [Contact Chainguard](https://www.chainguard.dev/chainguard-images) for enterprise support, SLAs, and access to older tags.* + +--- + + + +Minimal PostgreSQL Bitnami image. + + + +## Download this Image +The image is available on `cgr.dev`: + +``` +docker pull cgr.dev/chainguard/postgres-bitnami:latest +``` + + + +This image provides PostgreSQL with bitnami compliance in place. + +The latest image and usage documentation can be found [here](https://github.com/chainguard-images/images/tree/main/images/postgres). + diff --git a/images/postgres-bitnami/config/main.tf b/images/postgres-bitnami/config/main.tf new file mode 100644 index 0000000000..287175e7f4 --- /dev/null +++ b/images/postgres-bitnami/config/main.tf @@ -0,0 +1,19 @@ +terraform { + required_providers { + apko = { source = "chainguard-dev/apko" } + } +} + +variable "extra_packages" { + description = "The additional packages to install (e.g. postgresql-15)." + default = [""] +} + +data "apko_config" "this" { + config_contents = file("${path.module}/template.apko.yaml") + extra_packages = var.extra_packages +} + +output "config" { + value = jsonencode(data.apko_config.this.config) +} diff --git a/images/postgres-bitnami/config/template.apko.yaml b/images/postgres-bitnami/config/template.apko.yaml new file mode 100644 index 0000000000..629dd81147 --- /dev/null +++ b/images/postgres-bitnami/config/template.apko.yaml @@ -0,0 +1,51 @@ +contents: + packages: + - glibc-locale-en + - busybox + - su-exec + # Postgres comes via var.extra_packages + +accounts: + groups: + - groupname: postgres + gid: 1001 + users: + - username: postgres + uid: 1001 + gid: 1001 + run-as: 1001 + +entrypoint: + command: /opt/bitnami/scripts/postgresql/entrypoint.sh /opt/bitnami/scripts/postgresql/run.sh + +environment: + PGDATA: /opt/bitnami/postgresql/data + # Postgres defers to locale and docker-library/postgres sets UTF-8 as default. + LANG: en_US.UTF-8 + BITNAMI_APP_NAME: postgresql + +paths: + - path: /opt/bitnami/postgresql/data + type: directory + uid: 1001 + gid: 1001 + permissions: 0o755 + recursive: true + - path: /opt/bitnami/postgresql/tmp + type: directory + uid: 1001 + gid: 1001 + permissions: 0o755 + recursive: true + - path: /opt/bitnami/postgresql/logs + type: directory + uid: 1001 + gid: 1001 + permissions: 0o755 + recursive: true + - path: /opt/bitnami/postgresql/conf + type: directory + uid: 1001 + gid: 1001 + permissions: 0o777 + recursive: true diff --git a/images/postgres-bitnami/generated.tf b/images/postgres-bitnami/generated.tf new file mode 100644 index 0000000000..e59873f1c5 --- /dev/null +++ b/images/postgres-bitnami/generated.tf @@ -0,0 +1,13 @@ +# DO NOT EDIT - this file is autogenerated by tfgen + +output "summary" { + value = merge( + { + basename(path.module) = { + "ref" = module.latest.image_ref + "config" = module.latest.config + "tags" = ["latest"] + } + }) +} + diff --git a/images/postgres-bitnami/main.tf b/images/postgres-bitnami/main.tf new file mode 100644 index 0000000000..9d213a375c --- /dev/null +++ b/images/postgres-bitnami/main.tf @@ -0,0 +1,46 @@ +terraform { + required_providers { + oci = { source = "chainguard-dev/oci" } + } +} + +variable "target_repository" { + description = "The docker repo into which the image and attestations should be published." +} + +module "latest-config" { + source = "./config" + extra_packages = [ + "postgresql", + "postgresql-client", + "postgresql-oci-entrypoint", + "postgresql-contrib", + "postgresql-bitnami-compat", + "libpq", + ] +} + +module "latest" { + source = "../../tflib/publisher" + name = basename(path.module) + target_repository = var.target_repository + config = module.latest-config.config + build-dev = true +} + +module "latest-test" { + source = "./tests" + digest = module.latest.image_ref +} + +resource "oci_tag" "latest" { + depends_on = [module.latest-test] + digest_ref = module.latest.image_ref + tag = "latest" +} + +resource "oci_tag" "latest-dev" { + depends_on = [module.latest-test] + digest_ref = module.latest.dev_ref + tag = "latest-dev" +} diff --git a/images/postgres-bitnami/metadata.yaml b/images/postgres-bitnami/metadata.yaml new file mode 100644 index 0000000000..41370df8b4 --- /dev/null +++ b/images/postgres-bitnami/metadata.yaml @@ -0,0 +1,12 @@ +name: postgres-bitnami +image: cgr.dev/chainguard/postgres-bitnami +logo: https://storage.googleapis.com/chainguard-academy/logos/postgres.svg +endoflife: "" +console_summary: "" +short_description: Minimal PostgreSQL Bitnami image. +compatibility_notes: "" +readme_file: README.md +upstream_url: https://www.postgresql.org/ +keywords: + - application + - databases diff --git a/images/postgres-bitnami/tests/main.tf b/images/postgres-bitnami/tests/main.tf new file mode 100644 index 0000000000..60a9a847c1 --- /dev/null +++ b/images/postgres-bitnami/tests/main.tf @@ -0,0 +1,79 @@ +terraform { + required_providers { + oci = { source = "chainguard-dev/oci" } + imagetest = { source = "chainguard-dev/imagetest" } + } +} + +variable "digest" { + description = "The image digest to run tests over." +} + +data "oci_string" "ref" { input = var.digest } + +data "imagetest_inventory" "this" {} + +resource "imagetest_harness_k3s" "this" { + name = "postgres" + inventory = data.imagetest_inventory.this + + sandbox = { + envs = { + "NAME" : "postgres" + "NAMESPACE" : "postgres" + } + mounts = [{ + source = path.module + destination = "/tests" + }] + } +} + +module "helm" { + source = "../../../tflib/imagetest/helm" + + name = "postgres" + namespace = "postgres" + chart = "oci://registry-1.docker.io/bitnamicharts/postgresql" + + # https://artifacthub.io/packages/helm/bitnami/postgresql#securing-traffic-using-tls + values = { + image = { + registry = data.oci_string.ref.registry + repository = data.oci_string.ref.repo + tag = data.oci_string.ref.pseudo_tag + digest = data.oci_string.ref.digest + } + volumePermissions = { + enabled = true + } + tls = { + enabled = true + autoGenerated = true + } + } +} + +resource "imagetest_feature" "basic" { + harness = imagetest_harness_k3s.this + name = "Basic" + description = "Basic functionality of the Postgres Helm chart." + + steps = [ + { + name = "Install Helm chart" + cmd = module.helm.install_cmd + }, + { + name = "Postgres TLS test" + workdir = "/tests" + cmd = <