From 0a5fef55b15a62621a1cc51f8cd4775f0b5bf1f7 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Mon, 10 Jan 2022 01:14:41 +0800
Subject: [PATCH 01/64] chore(database): use exec runner replace docker runner

---
 .drone/drone.yml | 59 +++++++++---------------------------------------
 1 file changed, 11 insertions(+), 48 deletions(-)

diff --git a/.drone/drone.yml b/.drone/drone.yml
index 233caf3..0f1474f 100644
--- a/.drone/drone.yml
+++ b/.drone/drone.yml
@@ -1,5 +1,5 @@
 kind: pipeline
-type: docker
+type: exec
 name: linux-amd64
 
 platform:
@@ -8,9 +8,6 @@ platform:
 
 steps:
 - name: test
-  image: docker.io/drycc/go-dev
-  pull: always
-  privileged: true
   commands:
   - make docker-build test
   environment:
@@ -22,14 +19,8 @@ steps:
     - push
     - tag
     - pull_request
-  volumes:
-  - name: image_registries
-    path: /etc/containers/registries.conf
 
 - name: publish
-  image: docker.io/drycc/go-dev
-  pull: always
-  privileged: true
   commands:
   - echo $DOCKER_PASSWORD | docker login $DRYCC_REGISTRY --username $DOCKER_USERNAME --password-stdin
   - make docker-build docker-immutable-push
@@ -47,24 +38,10 @@ steps:
     event:
     - push
     - tag
-  volumes:
-  - name: image_registries
-    path: /etc/containers/registries.conf
-
-trigger:
-  event:
-  - push
-  - tag
-  - pull_request
-
-volumes:
-- name: image_registries
-  host:
-    path: /etc/containers/registries.conf
 
 ---
 kind: pipeline
-type: docker
+type: exec
 name: linux-arm64
 
 platform:
@@ -73,9 +50,6 @@ platform:
 
 steps:
 - name: publish
-  image: docker.io/drycc/go-dev
-  pull: always
-  privileged: true
   commands:
   - echo $DOCKER_PASSWORD | docker login $DRYCC_REGISTRY --username $DOCKER_USERNAME --password-stdin
   - make docker-build docker-immutable-push
@@ -89,19 +63,10 @@ steps:
       from_secret: docker_username
     DOCKER_PASSWORD:
       from_secret: docker_password
-  volumes:
-  - name: image_registries
-    path: /etc/containers/registries.conf
-
-trigger:
-  event:
-  - push
-  - tag
-
-volumes:
-- name: image_registries
-  host:
-    path: /etc/containers/registries.conf
+  when:
+    event:
+    - push
+    - tag
 
 ---
 kind: pipeline
@@ -143,12 +108,11 @@ depends_on:
 
 ---
 kind: pipeline
-type: docker
+type: exec
 name: chart
 
 steps:
 - name: generate chart
-  image: docker.io/drycc/python-dev
   commands:
   - IMAGE_TAG=$([ ! -z $DRONE_TAG ] && echo \"${DRONE_TAG:1}\" || echo \"canary\")
   - sed -i "s/image_tag:\ \"canary\"/image_tag:\ $IMAGE_TAG/g" charts/database/values.yaml
@@ -161,8 +125,7 @@ steps:
       from_secret: chartmuseum_password
     CHARTMUSEUM_API:
       from_secret: chartmuseum_api
-
-trigger:
-  event:
-  - push
-  - tag
+  when:
+    event:
+    - push
+    - tag

From 6c4cfe9afbe7b42992ada1c9637b8c0d1cdc430f Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Fri, 14 Jan 2022 10:22:15 +0800
Subject: [PATCH 02/64] chore(database): canonical charts naming

---
 .drone/drone.yml                              |  2 +-
 .../templates/database-deployment.yaml        | 20 +++++++++----------
 .../templates/database-secret-creds.yaml      |  6 +++---
 .../templates/database-service-account.yaml   |  2 +-
 .../database/templates/database-service.yaml  |  2 +-
 charts/database/values.yaml                   | 16 +++++++--------
 6 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/.drone/drone.yml b/.drone/drone.yml
index 0f1474f..3abfe2c 100644
--- a/.drone/drone.yml
+++ b/.drone/drone.yml
@@ -115,7 +115,7 @@ steps:
 - name: generate chart
   commands:
   - IMAGE_TAG=$([ ! -z $DRONE_TAG ] && echo \"${DRONE_TAG:1}\" || echo \"canary\")
-  - sed -i "s/image_tag:\ \"canary\"/image_tag:\ $IMAGE_TAG/g" charts/database/values.yaml
+  - sed -i "s/imageTag:\ \"canary\"/imageTag:\ $IMAGE_TAG/g" charts/database/values.yaml
   - helm package charts/database --version ${DRONE_TAG:-v1.0.0}
   - curl -u $CHARTMUSEUM_USERNAME:$CHARTMUSEUM_PASSWORD -F chart=@database-${DRONE_TAG:-v1.0.0}.tgz "$CHARTMUSEUM_API/api/$([ -z $DRONE_TAG ] && echo testing || echo stable)/charts"
   environment:
diff --git a/charts/database/templates/database-deployment.yaml b/charts/database/templates/database-deployment.yaml
index a7f0223..9376756 100644
--- a/charts/database/templates/database-deployment.yaml
+++ b/charts/database/templates/database-deployment.yaml
@@ -1,4 +1,4 @@
-{{- if eq .Values.global.database_location "on-cluster" }}
+{{- if eq .Values.global.databaseLocation "on-cluster" }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -6,7 +6,7 @@ metadata:
   labels:
     heritage: drycc
   annotations:
-    component.drycc.cc/version: {{ .Values.image_tag }}
+    component.drycc.cc/version: {{ .Values.imageTag }}
 spec:
   replicas: 1
   strategy:
@@ -23,7 +23,7 @@ spec:
       initContainers:
       - name: drycc-database-init
         image: docker.io/drycc/python-dev:latest
-        imagePullPolicy: {{.Values.image_pull_policy}}
+        imagePullPolicy: {{.Values.imagePullPolicy}}
         command:
           - netcat
           - -v
@@ -31,18 +31,18 @@ spec:
           - $(DRYCC_MINIO_SERVICE_HOST):$(DRYCC_MINIO_SERVICE_PORT)
       containers:
         - name: drycc-database
-          image: {{.Values.image_registry}}/{{.Values.image_org}}/postgres:{{.Values.image_tag}}
-          imagePullPolicy: {{.Values.image_pull_policy}}
+          image: {{.Values.imageRegistry}}/{{.Values.imageOrg}}/postgres:{{.Values.imageTag}}
+          imagePullPolicy: {{.Values.imagePullPolicy}}
           ports:
             - containerPort: 5432
-{{- if or (.Values.limits_cpu) (.Values.limits_memory)}}
+{{- if or (.Values.limitsCpu) (.Values.limitsMemory)}}
           resources:
             limits:
-{{- if (.Values.limits_cpu) }}
-              cpu: {{.Values.limits_cpu}}
+{{- if (.Values.limitsCpu) }}
+              cpu: {{.Values.limitsCpu}}
 {{- end}}
-{{- if (.Values.limits_memory) }}
-              memory: {{.Values.limits_memory}}
+{{- if (.Values.limitsMemory) }}
+              memory: {{.Values.limitsMemory}}
 {{- end}}
 {{- end}}
           env:
diff --git a/charts/database/templates/database-secret-creds.yaml b/charts/database/templates/database-secret-creds.yaml
index eee2b80..9dd65eb 100644
--- a/charts/database/templates/database-secret-creds.yaml
+++ b/charts/database/templates/database-secret-creds.yaml
@@ -1,4 +1,4 @@
-{{ if eq .Values.global.database_location "on-cluster"}}
+{{ if eq .Values.global.databaseLocation "on-cluster"}}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -11,6 +11,6 @@ metadata:
 data:
   user: {{ if .Values.username | default "" | ne "" }}{{ .Values.username | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
   password: {{ if .Values.password | default "" | ne "" }}{{ .Values.password | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
-  controller-database-name: {{ if .Values.controller_database_name | default "" | ne "" }}{{ .Values.controller_database_name | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
-  passport-database-name: {{ if .Values.passport_database_name | default "" | ne "" }}{{ .Values.passport_database_name | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
+  controller-database-name: {{ if .Values.controllerDatabaseName | default "" | ne "" }}{{ .Values.controllerDatabaseName | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
+  passport-database-name: {{ if .Values.passportDatabaseName | default "" | ne "" }}{{ .Values.passportDatabaseName | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
 {{- end }}
diff --git a/charts/database/templates/database-service-account.yaml b/charts/database/templates/database-service-account.yaml
index 094eef2..553f18e 100644
--- a/charts/database/templates/database-service-account.yaml
+++ b/charts/database/templates/database-service-account.yaml
@@ -1,4 +1,4 @@
-{{- if eq .Values.global.database_location "on-cluster" }}
+{{- if eq .Values.global.databaseLocation "on-cluster" }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
diff --git a/charts/database/templates/database-service.yaml b/charts/database/templates/database-service.yaml
index cefe91d..f589721 100644
--- a/charts/database/templates/database-service.yaml
+++ b/charts/database/templates/database-service.yaml
@@ -1,4 +1,4 @@
-{{- if eq .Values.global.database_location "on-cluster" }}
+{{- if eq .Values.global.databaseLocation "on-cluster" }}
 apiVersion: v1
 kind: Service
 metadata:
diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index ec2e51d..6701c21 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -1,13 +1,13 @@
-image_org: "drycc"
-image_pull_policy: "Always"
-image_tag: "canary"
-image_registry: "docker.io"
-# limits_cpu: "100m"
-# limits_memory: "50Mi"
+imageOrg: "drycc"
+imagePullPolicy: "Always"
+imageTag: "canary"
+imageRegistry: "docker.io"
+# limitsCpu: "100m"
+# limitsMemory: "50Mi"
 timeout: "1200"
 # The username and password to be used by the on-cluster database.
 # If left empty they will be generated using randAlphaNum
 username: ""
 password: ""
-controller_database_name: "drycc_controller"
-passport_database_name: "drycc_passport"
+controllerDatabaseName: "drycc_controller"
+passportDatabaseName: "drycc_passport"

From 022a37de997eddfee9238b5de9a1c58c32500ada Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Mon, 17 Jan 2022 09:27:36 +0800
Subject: [PATCH 03/64] feat(database): upgrade to pg14

---
 Dockerfile                                                   | 5 +++--
 charts/database/values.yaml                                  | 2 +-
 rootfs/docker-entrypoint-initdb.d/003_restore_from_backup.sh | 2 ++
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index d4d386f..b7a9a4e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,7 +14,7 @@ RUN apt-get update \
   && make pg_install
 
 
-FROM docker.io/library/postgres:13-buster
+FROM docker.io/library/postgres:14-bullseye
 
 COPY rootfs /
 COPY --from=mc /usr/bin/mc /bin/mc
@@ -23,7 +23,8 @@ COPY --from=builder /usr/local/bin/wal-g  /bin/wal-g
 ENV PGDATA $PGDATA/$PG_MAJOR
 ENV WALG_ENVDIR /etc/wal-g.d/env
 
-RUN mkdir -p $WALG_ENVDIR \
+RUN sed -i -r 's/#huge_pages.*?/huge_pages = try/g' /usr/share/postgresql/postgresql.conf.sample \
+  && mkdir -p $WALG_ENVDIR \
   && apt-get update \
   && apt-get install -y --no-install-recommends \
     jq \
diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index 6701c21..da68f85 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -9,5 +9,5 @@ timeout: "1200"
 # If left empty they will be generated using randAlphaNum
 username: ""
 password: ""
-controllerDatabaseName: "drycc_controller"
 passportDatabaseName: "drycc_passport"
+controllerDatabaseName: "drycc_controller"
diff --git a/rootfs/docker-entrypoint-initdb.d/003_restore_from_backup.sh b/rootfs/docker-entrypoint-initdb.d/003_restore_from_backup.sh
index 6caedc5..0f7f9f9 100755
--- a/rootfs/docker-entrypoint-initdb.d/003_restore_from_backup.sh
+++ b/rootfs/docker-entrypoint-initdb.d/003_restore_from_backup.sh
@@ -21,6 +21,7 @@ lc_monetary = 'C'     # locale for monetary formatting
 lc_numeric = 'C'      # locale for number formatting
 lc_time = 'C'       # locale for time formatting
 default_text_search_config = 'pg_catalog.english'
+huge_pages = try
 wal_level = archive
 archive_mode = on
 archive_command = 'envdir "${WALG_ENVDIR}" wal-g wal-push %p'
@@ -48,6 +49,7 @@ EOF
       -w start
 else
   cat << EOF >> "$PGDATA/postgresql.conf"
+huge_pages = try
 wal_level = archive
 archive_mode = on
 archive_command = 'envdir "${WALG_ENVDIR}" wal-g wal-push %p'

From 07e637ff1896aae73917ac0e757679c6229954cf Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Mon, 17 Jan 2022 22:09:54 +0800
Subject: [PATCH 04/64] chore(database): disable huge_pages

---
 Dockerfile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index b7a9a4e..b260bdf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,15 +23,15 @@ COPY --from=builder /usr/local/bin/wal-g  /bin/wal-g
 ENV PGDATA $PGDATA/$PG_MAJOR
 ENV WALG_ENVDIR /etc/wal-g.d/env
 
-RUN sed -i -r 's/#huge_pages.*?/huge_pages = try/g' /usr/share/postgresql/postgresql.conf.sample \
-  && mkdir -p $WALG_ENVDIR \
+RUN mkdir -p $WALG_ENVDIR \
   && apt-get update \
   && apt-get install -y --no-install-recommends \
     jq \
     python3 \
     ca-certificates \
     python3-pip \
-  && pip3 install envdir
+  && pip3 install envdir \
+  && sed -i -r 's/#huge_pages.*?/huge_pages = off/g' /usr/share/postgresql/postgresql.conf.sample
 
 CMD ["/docker-entrypoint.sh", "postgres"]
 EXPOSE 5432

From 498aaed917c30c66865283492fe5ebcf37fd083b Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Tue, 18 Jan 2022 16:50:37 +0800
Subject: [PATCH 05/64] feat(database): add hugepages support

---
 Dockerfile                                     |  3 +--
 .../templates/database-deployment.yaml         | 18 ++++++++++++------
 charts/database/values.yaml                    |  2 ++
 rootfs/docker-entrypoint.sh                    |  1 -
 4 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index b260bdf..bf67369 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -30,8 +30,7 @@ RUN mkdir -p $WALG_ENVDIR \
     python3 \
     ca-certificates \
     python3-pip \
-  && pip3 install envdir \
-  && sed -i -r 's/#huge_pages.*?/huge_pages = off/g' /usr/share/postgresql/postgresql.conf.sample
+  && pip3 install envdir
 
 CMD ["/docker-entrypoint.sh", "postgres"]
 EXPOSE 5432
diff --git a/charts/database/templates/database-deployment.yaml b/charts/database/templates/database-deployment.yaml
index 9376756..673473a 100644
--- a/charts/database/templates/database-deployment.yaml
+++ b/charts/database/templates/database-deployment.yaml
@@ -35,16 +35,22 @@ spec:
           imagePullPolicy: {{.Values.imagePullPolicy}}
           ports:
             - containerPort: 5432
-{{- if or (.Values.limitsCpu) (.Values.limitsMemory)}}
+          {{- if or (.Values.limitsCpu) (.Values.limitsMemory)}}
           resources:
             limits:
-{{- if (.Values.limitsCpu) }}
+              {{- if (.Values.limitsCpu) }}
               cpu: {{.Values.limitsCpu}}
-{{- end}}
-{{- if (.Values.limitsMemory) }}
+              {{- end}}
+              {{- if (.Values.limitsMemory) }}
               memory: {{.Values.limitsMemory}}
-{{- end}}
-{{- end}}
+              {{- end}}
+              {{- if (.Values.limitsHugepages2Mi) }}
+              hugepages-2Mi: {{.Values.limitsHugepages2Mi}}
+              {{- end}}
+              {{- if (.Values.limitsHugepages1Gi) }}
+              hugepages-1Gi: {{.Values.limitsHugepages1Gi}}
+              {{- end}}
+          {{- end}}
           env:
             - name: DATABASE_STORAGE
               value: "{{.Values.global.storage}}"
diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index da68f85..fd2da2e 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -4,6 +4,8 @@ imageTag: "canary"
 imageRegistry: "docker.io"
 # limitsCpu: "100m"
 # limitsMemory: "50Mi"
+# limitsHugepages2Mi: 100Mi
+# limitsHugepages1Gi: 2Gi
 timeout: "1200"
 # The username and password to be used by the on-cluster database.
 # If left empty they will be generated using randAlphaNum
diff --git a/rootfs/docker-entrypoint.sh b/rootfs/docker-entrypoint.sh
index b9fcf28..14786c3 100755
--- a/rootfs/docker-entrypoint.sh
+++ b/rootfs/docker-entrypoint.sh
@@ -26,7 +26,6 @@ if [ "$1" = 'postgres' ]; then
 	# look specifically for PG_VERSION, as it is expected in the DB dir
 	if [ ! -s "$PGDATA/PG_VERSION" ]; then
 		gosu postgres initdb
-
 		# check password first so we can output the warning before postgres
 		# messes it up
 		if [ "$POSTGRES_PASSWORD" ]; then

From f9ef8382c95b8b1d971bd03024a1818d2fdfd6db Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Thu, 20 Jan 2022 10:48:36 +0800
Subject: [PATCH 06/64] chore(database): add persistence

---
 .../templates/database-deployment.yaml        |  9 +++++++
 charts/database/templates/database-pvc.yaml   | 24 +++++++++++++++++++
 charts/database/values.yaml                   | 16 +++++++++++++
 3 files changed, 49 insertions(+)
 create mode 100644 charts/database/templates/database-pvc.yaml

diff --git a/charts/database/templates/database-deployment.yaml b/charts/database/templates/database-deployment.yaml
index 673473a..11226ab 100644
--- a/charts/database/templates/database-deployment.yaml
+++ b/charts/database/templates/database-deployment.yaml
@@ -74,7 +74,16 @@ spec:
               mountPath: /var/run/secrets/drycc/database/creds
             - name: objectstore-creds
               mountPath: /var/run/secrets/drycc/objectstore/creds
+            {{- if .Values.persistence.enabled }}
+            - name: database-data
+              mountPath: /var/lib/postgresql
+            {{- end }}
       volumes:
+        {{- if .Values.persistence.enabled }}
+        - name: database-data
+          persistentVolumeClaim:
+            claimName: drycc-database
+        {{- end }}
         - name: database-creds
           secret:
             secretName: database-creds
diff --git a/charts/database/templates/database-pvc.yaml b/charts/database/templates/database-pvc.yaml
new file mode 100644
index 0000000..1de3839
--- /dev/null
+++ b/charts/database/templates/database-pvc.yaml
@@ -0,0 +1,24 @@
+{{- if .Values.persistence.enabled }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: drycc-database
+  labels:
+    heritage: drycc
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode | quote }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size | quote }}
+{{- if .Values.persistence.storageClass }}
+{{- if (eq "-" .Values.persistence.storageClass) }}
+  storageClassName: ""
+{{- else }}
+  storageClassName: "{{ .Values.persistence.storageClass }}"
+{{- end }}
+{{- end }}
+{{- if .Values.persistence.volumeName }}
+  volumeName: "{{ .Values.persistence.volumeName }}"
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index fd2da2e..8a7adfc 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -7,6 +7,22 @@ imageRegistry: "docker.io"
 # limitsHugepages2Mi: 100Mi
 # limitsHugepages1Gi: 2Gi
 timeout: "1200"
+# GCP PDs and EBS volumes are supported only
+persistence:
+  enabled: false # Set to true to enable persistence
+  accessMode: ReadWriteOnce
+  size: 5Gi # PVC size
+  ## database data Persistent Volume Storage Class
+  ## If defined, storageClassName: <storageClass>
+  ## If set to "-", storageClassName: "", which disables dynamic provisioning
+  ## If undefined (the default) or set to null, no storageClassName spec is
+  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
+  ##   GKE, AWS & OpenStack)
+  ##
+  ## Storage class of PV to bind. By default it looks for standard storage class.
+  ## If the PV uses a different storage class, specify that here.
+  storageClass: ""
+  volumeName: ""
 # The username and password to be used by the on-cluster database.
 # If left empty they will be generated using randAlphaNum
 username: ""

From 5ffa541eb5198dabb22a84ae93410488ef9ef9f6 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Tue, 25 Jan 2022 17:02:11 +0800
Subject: [PATCH 07/64] chore(database): provide any additional service
 annotations

---
 charts/database/templates/database-service.yaml | 4 ++++
 charts/database/values.yaml                     | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/charts/database/templates/database-service.yaml b/charts/database/templates/database-service.yaml
index f589721..cc95aa7 100644
--- a/charts/database/templates/database-service.yaml
+++ b/charts/database/templates/database-service.yaml
@@ -3,6 +3,10 @@ apiVersion: v1
 kind: Service
 metadata:
   name: drycc-database
+  annotations:
+    {{- with .Values.service.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
   labels:
     heritage: drycc
 spec:
diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index 8a7adfc..4a4a53c 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -7,6 +7,10 @@ imageRegistry: "docker.io"
 # limitsHugepages2Mi: 100Mi
 # limitsHugepages1Gi: 2Gi
 timeout: "1200"
+# Service
+service:
+  # Provide any additional service annotations
+  annotations: {}
 # GCP PDs and EBS volumes are supported only
 persistence:
   enabled: false # Set to true to enable persistence

From 57d32dc81e7f77a1ac92f15544c79c8d8198cb03 Mon Sep 17 00:00:00 2001
From: lijianguo <lijianguo@zhumengyuan.com>
Date: Wed, 2 Mar 2022 14:19:41 +0800
Subject: [PATCH 08/64] chore(dockerfile): use drycc/base image

---
 Dockerfile               | 68 ++++++++++++++++++++++------------------
 Makefile                 |  2 +-
 contrib/ci/test-minio.sh |  2 +-
 contrib/ci/test.sh       |  2 +-
 4 files changed, 41 insertions(+), 33 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index bf67369..f195699 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,36 +1,44 @@
-FROM docker.io/minio/mc:latest as mc
+FROM docker.io/drycc/base:bullseye
 
-
-FROM docker.io/library/golang:buster as builder
-ARG GOBIN=/usr/local/bin
-ARG WAL_G_VERSION=v1.1
-
-RUN apt-get update \
-  && apt-get install -y git gcc liblzo2-dev cmake \
-  && git clone --dept 1 -b $WAL_G_VERSION https://github.com/wal-g/wal-g $GOPATH/src/github.com/wal-g/wal-g \
-  && cd $GOPATH/src/github.com/wal-g/wal-g \
-  && make install \
-  && make deps \
-  && make pg_install
-
-
-FROM docker.io/library/postgres:14-bullseye
-
-COPY rootfs /
-COPY --from=mc /usr/bin/mc /bin/mc
-COPY --from=builder /usr/local/bin/wal-g  /bin/wal-g
-
-ENV PGDATA $PGDATA/$PG_MAJOR
+ENV PGDATA /opt/drycc/postgresql/14/data
 ENV WALG_ENVDIR /etc/wal-g.d/env
 
-RUN mkdir -p $WALG_ENVDIR \
-  && apt-get update \
-  && apt-get install -y --no-install-recommends \
-    jq \
-    python3 \
-    ca-certificates \
-    python3-pip \
-  && pip3 install envdir
+COPY rootfs/bin /bin/
+COPY rootfs/docker-entrypoint-initdb.d /docker-entrypoint-initdb.d/
+COPY rootfs/docker-entrypoint.sh /docker-entrypoint.sh
+ENV JQ_VERSION="1.6" \
+  GOSU_VERSION="1.14" \
+  MC_VERSION="2022.02.26.03.58.31" \
+  WAL_G_VERSION="1.1" \
+  PYTHON_VERSION="3.10.2" \
+  POSTGRESQL_VERSION="14.2"
 
+RUN mkdir -p $WALG_ENVDIR \
+  && install-stack jq $JQ_VERSION \
+  && install-stack gosu $GOSU_VERSION \
+  && install-stack mc $MC_VERSION \
+  && install-stack wal-g $WAL_G_VERSION \
+  && install-stack python $PYTHON_VERSION \
+  && install-stack postgresql $POSTGRESQL_VERSION && . init-stack \
+  && rm -rf \
+      /usr/share/doc \
+      /usr/share/man \
+      /usr/share/info \
+      /usr/share/locale \
+      /var/lib/apt/lists/* \
+      /var/log/* \
+      /var/cache/debconf/* \
+      /etc/systemd \
+      /lib/lsb \
+      /lib/udev \
+      /usr/lib/`echo $(uname -m)`-linux-gnu/gconv/IBM* \
+      /usr/lib/`echo $(uname -m)`-linux-gnu/gconv/EBC* \
+  && mkdir -p /usr/share/man/man{1..8} \
+  && mkdir -p /run/postgresql $PGDATA \
+  && groupadd postgres && useradd -g postgres postgres \
+  && chown -R postgres:postgres /run/postgresql $PGDATA \
+  && set -eux; pip3 install --disable-pip-version-check --no-cache-dir envdir 2>/dev/null
+
+ENTRYPOINT ["init-stack"]
 CMD ["/docker-entrypoint.sh", "postgres"]
 EXPOSE 5432
diff --git a/Makefile b/Makefile
index 6c14bbb..df0529a 100644
--- a/Makefile
+++ b/Makefile
@@ -14,7 +14,7 @@ SHELL_SCRIPTS = $(wildcard _scripts/*.sh contrib/ci/*.sh rootfs/bin/*)
 # The following variables describe the containerized development environment
 # and other build options
 DEV_ENV_IMAGE := ${DEV_REGISTRY}/drycc/go-dev
-DEV_ENV_WORK_DIR := /go/src/${REPO_PATH}
+DEV_ENV_WORK_DIR := /opt/drycc/go/src/${REPO_PATH}
 DEV_ENV_CMD := docker run --rm -v ${CURDIR}:${DEV_ENV_WORK_DIR} -w ${DEV_ENV_WORK_DIR} ${DEV_ENV_IMAGE}
 DEV_ENV_CMD_INT := docker run -it --rm -v ${CURDIR}:${DEV_ENV_WORK_DIR} -w ${DEV_ENV_WORK_DIR} ${DEV_ENV_IMAGE}
 
diff --git a/contrib/ci/test-minio.sh b/contrib/ci/test-minio.sh
index 1d071c5..c7d6120 100755
--- a/contrib/ci/test-minio.sh
+++ b/contrib/ci/test-minio.sh
@@ -26,7 +26,7 @@ echo "1234567890123456789012345678901234567890" > "${CURRENT_DIR}"/tmp/aws-user/
 
 # boot minio
 mkdir -p "${CURRENT_DIR}"/tmp/bin
-echo "ls /data/*/*/basebackups_005" > "${CURRENT_DIR}"/tmp/bin/backups.sh
+echo "ls /data/*/basebackups_005" > "${CURRENT_DIR}"/tmp/bin/backups.sh
 MINIO_JOB=$(docker run -d \
   -v "${CURRENT_DIR}"/tmp/bin:/tmp/bin \
   -v "${CURRENT_DIR}"/tmp/aws-user:/var/run/secrets/drycc/objectstore/creds \
diff --git a/contrib/ci/test.sh b/contrib/ci/test.sh
index 963f1fb..5d124c8 100755
--- a/contrib/ci/test.sh
+++ b/contrib/ci/test.sh
@@ -41,5 +41,5 @@ check-postgres() {
 
