Skip to content

Commit 462da58

Browse files
marcleblanc2marcleblanc2
authored
Update AWS example for RDS IAM auth docs (#770)
Will reference this example on the doc site for configuring AWS RDS IAM auth ### Checklist - [ ] Follow the [manual testing process](https://github.com/sourcegraph/deploy-sourcegraph-helm/blob/main/TEST.md) - [ ] Update [changelog](https://github.com/sourcegraph/deploy-sourcegraph-helm/blob/main/charts/sourcegraph/CHANGELOG.md) - [ ] Update [Kubernetes update doc](https://docs.sourcegraph.com/admin/updates/kubernetes) ### Test plan Doc update <!-- As part of SOC2/GN-104 and SOC2/GN-105 requirements, all pull requests are REQUIRED to provide a "test plan". A test plan is a loose explanation of what you have done or implemented to test this, as outlined in our Testing principles and guidelines: https://docs.sourcegraph.com/dev/background-information/testing_principles Write your test plan here after the "Test plan" header. -->
1 parent 42c3be6 commit 462da58

File tree

1 file changed

+175
-11
lines changed

1 file changed

+175
-11
lines changed

‎charts/sourcegraph/examples/aws/override.yaml‎

Lines changed: 175 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,180 @@
1+
# Example Helm override file for deploying on AWS EKS
2+
3+
# Using:
4+
# ALB Ingress Controller EKS add-on
5+
# RDS databases, with IAM authentication
6+
# Customer-manged encryption key for EBS storage volumes for persistent volumes
7+
# Not EKS Auto Mode, but with comments for changes required for Auto Mode
8+
# Kubernetes-native Executors, in the same namespace
9+
10+
################################################################################
11+
# Sourcegraph-wide configuration
12+
################################################################################
13+
14+
storageClass:
15+
create: true
16+
provisioner: ebs.csi.aws.com # If using the EBS CSI EKS add-on
17+
# provisioner: ebs.csi.eks.amazonaws.com # If using an AWS EKS "Auto mode" cluster, need use its storage provisioner
18+
reclaimPolicy: Retain
19+
type: gp3
20+
volumeBindingMode: WaitForFirstConsumer
21+
parameters:
22+
# If using CMK encryption for EBS volumes for persistent storage
23+
encrypted: "true"
24+
kmsKeyId: arn:aws:kms:region:account-id:key/key-id # Full ARN of the key
25+
26+
################################################################################
27+
# Databases
28+
# Using external DBs, on RDS, with IAM auth
29+
################################################################################
30+
31+
codeInsightsDB:
32+
enabled: false
33+
auth:
34+
database: "sg"
35+
host: codeinsights.rds.amazon.com
36+
password: "" # Empty password for IAM auth
37+
port: "5432"
38+
sslmode: require
39+
user: "sg"
40+
41+
codeIntelDB:
42+
enabled: false
43+
auth:
44+
database: "sg"
45+
host: codeintel.rds.amazon.com
46+
password: "" # Empty password for IAM auth
47+
port: "5432"
48+
sslmode: require
49+
user: "sg"
50+
51+
pgsql:
52+
enabled: false
53+
auth:
54+
database: "sg"
55+
host: pgsql.rds.amazon.com
56+
password: "" # Empty password for IAM auth
57+
port: "5432"
58+
sslmode: require
59+
user: "sg"
60+
61+
################################################################################
62+
# Frontend / ingress
63+
################################################################################
64+
165
frontend:
66+
267
ingress:
368
enabled: true
469
annotations:
5-
kubernetes.io/ingress.class: alb # aws load balancer controller ingressClass name
6-
# additional aws alb ingress controller supported annotations
7-
# ...
8-
# replace with your actual domain
9-
host: sourcegraph.company.com
70+
# Unset deprecated annotation to hide warning
71+
kubernetes.io/ingress.class: null
1072