   # check if postgres is running
   puts-step "checking if postgres is running"
-  docker exec "$1" is_running
+  docker exec "$1" init-stack is_running
 }

From 5cce599f98c094c33bb55c8c4a3b1f6a79fe588a Mon Sep 17 00:00:00 2001
From: lijianguo <lijianguo@zhumengyuan.com>
Date: Thu, 3 Mar 2022 09:42:36 +0800
Subject: [PATCH 09/64] chore(dockerfile): change entrypoint

---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index f195699..95180c2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -39,6 +39,6 @@ RUN mkdir -p $WALG_ENVDIR \
   && chown -R postgres:postgres /run/postgresql $PGDATA \
   && set -eux; pip3 install --disable-pip-version-check --no-cache-dir envdir 2>/dev/null
 
-ENTRYPOINT ["init-stack"]
-CMD ["/docker-entrypoint.sh", "postgres"]
+ENTRYPOINT ["init-stack", "/docker-entrypoint.sh"]
+CMD ["postgres"]
 EXPOSE 5432

From f565eb5281279cf08861604eefcc88076242507f Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Fri, 4 Mar 2022 09:53:22 +0800
Subject: [PATCH 10/64] fix(database): premission denied

---
 Dockerfile                                         | 8 +++++---
 charts/database/templates/database-deployment.yaml | 6 ++++--
 contrib/ci/test-minio.sh                           | 4 ++--
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 95180c2..620d47d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,5 @@
 FROM docker.io/drycc/base:bullseye
 
-ENV PGDATA /opt/drycc/postgresql/14/data
-ENV WALG_ENVDIR /etc/wal-g.d/env
-
 COPY rootfs/bin /bin/
 COPY rootfs/docker-entrypoint-initdb.d /docker-entrypoint-initdb.d/
 COPY rootfs/docker-entrypoint.sh /docker-entrypoint.sh
@@ -11,8 +8,13 @@ ENV JQ_VERSION="1.6" \
   MC_VERSION="2022.02.26.03.58.31" \
   WAL_G_VERSION="1.1" \
   PYTHON_VERSION="3.10.2" \
+  PG_MAJOR=14 \
   POSTGRESQL_VERSION="14.2"
 
+
+ENV PGDATA /data/${PG_MAJOR}
+ENV WALG_ENVDIR /etc/wal-g.d/env
+
 RUN mkdir -p $WALG_ENVDIR \
   && install-stack jq $JQ_VERSION \
   && install-stack gosu $GOSU_VERSION \
diff --git a/charts/database/templates/database-deployment.yaml b/charts/database/templates/database-deployment.yaml
index 11226ab..27e2c3c 100644
--- a/charts/database/templates/database-deployment.yaml
+++ b/charts/database/templates/database-deployment.yaml
@@ -24,7 +24,7 @@ spec:
       - name: drycc-database-init
         image: docker.io/drycc/python-dev:latest
         imagePullPolicy: {{.Values.imagePullPolicy}}
-        command:
+        args:
           - netcat
           - -v
           - -a
@@ -60,12 +60,14 @@ spec:
             preStop:
               exec:
                 command:
+                  - init-stack
                   - gosu
                   - postgres
                   - do_backup
           readinessProbe:
             exec:
               command:
+                - init-stack
                 - is_running
             initialDelaySeconds: 30
             timeoutSeconds: 1
@@ -76,7 +78,7 @@ spec:
               mountPath: /var/run/secrets/drycc/objectstore/creds
             {{- if .Values.persistence.enabled }}
             - name: database-data
-              mountPath: /var/lib/postgresql
+              mountPath: /data
             {{- end }}
       volumes:
         {{- if .Values.persistence.enabled }}
diff --git a/contrib/ci/test-minio.sh b/contrib/ci/test-minio.sh
index c7d6120..dd5ee57 100755
--- a/contrib/ci/test-minio.sh
+++ b/contrib/ci/test-minio.sh
@@ -26,13 +26,12 @@ echo "1234567890123456789012345678901234567890" > "${CURRENT_DIR}"/tmp/aws-user/
 
 # boot minio
 mkdir -p "${CURRENT_DIR}"/tmp/bin
-echo "ls /data/*/basebackups_005" > "${CURRENT_DIR}"/tmp/bin/backups.sh
+echo "ls /data/database-bucket/*/basebackups_005" > "${CURRENT_DIR}"/tmp/bin/backups.sh
 MINIO_JOB=$(docker run -d \
   -v "${CURRENT_DIR}"/tmp/bin:/tmp/bin \
   -v "${CURRENT_DIR}"/tmp/aws-user:/var/run/secrets/drycc/objectstore/creds \
   drycc/minio:canary server /data/)
 
-
 puts-step "minio starting, wait 30s."
 sleep 30
 
@@ -55,6 +54,7 @@ check-postgres "${PG_JOB}"
 # check if minio has the 5 backups
 puts-step "checking if minio has 5 backups"
 BACKUPS="$(docker exec "${MINIO_JOB}" sh /tmp/bin/backups.sh | grep json)"
+
 NUM_BACKUPS="$(echo "${BACKUPS}" | wc -w)"
 # NOTE (bacongobbler): the BACKUP_FREQUENCY is only 1 second, so we could technically be checking
 # in the middle of a backup. Instead of failing, let's consider N+1 backups an acceptable case

From 3666b67a8a62ed9b44880d4eff902167b5b065ba Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Wed, 16 Mar 2022 15:14:46 +0800
Subject: [PATCH 11/64] feat(database): add affinity

---
 .drone/drone.yml                                   | 2 +-
 charts/database/Chart.yaml                         | 5 +++++
 charts/database/templates/database-deployment.yaml | 1 +
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.drone/drone.yml b/.drone/drone.yml
index 3abfe2c..8319def 100644
--- a/.drone/drone.yml
+++ b/.drone/drone.yml
@@ -116,7 +116,7 @@ steps:
   commands:
   - IMAGE_TAG=$([ ! -z $DRONE_TAG ] && echo \"${DRONE_TAG:1}\" || echo \"canary\")
   - sed -i "s/imageTag:\ \"canary\"/imageTag:\ $IMAGE_TAG/g" charts/database/values.yaml
-  - helm package charts/database --version ${DRONE_TAG:-v1.0.0}
+  - helm package -u charts/database --version ${DRONE_TAG:-v1.0.0}
   - curl -u $CHARTMUSEUM_USERNAME:$CHARTMUSEUM_PASSWORD -F chart=@database-${DRONE_TAG:-v1.0.0}.tgz "$CHARTMUSEUM_API/api/$([ -z $DRONE_TAG ] && echo testing || echo stable)/charts"
   environment:
     CHARTMUSEUM_USERNAME:
diff --git a/charts/database/Chart.yaml b/charts/database/Chart.yaml
index a27dd34..d0c9e2d 100644
--- a/charts/database/Chart.yaml
+++ b/charts/database/Chart.yaml
@@ -1,4 +1,9 @@
 name: database
+apiVersion: v2
+dependencies:
+  - name: common
+    repository: https://charts.drycc.cc/stable
+    version: 1.x.x
 home: https://github.com/drycc/postgres
 version: v1.0.0
 description: A PostgreSQL database used by Drycc Workflow.
diff --git a/charts/database/templates/database-deployment.yaml b/charts/database/templates/database-deployment.yaml
index 27e2c3c..a73046c 100644
--- a/charts/database/templates/database-deployment.yaml
+++ b/charts/database/templates/database-deployment.yaml
@@ -19,6 +19,7 @@ spec:
       labels:
         app: drycc-database
     spec:
+      {{- include "common.affinities.nodes.soft" (dict "key" "app" "values" (list "drycc-database")) | indent 6 }}
       serviceAccount: drycc-database
       initContainers:
       - name: drycc-database-init

From 42c2860c1c322d8a782bf17b648136c5477f1ba6 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Thu, 17 Mar 2022 11:35:58 +0800
Subject: [PATCH 12/64] chore(database): change nodes to pod affinity

---
 charts/database/templates/database-deployment.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/database/templates/database-deployment.yaml b/charts/database/templates/database-deployment.yaml
index a73046c..c762785 100644
--- a/charts/database/templates/database-deployment.yaml
+++ b/charts/database/templates/database-deployment.yaml
@@ -19,7 +19,7 @@ spec:
       labels:
         app: drycc-database
     spec:
-      {{- include "common.affinities.nodes.soft" (dict "key" "app" "values" (list "drycc-database")) | indent 6 }}
+      {{- include "common.affinities.pods.soft" (dict "key" "app" "values" (list "drycc-database")) | indent 6 }}
       serviceAccount: drycc-database
       initContainers:
       - name: drycc-database-init

From 5091a0ef0bb7a6516e5af00cfd71b9cad0bb6d99 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Wed, 6 Apr 2022 16:03:17 +0800
Subject: [PATCH 13/64] chore(database): bump python 3.10.4 and mc
 2022.04.01.23.44.48

---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 620d47d..2e579b9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,9 +5,9 @@ COPY rootfs/docker-entrypoint-initdb.d /docker-entrypoint-initdb.d/
 COPY rootfs/docker-entrypoint.sh /docker-entrypoint.sh
 ENV JQ_VERSION="1.6" \
   GOSU_VERSION="1.14" \
-  MC_VERSION="2022.02.26.03.58.31" \
+  MC_VERSION="2022.04.01.23.44.48" \
   WAL_G_VERSION="1.1" \
-  PYTHON_VERSION="3.10.2" \
+  PYTHON_VERSION="3.10.4" \
   PG_MAJOR=14 \
   POSTGRESQL_VERSION="14.2"
 

From 6cecd6486f14aec5f4a88d3de2fd0ec1e252e034 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Thu, 14 Apr 2022 16:55:00 +0800
Subject: [PATCH 14/64] chore(database): use registry.drycc.cc replace
 docker.io

---
 .drone/drone.yml                              | 42 ++++++++++++-------
 .drone/manifest.tmpl                          |  6 +--
 Dockerfile                                    |  2 +-
 .../templates/database-deployment.yaml        |  2 +-
 charts/database/values.yaml                   |  2 +-
 5 files changed, 32 insertions(+), 22 deletions(-)

diff --git a/.drone/drone.yml b/.drone/drone.yml
index 8319def..14099ba 100644
--- a/.drone/drone.yml
+++ b/.drone/drone.yml
@@ -9,11 +9,16 @@ platform:
 steps:
 - name: test
   commands:
+  - mkdir -p $HOMEPATH/.docker; echo $IMAGE_PULL_SECRETS > $HOMEPATH/.docker/config.json
   - make docker-build test
   environment:
     VERSION: ${DRONE_TAG:-latest}-linux-amd64
-    DEV_REGISTRY: ${DEV_REGISTRY:-docker.io}
-    DRYCC_REGISTRY: ${DRYCC_REGISTRY:-docker.io}
+    DEV_REGISTRY:
+      from_secret: dev_registry
+    DRYCC_REGISTRY:
+      from_secret: drycc_registry
+    IMAGE_PULL_SECRETS:
+      from_secret: container_pull_secrets
   when:
     event:
     - push
@@ -22,7 +27,7 @@ steps:
 
 - name: publish
   commands:
-  - echo $DOCKER_PASSWORD | docker login $DRYCC_REGISTRY --username $DOCKER_USERNAME --password-stdin
+  - echo $CONTAINER_PASSWORD | docker login $DRYCC_REGISTRY --username $CONTAINER_USERNAME --password-stdin > /dev/null 2>&1
   - make docker-build docker-immutable-push
   environment:
     VERSION: ${DRONE_TAG:-latest}-linux-amd64
@@ -30,10 +35,10 @@ steps:
       from_secret: dev_registry
     DRYCC_REGISTRY:
       from_secret: drycc_registry
-    DOCKER_USERNAME:
-      from_secret: docker_username
-    DOCKER_PASSWORD:
-      from_secret: docker_password
+    CONTAINER_USERNAME:
+      from_secret: container_username
+    CONTAINER_PASSWORD:
+      from_secret: container_password
   when:
     event:
     - push
@@ -51,7 +56,7 @@ platform:
 steps:
 - name: publish
   commands:
-  - echo $DOCKER_PASSWORD | docker login $DRYCC_REGISTRY --username $DOCKER_USERNAME --password-stdin
+  - echo $CONTAINER_PASSWORD | docker login $DRYCC_REGISTRY --username $CONTAINER_USERNAME --password-stdin > /dev/null 2>&1
   - make docker-build docker-immutable-push
   environment:
     VERSION: ${DRONE_TAG:-latest}-linux-arm64
@@ -59,10 +64,10 @@ steps:
       from_secret: dev_registry
     DRYCC_REGISTRY:
       from_secret: drycc_registry
-    DOCKER_USERNAME:
-      from_secret: docker_username
-    DOCKER_PASSWORD:
-      from_secret: docker_password
+    CONTAINER_USERNAME:
+      from_secret: container_username
+    CONTAINER_PASSWORD:
+      from_secret: container_password
   when:
     event:
     - push
@@ -72,14 +77,19 @@ steps:
 kind: pipeline
 type: docker
 name: manifest
+image_pull_secrets:
+- container_pull_secrets
 
 steps:
+
 - name: generate manifest
-  image: docker.io/drycc/go-dev
+  image: registry.drycc.cc/drycc/python-dev
   pull: always
   commands:
-  - sed -i "s/docker.io/$${DRYCC_REGISTRY}/g" .drone/manifest.tmpl
+  - sed -i "s/registry.drycc.cc/$${DRYCC_REGISTRY}/g" .drone/manifest.tmpl
   environment:
+    DEV_REGISTRY:
+      from_secret: dev_registry
     DRYCC_REGISTRY:
       from_secret: drycc_registry
 
@@ -88,9 +98,9 @@ steps:
   settings:
     spec: .drone/manifest.tmpl
     username:
-      from_secret: docker_username
+      from_secret: container_username
     password:
-      from_secret: docker_password
+      from_secret: container_password
   environment:
     DEV_REGISTRY:
       from_secret: dev_registry
diff --git a/.drone/manifest.tmpl b/.drone/manifest.tmpl
index c3bab75..0182d12 100644
--- a/.drone/manifest.tmpl
+++ b/.drone/manifest.tmpl
@@ -1,4 +1,4 @@
-image: docker.io/drycc/postgres:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}canary{{/if}}
+image: registry.drycc.cc/drycc/postgres:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}canary{{/if}}
 {{#if build.tags}}
 tags:
 {{#each build.tags}}
@@ -7,12 +7,12 @@ tags:
 {{/if}}
 manifests:
   -
-    image: docker.io/drycc/postgres:{{#if build.tag}}{{build.tag}}-{{else}}latest-{{/if}}linux-amd64
+    image: registry.drycc.cc/drycc/postgres:{{#if build.tag}}{{build.tag}}-{{else}}latest-{{/if}}linux-amd64
     platform:
       architecture: amd64
       os: linux
   -
-    image: docker.io/drycc/postgres:{{#if build.tag}}{{build.tag}}-{{else}}latest-{{/if}}linux-arm64
+    image: registry.drycc.cc/drycc/postgres:{{#if build.tag}}{{build.tag}}-{{else}}latest-{{/if}}linux-arm64
     platform:
       architecture: arm64
       os: linux
diff --git a/Dockerfile b/Dockerfile
index 2e579b9..e69ebba 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/drycc/base:bullseye
+FROM registry.drycc.cc/drycc/base:bullseye
 
 COPY rootfs/bin /bin/
 COPY rootfs/docker-entrypoint-initdb.d /docker-entrypoint-initdb.d/
diff --git a/charts/database/templates/database-deployment.yaml b/charts/database/templates/database-deployment.yaml
index c762785..0ee05e6 100644
--- a/charts/database/templates/database-deployment.yaml
+++ b/charts/database/templates/database-deployment.yaml
@@ -23,7 +23,7 @@ spec:
       serviceAccount: drycc-database
       initContainers:
       - name: drycc-database-init
-        image: docker.io/drycc/python-dev:latest
+        image: registry.drycc.cc/drycc/python-dev:latest
         imagePullPolicy: {{.Values.imagePullPolicy}}
         args:
           - netcat
diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index 4a4a53c..f33837d 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -1,7 +1,7 @@
 imageOrg: "drycc"
 imagePullPolicy: "Always"
 imageTag: "canary"
-imageRegistry: "docker.io"
+imageRegistry: "registry.drycc.cc"
 # limitsCpu: "100m"
 # limitsMemory: "50Mi"
 # limitsHugepages2Mi: 100Mi

From f5dbc1e0ac620383f1ff1269c5a5f6a77df9b9fa Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Sat, 16 Apr 2022 11:23:10 +0800
Subject: [PATCH 15/64] chore(database): change python-dev registry

---
 charts/database/templates/database-deployment.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/database/templates/database-deployment.yaml b/charts/database/templates/database-deployment.yaml
index 0ee05e6..958f9fe 100644
--- a/charts/database/templates/database-deployment.yaml
+++ b/charts/database/templates/database-deployment.yaml
@@ -23,7 +23,7 @@ spec:
       serviceAccount: drycc-database
       initContainers:
       - name: drycc-database-init
-        image: registry.drycc.cc/drycc/python-dev:latest
+        image: {{.Values.imageRegistry}}/{{.Values.imageOrg}}/python-dev:latest
         imagePullPolicy: {{.Values.imagePullPolicy}}
         args:
           - netcat

From 70ed4c3478676e8df600a6e2248ccf22129d2487 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Sun, 17 Apr 2022 15:04:53 +0800
Subject: [PATCH 16/64] style(database): database name convention over
 configuration

---
 .../templates/database-secret-creds.yaml      |  2 --
 contrib/ci/test.sh                            |  2 --
 rootfs/docker-entrypoint.sh                   | 22 +++++--------------
 3 files changed, 6 insertions(+), 20 deletions(-)

diff --git a/charts/database/templates/database-secret-creds.yaml b/charts/database/templates/database-secret-creds.yaml
index 9dd65eb..e6c0c38 100644
--- a/charts/database/templates/database-secret-creds.yaml
+++ b/charts/database/templates/database-secret-creds.yaml
@@ -11,6 +11,4 @@ metadata:
 data:
   user: {{ if .Values.username | default "" | ne "" }}{{ .Values.username | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
   password: {{ if .Values.password | default "" | ne "" }}{{ .Values.password | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
-  controller-database-name: {{ if .Values.controllerDatabaseName | default "" | ne "" }}{{ .Values.controllerDatabaseName | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
-  passport-database-name: {{ if .Values.passportDatabaseName | default "" | ne "" }}{{ .Values.passportDatabaseName | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
 {{- end }}
diff --git a/contrib/ci/test.sh b/contrib/ci/test.sh
index 5d124c8..55d2b20 100755
--- a/contrib/ci/test.sh
+++ b/contrib/ci/test.sh
@@ -22,8 +22,6 @@ create-postgres-creds() {
   mkdir -p "${CURRENT_DIR}"/tmp/creds
   echo "testuser" > "${CURRENT_DIR}"/tmp/creds/user
   echo "icanttellyou" > "${CURRENT_DIR}"/tmp/creds/password
-  echo "drycc_controller" > "${CURRENT_DIR}"/tmp/creds/controller-database-name
-  echo "drycc_passport" > "${CURRENT_DIR}"/tmp/creds/passport-database-name
 }
 
 start-postgres() {
diff --git a/rootfs/docker-entrypoint.sh b/rootfs/docker-entrypoint.sh
index 14786c3..7834fc2 100755
--- a/rootfs/docker-entrypoint.sh
+++ b/rootfs/docker-entrypoint.sh
@@ -12,8 +12,6 @@ set_listen_addresses() {
 
 POSTGRES_USER="$(cat /var/run/secrets/drycc/database/creds/user)"
 POSTGRES_PASSWORD="$(cat /var/run/secrets/drycc/database/creds/password)"
-POSTGRES_CONTROLLER="$(cat /var/run/secrets/drycc/database/creds/controller-database-name)"
-POSTGRES_PASSPORT="$(cat /var/run/secrets/drycc/database/creds/passport-database-name)"
 
 if [ "$1" = 'postgres' ]; then
 	mkdir -p "$PGDATA"
@@ -62,20 +60,6 @@ if [ "$1" = 'postgres' ]; then
 		: ${POSTGRES_USER:=postgres}
 		export POSTGRES_USER
 
-		if [ "$POSTGRES_CONTROLLER" != '' ]; then
-			psql --username postgres <<-EOSQL
-				CREATE DATABASE "$POSTGRES_CONTROLLER" ;
-			EOSQL
-			echo
-		fi
-
-		if [ "$POSTGRES_PASSPORT" != '' ]; then
-			psql --username postgres <<-EOSQL
-				CREATE DATABASE "$POSTGRES_PASSPORT" ;
-			EOSQL
-			echo
-		fi
-
 		if [ "$POSTGRES_USER" = 'postgres' ]; then
 			op='ALTER'
 		else
@@ -87,7 +71,13 @@ if [ "$1" = 'postgres' ]; then
 		EOSQL
 		echo
 
+		# Initialize the passport and controller databases
+		psql --username postgres <<-EOSQL
+			CREATE DATABASE passport;
+			CREATE DATABASE controller;
+		EOSQL
 		echo
+
 		for f in /docker-entrypoint-initdb.d/*; do
 			case "$f" in
 				*.sh)  echo "$0: running $f"; . "$f" ;;

From 4e5aa2dfc53e0f8fb50462630a9abad23d1dd9be Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Tue, 19 Apr 2022 09:51:59 +0800
Subject: [PATCH 17/64] chore(database):
 https://github.com/minio/minio/issues/14331

---
 charts/database/templates/_helper.tpl         | 34 +++++++
 .../templates/database-deployment.yaml        | 98 ++++++++-----------
 contrib/ci/test-minio.sh                      | 10 +-
 rootfs/bin/normalize_storage                  | 10 +-
 .../001_setup_envdir.sh                       | 15 ++-
 5 files changed, 96 insertions(+), 71 deletions(-)
 create mode 100644 charts/database/templates/_helper.tpl

diff --git a/charts/database/templates/_helper.tpl b/charts/database/templates/_helper.tpl
new file mode 100644
index 0000000..bab4a66
--- /dev/null
+++ b/charts/database/templates/_helper.tpl
@@ -0,0 +1,34 @@
+{{- define "database.envs" -}}
+env:
+- name: DATABASE_STORAGE
+  value: "{{.Values.global.storage}}"
+- name: PGCTLTIMEOUT
+  value: "{{.Values.timeout}}"
+{{- if eq .Values.global.minioLocation "on-cluster" }}
+- name: "DRYCC_MINIO_ENDPOINT"
+  value: ${DRYCC_MINIO_SERVICE_HOST}:${DRYCC_MINIO_SERVICE_PORT}
+{{- else }}
+- name: "DRYCC_MINIO_ENDPOINT"
+  value: "{{ .Values.minio.endpoint }}"
+{{- end }}
+{{- end }}
+
+{{/* Generate database deployment limits */}}
+{{- define "database.limits" -}}
+{{- if or (.Values.limitsCpu) (.Values.limitsMemory)}}
+resources:
+  limits:
+    {{- if (.Values.limitsCpu) }}
+    cpu: {{.Values.limitsCpu}}
+    {{- end }}
+    {{- if (.Values.limitsMemory) }}
+    memory: {{.Values.limitsMemory}}
+    {{- end }}
+    {{- if (.Values.limitsHugepages2Mi) }}
+    hugepages-2Mi: {{.Values.limitsHugepages2Mi}}
+    {{- end }}
+    {{- if (.Values.limitsHugepages1Gi) }}
+    hugepages-1Gi: {{.Values.limitsHugepages1Gi}}
+    {{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/charts/database/templates/database-deployment.yaml b/charts/database/templates/database-deployment.yaml
index 958f9fe..2f3b883 100644
--- a/charts/database/templates/database-deployment.yaml
+++ b/charts/database/templates/database-deployment.yaml
@@ -29,68 +29,50 @@ spec:
           - netcat
           - -v
           - -a
-          - $(DRYCC_MINIO_SERVICE_HOST):$(DRYCC_MINIO_SERVICE_PORT)
+          - $(DRYCC_MINIO_ENDPOINT)
+        {{- include "builder.envs" . | indent 8 }}
       containers:
-        - name: drycc-database
-          image: {{.Values.imageRegistry}}/{{.Values.imageOrg}}/postgres:{{.Values.imageTag}}
-          imagePullPolicy: {{.Values.imagePullPolicy}}
-          ports:
-            - containerPort: 5432
-          {{- if or (.Values.limitsCpu) (.Values.limitsMemory)}}
-          resources:
-            limits:
-              {{- if (.Values.limitsCpu) }}
-              cpu: {{.Values.limitsCpu}}
-              {{- end}}
-              {{- if (.Values.limitsMemory) }}
-              memory: {{.Values.limitsMemory}}
-              {{- end}}
-              {{- if (.Values.limitsHugepages2Mi) }}
-              hugepages-2Mi: {{.Values.limitsHugepages2Mi}}
-              {{- end}}
-              {{- if (.Values.limitsHugepages1Gi) }}
-              hugepages-1Gi: {{.Values.limitsHugepages1Gi}}
-              {{- end}}
-          {{- end}}
-          env:
-            - name: DATABASE_STORAGE
-              value: "{{.Values.global.storage}}"
-            - name: PGCTLTIMEOUT
-              value: "{{.Values.timeout}}"
-          lifecycle:
-            preStop:
-              exec:
-                command:
-                  - init-stack
-                  - gosu
-                  - postgres
-                  - do_backup
-          readinessProbe:
+      - name: drycc-database
+        image: {{.Values.imageRegistry}}/{{.Values.imageOrg}}/postgres:{{.Values.imageTag}}
+        imagePullPolicy: {{.Values.imagePullPolicy}}
+        ports:
+        - containerPort: 5432
+        {{- include "builder.limits" . | indent 8 }}
+        {{- include "builder.envs" . | indent 8 }}
+        lifecycle:
+          preStop:
             exec:
               command:
-                - init-stack
-                - is_running
-            initialDelaySeconds: 30
-            timeoutSeconds: 1
-          volumeMounts:
-            - name: database-creds
-              mountPath: /var/run/secrets/drycc/database/creds
-            - name: objectstore-creds
-              mountPath: /var/run/secrets/drycc/objectstore/creds
-            {{- if .Values.persistence.enabled }}
-            - name: database-data
-              mountPath: /data
-            {{- end }}
-      volumes:
+              - init-stack
+              - gosu
+              - postgres
+              - do_backup
+        readinessProbe:
+          exec:
+            command:
+            - init-stack
+            - is_running
+          initialDelaySeconds: 30
+          timeoutSeconds: 1
+        volumeMounts:
+        - name: database-creds
+          mountPath: /var/run/secrets/drycc/database/creds
+        - name: minio-creds
+          mountPath: /var/run/secrets/drycc/minio/creds
         {{- if .Values.persistence.enabled }}
         - name: database-data
-          persistentVolumeClaim:
-            claimName: drycc-database
+          mountPath: /data
         {{- end }}
-        - name: database-creds
-          secret:
-            secretName: database-creds
-        - name: objectstore-creds
-          secret:
-            secretName: objectstorage-keyfile
+      volumes:
+      {{- if .Values.persistence.enabled }}
+      - name: database-data
+        persistentVolumeClaim:
+          claimName: drycc-database
+      {{- end }}
+      - name: database-creds
+        secret:
+          secretName: database-creds
+      - name: minio-creds
+        secret:
+          secretName: minio-creds
 {{- end }}
diff --git a/contrib/ci/test-minio.sh b/contrib/ci/test-minio.sh
index dd5ee57..392713a 100755
--- a/contrib/ci/test-minio.sh
+++ b/contrib/ci/test-minio.sh
@@ -29,19 +29,19 @@ mkdir -p "${CURRENT_DIR}"/tmp/bin
 echo "ls /data/database-bucket/*/basebackups_005" > "${CURRENT_DIR}"/tmp/bin/backups.sh
 MINIO_JOB=$(docker run -d \
   -v "${CURRENT_DIR}"/tmp/bin:/tmp/bin \
-  -v "${CURRENT_DIR}"/tmp/aws-user:/var/run/secrets/drycc/objectstore/creds \
-  drycc/minio:canary server /data/)
+  -v "${CURRENT_DIR}"/tmp/aws-user:/var/run/secrets/drycc/minio/creds \
+  "${DEV_REGISTRY}"/drycc/minio:canary server /data/)
 
 puts-step "minio starting, wait 30s."
 sleep 30
 
-# boot postgres, linking the minio container and setting DRYCC_MINIO_SERVICE_HOST and DRYCC_MINIO_SERVICE_PORT
+# boot postgres, linking the minio container and setting DRYCC_MINIO_ENDPOINT
 MINIO_IP=$(docker inspect --format "{{ .NetworkSettings.IPAddress }}" "${MINIO_JOB}")
 PG_CMD="docker run -d --add-host minio:${MINIO_IP} -e PGCTLTIMEOUT=1200 \
   -e BACKUP_FREQUENCY=1s -e DATABASE_STORAGE=minio \
-  -e DRYCC_MINIO_SERVICE_HOST=minio -e DRYCC_MINIO_SERVICE_PORT=9000 \
+  -e DRYCC_MINIO_ENDPOINT=minio:9000 \
   -v ${CURRENT_DIR}/tmp/creds:/var/run/secrets/drycc/database/creds \
-  -v ${CURRENT_DIR}/tmp/aws-user:/var/run/secrets/drycc/objectstore/creds $1"
+  -v ${CURRENT_DIR}/tmp/aws-user:/var/run/secrets/drycc/minio/creds $1"
 
 start-postgres "${PG_CMD}"
 
diff --git a/rootfs/bin/normalize_storage b/rootfs/bin/normalize_storage
index 62b81ec..01f07b1 100755
--- a/rootfs/bin/normalize_storage
+++ b/rootfs/bin/normalize_storage
@@ -1,11 +1,13 @@
 #!/usr/bin/env sh
-BUCKET_FILE="/var/run/secrets/drycc/objectstore/creds/database-bucket"
-ACCESS_KEY_FILE="/var/run/secrets/drycc/objectstore/creds/accesskey"
-SECRET_KEY_FILE="/var/run/secrets/drycc/objectstore/creds/secretkey"
+BUCKET_FILE="/var/run/secrets/drycc/minio/creds/database-bucket"
+ACCESS_KEY_FILE="/var/run/secrets/drycc/minio/creds/accesskey"
+SECRET_KEY_FILE="/var/run/secrets/drycc/minio/creds/secretkey"
 
 if [ -f $BUCKET_FILE ]; then
   MINIO_BUCKET=$(cat "$BUCKET_FILE")
   export MINIO_BUCKET
+else
+  export MINIO_BUCKET="database"
 fi
 if [ -f $ACCESS_KEY_FILE ]; then
   MINIO_ACCESS_KEY=$(cat "$ACCESS_KEY_FILE")
@@ -16,6 +18,6 @@ if [ -f $SECRET_KEY_FILE ]; then
   export MINIO_SECRET_KEY
 fi
 
-export MINIO_ENDPOINT=http://"${DRYCC_MINIO_SERVICE_HOST}:${DRYCC_MINIO_SERVICE_PORT}"
+export MINIO_ENDPOINT=http://"${DRYCC_MINIO_ENDPOINT}"
 
 mc config host add minio "${MINIO_ENDPOINT}" "${MINIO_ACCESS_KEY}" "${MINIO_SECRET_KEY}"
diff --git a/rootfs/docker-entrypoint-initdb.d/001_setup_envdir.sh b/rootfs/docker-entrypoint-initdb.d/001_setup_envdir.sh
index 096818c..5b07b08 100755
--- a/rootfs/docker-entrypoint-initdb.d/001_setup_envdir.sh
+++ b/rootfs/docker-entrypoint-initdb.d/001_setup_envdir.sh
@@ -2,14 +2,21 @@
 
 cd "$WALG_ENVDIR"
 
-AWS_ACCESS_KEY_ID=$(cat /var/run/secrets/drycc/objectstore/creds/accesskey)
-AWS_SECRET_ACCESS_KEY=$(cat /var/run/secrets/drycc/objectstore/creds/secretkey)
-BUCKET_NAME=$(cat /var/run/secrets/drycc/objectstore/creds/database-bucket)
+AWS_ACCESS_KEY_ID=$(cat /var/run/secrets/drycc/minio/creds/accesskey)
+AWS_SECRET_ACCESS_KEY=$(cat /var/run/secrets/drycc/minio/creds/secretkey)
+
+BUCKET_FILE="/var/run/secrets/drycc/minio/creds/database-bucket"
+if [ -f $BUCKET_FILE ]; then
+  BUCKET_NAME=$(cat "$BUCKET_FILE")
+  export BUCKET_NAME
+else
+  export BUCKET_NAME="database"
+fi
 
 echo $AWS_ACCESS_KEY_ID > AWS_ACCESS_KEY_ID
 echo $AWS_SECRET_ACCESS_KEY > AWS_SECRET_ACCESS_KEY
 echo "s3://$BUCKET_NAME/$PG_MAJOR" > WALE_S3_PREFIX
-echo "http://$DRYCC_MINIO_SERVICE_HOST:$DRYCC_MINIO_SERVICE_PORT" > AWS_ENDPOINT
+echo "http://${DRYCC_MINIO_ENDPOINT}" > AWS_ENDPOINT
 echo "true" > AWS_S3_FORCE_PATH_STYLE
 echo $AWS_REGION > S3_REGION
 echo $BUCKET_NAME > BUCKET_NAME

From bde48c78c86ec43573bead4737e6d35ef5edd7f3 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Tue, 19 Apr 2022 15:43:45 +0800
Subject: [PATCH 18/64] chore(database):
 https://github.com/minio/minio/issues/13799

---
 rootfs/bin/normalize_storage | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rootfs/bin/normalize_storage b/rootfs/bin/normalize_storage
index 01f07b1..71098f1 100755
--- a/rootfs/bin/normalize_storage
+++ b/rootfs/bin/normalize_storage
@@ -20,4 +20,4 @@ fi
 
 export MINIO_ENDPOINT=http://"${DRYCC_MINIO_ENDPOINT}"
 
-mc config host add minio "${MINIO_ENDPOINT}" "${MINIO_ACCESS_KEY}" "${MINIO_SECRET_KEY}"
+mc config host add minio "${MINIO_ENDPOINT}" "${MINIO_ACCESS_KEY}" "${MINIO_SECRET_KEY}" --api s3v4

From 42c0433b0177c36be7233437e556340012125005 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Wed, 20 Apr 2022 16:46:11 +0800
Subject: [PATCH 19/64] chore(database): use env replace creds volume

---
 charts/database/templates/_helper.tpl         | 42 +++++++++++++++----
 .../templates/database-deployment.yaml        | 22 +++-------
 .../templates/database-secret-creds.yaml      |  2 +-
 contrib/ci/test-minio.sh                      | 28 +++++++------
 rootfs/bin/create_bucket                      | 16 ++++---
 rootfs/bin/normalize_storage                  | 23 ----------
 .../001_setup_envdir.sh                       | 24 ++++-------
 rootfs/docker-entrypoint.sh                   |  4 +-
 8 files changed, 75 insertions(+), 86 deletions(-)
 delete mode 100755 rootfs/bin/normalize_storage

diff --git a/charts/database/templates/_helper.tpl b/charts/database/templates/_helper.tpl
index bab4a66..cb3ada8 100644
--- a/charts/database/templates/_helper.tpl
+++ b/charts/database/templates/_helper.tpl
@@ -1,16 +1,44 @@
-{{- define "database.envs" -}}
+{{- define "database.envs" }}
 env:
 - name: DATABASE_STORAGE
   value: "{{.Values.global.storage}}"
 - name: PGCTLTIMEOUT
   value: "{{.Values.timeout}}"
-{{- if eq .Values.global.minioLocation "on-cluster" }}
+- name: "DRYCC_DATABASE_USER"
+  valueFrom:
+    secretKeyRef:
+      name: database-creds
+      key: user
+- name: "DRYCC_DATABASE_PASSWORD"
+  valueFrom:
+    secretKeyRef:
+      name: database-creds
+      key: password
+- name: "DRYCC_MINIO_LOOKUP"
+  valueFrom:
+    secretKeyRef:
+      name: minio-creds
+      key: lookup
+- name: "DRYCC_MINIO_BUCKET"
+  valueFrom:
+    secretKeyRef:
+      name: minio-creds
+      key: database-bucket
 - name: "DRYCC_MINIO_ENDPOINT"
-  value: ${DRYCC_MINIO_SERVICE_HOST}:${DRYCC_MINIO_SERVICE_PORT}
-{{- else }}
-- name: "DRYCC_MINIO_ENDPOINT"
-  value: "{{ .Values.minio.endpoint }}"
-{{- end }}
+  valueFrom:
+    secretKeyRef:
+      name: minio-creds
+      key: endpoint
+- name: "DRYCC_MINIO_ACCESSKEY"
+  valueFrom:
+    secretKeyRef:
+      name: minio-creds
+      key: accesskey
+- name: "DRYCC_MINIO_SECRETKEY"
+  valueFrom:
+    secretKeyRef:
+      name: minio-creds
+      key: secretkey
 {{- end }}
 
 {{/* Generate database deployment limits */}}
diff --git a/charts/database/templates/database-deployment.yaml b/charts/database/templates/database-deployment.yaml
index 2f3b883..05d655c 100644
--- a/charts/database/templates/database-deployment.yaml
+++ b/charts/database/templates/database-deployment.yaml
@@ -28,17 +28,17 @@ spec:
         args:
           - netcat
           - -v
-          - -a
+          - -u
           - $(DRYCC_MINIO_ENDPOINT)
-        {{- include "builder.envs" . | indent 8 }}
+        {{- include "database.envs" . | indent 8 }}
       containers:
       - name: drycc-database
         image: {{.Values.imageRegistry}}/{{.Values.imageOrg}}/postgres:{{.Values.imageTag}}
         imagePullPolicy: {{.Values.imagePullPolicy}}
         ports:
         - containerPort: 5432
-        {{- include "builder.limits" . | indent 8 }}
-        {{- include "builder.envs" . | indent 8 }}
+        {{- include "database.limits" . | indent 8 }}
+        {{- include "database.envs" . | indent 8 }}
         lifecycle:
           preStop:
             exec:
@@ -54,25 +54,13 @@ spec:
             - is_running
           initialDelaySeconds: 30
           timeoutSeconds: 1
+      {{- if .Values.persistence.enabled }}
         volumeMounts:
-        - name: database-creds
-          mountPath: /var/run/secrets/drycc/database/creds
-        - name: minio-creds
-          mountPath: /var/run/secrets/drycc/minio/creds
-        {{- if .Values.persistence.enabled }}
         - name: database-data
           mountPath: /data
-        {{- end }}
       volumes:
-      {{- if .Values.persistence.enabled }}
       - name: database-data
         persistentVolumeClaim:
           claimName: drycc-database
       {{- end }}
-      - name: database-creds
-        secret:
-          secretName: database-creds
-      - name: minio-creds
-        secret:
-          secretName: minio-creds
 {{- end }}
diff --git a/charts/database/templates/database-secret-creds.yaml b/charts/database/templates/database-secret-creds.yaml
index e6c0c38..dba1870 100644
--- a/charts/database/templates/database-secret-creds.yaml
+++ b/charts/database/templates/database-secret-creds.yaml
@@ -9,6 +9,6 @@ metadata:
   annotations:
     "helm.sh/hook": pre-install
 data:
-  user: {{ if .Values.username | default "" | ne "" }}{{ .Values.username | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
+  user: {{ if .Values.user | default "" | ne "" }}{{ .Values.user | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
   password: {{ if .Values.password | default "" | ne "" }}{{ .Values.password | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
 {{- end }}
diff --git a/contrib/ci/test-minio.sh b/contrib/ci/test-minio.sh
index 392713a..fd912a3 100755
--- a/contrib/ci/test-minio.sh
+++ b/contrib/ci/test-minio.sh
@@ -18,18 +18,15 @@ create-postgres-creds
 
 puts-step "creating fake minio credentials"
 
-mkdir -p "${CURRENT_DIR}"/tmp/aws-user
-echo "us-east-1" > "${CURRENT_DIR}"/tmp/aws-user/region
-echo "database-bucket" > "${CURRENT_DIR}"/tmp/aws-user/database-bucket
-echo "1234567890123456789012345678901234567890" > "${CURRENT_DIR}"/tmp/aws-user/accesskey
-echo "1234567890123456789012345678901234567890" > "${CURRENT_DIR}"/tmp/aws-user/secretkey
-
+s3Accesskey="1234567890123456789012345678901234567890"
+s3Secretkey="1234567890123456789012345678901234567890"
 # boot minio
 mkdir -p "${CURRENT_DIR}"/tmp/bin
-echo "ls /data/database-bucket/*/basebackups_005" > "${CURRENT_DIR}"/tmp/bin/backups.sh
+echo "ls /data/database/*/basebackups_005" > "${CURRENT_DIR}"/tmp/bin/backups.sh
 MINIO_JOB=$(docker run -d \
+  -e DRYCC_MINIO_ACCESSKEY=$s3Accesskey \
+  -e DRYCC_MINIO_SECRETKEY=$s3Secretkey \
   -v "${CURRENT_DIR}"/tmp/bin:/tmp/bin \
-  -v "${CURRENT_DIR}"/tmp/aws-user:/var/run/secrets/drycc/minio/creds \
   "${DEV_REGISTRY}"/drycc/minio:canary server /data/)
 
 puts-step "minio starting, wait 30s."
@@ -37,11 +34,16 @@ sleep 30
 
 # boot postgres, linking the minio container and setting DRYCC_MINIO_ENDPOINT
 MINIO_IP=$(docker inspect --format "{{ .NetworkSettings.IPAddress }}" "${MINIO_JOB}")
-PG_CMD="docker run -d --add-host minio:${MINIO_IP} -e PGCTLTIMEOUT=1200 \
-  -e BACKUP_FREQUENCY=1s -e DATABASE_STORAGE=minio \
-  -e DRYCC_MINIO_ENDPOINT=minio:9000 \
-  -v ${CURRENT_DIR}/tmp/creds:/var/run/secrets/drycc/database/creds \
-  -v ${CURRENT_DIR}/tmp/aws-user:/var/run/secrets/drycc/minio/creds $1"
+PG_CMD="docker run -d \
+  --add-host minio.local:${MINIO_IP} \
+  -e PGCTLTIMEOUT=1200 \
+  -e BACKUP_FREQUENCY=1s \
+  -e DATABASE_STORAGE=minio \
+  -e DRYCC_MINIO_LOOKUP=path \
+  -e DRYCC_MINIO_BUCKET=database \
+  -e DRYCC_MINIO_ENDPOINT=http://minio.local:9000 \
+  -e DRYCC_MINIO_ACCESSKEY=$s3Accesskey \
+  -e DRYCC_MINIO_SECRETKEY=$s3Secretkey $1"
 
 start-postgres "${PG_CMD}"
 
diff --git a/rootfs/bin/create_bucket b/rootfs/bin/create_bucket
index 196a744..af35a47 100755
--- a/rootfs/bin/create_bucket
+++ b/rootfs/bin/create_bucket
@@ -2,18 +2,22 @@
 
 set -e
 
-# shellcheck disable=SC1091
-source /bin/normalize_storage
+mc config host add minio \
+  "${DRYCC_MINIO_ENDPOINT}" \
+  "${DRYCC_MINIO_ACCESSKEY}" \
+  "${DRYCC_MINIO_SECRETKEY}" \
+  --lookup "${DRYCC_MINIO_LOOKUP}" \
+  --api s3v4
 
 has_bucket(){
-    mc ls minio -json|jq -r '.key'|grep -w "${MINIO_BUCKET}"
+    mc ls minio -json|jq -r '.key'|grep -w "${DRYCC_MINIO_BUCKET}"
 }
 
 if  [ -z "$(has_bucket)" ] ;then
-    mc mb minio/"${MINIO_BUCKET}"
+    mc mb minio/"${DRYCC_MINIO_BUCKET}"
     if  [ -z "$(has_bucket)" ] ;then
-        echo "create bucket ${MINIO_BUCKET} error"
+        echo "create bucket ${DRYCC_MINIO_BUCKET} error"
         exit 1
     fi
 fi
-echo "create bucket ${MINIO_BUCKET} success"
+echo "create bucket ${DRYCC_MINIO_BUCKET} success"
diff --git a/rootfs/bin/normalize_storage b/rootfs/bin/normalize_storage
deleted file mode 100755
index 71098f1..0000000
--- a/rootfs/bin/normalize_storage
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env sh
-BUCKET_FILE="/var/run/secrets/drycc/minio/creds/database-bucket"
-ACCESS_KEY_FILE="/var/run/secrets/drycc/minio/creds/accesskey"
-SECRET_KEY_FILE="/var/run/secrets/drycc/minio/creds/secretkey"
-
-if [ -f $BUCKET_FILE ]; then
-  MINIO_BUCKET=$(cat "$BUCKET_FILE")
-  export MINIO_BUCKET
-else
-  export MINIO_BUCKET="database"
-fi
-if [ -f $ACCESS_KEY_FILE ]; then
-  MINIO_ACCESS_KEY=$(cat "$ACCESS_KEY_FILE")
-  export MINIO_ACCESS_KEY
-fi
-if [ -f $SECRET_KEY_FILE ]; then
-  MINIO_SECRET_KEY=$(cat "$SECRET_KEY_FILE")
-  export MINIO_SECRET_KEY
-fi
-
-export MINIO_ENDPOINT=http://"${DRYCC_MINIO_ENDPOINT}"
-
-mc config host add minio "${MINIO_ENDPOINT}" "${MINIO_ACCESS_KEY}" "${MINIO_SECRET_KEY}" --api s3v4
diff --git a/rootfs/docker-entrypoint-initdb.d/001_setup_envdir.sh b/rootfs/docker-entrypoint-initdb.d/001_setup_envdir.sh
index 5b07b08..926b42c 100755
--- a/rootfs/docker-entrypoint-initdb.d/001_setup_envdir.sh
+++ b/rootfs/docker-entrypoint-initdb.d/001_setup_envdir.sh
@@ -2,21 +2,11 @@
 
 cd "$WALG_ENVDIR"
 
-AWS_ACCESS_KEY_ID=$(cat /var/run/secrets/drycc/minio/creds/accesskey)
-AWS_SECRET_ACCESS_KEY=$(cat /var/run/secrets/drycc/minio/creds/secretkey)
-
-BUCKET_FILE="/var/run/secrets/drycc/minio/creds/database-bucket"
-if [ -f $BUCKET_FILE ]; then
-  BUCKET_NAME=$(cat "$BUCKET_FILE")
-  export BUCKET_NAME
-else
-  export BUCKET_NAME="database"
+echo $DRYCC_MINIO_ACCESSKEY > AWS_ACCESS_KEY_ID
+echo $DRYCC_MINIO_SECRETKEY > AWS_SECRET_ACCESS_KEY
+echo "s3://$DRYCC_MINIO_BUCKET/$PG_MAJOR" > WALE_S3_PREFIX
+echo "${DRYCC_MINIO_ENDPOINT}" > AWS_ENDPOINT
+if [ "${DRYCC_MINIO_LOOKUP}" == "path" ]; then
+  echo "true" > AWS_S3_FORCE_PATH_STYLE
 fi
-
-echo $AWS_ACCESS_KEY_ID > AWS_ACCESS_KEY_ID
-echo $AWS_SECRET_ACCESS_KEY > AWS_SECRET_ACCESS_KEY
-echo "s3://$BUCKET_NAME/$PG_MAJOR" > WALE_S3_PREFIX
-echo "http://${DRYCC_MINIO_ENDPOINT}" > AWS_ENDPOINT
-echo "true" > AWS_S3_FORCE_PATH_STYLE
-echo $AWS_REGION > S3_REGION
-echo $BUCKET_NAME > BUCKET_NAME
+echo $DRYCC_MINIO_BUCKET > BUCKET_NAME
diff --git a/rootfs/docker-entrypoint.sh b/rootfs/docker-entrypoint.sh
index 7834fc2..d9de174 100755
--- a/rootfs/docker-entrypoint.sh
+++ b/rootfs/docker-entrypoint.sh
@@ -10,8 +10,8 @@ set_listen_addresses() {
 	sed -ri "s/^#?(listen_addresses\s*=\s*)\S+/\1'$sedEscapedValue'/" "$PGDATA/postgresql.conf"
 }
 
-POSTGRES_USER="$(cat /var/run/secrets/drycc/database/creds/user)"
-POSTGRES_PASSWORD="$(cat /var/run/secrets/drycc/database/creds/password)"
+POSTGRES_USER="${DRYCC_DATABASE_USER}"
+POSTGRES_PASSWORD="${DRYCC_DATABASE_PASSWORD}"
 
 if [ "$1" = 'postgres' ]; then
 	mkdir -p "$PGDATA"

From 3cdac737f706da8883a657b4ced992fc99b7e996 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Wed, 22 Jun 2022 14:20:59 +0800
Subject: [PATCH 20/64] chore(database): fine management affinity

---
 charts/database/Chart.yaml                    |  2 +-
 .../templates/database-deployment.yaml        |  5 ++++-
 charts/database/values.yaml                   | 19 +++++++++++++++++++
 3 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/charts/database/Chart.yaml b/charts/database/Chart.yaml
index d0c9e2d..7642091 100644
--- a/charts/database/Chart.yaml
+++ b/charts/database/Chart.yaml
@@ -5,7 +5,7 @@ dependencies:
     repository: https://charts.drycc.cc/stable
     version: 1.x.x
 home: https://github.com/drycc/postgres
-version: v1.0.0
+version: v1.1.0
 description: A PostgreSQL database used by Drycc Workflow.
 keywords:
   - database
diff --git a/charts/database/templates/database-deployment.yaml b/charts/database/templates/database-deployment.yaml
index 05d655c..c51d08e 100644
--- a/charts/database/templates/database-deployment.yaml
+++ b/charts/database/templates/database-deployment.yaml
@@ -19,7 +19,10 @@ spec:
       labels:
         app: drycc-database
     spec:
-      {{- include "common.affinities.pods.soft" (dict "key" "app" "values" (list "drycc-database")) | indent 6 }}
+      affinity:
+        podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset.type "key" .Values.podAffinityPreset.key "values" .Values.podAffinityPreset.values ) | nindent 10 }}
+        podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset.type "key" .Values.podAntiAffinityPreset.key "values" .Values.podAntiAffinityPreset.values ) | nindent 10 }}
+        nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values ) | nindent 10 }}
       serviceAccount: drycc-database
       initContainers:
       - name: drycc-database-init
diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index f33837d..9edcc4d 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -6,6 +6,25 @@ imageRegistry: "registry.drycc.cc"
 # limitsMemory: "50Mi"
 # limitsHugepages2Mi: 100Mi
 # limitsHugepages1Gi: 2Gi
+
+nodeAffinityPreset:
+  key: "drycc.cc/node"
+  type: "soft"
+  values:
+  - "true"
+
+podAffinityPreset:
+  key: "security"
+  type: ""
+  values:
+  - "drycc-security"
+
+podAntiAffinityPreset:
+  key: "app"
+  type: "soft"
+  values:
+  - "drycc-database"
+
 timeout: "1200"
 # Service
 service:

From b7dda451f9be9923c03e9427d9f747b9fdd58132 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Mon, 18 Jul 2022 11:44:19 +0800
Subject: [PATCH 21/64] chore(database): change minio to storage

---
 .gitignore                                    |  1 +
 Makefile                                      |  6 +--
 charts/database/templates/_helper.tpl         | 20 ++++-----
 .../templates/database-deployment.yaml        |  2 +-
 contrib/ci/{test-minio.sh => test-storage.sh} | 44 +++++++++----------
 rootfs/bin/create_bucket                      | 18 ++++----
 .../001_setup_envdir.sh                       | 12 ++---
 7 files changed, 52 insertions(+), 51 deletions(-)
 rename contrib/ci/{test-minio.sh => test-storage.sh} (57%)

diff --git a/.gitignore b/.gitignore
index 4d4647b..1ee9ef0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 contrib/ci/tmp
+.vscode/
\ No newline at end of file
diff --git a/Makefile b/Makefile
index df0529a..d08bf15 100644
--- a/Makefile
+++ b/Makefile
@@ -34,9 +34,9 @@ test: test-style test-functional
 test-style:
 	${DEV_ENV_CMD} shellcheck $(SHELL_SCRIPTS)
 
-test-functional: test-functional-minio
+test-functional: test-functional-storage
 
-test-functional-minio:
-	contrib/ci/test-minio.sh ${IMAGE}
+test-functional-storage:
+	contrib/ci/test-storage.sh ${IMAGE}
 