11-
storageClass:
12-
create: true
13-
type: gp3 # This configures SSDs (recommended).
14-
provisioner: ebs.csi.aws.com
15-
volumeBindingMode: WaitForFirstConsumer
16-
reclaimPolicy: Retain
73+
# AWS ALB ingress controller annotations
74+
alb.ingress.kubernetes.io/healthcheck-path: /healthz
75+
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
76+
alb.ingress.kubernetes.io/ssl-redirect: '443'
77+
78+
# Replace with your actual hostname, for TLS cert lookup, and ALB Ingress Controller, and ExternalDNS
79+
host: sourcegraph.example.com
80+
ingressClassName: alb
81+
82+
env:
83+
# If using databases in AWS RDS, with IAM authentication
84+
PG_CONNECTION_UPDATER:
85+
value: EC2_ROLE_CREDENTIALS
86+
# If using databases in AWS RDS, with IAM authentication, and regional endpoints
87+
AWS_STS_REGIONAL_ENDPOINTS:
88+
value: regional
89+
90+
################################################################################
91+
# Migrator
92+
################################################################################
93+
94+
migrator:
95+
96+
# Need to duplicate these environment variables on migrator, however, other pods will pull them from frontend
97+
env:
98+
# If using databases in AWS RDS, with IAM authentication
99+
PG_CONNECTION_UPDATER:
100+
value: EC2_ROLE_CREDENTIALS
101+
# If using databases in AWS RDS, with IAM authentication, and regional endpoints
102+
AWS_STS_REGIONAL_ENDPOINTS:
103+
value: regional
104+
105+
### Use the args list to operate migrator commands, if needed
106+
### Available commands can be found at
107+
### https://sourcegraph.com/docs/admin/updates/migrator/migrator-operations#commands
108+
109+
### Manually mark migrations as completed
110+
# After installing the Postgres extensions on fresh, new RDS databases via Terraform / other means
111+
# Run these one at a time, then run again with them all commented out for a normal startup
112+
# args:
113+
# - add-log
114+
# - --db=frontend
115+
# - --version=1680296731
116+
117+
# args:
118+
# - add-log
119+
# - --db=codeintel
120+
# - --version=1679010276
121+
122+
# args:
123+
# - add-log
124+
# - --db=codeinsights
125+
# - --version=1675347548
126+
127+
### Drift check
128+
# args:
129+
# - drift
130+
# - -version=v6.8.0
131+
132+
### Multi-version upgrades
133+
### https://sourcegraph.com/docs/admin/deploy/kubernetes#multi-version-upgrades
134+
# args:
135+
# - upgrade
136+
# - -from=v6.8.0
137+
# - -to=v6.10.3349
138+
139+
################################################################################
140+
# Executors
141+
# If deploying Kubernetes native executors in the same namespace,
142+
# you can use the same override.yaml file for both Helm charts
143+
################################################################################
144+
145+
executor:
146+
frontendUrl: "http://sourcegraph-frontend:30080" # Use cluster-local DNS name, to avoid paying extra for network traffic
147+
frontendPassword: "long_random_password_which_matches_in_site_config"
148+
queueNames: [ "batches", "codeintel" ]
149+
150+
################################################################################
151+
# Extra resources
152+
################################################################################
153+
154+
# extraResources:
155+
156+
# If using an AWS EKS "Auto mode" cluster, need to create the IngressClass, and IngressClassParams
157+
# https://docs.aws.amazon.com/eks/latest/userguide/auto-elb-example.html
158+
# https://docs.aws.amazon.com/eks/latest/userguide/auto-configure-alb.html
159+
160+
# - apiVersion: eks.amazonaws.com/v1
161+
# kind: IngressClassParams
162+
# metadata:
163+
# name: alb
164+
# spec:
165+
# scheme: internet-facing
166+
# # certificateARNs: # ALB seems to be smart enough, and have the needed perms, to find the correct cert based on matching host
167+
168+
# - apiVersion: networking.k8s.io/v1
169+
# kind: IngressClass
170+
# metadata:
171+
# annotations:
172+
# ingressclass.kubernetes.io/is-default-class: "true"
173+
# name: alb
174+
# spec:
175+
# # Use the EKS Auto Mode ALB controller
176+
# controller: eks.amazonaws.com/alb
177+
# parameters:
178+
# apiGroup: eks.amazonaws.com
179+
# kind: IngressClassParams
180+
# name: alb

0 commit comments

Comments
 (0)