 .PHONY: all docker-build docker-push test
diff --git a/charts/database/templates/_helper.tpl b/charts/database/templates/_helper.tpl
index cb3ada8..88787ed 100644
--- a/charts/database/templates/_helper.tpl
+++ b/charts/database/templates/_helper.tpl
@@ -14,30 +14,30 @@ env:
     secretKeyRef:
       name: database-creds
       key: password
-- name: "DRYCC_MINIO_LOOKUP"
+- name: "DRYCC_STORAGE_LOOKUP"
   valueFrom:
     secretKeyRef:
-      name: minio-creds
+      name: storage-creds
       key: lookup
-- name: "DRYCC_MINIO_BUCKET"
+- name: "DRYCC_STORAGE_BUCKET"
   valueFrom:
     secretKeyRef:
-      name: minio-creds
+      name: storage-creds
       key: database-bucket
-- name: "DRYCC_MINIO_ENDPOINT"
+- name: "DRYCC_STORAGE_ENDPOINT"
   valueFrom:
     secretKeyRef:
-      name: minio-creds
+      name: storage-creds
       key: endpoint
-- name: "DRYCC_MINIO_ACCESSKEY"
+- name: "DRYCC_STORAGE_ACCESSKEY"
   valueFrom:
     secretKeyRef:
-      name: minio-creds
+      name: storage-creds
       key: accesskey
-- name: "DRYCC_MINIO_SECRETKEY"
+- name: "DRYCC_STORAGE_SECRETKEY"
   valueFrom:
     secretKeyRef:
-      name: minio-creds
+      name: storage-creds
       key: secretkey
 {{- end }}
 
diff --git a/charts/database/templates/database-deployment.yaml b/charts/database/templates/database-deployment.yaml
index c51d08e..beb3ad1 100644
--- a/charts/database/templates/database-deployment.yaml
+++ b/charts/database/templates/database-deployment.yaml
@@ -32,7 +32,7 @@ spec:
           - netcat
           - -v
           - -u
-          - $(DRYCC_MINIO_ENDPOINT)
+          - $(DRYCC_STORAGE_ENDPOINT)
         {{- include "database.envs" . | indent 8 }}
       containers:
       - name: drycc-database
diff --git a/contrib/ci/test-minio.sh b/contrib/ci/test-storage.sh
similarity index 57%
rename from contrib/ci/test-minio.sh
rename to contrib/ci/test-storage.sh
index fd912a3..1279f54 100755
--- a/contrib/ci/test-minio.sh
+++ b/contrib/ci/test-storage.sh
@@ -3,7 +3,7 @@
 set -eof pipefail
 
 cleanup() {
-  kill-containers "${MINIO_JOB}" "${PG_JOB}"
+  kill-containers "${STORAGE_JOB}" "${PG_JOB}"
 }
 trap cleanup EXIT
 
@@ -16,46 +16,46 @@ CURRENT_DIR=$(cd "$(dirname "$0")"; pwd)
 
 create-postgres-creds
 
-puts-step "creating fake minio credentials"
+puts-step "creating fake storage credentials"
 
 s3Accesskey="1234567890123456789012345678901234567890"
 s3Secretkey="1234567890123456789012345678901234567890"
-# boot minio
+# boot storage
 mkdir -p "${CURRENT_DIR}"/tmp/bin
 echo "ls /data/database/*/basebackups_005" > "${CURRENT_DIR}"/tmp/bin/backups.sh
-MINIO_JOB=$(docker run -d \
-  -e DRYCC_MINIO_ACCESSKEY=$s3Accesskey \
-  -e DRYCC_MINIO_SECRETKEY=$s3Secretkey \
+STORAGE_JOB=$(docker run -d \
+  -e DRYCC_STORAGE_ACCESSKEY=$s3Accesskey \
+  -e DRYCC_STORAGE_SECRETKEY=$s3Secretkey \
   -v "${CURRENT_DIR}"/tmp/bin:/tmp/bin \
-  "${DEV_REGISTRY}"/drycc/minio:canary server /data/)
+  "${DEV_REGISTRY}"/drycc/storage:canary server /data/)
 
-puts-step "minio starting, wait 30s."
+puts-step "storage starting, wait 30s."
 sleep 30
 
-# boot postgres, linking the minio container and setting DRYCC_MINIO_ENDPOINT
-MINIO_IP=$(docker inspect --format "{{ .NetworkSettings.IPAddress }}" "${MINIO_JOB}")
+# boot postgres, linking the storage container and setting DRYCC_STORAGE_ENDPOINT
+STORAGE_IP=$(docker inspect --format "{{ .NetworkSettings.IPAddress }}" "${STORAGE_JOB}")
 PG_CMD="docker run -d \
-  --add-host minio.local:${MINIO_IP} \
+  --add-host storage.local:${STORAGE_IP} \
   -e PGCTLTIMEOUT=1200 \
   -e BACKUP_FREQUENCY=1s \
-  -e DATABASE_STORAGE=minio \
-  -e DRYCC_MINIO_LOOKUP=path \
-  -e DRYCC_MINIO_BUCKET=database \
-  -e DRYCC_MINIO_ENDPOINT=http://minio.local:9000 \
-  -e DRYCC_MINIO_ACCESSKEY=$s3Accesskey \
-  -e DRYCC_MINIO_SECRETKEY=$s3Secretkey $1"
+  -e DATABASE_STORAGE=storage \
+  -e DRYCC_STORAGE_LOOKUP=path \
+  -e DRYCC_STORAGE_BUCKET=database \
+  -e DRYCC_STORAGE_ENDPOINT=http://storage.local:9000 \
+  -e DRYCC_STORAGE_ACCESSKEY=$s3Accesskey \
+  -e DRYCC_STORAGE_SECRETKEY=$s3Secretkey $1"
 
 start-postgres "${PG_CMD}"
 
 # display logs for debugging purposes
-puts-step "displaying minio logs"
-docker logs "${MINIO_JOB}"
+puts-step "displaying storage logs"
+docker logs "${STORAGE_JOB}"
 
 check-postgres "${PG_JOB}"
 
-# check if minio has the 5 backups
-puts-step "checking if minio has 5 backups"
-BACKUPS="$(docker exec "${MINIO_JOB}" sh /tmp/bin/backups.sh | grep json)"
+# check if storage has the 5 backups
+puts-step "checking if storage has 5 backups"
+BACKUPS="$(docker exec "${STORAGE_JOB}" sh /tmp/bin/backups.sh | grep json)"
 
 NUM_BACKUPS="$(echo "${BACKUPS}" | wc -w)"
 # NOTE (bacongobbler): the BACKUP_FREQUENCY is only 1 second, so we could technically be checking
diff --git a/rootfs/bin/create_bucket b/rootfs/bin/create_bucket
index af35a47..0a58efe 100755
--- a/rootfs/bin/create_bucket
+++ b/rootfs/bin/create_bucket
@@ -2,22 +2,22 @@
 
 set -e
 
-mc config host add minio \
-  "${DRYCC_MINIO_ENDPOINT}" \
-  "${DRYCC_MINIO_ACCESSKEY}" \
-  "${DRYCC_MINIO_SECRETKEY}" \
-  --lookup "${DRYCC_MINIO_LOOKUP}" \
+mc config host add storage \
+  "${DRYCC_STORAGE_ENDPOINT}" \
+  "${DRYCC_STORAGE_ACCESSKEY}" \
+  "${DRYCC_STORAGE_SECRETKEY}" \
+  --lookup "${DRYCC_STORAGE_LOOKUP}" \
   --api s3v4
 
 has_bucket(){
-    mc ls minio -json|jq -r '.key'|grep -w "${DRYCC_MINIO_BUCKET}"
+    mc ls storage -json|jq -r '.key'|grep -w "${DRYCC_STORAGE_BUCKET}"
 }
 
 if  [ -z "$(has_bucket)" ] ;then
-    mc mb minio/"${DRYCC_MINIO_BUCKET}"
+    mc mb storage/"${DRYCC_STORAGE_BUCKET}"
     if  [ -z "$(has_bucket)" ] ;then
-        echo "create bucket ${DRYCC_MINIO_BUCKET} error"
+        echo "create bucket ${DRYCC_STORAGE_BUCKET} error"
         exit 1
     fi
 fi
-echo "create bucket ${DRYCC_MINIO_BUCKET} success"
+echo "create bucket ${DRYCC_STORAGE_BUCKET} success"
diff --git a/rootfs/docker-entrypoint-initdb.d/001_setup_envdir.sh b/rootfs/docker-entrypoint-initdb.d/001_setup_envdir.sh
index 926b42c..8f25c47 100755
--- a/rootfs/docker-entrypoint-initdb.d/001_setup_envdir.sh
+++ b/rootfs/docker-entrypoint-initdb.d/001_setup_envdir.sh
@@ -2,11 +2,11 @@
 
 cd "$WALG_ENVDIR"
 
-echo $DRYCC_MINIO_ACCESSKEY > AWS_ACCESS_KEY_ID
-echo $DRYCC_MINIO_SECRETKEY > AWS_SECRET_ACCESS_KEY
-echo "s3://$DRYCC_MINIO_BUCKET/$PG_MAJOR" > WALE_S3_PREFIX
-echo "${DRYCC_MINIO_ENDPOINT}" > AWS_ENDPOINT
-if [ "${DRYCC_MINIO_LOOKUP}" == "path" ]; then
+echo $DRYCC_STORAGE_ACCESSKEY > AWS_ACCESS_KEY_ID
+echo $DRYCC_STORAGE_SECRETKEY > AWS_SECRET_ACCESS_KEY
+echo "s3://$DRYCC_STORAGE_BUCKET/$PG_MAJOR" > WALE_S3_PREFIX
+echo "${DRYCC_STORAGE_ENDPOINT}" > AWS_ENDPOINT
+if [ "${DRYCC_STORAGE_LOOKUP}" == "path" ]; then
   echo "true" > AWS_S3_FORCE_PATH_STYLE
 fi
-echo $DRYCC_MINIO_BUCKET > BUCKET_NAME
+echo $DRYCC_STORAGE_BUCKET > BUCKET_NAME

From f987e2f7b8c470a787ad7d459a5cb689b5d7c9f1 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Tue, 9 Aug 2022 10:42:15 +0800
Subject: [PATCH 22/64] chore(database): add check storage health

---
 charts/database/templates/_helper.tpl              | 5 +++++
 charts/database/templates/database-deployment.yaml | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/charts/database/templates/_helper.tpl b/charts/database/templates/_helper.tpl
index 88787ed..1aeeba9 100644
--- a/charts/database/templates/_helper.tpl
+++ b/charts/database/templates/_helper.tpl
@@ -19,6 +19,11 @@ env:
     secretKeyRef:
       name: storage-creds
       key: lookup
+- name: "DRYCC_STORAGE_HEALTH"
+  valueFrom:
+    secretKeyRef:
+      name: storage-creds
+      key: health
 - name: "DRYCC_STORAGE_BUCKET"
   valueFrom:
     secretKeyRef:
diff --git a/charts/database/templates/database-deployment.yaml b/charts/database/templates/database-deployment.yaml
index beb3ad1..27b3e6c 100644
--- a/charts/database/templates/database-deployment.yaml
+++ b/charts/database/templates/database-deployment.yaml
@@ -32,7 +32,7 @@ spec:
           - netcat
           - -v
           - -u
-          - $(DRYCC_STORAGE_ENDPOINT)
+          - $(DRYCC_STORAGE_HEALTH)
         {{- include "database.envs" . | indent 8 }}
       containers:
       - name: drycc-database

From c186962df47db8898ecc71dfb016f3550f3c8a02 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Tue, 9 Aug 2022 11:46:57 +0800
Subject: [PATCH 23/64] chore(database): fix storage run error

---
 charts/database/templates/database-deployment.yaml | 2 +-
 contrib/ci/test-storage.sh                         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/charts/database/templates/database-deployment.yaml b/charts/database/templates/database-deployment.yaml
index 27b3e6c..313f4b2 100644
--- a/charts/database/templates/database-deployment.yaml
+++ b/charts/database/templates/database-deployment.yaml
@@ -31,7 +31,7 @@ spec:
         args:
           - netcat
           - -v
-          - -u
+          - -g
           - $(DRYCC_STORAGE_HEALTH)
         {{- include "database.envs" . | indent 8 }}
       containers:
diff --git a/contrib/ci/test-storage.sh b/contrib/ci/test-storage.sh
index 1279f54..5b8e63d 100755
--- a/contrib/ci/test-storage.sh
+++ b/contrib/ci/test-storage.sh
@@ -27,7 +27,7 @@ STORAGE_JOB=$(docker run -d \
   -e DRYCC_STORAGE_ACCESSKEY=$s3Accesskey \
   -e DRYCC_STORAGE_SECRETKEY=$s3Secretkey \
   -v "${CURRENT_DIR}"/tmp/bin:/tmp/bin \
-  "${DEV_REGISTRY}"/drycc/storage:canary server /data/)
+  "${DEV_REGISTRY}"/drycc/storage:canary minio server /data/)
 
 puts-step "storage starting, wait 30s."
 sleep 30

From 91c8331bfa966480082eeb4f9478c6259abbb430 Mon Sep 17 00:00:00 2001
From: jianxiaoguo <842666271@qq.com>
Date: Fri, 12 Aug 2022 13:51:37 +0800
Subject: [PATCH 24/64] feat(postgres): use patroni

---
 Dockerfile                                    |  56 ++++------
 Makefile                                      |   9 +-
 charts/database/templates/_helper.tpl         |  77 +++++++++----
 .../templates/database-clusterrole.yaml       |  15 +++
 .../database-clusterrolebinding.yaml          |  14 +++
 charts/database/templates/database-pvc.yaml   |  24 ----
 .../templates/database-role-binding.yaml      |  13 +++
 charts/database/templates/database-role.yaml  |  56 ++++++++++
 .../templates/database-secret-creds.yaml      |   6 +-
 .../templates/database-service-replica.yaml   |  23 ++++
 .../database/templates/database-service.yaml  |   4 +-
 ...loyment.yaml => database-statefulset.yaml} |  71 +++++++++---
 charts/database/values.yaml                   |  29 ++++-
 contrib/ci/test-storage.sh                    |  78 -------------
 contrib/ci/test.sh                            |  43 -------
 rootfs/bin/backup                             |   8 --
 rootfs/bin/create_bucket                      |  23 ----
 rootfs/bin/do_backup                          |  15 ---
 rootfs/bin/is_running                         |  11 --
 .../001_setup_envdir.sh                       |  12 --
 .../002_create_bucket.sh                      |   4 -
 .../003_restore_from_backup.sh                |  71 ------------
 .../004_run_backups.sh                        |   4 -
 rootfs/docker-entrypoint.sh                   | 105 ------------------
 rootfs/entrypoint.sh                          |  43 +++++++
 rootfs/usr/share/scripts/patroni/post_init.sh |  15 +++
 26 files changed, 341 insertions(+), 488 deletions(-)
 create mode 100644 charts/database/templates/database-clusterrole.yaml
 create mode 100644 charts/database/templates/database-clusterrolebinding.yaml
 delete mode 100644 charts/database/templates/database-pvc.yaml
 create mode 100644 charts/database/templates/database-role-binding.yaml
 create mode 100644 charts/database/templates/database-role.yaml
 create mode 100644 charts/database/templates/database-service-replica.yaml
 rename charts/database/templates/{database-deployment.yaml => database-statefulset.yaml} (54%)
 delete mode 100755 contrib/ci/test-storage.sh
 delete mode 100755 contrib/ci/test.sh
 delete mode 100755 rootfs/bin/backup
 delete mode 100755 rootfs/bin/create_bucket
 delete mode 100755 rootfs/bin/do_backup
 delete mode 100755 rootfs/bin/is_running
 delete mode 100755 rootfs/docker-entrypoint-initdb.d/001_setup_envdir.sh
 delete mode 100755 rootfs/docker-entrypoint-initdb.d/002_create_bucket.sh
 delete mode 100755 rootfs/docker-entrypoint-initdb.d/003_restore_from_backup.sh
 delete mode 100755 rootfs/docker-entrypoint-initdb.d/004_run_backups.sh
 delete mode 100755 rootfs/docker-entrypoint.sh
 create mode 100755 rootfs/entrypoint.sh
 create mode 100755 rootfs/usr/share/scripts/patroni/post_init.sh

diff --git a/Dockerfile b/Dockerfile
index e69ebba..3f87a96 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,46 +1,34 @@
 FROM registry.drycc.cc/drycc/base:bullseye
 
-COPY rootfs/bin /bin/
-COPY rootfs/docker-entrypoint-initdb.d /docker-entrypoint-initdb.d/
-COPY rootfs/docker-entrypoint.sh /docker-entrypoint.sh
-ENV JQ_VERSION="1.6" \
-  GOSU_VERSION="1.14" \
-  MC_VERSION="2022.04.01.23.44.48" \
-  WAL_G_VERSION="1.1" \
-  PYTHON_VERSION="3.10.4" \
+COPY rootfs/usr /usr/
+COPY rootfs/entrypoint.sh /entrypoint.sh
+ENV PYTHON_VERSION="3.10.4" \
   PG_MAJOR=14 \
   POSTGRESQL_VERSION="14.2"
 
-
 ENV PGDATA /data/${PG_MAJOR}
-ENV WALG_ENVDIR /etc/wal-g.d/env
 
-RUN mkdir -p $WALG_ENVDIR \
-  && install-stack jq $JQ_VERSION \
-  && install-stack gosu $GOSU_VERSION \
-  && install-stack mc $MC_VERSION \
-  && install-stack wal-g $WAL_G_VERSION \
-  && install-stack python $PYTHON_VERSION \
+RUN install-stack python $PYTHON_VERSION \
   && install-stack postgresql $POSTGRESQL_VERSION && . init-stack \
   && rm -rf \
-      /usr/share/doc \
-      /usr/share/man \
-      /usr/share/info \
-      /usr/share/locale \
-      /var/lib/apt/lists/* \
-      /var/log/* \
-      /var/cache/debconf/* \
-      /etc/systemd \
-      /lib/lsb \
-      /lib/udev \
-      /usr/lib/`echo $(uname -m)`-linux-gnu/gconv/IBM* \
-      /usr/lib/`echo $(uname -m)`-linux-gnu/gconv/EBC* \
+    /usr/share/doc \
+    /usr/share/man \
+    /usr/share/info \
+    /usr/share/locale \
+    /var/lib/apt/lists/* \
+    /var/log/* \
+    /var/cache/debconf/* \
+    /etc/systemd \
+    /lib/lsb \
+    /lib/udev \
+    /usr/lib/`echo $(uname -m)`-linux-gnu/gconv/IBM* \
+    /usr/lib/`echo $(uname -m)`-linux-gnu/gconv/EBC* \
   && mkdir -p /usr/share/man/man{1..8} \
-  && mkdir -p /run/postgresql $PGDATA \
+  && mkdir -p $PGDATA \
   && groupadd postgres && useradd -g postgres postgres \
-  && chown -R postgres:postgres /run/postgresql $PGDATA \
-  && set -eux; pip3 install --disable-pip-version-check --no-cache-dir envdir 2>/dev/null
+  && chown -R postgres:postgres /data \
+  && set -eux; pip3 install --disable-pip-version-check --no-cache-dir psycopg[binary] patroni[kubernetes] 2>/dev/null
 
-ENTRYPOINT ["init-stack", "/docker-entrypoint.sh"]
-CMD ["postgres"]
-EXPOSE 5432
+USER postgres
+ENTRYPOINT ["init-stack", "/entrypoint.sh"]
+EXPOSE 5432 8008
diff --git a/Makefile b/Makefile
index d08bf15..5eaa3de 100644
--- a/Makefile
+++ b/Makefile
@@ -9,7 +9,7 @@ PLATFORM ?= linux/amd64,linux/arm64
 
 include versioning.mk
 
-SHELL_SCRIPTS = $(wildcard _scripts/*.sh contrib/ci/*.sh rootfs/bin/*)
+SHELL_SCRIPTS = $(wildcard rootfs/usr/share/scripts/patroni/*)
 
 # The following variables describe the containerized development environment
 # and other build options
@@ -29,14 +29,9 @@ docker-build:
 docker-buildx:
 	docker buildx build --platform ${PLATFORM} -t ${IMAGE} . --push
 
-test: test-style test-functional
+test: test-style
 
 test-style:
 	${DEV_ENV_CMD} shellcheck $(SHELL_SCRIPTS)
 
-test-functional: test-functional-storage
-
-test-functional-storage:
-	contrib/ci/test-storage.sh ${IMAGE}
-
 .PHONY: all docker-build docker-push test
diff --git a/charts/database/templates/_helper.tpl b/charts/database/templates/_helper.tpl
index 1aeeba9..0cf961a 100644
--- a/charts/database/templates/_helper.tpl
+++ b/charts/database/templates/_helper.tpl
@@ -2,48 +2,77 @@
 env:
 - name: DATABASE_STORAGE
   value: "{{.Values.global.storage}}"
+{{- if eq .Values.debug "true" }}
+- name: PATRONI_LOG_LEVEL
+  value: DEBUG
+- name: PATRONI_LOG_TRACEBACK_LEVEL
+  value: DEBUG
+{{- end }}
 - name: PGCTLTIMEOUT
   value: "{{.Values.timeout}}"
-- name: "DRYCC_DATABASE_USER"
+- name: PATRONI_KUBERNETES_POD_IP
   valueFrom:
-    secretKeyRef:
-      name: database-creds
-      key: user
-- name: "DRYCC_DATABASE_PASSWORD"
+    fieldRef:
+      fieldPath: status.podIP
+- name: PATRONI_KUBERNETES_NAMESPACE
+  valueFrom:
+    fieldRef:
+      fieldPath: metadata.namespace
+- name: PATRONI_KUBERNETES_BYPASS_API_SERVICE
+  value: 'true'
+- name: PATRONI_KUBERNETES_USE_ENDPOINTS
+  value: 'true'
+- name: PATRONI_KUBERNETES_LABELS
+  value: '{app: drycc-database, cluster-name: drycc-database}'
+- name: PATRONI_SCOPE
+  value: drycc-database
+- name: PATRONI_NAME
+  valueFrom:
+    fieldRef:
+      fieldPath: metadata.name
+- name: PATRONI_POSTGRESQL_PGPASS
+  value: /tmp/pgpass
+- name: PATRONI_POSTGRESQL_LISTEN
+  value: '0.0.0.0:5432'
+- name: PATRONI_RESTAPI_LISTEN
+  value: '0.0.0.0:8008'
+- name: DRYCC_DATABASE_SUPERUSER
   valueFrom:
     secretKeyRef:
       name: database-creds
-      key: password
-- name: "DRYCC_STORAGE_LOOKUP"
+      key: superuser
+- name: DRYCC_DATABASE_SUPERUSER_PASSWORD
   valueFrom:
     secretKeyRef:
-      name: storage-creds
-      key: lookup
-- name: "DRYCC_STORAGE_HEALTH"
+      name: database-creds
+      key: superuser-password
+- name: DRYCC_DATABASE_REPLICATOR
   valueFrom:
     secretKeyRef:
-      name: storage-creds
-      key: health
-- name: "DRYCC_STORAGE_BUCKET"
+      name: database-creds
+      key: replicator
+- name: DRYCC_DATABASE_REPLICATOR_PASSWORD
   valueFrom:
     secretKeyRef:
-      name: storage-creds
-      key: database-bucket
-- name: "DRYCC_STORAGE_ENDPOINT"
+      name: database-creds
+      key: replicator-password
+- name: "DRYCC_DATABASE_USER"
   valueFrom:
     secretKeyRef:
-      name: storage-creds
-      key: endpoint
-- name: "DRYCC_STORAGE_ACCESSKEY"
+      name: database-creds
+      key: user
+- name: "DRYCC_DATABASE_PASSWORD"
   valueFrom:
     secretKeyRef:
-      name: storage-creds
-      key: accesskey
-- name: "DRYCC_STORAGE_SECRETKEY"
+      name: database-creds
+      key: password
+{{- if eq .Values.global.storageLocation "on-cluster" }}
+- name: "DRYCC_STORAGE_HEALTH"
   valueFrom:
     secretKeyRef:
       name: storage-creds
-      key: secretkey
+      key: health
+{{- end }}
 {{- end }}
 
 {{/* Generate database deployment limits */}}
@@ -64,4 +93,4 @@ resources:
     hugepages-1Gi: {{.Values.limitsHugepages1Gi}}
     {{- end }}
 {{- end }}
-{{- end }}
\ No newline at end of file
+{{- end }}
diff --git a/charts/database/templates/database-clusterrole.yaml b/charts/database/templates/database-clusterrole.yaml
new file mode 100644
index 0000000..11b2f70
--- /dev/null
+++ b/charts/database/templates/database-clusterrole.yaml
@@ -0,0 +1,15 @@
+{{- if eq .Values.global.databaseLocation "on-cluster" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: drycc-database
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - endpoints
+  resourceNames:
+  - kubernetes
+  verbs:
+  - get
+{{- end }}
diff --git a/charts/database/templates/database-clusterrolebinding.yaml b/charts/database/templates/database-clusterrolebinding.yaml
new file mode 100644
index 0000000..11877bc
--- /dev/null
+++ b/charts/database/templates/database-clusterrolebinding.yaml
@@ -0,0 +1,14 @@
+{{- if eq .Values.global.databaseLocation "on-cluster" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: drycc-database
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: drycc-database
+subjects:
+- kind: ServiceAccount
+  name: drycc-database
+  namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/charts/database/templates/database-pvc.yaml b/charts/database/templates/database-pvc.yaml
deleted file mode 100644
index 1de3839..0000000
--- a/charts/database/templates/database-pvc.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-{{- if .Values.persistence.enabled }}
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: drycc-database
-  labels:
-    heritage: drycc
-spec:
-  accessModes:
-    - {{ .Values.persistence.accessMode | quote }}
-  resources:
-    requests:
-      storage: {{ .Values.persistence.size | quote }}
-{{- if .Values.persistence.storageClass }}
-{{- if (eq "-" .Values.persistence.storageClass) }}
-  storageClassName: ""
-{{- else }}
-  storageClassName: "{{ .Values.persistence.storageClass }}"
-{{- end }}
-{{- end }}
-{{- if .Values.persistence.volumeName }}
-  volumeName: "{{ .Values.persistence.volumeName }}"
-{{- end }}
-{{- end }}
\ No newline at end of file
diff --git a/charts/database/templates/database-role-binding.yaml b/charts/database/templates/database-role-binding.yaml
new file mode 100644
index 0000000..bbca50b
--- /dev/null
+++ b/charts/database/templates/database-role-binding.yaml
@@ -0,0 +1,13 @@
+{{- if eq .Values.global.databaseLocation "on-cluster" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: drycc-database
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: drycc-database
+subjects:
+- kind: ServiceAccount
+  name: drycc-database
+{{- end }}
diff --git a/charts/database/templates/database-role.yaml b/charts/database/templates/database-role.yaml
new file mode 100644
index 0000000..5ed547c
--- /dev/null
+++ b/charts/database/templates/database-role.yaml
@@ -0,0 +1,56 @@
+{{- if eq .Values.global.databaseLocation "on-cluster" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: drycc-database
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - update
+  - watch
+  # delete and deletecollection are required only for 'patronictl remove'
+  - delete
+  - deletecollection
+- apiGroups:
+  - ""
+  resources:
+  - endpoints
+  verbs:
+  - get
+  - patch
+  - update
+  # the following three privileges are necessary only when using endpoints
+  - create
+  - list
+  - watch
+  # delete and deletecollection are required only for for 'patronictl remove'
+  - delete
+  - deletecollection
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - patch
+  - update
+  - watch
+# The following privilege is only necessary for creation of headless service
+# for drycc-database-config endpoint, in order to prevent cleaning it up by the
+# k8s master. You can avoid giving this privilege by explicitly creating the
+# service like it is done in this manifest (lines 2..10)
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - create
+{{- end }}
diff --git a/charts/database/templates/database-secret-creds.yaml b/charts/database/templates/database-secret-creds.yaml
index dba1870..f689f15 100644
--- a/charts/database/templates/database-secret-creds.yaml
+++ b/charts/database/templates/database-secret-creds.yaml
@@ -9,6 +9,10 @@ metadata:
   annotations:
     "helm.sh/hook": pre-install
 data:
-  user: {{ if .Values.user | default "" | ne "" }}{{ .Values.user | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
+  superuser: {{ if .Values.superuser | default "" | ne "" }}{{ .Values.superuser | b64enc }}{{ else }}{{ randAlpha 32 | b64enc }}{{ end }}
+  superuser-password: {{ if .Values.superuserPassword | default "" | ne "" }}{{ .Values.superuserPassword | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
+  replicator: {{ if .Values.replicator | default "" | ne "" }}{{ .Values.replicator | b64enc }}{{ else }}{{ randAlpha 32 | b64enc }}{{ end }}
+  replicator-password: {{ if .Values.replicatorPassword | default "" | ne "" }}{{ .Values.replicatorPassword | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
+  user: {{ if .Values.user | default "" | ne "" }}{{ .Values.user | b64enc }}{{ else }}{{ randAlpha 32 | b64enc }}{{ end }}
   password: {{ if .Values.password | default "" | ne "" }}{{ .Values.password | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
 {{- end }}
diff --git a/charts/database/templates/database-service-replica.yaml b/charts/database/templates/database-service-replica.yaml
new file mode 100644
index 0000000..0bc8c00
--- /dev/null
+++ b/charts/database/templates/database-service-replica.yaml
@@ -0,0 +1,23 @@
+{{- if eq .Values.global.databaseLocation "on-cluster" }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: drycc-database-replica
+  annotations:
+    {{- with .Values.service.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  labels:
+    heritage: drycc
+    app: drycc-database
+    role: replica
+spec:
+  type: ClusterIP
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: 5432
+  selector:
+    app: drycc-database
+    role: replica
+{{- end }}
diff --git a/charts/database/templates/database-service.yaml b/charts/database/templates/database-service.yaml
index cc95aa7..2648b5c 100644
--- a/charts/database/templates/database-service.yaml
+++ b/charts/database/templates/database-service.yaml
@@ -10,9 +10,9 @@ metadata:
   labels:
     heritage: drycc
 spec:
+  type: ClusterIP
   ports:
     - name: postgres
       port: 5432
-  selector:
-    app: drycc-database
+      targetPort: 5432
 {{- end }}
diff --git a/charts/database/templates/database-deployment.yaml b/charts/database/templates/database-statefulset.yaml
similarity index 54%
rename from charts/database/templates/database-deployment.yaml
rename to charts/database/templates/database-statefulset.yaml
index 313f4b2..61280d0 100644
--- a/charts/database/templates/database-deployment.yaml
+++ b/charts/database/templates/database-statefulset.yaml
@@ -1,6 +1,6 @@
 {{- if eq .Values.global.databaseLocation "on-cluster" }}
 apiVersion: apps/v1
-kind: Deployment
+kind: StatefulSet
 metadata:
   name: drycc-database
   labels:
@@ -8,22 +8,24 @@ metadata:
   annotations:
     component.drycc.cc/version: {{ .Values.imageTag }}
 spec:
-  replicas: 1
-  strategy:
-    type: Recreate
+  replicas: {{ .Values.replicas }}
+  serviceName: drycc-database
   selector:
     matchLabels:
       app: drycc-database
+      cluster-name: drycc-database
   template:
     metadata:
       labels:
         app: drycc-database
+        cluster-name: drycc-database
     spec:
       affinity:
         podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset.type "key" .Values.podAffinityPreset.key "values" .Values.podAffinityPreset.values ) | nindent 10 }}
         podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset.type "key" .Values.podAntiAffinityPreset.key "values" .Values.podAntiAffinityPreset.values ) | nindent 10 }}
         nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values ) | nindent 10 }}
-      serviceAccount: drycc-database
+      serviceAccountName: drycc-database
+      {{- if eq .Values.global.storageLocation "on-cluster" }}
       initContainers:
       - name: drycc-database-init
         image: {{.Values.imageRegistry}}/{{.Values.imageOrg}}/python-dev:latest
@@ -34,36 +36,71 @@ spec:
           - -g
           - $(DRYCC_STORAGE_HEALTH)
         {{- include "database.envs" . | indent 8 }}
+      {{- end }}
       containers:
       - name: drycc-database
         image: {{.Values.imageRegistry}}/{{.Values.imageOrg}}/postgres:{{.Values.imageTag}}
         imagePullPolicy: {{.Values.imagePullPolicy}}
         ports:
+        - containerPort: 8008
+          protocol: TCP
         - containerPort: 5432
+          protocol: TCP
         {{- include "database.limits" . | indent 8 }}
         {{- include "database.envs" . | indent 8 }}
         lifecycle:
           preStop:
             exec:
               command:
-              - init-stack
-              - gosu
-              - postgres
-              - do_backup
+                - /usr/bin/env
+                - bash
+                - -c
+                - |
+                  # switch leader pod if the current pod is the leader
+                  if curl --fail http://localhost:8008/read-write; then
+                    init-stack patronictl switchover --force
+                  fi
+        livenessProbe:
+          failureThreshold: 3                            
+          httpGet:       
+            path: /liveness
+            port: 8008
+            scheme: HTTP   
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 5
         readinessProbe:
           exec:
             command:
-            - init-stack
-            - is_running
-          initialDelaySeconds: 30
-          timeoutSeconds: 1
-      {{- if .Values.persistence.enabled }}
+              - init-stack
+              - pg_isready
+              - -q
+          initialDelaySeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 3
         volumeMounts:
         - name: database-data
           mountPath: /data
+  {{- if .Values.persistence.enabled }}
+  volumeClaimTemplates:
+  - metadata:
+      name: database-data
+    spec:
+      accessModes: [ "ReadWriteOnce" ]
+      {{- if .Values.persistence.storageClass }}
+      {{- if (eq "-" .Values.persistence.storageClass) }}
+      storageClassName: ""
+      {{- else }}
+      storageClassName: "{{ .Values.persistence.storageClass }}"
+      {{- end }}
+      {{- end }}
+      resources:
+        requests:
+          storage: {{ .Values.persistence.size | quote }}
+  {{- else }}
       volumes:
       - name: database-data
-        persistentVolumeClaim:
-          claimName: drycc-database
-      {{- end }}
+        emptyDir: {}
+  {{- end }}
 {{- end }}
diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index 9edcc4d..97a62bb 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -7,6 +7,8 @@ imageRegistry: "registry.drycc.cc"
 # limitsHugepages2Mi: 100Mi
 # limitsHugepages1Gi: 2Gi
 
+replicas: 3
+
 nodeAffinityPreset:
   key: "drycc.cc/node"
   type: "soft"
@@ -25,6 +27,7 @@ podAntiAffinityPreset:
   values:
   - "drycc-database"
 
+debug: "false"
 timeout: "1200"
 # Service
 service:
@@ -33,7 +36,6 @@ service:
 # GCP PDs and EBS volumes are supported only
 persistence:
   enabled: false # Set to true to enable persistence
-  accessMode: ReadWriteOnce
   size: 5Gi # PVC size
   ## database data Persistent Volume Storage Class
   ## If defined, storageClassName: <storageClass>
@@ -45,10 +47,27 @@ persistence:
   ## Storage class of PV to bind. By default it looks for standard storage class.
   ## If the PV uses a different storage class, specify that here.
   storageClass: ""
-  volumeName: ""
 # The username and password to be used by the on-cluster database.
 # If left empty they will be generated using randAlphaNum
-username: ""
+superuser: "postgres"
+superuserPassword: ""
+replicator: "standby"
+replicatorPassword: ""
+user: ""
 password: ""
-passportDatabaseName: "drycc_passport"
-controllerDatabaseName: "drycc_controller"
+
+global:
+  # Set the location of Workflow's Object Storage
+  #
+  # Valid values are:
+  # - on-cluster: Run drycc storage within the Kubernetes cluster
+  # - off-cluster: Run Storage outside the Kubernetes cluster (Compatible with s3 API)
+  storageLocation: "on-cluster"
+  # Set the location of Workflow's PostgreSQL database
+  #
+  # Valid values are:
+  # - on-cluster: Run PostgreSQL within the Kubernetes cluster (credentials are generated
+  #   automatically; backups are sent to object storage
+  #   configured above)
+  # - off-cluster: Run PostgreSQL outside the Kubernetes cluster
+  databaseLocation: "on-cluster"
diff --git a/contrib/ci/test-storage.sh b/contrib/ci/test-storage.sh
deleted file mode 100755
index 5b8e63d..0000000
--- a/contrib/ci/test-storage.sh
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/usr/bin/env bash
-
-set -eof pipefail
-
-cleanup() {
-  kill-containers "${STORAGE_JOB}" "${PG_JOB}"
-}
-trap cleanup EXIT
-
-TEST_ROOT=$(dirname "${BASH_SOURCE[0]}")/
-# shellcheck source=/dev/null
-source "${TEST_ROOT}/test.sh"
-
-# make sure we are in this dir
-CURRENT_DIR=$(cd "$(dirname "$0")"; pwd)
-
-create-postgres-creds
-
-puts-step "creating fake storage credentials"
-
-s3Accesskey="1234567890123456789012345678901234567890"
-s3Secretkey="1234567890123456789012345678901234567890"
-# boot storage
-mkdir -p "${CURRENT_DIR}"/tmp/bin
-echo "ls /data/database/*/basebackups_005" > "${CURRENT_DIR}"/tmp/bin/backups.sh
-STORAGE_JOB=$(docker run -d \
-  -e DRYCC_STORAGE_ACCESSKEY=$s3Accesskey \
-  -e DRYCC_STORAGE_SECRETKEY=$s3Secretkey \
-  -v "${CURRENT_DIR}"/tmp/bin:/tmp/bin \
-  "${DEV_REGISTRY}"/drycc/storage:canary minio server /data/)
-
-puts-step "storage starting, wait 30s."
-sleep 30
-
-# boot postgres, linking the storage container and setting DRYCC_STORAGE_ENDPOINT
-STORAGE_IP=$(docker inspect --format "{{ .NetworkSettings.IPAddress }}" "${STORAGE_JOB}")
-PG_CMD="docker run -d \
-  --add-host storage.local:${STORAGE_IP} \
-  -e PGCTLTIMEOUT=1200 \
-  -e BACKUP_FREQUENCY=1s \
-  -e DATABASE_STORAGE=storage \
-  -e DRYCC_STORAGE_LOOKUP=path \
-  -e DRYCC_STORAGE_BUCKET=database \
-  -e DRYCC_STORAGE_ENDPOINT=http://storage.local:9000 \
-  -e DRYCC_STORAGE_ACCESSKEY=$s3Accesskey \
-  -e DRYCC_STORAGE_SECRETKEY=$s3Secretkey $1"
-
-start-postgres "${PG_CMD}"
-
-# display logs for debugging purposes
-puts-step "displaying storage logs"
-docker logs "${STORAGE_JOB}"
-
-check-postgres "${PG_JOB}"
-
-# check if storage has the 5 backups
-puts-step "checking if storage has 5 backups"
-BACKUPS="$(docker exec "${STORAGE_JOB}" sh /tmp/bin/backups.sh | grep json)"
-
-NUM_BACKUPS="$(echo "${BACKUPS}" | wc -w)"
-# NOTE (bacongobbler): the BACKUP_FREQUENCY is only 1 second, so we could technically be checking
-# in the middle of a backup. Instead of failing, let's consider N+1 backups an acceptable case
-if [[ "${NUM_BACKUPS}" -lt "5" ]]; then
-  puts-error "the number of backups is less than 5 (found $NUM_BACKUPS)"
-  puts-error "${BACKUPS}"
-  exit 1
-fi
-
-# kill off postgres, then reboot and see if it's running after recovering from backups
-puts-step "shutting off postgres, then rebooting to test data recovery"
-kill-containers "${PG_JOB}"
-
-start-postgres "${PG_CMD}"
-
-check-postgres "${PG_JOB}"
-
-puts-step "tests PASSED!"
-exit 0
diff --git a/contrib/ci/test.sh b/contrib/ci/test.sh
deleted file mode 100755
index 55d2b20..0000000
--- a/contrib/ci/test.sh
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/usr/bin/env bash
-
-set -eof pipefail
-
-puts-step() {
-  echo "-----> $*"
-}
-
-puts-error() {
-  echo "!!!    $*"
-}
-
-kill-containers() {
-	puts-step "destroying containers $*"
-	docker rm -f "$@"
-}
-
-create-postgres-creds() {
-  puts-step "creating fake postgres credentials"
-
-  # create fake postgres credentials
-  mkdir -p "${CURRENT_DIR}"/tmp/creds
-  echo "testuser" > "${CURRENT_DIR}"/tmp/creds/user
-  echo "icanttellyou" > "${CURRENT_DIR}"/tmp/creds/password
-}
-
-start-postgres() {
-  export PG_JOB
-  PG_JOB=$($1)
-  # wait for postgres to boot
-  puts-step "sleeping for 30s while postgres is booting..."
-  sleep 30s
-}
-
-check-postgres() {
-  # display logs for debugging purposes
-  puts-step "displaying postgres logs"
-  docker logs "$1"
-
-  # check if postgres is running
-  puts-step "checking if postgres is running"
-  docker exec "$1" init-stack is_running
-}
diff --git a/rootfs/bin/backup b/rootfs/bin/backup
deleted file mode 100755
index a56f52e..0000000
--- a/rootfs/bin/backup
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-
-export BACKUP_FREQUENCY=${BACKUP_FREQUENCY:-4h}
-
-while true; do
-    sleep "$BACKUP_FREQUENCY"
-    do_backup
-done
diff --git a/rootfs/bin/create_bucket b/rootfs/bin/create_bucket
deleted file mode 100755
index 0a58efe..0000000
--- a/rootfs/bin/create_bucket
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-mc config host add storage \
-  "${DRYCC_STORAGE_ENDPOINT}" \
-  "${DRYCC_STORAGE_ACCESSKEY}" \
-  "${DRYCC_STORAGE_SECRETKEY}" \
-  --lookup "${DRYCC_STORAGE_LOOKUP}" \
-  --api s3v4
-
-has_bucket(){
-    mc ls storage -json|jq -r '.key'|grep -w "${DRYCC_STORAGE_BUCKET}"
-}
-
-if  [ -z "$(has_bucket)" ] ;then
-    mc mb storage/"${DRYCC_STORAGE_BUCKET}"
-    if  [ -z "$(has_bucket)" ] ;then
-        echo "create bucket ${DRYCC_STORAGE_BUCKET} error"
-        exit 1
-    fi
-fi
-echo "create bucket ${DRYCC_STORAGE_BUCKET} success"
diff --git a/rootfs/bin/do_backup b/rootfs/bin/do_backup
deleted file mode 100755
index dfe8766..0000000
--- a/rootfs/bin/do_backup
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-
-export BACKUPS_TO_RETAIN=${BACKUPS_TO_RETAIN:-5}
-
-echo "Performing a base backup..."
-if [[ -f "$PGDATA/recovery.signal" ]] ; then
-    echo "Database is currently recovering from a backup. Aborting"
-    sleep 9
-else
-    # perform a backup
-    envdir "$WALG_ENVDIR" wal-g backup-push "$PGDATA"
-    # only retain the latest BACKUPS_TO_RETAIN backups
-    envdir "$WALG_ENVDIR" wal-g delete --confirm retain "$BACKUPS_TO_RETAIN"
-    echo "Backup has been completed."
-fi
diff --git a/rootfs/bin/is_running b/rootfs/bin/is_running
deleted file mode 100755
index 0286977..0000000
--- a/rootfs/bin/is_running
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/bash
-
-# fail fast
-set -e
-
-if [[ -f "$PGDATA/recovery.signal" ]]; then
-  # postgres is in recovery mode, so we know it's not ready to accept incoming connections.
-  exit 1
-fi
-
-gosu postgres pg_ctl status
diff --git a/rootfs/docker-entrypoint-initdb.d/001_setup_envdir.sh b/rootfs/docker-entrypoint-initdb.d/001_setup_envdir.sh
deleted file mode 100755
index 8f25c47..0000000
--- a/rootfs/docker-entrypoint-initdb.d/001_setup_envdir.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-
-cd "$WALG_ENVDIR"
-
-echo $DRYCC_STORAGE_ACCESSKEY > AWS_ACCESS_KEY_ID
-echo $DRYCC_STORAGE_SECRETKEY > AWS_SECRET_ACCESS_KEY
-echo "s3://$DRYCC_STORAGE_BUCKET/$PG_MAJOR" > WALE_S3_PREFIX
-echo "${DRYCC_STORAGE_ENDPOINT}" > AWS_ENDPOINT
-if [ "${DRYCC_STORAGE_LOOKUP}" == "path" ]; then
-  echo "true" > AWS_S3_FORCE_PATH_STYLE
-fi
-echo $DRYCC_STORAGE_BUCKET > BUCKET_NAME
diff --git a/rootfs/docker-entrypoint-initdb.d/002_create_bucket.sh b/rootfs/docker-entrypoint-initdb.d/002_create_bucket.sh
deleted file mode 100755
index 316af45..0000000
--- a/rootfs/docker-entrypoint-initdb.d/002_create_bucket.sh
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/usr/bin/env bash
-
-# ensure WAL log bucket exists
-envdir "$WALG_ENVDIR" create_bucket
diff --git a/rootfs/docker-entrypoint-initdb.d/003_restore_from_backup.sh b/rootfs/docker-entrypoint-initdb.d/003_restore_from_backup.sh
deleted file mode 100755
index 0f7f9f9..0000000
--- a/rootfs/docker-entrypoint-initdb.d/003_restore_from_backup.sh
+++ /dev/null
@@ -1,71 +0,0 @@
-#!/usr/bin/env bash
-
-# check if there are any backups -- if so, let's restore
-# we could probably do better than just testing number of lines -- one line is just a heading, meaning no backups
-
-if [[ $(envdir "$WALG_ENVDIR" wal-g backup-list | wc -l) -gt "1" ]]; then
-  echo "Found backups. Restoring from backup..."
-  {
-    gosu postgres pg_ctl -D "$PGDATA" -w stop > /dev/null 2>&1
-  } || {
-    echo "ignore script errors"
-  }
-  rm -rf "$PGDATA"
-  envdir "$WALG_ENVDIR" wal-g backup-fetch "$PGDATA" LATEST
-  touch "$PGDATA/recovery.signal"
-  cat << EOF > "$PGDATA/postgresql.conf"
-# These settings are initialized by initdb, but they can be changed.
-log_timezone = 'UTC'
-lc_messages = 'C'     # locale for system error message
-lc_monetary = 'C'     # locale for monetary formatting
-lc_numeric = 'C'      # locale for number formatting
-lc_time = 'C'       # locale for time formatting
-default_text_search_config = 'pg_catalog.english'
-huge_pages = try
-wal_level = archive
-archive_mode = on
-archive_command = 'envdir "${WALG_ENVDIR}" wal-g wal-push %p'
-archive_timeout = 60
-listen_addresses = '*'
-max_connections = 1024
-restore_command = 'envdir "${WALG_ENVDIR}" wal-g wal-fetch \"%f\" \"%p\"'
-EOF
-  cat << EOF > "$PGDATA/pg_hba.conf"
-# "local" is for Unix domain socket connections only
-local   all             all                                     trust
-# IPv4 local connections:
-host    all             all             127.0.0.1/32            trust
-# IPv6 local connections:
-host    all             all             ::1/128                 trust
-# IPv4 global connections
-host    all             all             0.0.0.0/0               md5
-EOF
-  touch "$PGDATA/pg_ident.conf"
-  touch "$PGDATA/recovery.signal"
-  chown -R postgres:postgres "$PGDATA"
-  chmod 0700 "$PGDATA"
-  gosu postgres pg_ctl -D "$PGDATA" \
-      -o "-c listen_addresses=''" \
-      -w start
-else
-  cat << EOF >> "$PGDATA/postgresql.conf"
-huge_pages = try
-wal_level = archive
-archive_mode = on
-archive_command = 'envdir "${WALG_ENVDIR}" wal-g wal-push %p'
-archive_timeout = 60
-max_connections = 1024
-EOF
-
-  # ensure $PGDATA has the right permissions
-  chown -R postgres:postgres "$PGDATA"
-  chmod 0700 "$PGDATA"
-
-  # reboot the server for wal_level to be set before backing up
-  echo "Rebooting postgres to enable archive mode"
-  gosu postgres pg_ctl -D "$PGDATA" -w restart
-fi
-
-# ensure $PGDATA has the right permissions
-chown -R postgres:postgres "$PGDATA"
-chmod 0700 "$PGDATA"
diff --git a/rootfs/docker-entrypoint-initdb.d/004_run_backups.sh b/rootfs/docker-entrypoint-initdb.d/004_run_backups.sh
deleted file mode 100755
index d311bd4..0000000
--- a/rootfs/docker-entrypoint-initdb.d/004_run_backups.sh
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/usr/bin/env bash
-
-# Run periodic backups in the background
-gosu postgres backup &
diff --git a/rootfs/docker-entrypoint.sh b/rootfs/docker-entrypoint.sh
deleted file mode 100755
index d9de174..0000000
--- a/rootfs/docker-entrypoint.sh
+++ /dev/null
@@ -1,105 +0,0 @@
-#!/bin/bash
-#
-# Originally copied and modified from
-# https://github.com/docker-library/postgres/blob/ec5ce80ca914e02c2d5eb9fde424039d4cee032e/9.4/docker-entrypoint.sh
-#
-set -e
-
-set_listen_addresses() {
-	sedEscapedValue="$(echo "$1" | sed 's/[\/&]/\\&/g')"
-	sed -ri "s/^#?(listen_addresses\s*=\s*)\S+/\1'$sedEscapedValue'/" "$PGDATA/postgresql.conf"
-}
-
-POSTGRES_USER="${DRYCC_DATABASE_USER}"
-POSTGRES_PASSWORD="${DRYCC_DATABASE_PASSWORD}"
-
-if [ "$1" = 'postgres' ]; then
-	mkdir -p "$PGDATA"
-	chmod 700 "$PGDATA"
-	chown -R postgres "$PGDATA"
-
-	chmod g+s /run/postgresql
-	chown -R postgres /run/postgresql
-
-	# look specifically for PG_VERSION, as it is expected in the DB dir
-	if [ ! -s "$PGDATA/PG_VERSION" ]; then
-		gosu postgres initdb
-		# check password first so we can output the warning before postgres
-		# messes it up
-		if [ "$POSTGRES_PASSWORD" ]; then
-			pass="PASSWORD '$POSTGRES_PASSWORD'"
-			authMethod=md5
-		else
-			# The - option suppresses leading tabs but *not* spaces. :)
-			cat >&2 <<-'EOWARN'
-				****************************************************
-				WARNING: No password has been set for the database.
-				         This will allow anyone with access to the
-				         Postgres port to access your database. In
-				         Docker's default configuration, this is
-				         effectively any other container on the same
-				         system.
-
-				         Use "-e POSTGRES_PASSWORD=password" to set
-				         it in "docker run".
-				****************************************************
-			EOWARN
-
-			pass=
-			authMethod=trust
-		fi
-
-		{ echo; echo "host all all 0.0.0.0/0 $authMethod"; } >> "$PGDATA/pg_hba.conf"
-
-		# internal start of server in order to allow set-up using psql-client
-		# does not listen on TCP/IP and waits until start finishes
-		gosu postgres pg_ctl -D "$PGDATA" \
-			-o "-c listen_addresses=''" \
-			-w start
-
-		: ${POSTGRES_USER:=postgres}
-		export POSTGRES_USER
-
-		if [ "$POSTGRES_USER" = 'postgres' ]; then
-			op='ALTER'
-		else
-			op='CREATE'
-		fi
-
-		psql --username postgres <<-EOSQL
-			$op USER "$POSTGRES_USER" WITH SUPERUSER $pass ;
-		EOSQL
-		echo
-
-		# Initialize the passport and controller databases
-		psql --username postgres <<-EOSQL
-			CREATE DATABASE passport;
-			CREATE DATABASE controller;
-		EOSQL
-		echo
-
-		for f in /docker-entrypoint-initdb.d/*; do
-			case "$f" in
-				*.sh)  echo "$0: running $f"; . "$f" ;;
-				*.sql)
-					echo "$0: running $f";
-					psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < "$f"
-					echo
-					;;
-				*)     echo "$0: ignoring $f" ;;
-			esac
-			echo
-		done
-
-		gosu postgres pg_ctl -D "$PGDATA" -m fast -w stop
-		set_listen_addresses '*'
-
-		echo
-		echo 'PostgreSQL init process complete; ready for start up.'
-		echo
-	fi
-
-	exec gosu postgres "$@"
-fi
-
-exec "$@"
diff --git a/rootfs/entrypoint.sh b/rootfs/entrypoint.sh
new file mode 100755
index 0000000..40e2ddf
--- /dev/null
+++ b/rootfs/entrypoint.sh
@@ -0,0 +1,43 @@
+#!/bin/bash
+
+if [[ $UID -ge 10000 ]]; then
+    GID=$(id -g)
+    sed -e "s/^postgres:x:[^:]*:[^:]*:/postgres:x:$UID:$GID:/" /etc/passwd > /tmp/passwd
+    cat /tmp/passwd > /etc/passwd
+    rm /tmp/passwd
+fi
+
+cat > /data/patroni.yaml <<__EOF__
+bootstrap:
+  dcs:
+    postgresql:
+      use_pg_rewind: true
+  initdb:
+  - auth-host: md5
+  - auth-local: trust
+  - encoding: UTF8
+  - locale: ${LANG}
+  - data-checksums
+  pg_hba:
+  - host all all 0.0.0.0/0 md5
+  - host replication ${DRYCC_DATABASE_REPLICATOR} ${PATRONI_KUBERNETES_POD_IP}/16 md5
+  post_bootstrap: /usr/share/scripts/patroni/post_init.sh
+restapi:
+  connect_address: '${PATRONI_KUBERNETES_POD_IP}:8008'
+postgresql:
+  data_dir: '${PGDATA}'
+  connect_address: '${PATRONI_KUBERNETES_POD_IP}:5432'
+  authentication:
+    superuser:
+      username: '${DRYCC_DATABASE_SUPERUSER}'
+      password: '${DRYCC_DATABASE_SUPERUSER_PASSWORD}'
+    replication:
+      username: '${DRYCC_DATABASE_REPLICATOR}'
+      password: '${DRYCC_DATABASE_REPLICATOR_PASSWORD}'
+watchdog:
+  mode: off
+__EOF__
+
+unset DRYCC_DATABASE_SUPERUSER_PASSWORD DRYCC_DATABASE_REPLICATION_PASSWORD
+
+exec patroni /data/patroni.yaml
diff --git a/rootfs/usr/share/scripts/patroni/post_init.sh b/rootfs/usr/share/scripts/patroni/post_init.sh
new file mode 100755
index 0000000..90478b1
--- /dev/null
+++ b/rootfs/usr/share/scripts/patroni/post_init.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -Eeu
+
+if [[ ( -n "$DRYCC_DATABASE_USER") &&  ( -n "$DRYCC_DATABASE_PASSWORD")]]; then
+  echo "Creating user ${DRYCC_DATABASE_USER}"
+  psql "$1" -w -c "create user ${DRYCC_DATABASE_USER} WITH LOGIN ENCRYPTED PASSWORD '${DRYCC_DATABASE_PASSWORD}'"
+
+  echo "Creating passport and controller databases"
+  psql "$1" -w -c "CREATE DATABASE passport OWNER ${DRYCC_DATABASE_USER}"
+  psql "$1" -w -c "CREATE DATABASE controller OWNER ${DRYCC_DATABASE_USER}"
+
+else
+  echo "Skipping user creation"
+  echo "Skipping database creation"
+fi

From fb8b00f429b0a96edbfc5093188dbccd17565b9c Mon Sep 17 00:00:00 2001
From: jianxiaoguo <842666271@qq.com>
Date: Tue, 16 Aug 2022 14:00:03 +0800
Subject: [PATCH 25/64] fixup(postgres): support arm, fix Failed to build
 psutil

---
 Dockerfile | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 3f87a96..a02d7f7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,8 +8,13 @@ ENV PYTHON_VERSION="3.10.4" \
 
 ENV PGDATA /data/${PG_MAJOR}
 
-RUN install-stack python $PYTHON_VERSION \
+RUN install-packages gcc \
+  && install-stack python $PYTHON_VERSION \
   && install-stack postgresql $POSTGRESQL_VERSION && . init-stack \
+  && set -eux; pip3 install --disable-pip-version-check --no-cache-dir psycopg[binary] patroni[kubernetes] 2>/dev/null; set +eux \
+  && apt-get purge -y --auto-remove gcc \
+  && apt-get autoremove -y \
+  && apt-get clean -y \
   && rm -rf \
     /usr/share/doc \
     /usr/share/man \
@@ -26,8 +31,7 @@ RUN install-stack python $PYTHON_VERSION \
   && mkdir -p /usr/share/man/man{1..8} \
   && mkdir -p $PGDATA \
   && groupadd postgres && useradd -g postgres postgres \
-  && chown -R postgres:postgres /data \
-  && set -eux; pip3 install --disable-pip-version-check --no-cache-dir psycopg[binary] patroni[kubernetes] 2>/dev/null
+  && chown -R postgres:postgres /data
 
 USER postgres
 ENTRYPOINT ["init-stack", "/entrypoint.sh"]

From 33ed5ede504a83f4cf02a68df91ac522fb240155 Mon Sep 17 00:00:00 2001
From: jianxiaoguo <842666271@qq.com>
Date: Tue, 16 Aug 2022 17:12:25 +0800
Subject: [PATCH 26/64] fixup(postgres): user name converted to lowercase
 letters

---
 Dockerfile                                           | 3 ++-
 charts/database/templates/database-secret-creds.yaml | 6 +++---
 charts/database/templates/database-service.yaml      | 3 +--
 charts/database/values.yaml                          | 3 ++-
 4 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index a02d7f7..c2ebaac 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,7 +10,8 @@ ENV PGDATA /data/${PG_MAJOR}
 
 RUN install-packages gcc \
   && install-stack python $PYTHON_VERSION \
-  && install-stack postgresql $POSTGRESQL_VERSION && . init-stack \
+  && install-stack postgresql $POSTGRESQL_VERSION \
+  && . init-stack \
   && set -eux; pip3 install --disable-pip-version-check --no-cache-dir psycopg[binary] patroni[kubernetes] 2>/dev/null; set +eux \
   && apt-get purge -y --auto-remove gcc \
   && apt-get autoremove -y \
diff --git a/charts/database/templates/database-secret-creds.yaml b/charts/database/templates/database-secret-creds.yaml
index f689f15..83424f2 100644
--- a/charts/database/templates/database-secret-creds.yaml
+++ b/charts/database/templates/database-secret-creds.yaml
@@ -9,10 +9,10 @@ metadata:
   annotations:
     "helm.sh/hook": pre-install
 data:
-  superuser: {{ if .Values.superuser | default "" | ne "" }}{{ .Values.superuser | b64enc }}{{ else }}{{ randAlpha 32 | b64enc }}{{ end }}
+  superuser: {{ if .Values.superuser | default "" | ne "" }}{{ .Values.superuser | lower | b64enc }}{{ else }}{{ randAlpha 32 | lower | b64enc }}{{ end }}
   superuser-password: {{ if .Values.superuserPassword | default "" | ne "" }}{{ .Values.superuserPassword | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
-  replicator: {{ if .Values.replicator | default "" | ne "" }}{{ .Values.replicator | b64enc }}{{ else }}{{ randAlpha 32 | b64enc }}{{ end }}
+  replicator: {{ if .Values.replicator | default "" | ne "" }}{{ .Values.replicator | lower | b64enc }}{{ else }}{{ randAlpha 32 | lower | b64enc }}{{ end }}
   replicator-password: {{ if .Values.replicatorPassword | default "" | ne "" }}{{ .Values.replicatorPassword | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
-  user: {{ if .Values.user | default "" | ne "" }}{{ .Values.user | b64enc }}{{ else }}{{ randAlpha 32 | b64enc }}{{ end }}
+  user: {{ if .Values.user | default "" | ne "" }}{{ .Values.user | lower | b64enc }}{{ else }}{{ randAlpha 32 | lower | b64enc }}{{ end }}
   password: {{ if .Values.password | default "" | ne "" }}{{ .Values.password | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
 {{- end }}
diff --git a/charts/database/templates/database-service.yaml b/charts/database/templates/database-service.yaml
index 2648b5c..5aa9fe9 100644
--- a/charts/database/templates/database-service.yaml
+++ b/charts/database/templates/database-service.yaml
@@ -12,7 +12,6 @@ metadata:
 spec:
   type: ClusterIP
   ports:
-    - name: postgres
-      port: 5432
+    - port: 5432
       targetPort: 5432
 {{- end }}
diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index 97a62bb..08cd8cd 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -48,7 +48,8 @@ persistence:
   ## If the PV uses a different storage class, specify that here.
   storageClass: ""
 # The username and password to be used by the on-cluster database.
-# If left empty they will be generated using randAlphaNum
+# If left empty they will be generated
+# The user name should be set to lowercase letters 
 superuser: "postgres"
 superuserPassword: ""
 replicator: "standby"

From 2bc64230488b33dca89ef7e29163b6a29ebc9a40 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Tue, 30 Aug 2022 13:13:31 +0800
Subject: [PATCH 27/64] chore(database): upgrade to pg 14.5

---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index c2ebaac..60fd030 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,9 +2,9 @@ FROM registry.drycc.cc/drycc/base:bullseye
 
 COPY rootfs/usr /usr/
 COPY rootfs/entrypoint.sh /entrypoint.sh
-ENV PYTHON_VERSION="3.10.4" \
+ENV PYTHON_VERSION="3.10.6" \
   PG_MAJOR=14 \
-  POSTGRESQL_VERSION="14.2"
+  POSTGRESQL_VERSION="14.5"
 
 ENV PGDATA /data/${PG_MAJOR}
 

From a9654daea49861433423458de6cb5cf87601433f Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Thu, 1 Sep 2022 17:22:07 +0800
Subject: [PATCH 28/64] feat(database): switch charts to oci

---
 .drone/drone.yml           | 17 +++++++++--------
 charts/database/Chart.yaml |  4 ++--
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/.drone/drone.yml b/.drone/drone.yml
index 14099ba..aa10b18 100644
--- a/.drone/drone.yml
+++ b/.drone/drone.yml
@@ -126,15 +126,16 @@ steps:
   commands:
   - IMAGE_TAG=$([ ! -z $DRONE_TAG ] && echo \"${DRONE_TAG:1}\" || echo \"canary\")
   - sed -i "s/imageTag:\ \"canary\"/imageTag:\ $IMAGE_TAG/g" charts/database/values.yaml
-  - helm package -u charts/database --version ${DRONE_TAG:-v1.0.0}
-  - curl -u $CHARTMUSEUM_USERNAME:$CHARTMUSEUM_PASSWORD -F chart=@database-${DRONE_TAG:-v1.0.0}.tgz "$CHARTMUSEUM_API/api/$([ -z $DRONE_TAG ] && echo testing || echo stable)/charts"
+  - helm package -u charts/database --version $([ -z $DRONE_TAG ] && echo 1.0.0 || echo ${DRONE_TAG#v})
+  - echo $CONTAINER_PASSWORD | helm registry login $DRYCC_REGISTRY -u $CONTAINER_USERNAME --password-stdin
+  - helm push database-$([ -z $DRONE_TAG ] && echo 1.0.0 || echo ${DRONE_TAG#v}).tgz oci://$DRYCC_REGISTRY/$([ -z $DRONE_TAG ] && echo charts-testing || echo charts)
   environment:
-    CHARTMUSEUM_USERNAME:
-      from_secret: chartmuseum_username
-    CHARTMUSEUM_PASSWORD:
-      from_secret: chartmuseum_password
-    CHARTMUSEUM_API:
-      from_secret: chartmuseum_api
+    DRYCC_REGISTRY:
+      from_secret: drycc_registry
+    CONTAINER_USERNAME:
+      from_secret: container_username
+    CONTAINER_PASSWORD:
+      from_secret: container_password
   when:
     event:
     - push
diff --git a/charts/database/Chart.yaml b/charts/database/Chart.yaml
index 7642091..0ec5901 100644
--- a/charts/database/Chart.yaml
+++ b/charts/database/Chart.yaml
@@ -2,8 +2,8 @@ name: database
 apiVersion: v2
 dependencies:
   - name: common
-    repository: https://charts.drycc.cc/stable
-    version: 1.x.x
+    repository: oci://registry.drycc.cc/charts
+    version: ~1.1.1
 home: https://github.com/drycc/postgres
 version: v1.1.0
 description: A PostgreSQL database used by Drycc Workflow.

From 2180258b545e6e502fdf9bae0df4fe1fa2026b2c Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Wed, 26 Oct 2022 10:56:55 +0800
Subject: [PATCH 29/64] chore(database): add init database configure

---
 charts/database/templates/_helper.tpl         | 2 ++
 charts/database/values.yaml                   | 1 +
 rootfs/usr/share/scripts/patroni/post_init.sh | 9 +++++----
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/charts/database/templates/_helper.tpl b/charts/database/templates/_helper.tpl
index 0cf961a..0e64d33 100644
--- a/charts/database/templates/_helper.tpl
+++ b/charts/database/templates/_helper.tpl
@@ -36,6 +36,8 @@ env:
   value: '0.0.0.0:5432'
 - name: PATRONI_RESTAPI_LISTEN
   value: '0.0.0.0:8008'
+- name: "DRYCC_DATABASE_INIT_NAMES"
+  value: "{{.Values.initDatabases}}"
 - name: DRYCC_DATABASE_SUPERUSER
   valueFrom:
     secretKeyRef:
diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index 08cd8cd..cb5d397 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -56,6 +56,7 @@ replicator: "standby"
 replicatorPassword: ""
 user: ""
 password: ""
+initDatabases: "controller,passport"
 
 global:
   # Set the location of Workflow's Object Storage
diff --git a/rootfs/usr/share/scripts/patroni/post_init.sh b/rootfs/usr/share/scripts/patroni/post_init.sh
index 90478b1..d6c88fe 100755
--- a/rootfs/usr/share/scripts/patroni/post_init.sh
+++ b/rootfs/usr/share/scripts/patroni/post_init.sh
@@ -5,10 +5,11 @@ if [[ ( -n "$DRYCC_DATABASE_USER") &&  ( -n "$DRYCC_DATABASE_PASSWORD")]]; then
   echo "Creating user ${DRYCC_DATABASE_USER}"
   psql "$1" -w -c "create user ${DRYCC_DATABASE_USER} WITH LOGIN ENCRYPTED PASSWORD '${DRYCC_DATABASE_PASSWORD}'"
 
-  echo "Creating passport and controller databases"
-  psql "$1" -w -c "CREATE DATABASE passport OWNER ${DRYCC_DATABASE_USER}"
-  psql "$1" -w -c "CREATE DATABASE controller OWNER ${DRYCC_DATABASE_USER}"
-
+  for dbname in ${DRYCC_DATABASE_INIT_NAMES//,/ }
+  do
+    echo "Creating database ${dbname}"
+    psql "$1" -w -c "CREATE DATABASE ${dbname} OWNER ${DRYCC_DATABASE_USER}"
+  done
 else
   echo "Skipping user creation"
   echo "Skipping database creation"

From 13eb7262b91f6c11b40226cac4fc79ac32e5ab65 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Wed, 26 Oct 2022 17:03:00 +0800
Subject: [PATCH 30/64] chore(database): use dynamic clusterrole name

---
 charts/database/templates/database-clusterrole.yaml        | 2 +-
 charts/database/templates/database-clusterrolebinding.yaml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/charts/database/templates/database-clusterrole.yaml b/charts/database/templates/database-clusterrole.yaml
index 11b2f70..7fc3898 100644
--- a/charts/database/templates/database-clusterrole.yaml
+++ b/charts/database/templates/database-clusterrole.yaml
@@ -2,7 +2,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: drycc-database
+  name: {{ printf "%s:drycc-database" .Release.Namespace | quote }}
 rules:
 - apiGroups:
   - ""
diff --git a/charts/database/templates/database-clusterrolebinding.yaml b/charts/database/templates/database-clusterrolebinding.yaml
index 11877bc..6db4596 100644
--- a/charts/database/templates/database-clusterrolebinding.yaml
+++ b/charts/database/templates/database-clusterrolebinding.yaml
@@ -2,11 +2,11 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: drycc-database
+  name: {{ printf "%s:drycc-database" .Release.Namespace | quote }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: drycc-database
+  name: {{ printf "%s:drycc-database" .Release.Namespace | quote }}
 subjects:
 - kind: ServiceAccount
   name: drycc-database

From 453738106cde52f4fc65fadead424c237902ce68 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Fri, 28 Oct 2022 13:26:06 +0800
Subject: [PATCH 31/64] chore(database): remove minio require

---
 charts/database/templates/_helper.tpl               |  7 -------
 charts/database/templates/database-statefulset.yaml | 12 ------------
 2 files changed, 19 deletions(-)

diff --git a/charts/database/templates/_helper.tpl b/charts/database/templates/_helper.tpl
index 0e64d33..7135587 100644
--- a/charts/database/templates/_helper.tpl
+++ b/charts/database/templates/_helper.tpl
@@ -68,13 +68,6 @@ env:
     secretKeyRef:
       name: database-creds
       key: password
-{{- if eq .Values.global.storageLocation "on-cluster" }}
-- name: "DRYCC_STORAGE_HEALTH"
-  valueFrom:
-    secretKeyRef:
-      name: storage-creds
-      key: health
-{{- end }}
 {{- end }}
 
 {{/* Generate database deployment limits */}}
diff --git a/charts/database/templates/database-statefulset.yaml b/charts/database/templates/database-statefulset.yaml
index 61280d0..f410b15 100644
--- a/charts/database/templates/database-statefulset.yaml
+++ b/charts/database/templates/database-statefulset.yaml
@@ -25,18 +25,6 @@ spec:
         podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset.type "key" .Values.podAntiAffinityPreset.key "values" .Values.podAntiAffinityPreset.values ) | nindent 10 }}
         nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values ) | nindent 10 }}
       serviceAccountName: drycc-database
-      {{- if eq .Values.global.storageLocation "on-cluster" }}
-      initContainers:
-      - name: drycc-database-init
-        image: {{.Values.imageRegistry}}/{{.Values.imageOrg}}/python-dev:latest
-        imagePullPolicy: {{.Values.imagePullPolicy}}
-        args:
-          - netcat
-          - -v
-          - -g
-          - $(DRYCC_STORAGE_HEALTH)
-        {{- include "database.envs" . | indent 8 }}
-      {{- end }}
       containers:
       - name: drycc-database
         image: {{.Values.imageRegistry}}/{{.Values.imageOrg}}/postgres:{{.Values.imageTag}}

From f02551c22c880b3985fe89035570c240075a77bd Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Fri, 10 Feb 2023 14:34:08 +0800
Subject: [PATCH 32/64] chore(database): use woodpecker replace drone

---
 .drone/drone.yml                              | 142 ------------------
 .drone/manifest.tmpl                          |  18 ---
 .woodpecker/build-linux.yml                   |  29 ++++
 .woodpecker/chart.yaml                        |  28 ++++
 .woodpecker/manifest.tmpl                     |  18 +++
 .woodpecker/manifest.yml                      |  38 +++++
 .woodpecker/test-linux.yml                    |  21 +++
 Makefile                                      |   2 +-
 README.md                                     |   2 +-
 charts/database/Chart.yaml                    |   2 +-
 .../templates/database-statefulset.yaml       |   2 +-
 11 files changed, 138 insertions(+), 164 deletions(-)
 delete mode 100644 .drone/drone.yml
 delete mode 100644 .drone/manifest.tmpl
 create mode 100644 .woodpecker/build-linux.yml
 create mode 100644 .woodpecker/chart.yaml
 create mode 100644 .woodpecker/manifest.tmpl
 create mode 100644 .woodpecker/manifest.yml
 create mode 100644 .woodpecker/test-linux.yml

diff --git a/.drone/drone.yml b/.drone/drone.yml
deleted file mode 100644
index aa10b18..0000000
--- a/.drone/drone.yml
+++ /dev/null
@@ -1,142 +0,0 @@
-kind: pipeline
-type: exec
-name: linux-amd64
-
-platform:
-  arch: amd64
-  os: linux
-
-steps:
-- name: test
-  commands:
-  - mkdir -p $HOMEPATH/.docker; echo $IMAGE_PULL_SECRETS > $HOMEPATH/.docker/config.json
-  - make docker-build test
-  environment:
-    VERSION: ${DRONE_TAG:-latest}-linux-amd64
-    DEV_REGISTRY:
-      from_secret: dev_registry
-    DRYCC_REGISTRY:
-      from_secret: drycc_registry
-    IMAGE_PULL_SECRETS:
-      from_secret: container_pull_secrets
-  when:
-    event:
-    - push
-    - tag
-    - pull_request
-
-- name: publish
-  commands:
-  - echo $CONTAINER_PASSWORD | docker login $DRYCC_REGISTRY --username $CONTAINER_USERNAME --password-stdin > /dev/null 2>&1
-  - make docker-build docker-immutable-push
-  environment:
-    VERSION: ${DRONE_TAG:-latest}-linux-amd64
-    DEV_REGISTRY:
-      from_secret: dev_registry
-    DRYCC_REGISTRY:
-      from_secret: drycc_registry
-    CONTAINER_USERNAME:
-      from_secret: container_username
-    CONTAINER_PASSWORD:
-      from_secret: container_password
-  when:
-    event:
-    - push
-    - tag
-
----
-kind: pipeline
-type: exec
-name: linux-arm64
-
-platform:
-  arch: arm64
-  os: linux
-
-steps:
-- name: publish
-  commands:
-  - echo $CONTAINER_PASSWORD | docker login $DRYCC_REGISTRY --username $CONTAINER_USERNAME --password-stdin > /dev/null 2>&1
-  - make docker-build docker-immutable-push
-  environment:
-    VERSION: ${DRONE_TAG:-latest}-linux-arm64
-    DEV_REGISTRY:
-      from_secret: dev_registry
-    DRYCC_REGISTRY:
-      from_secret: drycc_registry
-    CONTAINER_USERNAME:
-      from_secret: container_username
-    CONTAINER_PASSWORD:
-      from_secret: container_password
-  when:
-    event:
-    - push
-    - tag
-
----
-kind: pipeline
-type: docker
-name: manifest
-image_pull_secrets:
-- container_pull_secrets
-
-steps:
-
-- name: generate manifest
-  image: registry.drycc.cc/drycc/python-dev
-  pull: always
-  commands:
-  - sed -i "s/registry.drycc.cc/$${DRYCC_REGISTRY}/g" .drone/manifest.tmpl
-  environment:
-    DEV_REGISTRY:
-      from_secret: dev_registry
-    DRYCC_REGISTRY:
-      from_secret: drycc_registry
-
-- name: publish
-  image: plugins/manifest
-  settings:
-    spec: .drone/manifest.tmpl
-    username:
-      from_secret: container_username
-    password:
-      from_secret: container_password
-  environment:
-    DEV_REGISTRY:
-      from_secret: dev_registry
-    DRYCC_REGISTRY:
-      from_secret: drycc_registry
-
-trigger:
-  event:
-  - push
-  - tag
-
-depends_on:
-- linux-amd64
-- linux-arm64
-
----
-kind: pipeline
-type: exec
-name: chart
-
-steps:
-- name: generate chart
-  commands:
-  - IMAGE_TAG=$([ ! -z $DRONE_TAG ] && echo \"${DRONE_TAG:1}\" || echo \"canary\")
-  - sed -i "s/imageTag:\ \"canary\"/imageTag:\ $IMAGE_TAG/g" charts/database/values.yaml
-  - helm package -u charts/database --version $([ -z $DRONE_TAG ] && echo 1.0.0 || echo ${DRONE_TAG#v})
-  - echo $CONTAINER_PASSWORD | helm registry login $DRYCC_REGISTRY -u $CONTAINER_USERNAME --password-stdin
-  - helm push database-$([ -z $DRONE_TAG ] && echo 1.0.0 || echo ${DRONE_TAG#v}).tgz oci://$DRYCC_REGISTRY/$([ -z $DRONE_TAG ] && echo charts-testing || echo charts)
-  environment:
-    DRYCC_REGISTRY:
-      from_secret: drycc_registry
-    CONTAINER_USERNAME:
-      from_secret: container_username
-    CONTAINER_PASSWORD:
-      from_secret: container_password
-  when:
-    event:
-    - push
-    - tag
diff --git a/.drone/manifest.tmpl b/.drone/manifest.tmpl
deleted file mode 100644
index 0182d12..0000000
--- a/.drone/manifest.tmpl
+++ /dev/null
@@ -1,18 +0,0 @@
-image: registry.drycc.cc/drycc/postgres:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}canary{{/if}}
-{{#if build.tags}}
-tags:
-{{#each build.tags}}
-  - {{this}}
-{{/each}}
-{{/if}}
-manifests:
-  -
-    image: registry.drycc.cc/drycc/postgres:{{#if build.tag}}{{build.tag}}-{{else}}latest-{{/if}}linux-amd64
-    platform:
-      architecture: amd64
-      os: linux
-  -
-    image: registry.drycc.cc/drycc/postgres:{{#if build.tag}}{{build.tag}}-{{else}}latest-{{/if}}linux-arm64
-    platform:
-      architecture: arm64
-      os: linux
diff --git a/.woodpecker/build-linux.yml b/.woodpecker/build-linux.yml
new file mode 100644
index 0000000..a345874
--- /dev/null
+++ b/.woodpecker/build-linux.yml
@@ -0,0 +1,29 @@
+matrix:
+  platform:
+    - linux/amd64
+    - linux/arm64
+
+platform: ${platform}
+
+labels:
+  type: exec
+
+pipeline:
+- name: publish-linux
+  image: bash
+  commands:
+  - export VERSION=$([ -z $CI_COMMIT_TAG ] && echo latest || echo $CI_COMMIT_TAG)-$(sed 's#/#-#g' <<< $CI_SYSTEM_ARCH)
+  - echo $CONTAINER_PASSWORD | docker login $DRYCC_REGISTRY --username $CONTAINER_USERNAME --password-stdin > /dev/null 2>&1
+  - make docker-build docker-immutable-push
+  secrets:
+  - dev_registry
+  - drycc_registry
+  - container_username
+  - container_password
+  when:
+    event:
+    - push
+    - tag
+
+depends_on:
+- test-linux
\ No newline at end of file
diff --git a/.woodpecker/chart.yaml b/.woodpecker/chart.yaml
new file mode 100644
index 0000000..bfecf10
--- /dev/null
+++ b/.woodpecker/chart.yaml
@@ -0,0 +1,28 @@
+platform: linux/amd64
+
+labels:
+  type: exec
+
+pipeline:
+- name: generate-chart
+  type: local
+  image: bash
+  commands:
+  - export VERSION=$(sed 's#v##' <<< $CI_COMMIT_TAG)
+  - export IMAGE_TAG=$([ ! -z $CI_COMMIT_TAG ] && echo \"$VERSION\" || echo \"canary\")
+  - sed -i "s/imageTag:\ \"canary\"/imageTag:\ $IMAGE_TAG/g" charts/$${CI_REPO_NAME}/values.yaml
+  - helm package -u charts/$${CI_REPO_NAME} --version $([ -z $CI_COMMIT_TAG ] && echo 1.0.0 || echo $VERSION)
+  - echo $CONTAINER_PASSWORD | helm registry login $DRYCC_REGISTRY -u $CONTAINER_USERNAME --password-stdin
+  - helm push $${CI_REPO_NAME}-$([ -z $CI_COMMIT_TAG ] && echo 1.0.0 || echo $VERSION).tgz oci://$DRYCC_REGISTRY/$([ -z $CI_COMMIT_TAG ] && echo charts-testing || echo charts)
+  secrets:
+  - dev_registry
+  - drycc_registry
+  - container_username
+  - container_password
+  when:
+    event:
+    - push
+    - tag
+
+depends_on:
+- manifest
\ No newline at end of file
diff --git a/.woodpecker/manifest.tmpl b/.woodpecker/manifest.tmpl
new file mode 100644
index 0000000..8739535
--- /dev/null
+++ b/.woodpecker/manifest.tmpl
@@ -0,0 +1,18 @@
+image: registry.drycc.cc/drycc/{{project}}:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}canary{{/if}}
+{{#if build.tags}}
+tags:
+{{#each build.tags}}
+  - {{this}}
+{{/each}}
+{{/if}}
+manifests:
+  -
+    image: registry.drycc.cc/drycc/{{project}}:{{#if build.tag}}{{build.tag}}-{{else}}latest-{{/if}}linux-amd64
+    platform:
+      architecture: amd64
+      os: linux
+  -
+    image: registry.drycc.cc/drycc/{{project}}:{{#if build.tag}}{{build.tag}}-{{else}}latest-{{/if}}linux-arm64
+    platform:
+      architecture: arm64
+      os: linux
diff --git a/.woodpecker/manifest.yml b/.woodpecker/manifest.yml
new file mode 100644
index 0000000..f7023ff
--- /dev/null
+++ b/.woodpecker/manifest.yml
@@ -0,0 +1,38 @@
+platform: linux/amd64
+
+labels:
+  type: exec
+
+pipeline:
+- name: generate-manifest
+  image: bash
+  commands:
+  - sed -i "s/{{project}}/$${CI_REPO_NAME}/g" .woodpecker/manifest.tmpl
+  - sed -i "s/registry.drycc.cc/$${DRYCC_REGISTRY}/g" .woodpecker/manifest.tmpl
+  secrets:
+  - drycc_registry
+  when:
+    event:
+    - tag
+    - push
+
+- name: publish-manifest
+  image: bash
+  commands:
+  - docker run --rm
+    -e PLUGIN_SPEC=.woodpecker/manifest.tmpl
+    -e PLUGIN_USERNAME=$CONTAINER_USERNAME
+    -e PLUGIN_PASSWORD=$CONTAINER_PASSWORD
+    -v $(pwd):$(pwd)
+    -w $(pwd)
+    plugins/manifest
+  secrets:
+  - container_username
+  - container_password
+  when:
+    event:
+    - tag
+    - push
+
+depends_on:
+- build-linux
diff --git a/.woodpecker/test-linux.yml b/.woodpecker/test-linux.yml
new file mode 100644
index 0000000..d736541
--- /dev/null
+++ b/.woodpecker/test-linux.yml
@@ -0,0 +1,21 @@
+matrix:
+  platform:
+  - linux/amd64
+  - linux/arm64
+
+platform: ${platform}
+
+labels:
+  type: exec
+
+pipeline:
+- name: test-linux
+  image: bash
+  commands:
+  - make test
+  secrets:
+  - dev_registry
+  when:
+    event:
+    - push
+    - tag
diff --git a/Makefile b/Makefile
index 5eaa3de..0e70795 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 # Some uses for short name:
 # - Docker image name
 # - Kubernetes service, rc, pod, secret, volume names
-SHORT_NAME := postgres
+SHORT_NAME := database
 DRYCC_REGISTRY ?= ${DEV_REGISTRY}
 IMAGE_PREFIX ?= drycc
 PLATFORM ?= linux/amd64,linux/arm64
diff --git a/README.md b/README.md
index fa2c5a5..4e029b6 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 
 # Drycc Postgres
-[![Build Status](https://drone.drycc.cc/api/badges/drycc/postgres/status.svg)](https://drone.drycc.cc/drycc/postgres)
+[![Build Status](https://woodpecker.drycc.cc/api/badges/drycc/database/status.svg)](https://woodpecker.drycc.cc/drycc/database)
 
 Drycc (pronounced DAY-iss) Workflow is an open source Platform as a Service (PaaS) that adds a developer-friendly layer to any [Kubernetes](http://kubernetes.io) cluster, making it easy to deploy and manage applications on your own servers.
 
diff --git a/charts/database/Chart.yaml b/charts/database/Chart.yaml
index 0ec5901..dca398c 100644
--- a/charts/database/Chart.yaml
+++ b/charts/database/Chart.yaml
@@ -4,7 +4,7 @@ dependencies:
   - name: common
     repository: oci://registry.drycc.cc/charts
     version: ~1.1.1
-home: https://github.com/drycc/postgres
+home: https://github.com/drycc/database
 version: v1.1.0
 description: A PostgreSQL database used by Drycc Workflow.
 keywords:
diff --git a/charts/database/templates/database-statefulset.yaml b/charts/database/templates/database-statefulset.yaml
index f410b15..e36da25 100644
--- a/charts/database/templates/database-statefulset.yaml
+++ b/charts/database/templates/database-statefulset.yaml
@@ -27,7 +27,7 @@ spec:
       serviceAccountName: drycc-database
       containers:
       - name: drycc-database
-        image: {{.Values.imageRegistry}}/{{.Values.imageOrg}}/postgres:{{.Values.imageTag}}
+        image: {{.Values.imageRegistry}}/{{.Values.imageOrg}}/database:{{.Values.imageTag}}
         imagePullPolicy: {{.Values.imagePullPolicy}}
         ports:
         - containerPort: 8008

From f896caedd33ff951446922efb1329a3a86765f15 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Fri, 24 Mar 2023 13:52:38 +0800
Subject: [PATCH 33/64] fix(database): manifest error

---
 .woodpecker/manifest.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.woodpecker/manifest.yml b/.woodpecker/manifest.yml
index f7023ff..7f6ec36 100644
--- a/.woodpecker/manifest.yml
+++ b/.woodpecker/manifest.yml
@@ -23,6 +23,7 @@ pipeline:
     -e PLUGIN_SPEC=.woodpecker/manifest.tmpl
     -e PLUGIN_USERNAME=$CONTAINER_USERNAME
     -e PLUGIN_PASSWORD=$CONTAINER_PASSWORD
+    -e DRONE_TAG=$CI_COMMIT_TAG
     -v $(pwd):$(pwd)
     -w $(pwd)
     plugins/manifest

From 04d387cff761b470f82a00878598a9a99d987d9e Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Tue, 9 May 2023 14:22:41 +0800
Subject: [PATCH 34/64] fix(database): label conflict error


From 94fefaa3be9c00a22726177a6de35f45a7dae9a3 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Wed, 31 May 2023 12:35:40 +0800
Subject: [PATCH 35/64] chore(database): add chart appVersion

---
 .woodpecker/chart.yaml     | 6 ++++--
 charts/database/Chart.yaml | 1 +
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/.woodpecker/chart.yaml b/.woodpecker/chart.yaml
index bfecf10..3204cf5 100644
--- a/.woodpecker/chart.yaml
+++ b/.woodpecker/chart.yaml
@@ -10,10 +10,12 @@ pipeline:
   commands:
   - export VERSION=$(sed 's#v##' <<< $CI_COMMIT_TAG)
   - export IMAGE_TAG=$([ ! -z $CI_COMMIT_TAG ] && echo \"$VERSION\" || echo \"canary\")
+  - export APP_VERSION=$([ ! -z $CI_COMMIT_TAG ] && echo $VERSION || echo 1.0.0)
+  - export CHART_VERSION=$([ -z $CI_COMMIT_TAG ] && echo 1.0.0 || echo $VERSION)
   - sed -i "s/imageTag:\ \"canary\"/imageTag:\ $IMAGE_TAG/g" charts/$${CI_REPO_NAME}/values.yaml
-  - helm package -u charts/$${CI_REPO_NAME} --version $([ -z $CI_COMMIT_TAG ] && echo 1.0.0 || echo $VERSION)
+  - helm package -u charts/$${CI_REPO_NAME} --version $CHART_VERSION --app-version $APP_VERSION
   - echo $CONTAINER_PASSWORD | helm registry login $DRYCC_REGISTRY -u $CONTAINER_USERNAME --password-stdin
-  - helm push $${CI_REPO_NAME}-$([ -z $CI_COMMIT_TAG ] && echo 1.0.0 || echo $VERSION).tgz oci://$DRYCC_REGISTRY/$([ -z $CI_COMMIT_TAG ] && echo charts-testing || echo charts)
+  - helm push $${CI_REPO_NAME}-$CHART_VERSION.tgz oci://$DRYCC_REGISTRY/$([ -z $CI_COMMIT_TAG ] && echo charts-testing || echo charts)
   secrets:
   - dev_registry
   - drycc_registry
diff --git a/charts/database/Chart.yaml b/charts/database/Chart.yaml
index dca398c..139f3eb 100644
--- a/charts/database/Chart.yaml
+++ b/charts/database/Chart.yaml
@@ -1,5 +1,6 @@
 name: database
 apiVersion: v2
+appVersion: 1.0.0
 dependencies:
   - name: common
     repository: oci://registry.drycc.cc/charts

From b6783f3cfabfb9732d79554c1c058ae0cd8c8838 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Mon, 19 Jun 2023 16:08:56 +0800
Subject: [PATCH 36/64] chore(database): upgrade codename to bookworm

---
 Dockerfile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 60fd030..3301d47 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,10 @@
-FROM registry.drycc.cc/drycc/base:bullseye
+FROM registry.drycc.cc/drycc/base:bookworm
 
 COPY rootfs/usr /usr/
 COPY rootfs/entrypoint.sh /entrypoint.sh
-ENV PYTHON_VERSION="3.10.6" \
+ENV PYTHON_VERSION="3.11" \
   PG_MAJOR=14 \
-  POSTGRESQL_VERSION="14.5"
+  POSTGRESQL_VERSION="15.3"
 
 ENV PGDATA /data/${PG_MAJOR}
 

From e2699380e63261e442a4a21cfde035dcb1e1e657 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Tue, 20 Jun 2023 15:54:50 +0800
Subject: [PATCH 37/64] chore(database): add codename build-arg

---
 .woodpecker/build-linux.yml | 1 +
 .woodpecker/test-linux.yml  | 1 +
 Dockerfile                  | 3 ++-
 Makefile                    | 4 ++--
 4 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/.woodpecker/build-linux.yml b/.woodpecker/build-linux.yml
index a345874..db9ad17 100644
--- a/.woodpecker/build-linux.yml
+++ b/.woodpecker/build-linux.yml
@@ -16,6 +16,7 @@ pipeline:
   - echo $CONTAINER_PASSWORD | docker login $DRYCC_REGISTRY --username $CONTAINER_USERNAME --password-stdin > /dev/null 2>&1
   - make docker-build docker-immutable-push
   secrets:
+  - codename
   - dev_registry
   - drycc_registry
   - container_username
diff --git a/.woodpecker/test-linux.yml b/.woodpecker/test-linux.yml
index d736541..313179e 100644
--- a/.woodpecker/test-linux.yml
+++ b/.woodpecker/test-linux.yml
@@ -14,6 +14,7 @@ pipeline:
   commands:
   - make test
   secrets:
+  - codename
   - dev_registry
   when:
     event:
diff --git a/Dockerfile b/Dockerfile
index 3301d47..87cac65 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,5 @@
-FROM registry.drycc.cc/drycc/base:bookworm
+ARG CODENAME
+FROM registry.drycc.cc/drycc/base:${CODENAME}
 
 COPY rootfs/usr /usr/
 COPY rootfs/entrypoint.sh /entrypoint.sh
diff --git a/Makefile b/Makefile
index 0e70795..ed4a626 100644
--- a/Makefile
+++ b/Makefile
@@ -23,11 +23,11 @@ all: docker-build docker-push
 # For cases where we're building from local
 # We also alter the RC file to set the image name.
 docker-build:
-	docker build ${DOCKER_BUILD_FLAGS} -t ${IMAGE} .
+	docker build ${DOCKER_BUILD_FLAGS} --build-arg CODENAME=${CODENAME} -t ${IMAGE} .
 	docker tag ${IMAGE} ${MUTABLE_IMAGE}
 
 docker-buildx:
-	docker buildx build --platform ${PLATFORM} -t ${IMAGE} . --push
+	docker buildx build --build-arg CODENAME=${CODENAME} --platform ${PLATFORM} -t ${IMAGE} . --push
 
 test: test-style
 

From eb99ebd03abf30d95e533fbd46b157f6bcae7150 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Sun, 25 Jun 2023 08:53:22 +0800
Subject: [PATCH 38/64] chore(database): add database extension

---
 Dockerfile                                    | 8 ++++----
 charts/database/templates/_helper.tpl         | 2 ++
 charts/database/values.yaml                   | 3 ++-
 rootfs/entrypoint.sh                          | 3 +++
 rootfs/usr/share/scripts/patroni/post_init.sh | 9 ++++++++-
 5 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 87cac65..3daf337 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,15 +3,15 @@ FROM registry.drycc.cc/drycc/base:${CODENAME}
 
 COPY rootfs/usr /usr/
 COPY rootfs/entrypoint.sh /entrypoint.sh
-ENV PYTHON_VERSION="3.11" \
-  PG_MAJOR=14 \
-  POSTGRESQL_VERSION="15.3"
+ENV PG_MAJOR=15 \
+  PG_MINOR=3 \
+  PYTHON_VERSION="3.11"
 
 ENV PGDATA /data/${PG_MAJOR}
 
 RUN install-packages gcc \
   && install-stack python $PYTHON_VERSION \
-  && install-stack postgresql $POSTGRESQL_VERSION \
+  && install-stack postgresql $PG_MAJOR.$PG_MINOR \
   && . init-stack \
   && set -eux; pip3 install --disable-pip-version-check --no-cache-dir psycopg[binary] patroni[kubernetes] 2>/dev/null; set +eux \
   && apt-get purge -y --auto-remove gcc \
diff --git a/charts/database/templates/_helper.tpl b/charts/database/templates/_helper.tpl
index 7135587..5a01d6b 100644
--- a/charts/database/templates/_helper.tpl
+++ b/charts/database/templates/_helper.tpl
@@ -38,6 +38,8 @@ env:
   value: '0.0.0.0:8008'
 - name: "DRYCC_DATABASE_INIT_NAMES"
   value: "{{.Values.initDatabases}}"
+- name: "DRYCC_DATABASE_EXTENSIONS"
+  value: "{{.Values.databaseExtensions}}"
 - name: DRYCC_DATABASE_SUPERUSER
   valueFrom:
     secretKeyRef:
diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index cb5d397..90c7398 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -56,7 +56,8 @@ replicator: "standby"
 replicatorPassword: ""
 user: ""
 password: ""
-initDatabases: "controller,passport"
+initDatabases: "controller,passport,monitor"
+databaseExtensions: "postgis,timescaledb"
 
 global:
   # Set the location of Workflow's Object Storage
diff --git a/rootfs/entrypoint.sh b/rootfs/entrypoint.sh
index 40e2ddf..d8baed7 100755
--- a/rootfs/entrypoint.sh
+++ b/rootfs/entrypoint.sh
@@ -26,6 +26,9 @@ restapi:
   connect_address: '${PATRONI_KUBERNETES_POD_IP}:8008'
 postgresql:
   data_dir: '${PGDATA}'
+  parameters:
+    timescaledb.license: 'timescale'
+    shared_preload_libraries: 'auto_explain,timescaledb,pg_stat_statements'
   connect_address: '${PATRONI_KUBERNETES_POD_IP}:5432'
   authentication:
     superuser:
diff --git a/rootfs/usr/share/scripts/patroni/post_init.sh b/rootfs/usr/share/scripts/patroni/post_init.sh
index d6c88fe..338c150 100755
--- a/rootfs/usr/share/scripts/patroni/post_init.sh
+++ b/rootfs/usr/share/scripts/patroni/post_init.sh
@@ -4,11 +4,18 @@ set -Eeu
 if [[ ( -n "$DRYCC_DATABASE_USER") &&  ( -n "$DRYCC_DATABASE_PASSWORD")]]; then
   echo "Creating user ${DRYCC_DATABASE_USER}"
   psql "$1" -w -c "create user ${DRYCC_DATABASE_USER} WITH LOGIN ENCRYPTED PASSWORD '${DRYCC_DATABASE_PASSWORD}'"
-
   for dbname in ${DRYCC_DATABASE_INIT_NAMES//,/ }
   do
     echo "Creating database ${dbname}"
     psql "$1" -w -c "CREATE DATABASE ${dbname} OWNER ${DRYCC_DATABASE_USER}"
+    for extension in ${DRYCC_DATABASE_EXTENSIONS//,/ }
+    do
+      echo "Creating extension ${extension}"
+      psql "$1" -w << EOF
+\c ${dbname};
+create extension ${extension};
+EOF
+    done
   done
 else
   echo "Skipping user creation"

From bb5a8516f2d820cbfbc31ca1a5a0a1ef81f2db53 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Wed, 28 Jun 2023 15:55:15 +0800
Subject: [PATCH 39/64] fix(database): link error

---
 CONTRIBUTING.md | 5 ++---
 Dockerfile      | 5 +++--
 MAINTAINERS.md  | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 2e2c6ae..c0c3290 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,5 +1,4 @@
-# How to Contribute
+# Contributing to Drycc
 
 This project is part of Drycc. You can find the latest contribution
-guidelines [at the Drycc project](https://github.com/drycc/drycc/blob/main/CONTRIBUTING.md).
-
+guidelines [in our documentation](https://www.drycc.cc/docs/workflow/contributing/overview/).
diff --git a/Dockerfile b/Dockerfile
index 3daf337..83f4ba0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,7 +7,8 @@ ENV PG_MAJOR=15 \
   PG_MINOR=3 \
   PYTHON_VERSION="3.11"
 
-ENV PGDATA /data/${PG_MAJOR}
+ENV HOME /data
+ENV PGDATA $HOME/$PG_MAJOR
 
 RUN install-packages gcc \
   && install-stack python $PYTHON_VERSION \
@@ -33,7 +34,7 @@ RUN install-packages gcc \
   && mkdir -p /usr/share/man/man{1..8} \
   && mkdir -p $PGDATA \
   && groupadd postgres && useradd -g postgres postgres \
-  && chown -R postgres:postgres /data
+  && chown -R postgres:postgres $HOME
 
 USER postgres
 ENTRYPOINT ["init-stack", "/entrypoint.sh"]
diff --git a/MAINTAINERS.md b/MAINTAINERS.md
index 634e415..fc5f4fa 100644
--- a/MAINTAINERS.md
+++ b/MAINTAINERS.md
@@ -1,4 +1,4 @@
 # Drycc Maintainers
 
 This project is part of Drycc. The official maintainers documentation is
-located [in the main project](https://github.com/drycc/drycc/blob/main/MAINTAINERS.md).
+located [in our documentation](http://www.drycc.cc/contributing/maintainers/).

From 4f05056e583e7b14bb37deafba610c0d40439fce Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Tue, 15 Aug 2023 10:54:01 +0800
Subject: [PATCH 40/64] chore(database): bump common 1.1.2

---
 charts/database/Chart.yaml                          |  2 +-
 charts/database/templates/database-statefulset.yaml |  6 +++---
 charts/database/values.yaml                         | 10 ++++------
 3 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/charts/database/Chart.yaml b/charts/database/Chart.yaml
index 139f3eb..d12aee8 100644
--- a/charts/database/Chart.yaml
+++ b/charts/database/Chart.yaml
@@ -4,7 +4,7 @@ appVersion: 1.0.0
 dependencies:
   - name: common
     repository: oci://registry.drycc.cc/charts
-    version: ~1.1.1
+    version: ~1.1.2
 home: https://github.com/drycc/database
 version: v1.1.0
 description: A PostgreSQL database used by Drycc Workflow.
diff --git a/charts/database/templates/database-statefulset.yaml b/charts/database/templates/database-statefulset.yaml
index e36da25..e46e2eb 100644
--- a/charts/database/templates/database-statefulset.yaml
+++ b/charts/database/templates/database-statefulset.yaml
@@ -16,13 +16,13 @@ spec:
       cluster-name: drycc-database
   template:
     metadata:
-      labels:
+      labels: {{- include "common.labels.standard" . | nindent 8 }}
         app: drycc-database
         cluster-name: drycc-database
     spec:
       affinity:
-        podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset.type "key" .Values.podAffinityPreset.key "values" .Values.podAffinityPreset.values ) | nindent 10 }}
-        podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset.type "key" .Values.podAntiAffinityPreset.key "values" .Values.podAntiAffinityPreset.values ) | nindent 10 }}
+        podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset.type "component" "" "extraMatchLabels" .Values.podAffinityPreset.extraMatchLabels "topologyKey" "" "context" $) | nindent 10 }}
+        podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset.type "component" "" "extraMatchLabels" .Values.podAntiAffinityPreset.extraMatchLabels "topologyKey" "" "context" $) | nindent 10 }}
         nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values ) | nindent 10 }}
       serviceAccountName: drycc-database
       containers:
diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index 90c7398..850a471 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -16,16 +16,14 @@ nodeAffinityPreset:
   - "true"
 
 podAffinityPreset:
-  key: "security"
   type: ""
-  values:
-  - "drycc-security"
+  extraMatchLabels:
+    security: "drycc-security"
 
 podAntiAffinityPreset:
-  key: "app"
   type: "soft"
-  values:
-  - "drycc-database"
+  extraMatchLabels:
+    app: "drycc-database"
 
 debug: "false"
 timeout: "1200"

From 6c25e1ca6715349957b655419c39f4aba1decaab Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Thu, 28 Sep 2023 10:36:22 +0800
Subject: [PATCH 41/64] chore(database): use podman replace docker

---
 .woodpecker/build-linux.yml |  4 ++--
 .woodpecker/manifest.yml    |  4 ++--
 Makefile                    | 19 ++++++++-----------
 README.md                   | 20 ++++++++------------
 versioning.mk               | 16 ++++++++--------
 5 files changed, 28 insertions(+), 35 deletions(-)

diff --git a/.woodpecker/build-linux.yml b/.woodpecker/build-linux.yml
index db9ad17..8cdd984 100644
--- a/.woodpecker/build-linux.yml
+++ b/.woodpecker/build-linux.yml
@@ -13,8 +13,8 @@ pipeline:
   image: bash
   commands:
   - export VERSION=$([ -z $CI_COMMIT_TAG ] && echo latest || echo $CI_COMMIT_TAG)-$(sed 's#/#-#g' <<< $CI_SYSTEM_ARCH)
-  - echo $CONTAINER_PASSWORD | docker login $DRYCC_REGISTRY --username $CONTAINER_USERNAME --password-stdin > /dev/null 2>&1
-  - make docker-build docker-immutable-push
+  - echo $CONTAINER_PASSWORD | podman login $DRYCC_REGISTRY --username $CONTAINER_USERNAME --password-stdin > /dev/null 2>&1
+  - make podman-build podman-immutable-push
   secrets:
   - codename
   - dev_registry
diff --git a/.woodpecker/manifest.yml b/.woodpecker/manifest.yml
index 7f6ec36..2d5c4e5 100644
--- a/.woodpecker/manifest.yml
+++ b/.woodpecker/manifest.yml
@@ -19,14 +19,14 @@ pipeline:
 - name: publish-manifest
   image: bash
   commands:
-  - docker run --rm
+  - podman run --rm
     -e PLUGIN_SPEC=.woodpecker/manifest.tmpl
     -e PLUGIN_USERNAME=$CONTAINER_USERNAME
     -e PLUGIN_PASSWORD=$CONTAINER_PASSWORD
     -e DRONE_TAG=$CI_COMMIT_TAG
     -v $(pwd):$(pwd)
     -w $(pwd)
-    plugins/manifest
+    docker.io/plugins/manifest
   secrets:
   - container_username
   - container_password
diff --git a/Makefile b/Makefile
index ed4a626..185c51b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 # Short name: Short name, following [a-zA-Z_], used all over the place.
 # Some uses for short name:
-# - Docker image name
+# - Container image name
 # - Kubernetes service, rc, pod, secret, volume names
 SHORT_NAME := database
 DRYCC_REGISTRY ?= ${DEV_REGISTRY}
@@ -15,23 +15,20 @@ SHELL_SCRIPTS = $(wildcard rootfs/usr/share/scripts/patroni/*)
 # and other build options
 DEV_ENV_IMAGE := ${DEV_REGISTRY}/drycc/go-dev
 DEV_ENV_WORK_DIR := /opt/drycc/go/src/${REPO_PATH}
-DEV_ENV_CMD := docker run --rm -v ${CURDIR}:${DEV_ENV_WORK_DIR} -w ${DEV_ENV_WORK_DIR} ${DEV_ENV_IMAGE}
-DEV_ENV_CMD_INT := docker run -it --rm -v ${CURDIR}:${DEV_ENV_WORK_DIR} -w ${DEV_ENV_WORK_DIR} ${DEV_ENV_IMAGE}
+DEV_ENV_CMD := podman run --rm -v ${CURDIR}:${DEV_ENV_WORK_DIR} -w ${DEV_ENV_WORK_DIR} ${DEV_ENV_IMAGE}
+DEV_ENV_CMD_INT := podman run -it --rm -v ${CURDIR}:${DEV_ENV_WORK_DIR} -w ${DEV_ENV_WORK_DIR} ${DEV_ENV_IMAGE}
 
-all: docker-build docker-push
+all: podman-build podman-push
 
 # For cases where we're building from local
 # We also alter the RC file to set the image name.
-docker-build:
-	docker build ${DOCKER_BUILD_FLAGS} --build-arg CODENAME=${CODENAME} -t ${IMAGE} .
-	docker tag ${IMAGE} ${MUTABLE_IMAGE}
-
-docker-buildx:
-	docker buildx build --build-arg CODENAME=${CODENAME} --platform ${PLATFORM} -t ${IMAGE} . --push
+podman-build:
+	podman build --build-arg CODENAME=${CODENAME} -t ${IMAGE} .
+	podman tag ${IMAGE} ${MUTABLE_IMAGE}
 
 test: test-style
 
 test-style:
 	${DEV_ENV_CMD} shellcheck $(SHELL_SCRIPTS)
 
-.PHONY: all docker-build docker-push test
+.PHONY: all podman-build podman-push test
diff --git a/README.md b/README.md
index 4e029b6..80225f9 100644
--- a/README.md
+++ b/README.md
@@ -8,10 +8,6 @@ For more information about the Drycc Workflow, please visit the main project pag
 
 We welcome your input! If you have feedback, please submit an [issue][issues]. If you'd like to participate in development, please read the "Development" section below and submit a [pull request][prs].
 
-# About
-
-This component is a PostgreSQL database for use in Kubernetes. It builds on the official [postgres](https://registry.hub.docker.com/_/postgres/) Docker image. While it's intended for use inside of the Drycc Workflow open source [PaaS](https://en.wikipedia.org/wiki/Platform_as_a_service), it's flexible enough to be used as a standalone pod on any Kubernetes cluster or even as a standalone Docker container.
-
 # Development
 
 The Drycc project welcomes contributions from all developers. The high level process for development matches many other open source projects. See below for an outline.
@@ -27,7 +23,7 @@ The Drycc project welcomes contributions from all developers. The high level pro
 In order to develop and test this component in a Drycc cluster, you'll need the following:
 
 * [GNU Make](https://www.gnu.org/software/make/)
-* [Docker](https://www.docker.com/) installed, configured and running
+* [Podman](https://podman.io/) installed, configured and running
 * A working Kubernetes cluster and `kubectl` installed and configured to talk to the cluster
  * If you don't have this setup, please see [the Kubernetes documentation][k8s-docs]
 
@@ -39,27 +35,27 @@ If your feature or bugfix doesn't easily lend itself to unit/integration testing
 
 ### Dogfooding
 
-Finally, we encourage you to [dogfood](https://en.wikipedia.org/wiki/Eating_your_own_dog_food) this component while you're writing code on it. To do so, you'll need to build and push Docker images with your changes.
+Finally, we encourage you to [dogfood](https://en.wikipedia.org/wiki/Eating_your_own_dog_food) this component while you're writing code on it. To do so, you'll need to build and push Container images with your changes.
 
 This project has a [Makefile](https://github.com/drycc/postgres/blob/main/Makefile) that makes these tasks significantly easier. It requires the following environment variables to be set:
 
-* `DRYCC_REGISTRY` - A Docker registry that you have push access to and your Kubernetes cluster can pull from
+* `DRYCC_REGISTRY` - A Container registry that you have push access to and your Kubernetes cluster can pull from
   * If this is [Docker Hub](https://hub.docker.com/), leave this variable empty
   * Otherwise, ensure it has a trailing `/`
-* `IMAGE_PREFIX` - The organization in the Docker repository. This defaults to `drycc`, but if you don't have access to that organization, set this to one you have push access to.
+* `IMAGE_PREFIX` - The organization in the Container repository. This defaults to `drycc`, but if you don't have access to that organization, set this to one you have push access to.
 * `SHORT_NAME` (optional) - The name of the image. This defaults to `postgres`
-* `VERSION` (optional) - The tag of the Docker image. This defaults to the current Git SHA (the output of `git rev-parse --short HEAD`)
+* `VERSION` (optional) - The tag of the Container image. This defaults to the current Git SHA (the output of `git rev-parse --short HEAD`)
 
-Assuming you have these variables set correctly, run `make docker-build` to build the new image, and `make docker-push` to push it. Here is an example command that would push to `example.com/arschles/postgres:devel`:
+Assuming you have these variables set correctly, run `make podman-build` to build the new image, and `make podman-push` to push it. Here is an example command that would push to `example.com/arschles/postgres:devel`:
 
 ```console
 export DRYCC_REGISTRY=example.com/
 export IMAGE_PREFIX=arschles
 export VERSION=devel
-make docker-build docker-push
+make podman-build podman-push
 ```
 
-Note that you'll have to push your image to a Docker repository (`make docker-push`) in order for your Kubernetes cluster to pull the image. This is important for testing in your cluster.
+Note that you'll have to push your image to a Container repository (`make podman-push`) in order for your Kubernetes cluster to pull the image. This is important for testing in your cluster.
 
 
 [issues]: https://github.com/drycc/postgres/issues
diff --git a/versioning.mk b/versioning.mk
index fd4a488..10e3d7b 100644
--- a/versioning.mk
+++ b/versioning.mk
@@ -10,13 +10,13 @@ info:
 	@echo "Immutable tag:   ${IMAGE}"
 	@echo "Mutable tag:     ${MUTABLE_IMAGE}"
 
-.PHONY: docker-push
-docker-push: docker-immutable-push docker-mutable-push
+.PHONY: podman-push
+podman-push: podman-immutable-push podman-mutable-push
 
-.PHONY: docker-immutable-push
-docker-immutable-push:
-	docker push ${IMAGE}
+.PHONY: podman-immutable-push
+podman-immutable-push:
+	podman push ${IMAGE}
 
-.PHONY: docker-mutable-push
-docker-mutable-push:
-	docker push ${MUTABLE_IMAGE}
+.PHONY: podman-mutable-push
+podman-mutable-push:
+	podman push ${MUTABLE_IMAGE}

From 5cf5446f57d60a7cd23d35d1d3958d605584e4b2 Mon Sep 17 00:00:00 2001
From: Eamon <zhang.eamon@hotmail.com>
Date: Wed, 28 Feb 2024 13:23:05 +0800
Subject: [PATCH 42/64] chore(postgres): add patroni and postgres params (#15)

---
 rootfs/entrypoint.sh | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/rootfs/entrypoint.sh b/rootfs/entrypoint.sh
index d8baed7..43e7f9f 100755
--- a/rootfs/entrypoint.sh
+++ b/rootfs/entrypoint.sh
@@ -10,8 +10,14 @@ fi
 cat > /data/patroni.yaml <<__EOF__
 bootstrap:
   dcs:
+    ttl: 30
+    loop_wait: 10
+    retry_timeout: 10
+    maximum_lag_on_failover: 1048576
+    failsafe_mode: true
     postgresql:
       use_pg_rewind: true
+      use_slots: true
   initdb:
   - auth-host: md5
   - auth-local: trust
@@ -29,6 +35,22 @@ postgresql:
   parameters:
     timescaledb.license: 'timescale'
     shared_preload_libraries: 'auto_explain,timescaledb,pg_stat_statements'
+    hot_standby: "on"
+    max_connections: 1005
+    max_worker_processes: 8
+    max_wal_senders: 10
+    max_replication_slots: 10
+    hot_standby_feedback: on
+    max_prepared_transactions: 0
+    max_locks_per_transaction: 64
+    wal_log_hints: "on"
+    track_commit_timestamp: "off"
+    archive_mode: "on"
+    archive_timeout: 300s
+    archive_command: "/bin/true"
+    log_min_duration_statement: 1000
+    log_lock_waits: on
+    log_statement: 'ddl' 
   connect_address: '${PATRONI_KUBERNETES_POD_IP}:5432'
   authentication:
     superuser:

From 2f9ad68c09781ee3396aeb3dfd9fdc19b7c5aa88 Mon Sep 17 00:00:00 2001
From: Eamon <zhang.eamon@hotmail.com>
Date: Wed, 28 Feb 2024 13:47:33 +0800
Subject: [PATCH 43/64] chore(dockerfile): install vi

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 83f4ba0..2edc393 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,7 +10,7 @@ ENV PG_MAJOR=15 \
 ENV HOME /data
 ENV PGDATA $HOME/$PG_MAJOR
 
-RUN install-packages gcc \
+RUN install-packages vi gcc \
   && install-stack python $PYTHON_VERSION \
   && install-stack postgresql $PG_MAJOR.$PG_MINOR \
   && . init-stack \

From ab75e3c402e24aae81b7ea46460ead72dd57025b Mon Sep 17 00:00:00 2001
From: Eamon <zhang.eamon@hotmail.com>
Date: Fri, 1 Mar 2024 09:40:14 +0800
Subject: [PATCH 44/64] chore(dockerfile): install vim instand of vi

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 2edc393..8cc8851 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,7 +10,7 @@ ENV PG_MAJOR=15 \
 ENV HOME /data
 ENV PGDATA $HOME/$PG_MAJOR
 
-RUN install-packages vi gcc \
+RUN install-packages vim gcc \
   && install-stack python $PYTHON_VERSION \
   && install-stack postgresql $PG_MAJOR.$PG_MINOR \
   && . init-stack \

From 729cdc248b4ff4d67a1a2a8e247d0aa8f604d6a0 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Mon, 4 Mar 2024 16:56:35 +0800
Subject: [PATCH 45/64] chore(charts): add diagnostic mode

---
 .../database/templates/database-statefulset.yaml  |  6 ++++++
 charts/database/values.yaml                       | 15 +++++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/charts/database/templates/database-statefulset.yaml b/charts/database/templates/database-statefulset.yaml
index e46e2eb..d958c29 100644
--- a/charts/database/templates/database-statefulset.yaml
+++ b/charts/database/templates/database-statefulset.yaml
@@ -29,6 +29,10 @@ spec:
       - name: drycc-database
         image: {{.Values.imageRegistry}}/{{.Values.imageOrg}}/database:{{.Values.imageTag}}
         imagePullPolicy: {{.Values.imagePullPolicy}}
+        {{- if .Values.diagnosticMode.enabled }}
+        command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 10 }}
+        args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 10 }}
+        {{- end }}
         ports:
         - containerPort: 8008
           protocol: TCP
@@ -36,6 +40,7 @@ spec:
           protocol: TCP
         {{- include "database.limits" . | indent 8 }}
         {{- include "database.envs" . | indent 8 }}
+        {{- if not .Values.diagnosticMode.enabled }}
         lifecycle:
           preStop:
             exec:
@@ -67,6 +72,7 @@ spec:
           initialDelaySeconds: 10
           timeoutSeconds: 5
           failureThreshold: 3
+        {{- end }}
         volumeMounts:
         - name: database-data
           mountPath: /data
diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index 850a471..d75a5b3 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -9,6 +9,21 @@ imageRegistry: "registry.drycc.cc"
 
 replicas: 3
 
+## Enable diagnostic mode
+##
+diagnosticMode:
+  ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden)
+  ##
+  enabled: false
+  ## @param diagnosticMode.command Command to override all containers
+  ##
+  command:
+    - sleep
+  ## @param diagnosticMode.args Args to override all containers
+  ##
+  args:
+    - infinity
+
 nodeAffinityPreset:
   key: "drycc.cc/node"
   type: "soft"

From c1d5d40e12e4bc798759aa6d321727121fb06d82 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Wed, 6 Mar 2024 14:49:51 +0800
Subject: [PATCH 46/64] feat(charts): reuses the value from an existing secret
 and config

---
 .../database/templates/database-secret-creds.yaml  | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/charts/database/templates/database-secret-creds.yaml b/charts/database/templates/database-secret-creds.yaml
index 83424f2..59a8f3e 100644
--- a/charts/database/templates/database-secret-creds.yaml
+++ b/charts/database/templates/database-secret-creds.yaml
@@ -6,13 +6,11 @@ metadata:
   labels:
     app: drycc-database
     heritage: drycc
-  annotations:
-    "helm.sh/hook": pre-install
 data:
-  superuser: {{ if .Values.superuser | default "" | ne "" }}{{ .Values.superuser | lower | b64enc }}{{ else }}{{ randAlpha 32 | lower | b64enc }}{{ end }}
-  superuser-password: {{ if .Values.superuserPassword | default "" | ne "" }}{{ .Values.superuserPassword | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
-  replicator: {{ if .Values.replicator | default "" | ne "" }}{{ .Values.replicator | lower | b64enc }}{{ else }}{{ randAlpha 32 | lower | b64enc }}{{ end }}
-  replicator-password: {{ if .Values.replicatorPassword | default "" | ne "" }}{{ .Values.replicatorPassword | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
-  user: {{ if .Values.user | default "" | ne "" }}{{ .Values.user | lower | b64enc }}{{ else }}{{ randAlpha 32 | lower | b64enc }}{{ end }}
-  password: {{ if .Values.password | default "" | ne "" }}{{ .Values.password | b64enc }}{{ else }}{{ randAlphaNum 32 | b64enc }}{{ end }}
+  superuser: {{ include "common.secrets.lookup" (dict "secret" "database-creds" "key" "superuser" "defaultValue" (.Values.superuser | default (randAlpha 32) | lower) "context" $) }}
+  superuser-password: {{ include "common.secrets.lookup" (dict "secret" "database-creds" "key" "superuser-password" "defaultValue" (.Values.superuserPassword | default (randAlphaNum 32)) "context" $) }}
+  replicator: {{ include "common.secrets.lookup" (dict "secret" "database-creds" "key" "replicator" "defaultValue" (.Values.replicator | default (randAlpha 32) | lower) "context" $) }}
+  replicator-password: {{ include "common.secrets.lookup" (dict "secret" "database-creds" "key" "replicator-password" "defaultValue" (.Values.replicatorPassword | default (randAlphaNum 32) | lower) "context" $) }}
+  user: {{ include "common.secrets.lookup" (dict "secret" "database-creds" "key" "user" "defaultValue" (.Values.user | default (randAlpha 32) | lower) "context" $) }}
+  password: {{ include "common.secrets.lookup" (dict "secret" "database-creds" "key" "password" "defaultValue" (.Values.password | default (randAlphaNum 32)) "context" $) }}
 {{- end }}

From caf5881356841b8416b865d527fa21d4a8170fa5 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Mon, 18 Mar 2024 16:27:29 +0800
Subject: [PATCH 47/64] chore(woodpecker): migrations woodpecker-ci to 2

---
 .woodpecker/build-linux.yml | 5 ++---
 .woodpecker/chart.yaml      | 6 ++----
 .woodpecker/manifest.yml    | 5 ++---
 .woodpecker/test-linux.yml  | 5 ++---
 4 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/.woodpecker/build-linux.yml b/.woodpecker/build-linux.yml
index 8cdd984..f411033 100644
--- a/.woodpecker/build-linux.yml
+++ b/.woodpecker/build-linux.yml
@@ -3,12 +3,11 @@ matrix:
     - linux/amd64
     - linux/arm64
 
-platform: ${platform}
-
 labels:
   type: exec
+  platform: ${platform}
 
-pipeline:
+steps:
 - name: publish-linux
   image: bash
   commands:
diff --git a/.woodpecker/chart.yaml b/.woodpecker/chart.yaml
index 3204cf5..20f9ea9 100644
--- a/.woodpecker/chart.yaml
+++ b/.woodpecker/chart.yaml
@@ -1,11 +1,9 @@
-platform: linux/amd64
-
 labels:
   type: exec
+  platform: linux/amd64
 
-pipeline:
+steps:
 - name: generate-chart
-  type: local
   image: bash
   commands:
   - export VERSION=$(sed 's#v##' <<< $CI_COMMIT_TAG)
diff --git a/.woodpecker/manifest.yml b/.woodpecker/manifest.yml
index 2d5c4e5..b4735ee 100644
--- a/.woodpecker/manifest.yml
+++ b/.woodpecker/manifest.yml
@@ -1,9 +1,8 @@
-platform: linux/amd64
-
 labels:
   type: exec
+  platform: linux/amd64
 
-pipeline:
+steps:
 - name: generate-manifest
   image: bash
   commands:
diff --git a/.woodpecker/test-linux.yml b/.woodpecker/test-linux.yml
index 313179e..d47ccc5 100644
--- a/.woodpecker/test-linux.yml
+++ b/.woodpecker/test-linux.yml
@@ -3,12 +3,11 @@ matrix:
   - linux/amd64
   - linux/arm64
 
-platform: ${platform}
-
 labels:
   type: exec
+  platform: ${platform}
 
-pipeline:
+steps:
 - name: test-linux
   image: bash
   commands:

From e4352cd8dfb8bf7d9e29be7a1f1e60f1a58e33bc Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Tue, 19 Mar 2024 23:12:49 +0800
Subject: [PATCH 48/64] fix(woodpecker): CI_SYSTEM_ARCH env removed

---
 .woodpecker/build-linux.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.woodpecker/build-linux.yml b/.woodpecker/build-linux.yml
index f411033..782d2f5 100644
--- a/.woodpecker/build-linux.yml
+++ b/.woodpecker/build-linux.yml
@@ -11,7 +11,7 @@ steps:
 - name: publish-linux
   image: bash
   commands:
-  - export VERSION=$([ -z $CI_COMMIT_TAG ] && echo latest || echo $CI_COMMIT_TAG)-$(sed 's#/#-#g' <<< $CI_SYSTEM_ARCH)
+  - export VERSION=$([ -z $CI_COMMIT_TAG ] && echo latest || echo $CI_COMMIT_TAG)-$(sed 's#/#-#g' <<< $CI_SYSTEM_PLATFORM)
   - echo $CONTAINER_PASSWORD | podman login $DRYCC_REGISTRY --username $CONTAINER_USERNAME --password-stdin > /dev/null 2>&1
   - make podman-build podman-immutable-push
   secrets:

From 8f010d87f75e2bfcc5b0337143ea0263f08155d1 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Wed, 20 Mar 2024 14:16:51 +0800
Subject: [PATCH 49/64] chore(charts): change canary app version

---
 .woodpecker/chart.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.woodpecker/chart.yaml b/.woodpecker/chart.yaml
index 20f9ea9..5aa7eb3 100644
--- a/.woodpecker/chart.yaml
+++ b/.woodpecker/chart.yaml
@@ -8,7 +8,7 @@ steps:
   commands:
   - export VERSION=$(sed 's#v##' <<< $CI_COMMIT_TAG)
   - export IMAGE_TAG=$([ ! -z $CI_COMMIT_TAG ] && echo \"$VERSION\" || echo \"canary\")
-  - export APP_VERSION=$([ ! -z $CI_COMMIT_TAG ] && echo $VERSION || echo 1.0.0)
+  - export APP_VERSION=$([ -z $CI_COMMIT_TAG ] && echo $CI_COMMIT_SHA || echo $VERSION)
   - export CHART_VERSION=$([ -z $CI_COMMIT_TAG ] && echo 1.0.0 || echo $VERSION)
   - sed -i "s/imageTag:\ \"canary\"/imageTag:\ $IMAGE_TAG/g" charts/$${CI_REPO_NAME}/values.yaml
   - helm package -u charts/$${CI_REPO_NAME} --version $CHART_VERSION --app-version $APP_VERSION
@@ -25,4 +25,4 @@ steps:
     - tag
 
 depends_on:
-- manifest
\ No newline at end of file
+- manifest

From c39708983d01f281a965ac6d0e8d40a775df8ade Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Fri, 15 Nov 2024 11:08:49 +0800
Subject: [PATCH 50/64] chore(postgres): bump version 15.8

---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 8cc8851..7cb4b59 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,8 +4,8 @@ FROM registry.drycc.cc/drycc/base:${CODENAME}
 COPY rootfs/usr /usr/
 COPY rootfs/entrypoint.sh /entrypoint.sh
 ENV PG_MAJOR=15 \
-  PG_MINOR=3 \
-  PYTHON_VERSION="3.11"
+  PG_MINOR=8 \
+  PYTHON_VERSION="3.12"
 
 ENV HOME /data
 ENV PGDATA $HOME/$PG_MAJOR

From 95e270fd8c3f700eccf659a420dbeb54a2181b21 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Tue, 26 Nov 2024 17:36:46 +0800
Subject: [PATCH 51/64] chore(database): remove all database extensions

---
 charts/database/values.yaml | 4 ++--
 rootfs/entrypoint.sh        | 3 +--
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index d75a5b3..b060236 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -69,8 +69,8 @@ replicator: "standby"
 replicatorPassword: ""
 user: ""
 password: ""
-initDatabases: "controller,passport,monitor"
-databaseExtensions: "postgis,timescaledb"
+initDatabases: "controller,passport"
+databaseExtensions: ""
 
 global:
   # Set the location of Workflow's Object Storage
diff --git a/rootfs/entrypoint.sh b/rootfs/entrypoint.sh
index 43e7f9f..4f005a8 100755
--- a/rootfs/entrypoint.sh
+++ b/rootfs/entrypoint.sh
@@ -33,8 +33,7 @@ restapi:
 postgresql:
   data_dir: '${PGDATA}'
   parameters:
-    timescaledb.license: 'timescale'
-    shared_preload_libraries: 'auto_explain,timescaledb,pg_stat_statements'
+    shared_preload_libraries: 'auto_explain,pg_stat_statements'
     hot_standby: "on"
     max_connections: 1005
     max_worker_processes: 8

From d34a9bf51999d2da6964f65e41bd867b3b959269 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Mon, 23 Dec 2024 13:59:39 +0800
Subject: [PATCH 52/64] fix(wooddpecker): secsets are deprecated

---
 .woodpecker/build-linux.yml | 17 +++++++++++------
 .woodpecker/chart.yaml      | 14 +++++++++-----
 .woodpecker/manifest.yml    |  5 +++--
 .woodpecker/test-linux.yml  |  8 +++++---
 4 files changed, 28 insertions(+), 16 deletions(-)

diff --git a/.woodpecker/build-linux.yml b/.woodpecker/build-linux.yml
index 782d2f5..3424a97 100644
--- a/.woodpecker/build-linux.yml
+++ b/.woodpecker/build-linux.yml
@@ -14,12 +14,17 @@ steps:
   - export VERSION=$([ -z $CI_COMMIT_TAG ] && echo latest || echo $CI_COMMIT_TAG)-$(sed 's#/#-#g' <<< $CI_SYSTEM_PLATFORM)
   - echo $CONTAINER_PASSWORD | podman login $DRYCC_REGISTRY --username $CONTAINER_USERNAME --password-stdin > /dev/null 2>&1
   - make podman-build podman-immutable-push
-  secrets:
-  - codename
-  - dev_registry
-  - drycc_registry
-  - container_username
-  - container_password
+  environment:
+    CODENAME:
+      from_secret: codename
+    DEV_REGISTRY:
+      from_secret: dev_registry
+    DRYCC_REGISTRY:
+      from_secret: drycc_registry
+    CONTAINER_USERNAME:
+      from_secret: container_username
+    CONTAINER_PASSWORD:
+      from_secret: container_password
   when:
     event:
     - push
diff --git a/.woodpecker/chart.yaml b/.woodpecker/chart.yaml
index 5aa7eb3..40397e0 100644
--- a/.woodpecker/chart.yaml
+++ b/.woodpecker/chart.yaml
@@ -14,11 +14,15 @@ steps:
   - helm package -u charts/$${CI_REPO_NAME} --version $CHART_VERSION --app-version $APP_VERSION
   - echo $CONTAINER_PASSWORD | helm registry login $DRYCC_REGISTRY -u $CONTAINER_USERNAME --password-stdin
   - helm push $${CI_REPO_NAME}-$CHART_VERSION.tgz oci://$DRYCC_REGISTRY/$([ -z $CI_COMMIT_TAG ] && echo charts-testing || echo charts)
-  secrets:
-  - dev_registry
-  - drycc_registry
-  - container_username
-  - container_password
+  environment:
+    DEV_REGISTRY:
+      from_secret: dev_registry
+    DRYCC_REGISTRY:
+      from_secret: drycc_registry
+    CONTAINER_USERNAME:
+      from_secret: container_username
+    CONTAINER_PASSWORD:
+      from_secret: container_password
   when:
     event:
     - push
diff --git a/.woodpecker/manifest.yml b/.woodpecker/manifest.yml
index b4735ee..c842a08 100644
--- a/.woodpecker/manifest.yml
+++ b/.woodpecker/manifest.yml
@@ -8,8 +8,9 @@ steps:
   commands:
   - sed -i "s/{{project}}/$${CI_REPO_NAME}/g" .woodpecker/manifest.tmpl
   - sed -i "s/registry.drycc.cc/$${DRYCC_REGISTRY}/g" .woodpecker/manifest.tmpl
-  secrets:
-  - drycc_registry
+  environment:
+    DRYCC_REGISTRY:
+      from_secret: drycc_registry
   when:
     event:
     - tag
diff --git a/.woodpecker/test-linux.yml b/.woodpecker/test-linux.yml
index d47ccc5..0d5a93f 100644
--- a/.woodpecker/test-linux.yml
+++ b/.woodpecker/test-linux.yml
@@ -12,9 +12,11 @@ steps:
   image: bash
   commands:
   - make test
-  secrets:
-  - codename
-  - dev_registry
+  environment:
+    CODENAME:
+      from_secret: codename
+    DEV_REGISTRY:
+      from_secret: dev_registry
   when:
     event:
     - push

From 3a7743f187977991c12ed8432a7af03b22d38a30 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Wed, 2 Apr 2025 11:40:42 +0800
Subject: [PATCH 53/64] chore(woodpecker): add cron event

---
 .woodpecker/build-linux.yml |  1 +
 .woodpecker/chart.yaml      |  1 +
 .woodpecker/manifest.yml    | 10 +++++++---
 .woodpecker/test-linux.yml  |  1 +
 4 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.woodpecker/build-linux.yml b/.woodpecker/build-linux.yml
index 3424a97..ef4ecfd 100644
--- a/.woodpecker/build-linux.yml
+++ b/.woodpecker/build-linux.yml
@@ -29,6 +29,7 @@ steps:
     event:
     - push
     - tag
+    - cron
 
 depends_on:
 - test-linux
\ No newline at end of file
diff --git a/.woodpecker/chart.yaml b/.woodpecker/chart.yaml
index 40397e0..cfcd3ec 100644
--- a/.woodpecker/chart.yaml
+++ b/.woodpecker/chart.yaml
@@ -27,6 +27,7 @@ steps:
     event:
     - push
     - tag
+    - cron
 
 depends_on:
 - manifest
diff --git a/.woodpecker/manifest.yml b/.woodpecker/manifest.yml
index c842a08..19fc70c 100644
--- a/.woodpecker/manifest.yml
+++ b/.woodpecker/manifest.yml
@@ -15,6 +15,7 @@ steps:
     event:
     - tag
     - push
+    - cron
 
 - name: publish-manifest
   image: bash
@@ -27,13 +28,16 @@ steps:
     -v $(pwd):$(pwd)
     -w $(pwd)
     docker.io/plugins/manifest
-  secrets:
-  - container_username
-  - container_password
+  environment:
+    CONTAINER_USERNAME:
+      from_secret: container_username
+    CONTAINER_PASSWORD:
+      from_secret: container_password
   when:
     event:
     - tag
     - push
+    - cron
 
 depends_on:
 - build-linux
diff --git a/.woodpecker/test-linux.yml b/.woodpecker/test-linux.yml
index 0d5a93f..194832f 100644
--- a/.woodpecker/test-linux.yml
+++ b/.woodpecker/test-linux.yml
@@ -21,3 +21,4 @@ steps:
     event:
     - push
     - tag
+    - cron

From 5ccd2730235b295f62191c01f06cad729a1469a7 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Wed, 7 May 2025 18:02:02 +0800
Subject: [PATCH 54/64] chore(charts): use condition

---
 charts/database/templates/_helper.tpl            |  2 --
 .../database/templates/database-clusterrole.yaml |  2 --
 .../templates/database-clusterrolebinding.yaml   |  2 --
 .../templates/database-role-binding.yaml         |  2 --
 charts/database/templates/database-role.yaml     |  2 --
 .../templates/database-secret-creds.yaml         |  2 --
 .../templates/database-service-account.yaml      |  2 --
 .../templates/database-service-replica.yaml      |  2 --
 charts/database/templates/database-service.yaml  |  2 --
 .../database/templates/database-statefulset.yaml |  2 --
 charts/database/values.yaml                      | 16 ----------------
 11 files changed, 36 deletions(-)

diff --git a/charts/database/templates/_helper.tpl b/charts/database/templates/_helper.tpl
index 5a01d6b..2f9278f 100644
--- a/charts/database/templates/_helper.tpl
+++ b/charts/database/templates/_helper.tpl
@@ -1,7 +1,5 @@
 {{- define "database.envs" }}
 env:
-- name: DATABASE_STORAGE
-  value: "{{.Values.global.storage}}"
 {{- if eq .Values.debug "true" }}
 - name: PATRONI_LOG_LEVEL
   value: DEBUG
diff --git a/charts/database/templates/database-clusterrole.yaml b/charts/database/templates/database-clusterrole.yaml
index 7fc3898..066c2e1 100644
--- a/charts/database/templates/database-clusterrole.yaml
+++ b/charts/database/templates/database-clusterrole.yaml
@@ -1,4 +1,3 @@
-{{- if eq .Values.global.databaseLocation "on-cluster" }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -12,4 +11,3 @@ rules:
   - kubernetes
   verbs:
   - get
-{{- end }}
diff --git a/charts/database/templates/database-clusterrolebinding.yaml b/charts/database/templates/database-clusterrolebinding.yaml
index 6db4596..24e3fa6 100644
--- a/charts/database/templates/database-clusterrolebinding.yaml
+++ b/charts/database/templates/database-clusterrolebinding.yaml
@@ -1,4 +1,3 @@
-{{- if eq .Values.global.databaseLocation "on-cluster" }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -11,4 +10,3 @@ subjects:
 - kind: ServiceAccount
   name: drycc-database
   namespace: {{ .Release.Namespace }}
-{{- end }}
diff --git a/charts/database/templates/database-role-binding.yaml b/charts/database/templates/database-role-binding.yaml
index bbca50b..e927dab 100644
--- a/charts/database/templates/database-role-binding.yaml
+++ b/charts/database/templates/database-role-binding.yaml
@@ -1,4 +1,3 @@
-{{- if eq .Values.global.databaseLocation "on-cluster" }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
@@ -10,4 +9,3 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: drycc-database
-{{- end }}
diff --git a/charts/database/templates/database-role.yaml b/charts/database/templates/database-role.yaml
index 5ed547c..8957f9b 100644
--- a/charts/database/templates/database-role.yaml
+++ b/charts/database/templates/database-role.yaml
@@ -1,4 +1,3 @@
-{{- if eq .Values.global.databaseLocation "on-cluster" }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -53,4 +52,3 @@ rules:
   - services
   verbs:
   - create
-{{- end }}
diff --git a/charts/database/templates/database-secret-creds.yaml b/charts/database/templates/database-secret-creds.yaml
index 59a8f3e..1f5eddc 100644
--- a/charts/database/templates/database-secret-creds.yaml
+++ b/charts/database/templates/database-secret-creds.yaml
@@ -1,4 +1,3 @@
-{{ if eq .Values.global.databaseLocation "on-cluster"}}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -13,4 +12,3 @@ data:
   replicator-password: {{ include "common.secrets.lookup" (dict "secret" "database-creds" "key" "replicator-password" "defaultValue" (.Values.replicatorPassword | default (randAlphaNum 32) | lower) "context" $) }}
   user: {{ include "common.secrets.lookup" (dict "secret" "database-creds" "key" "user" "defaultValue" (.Values.user | default (randAlpha 32) | lower) "context" $) }}
   password: {{ include "common.secrets.lookup" (dict "secret" "database-creds" "key" "password" "defaultValue" (.Values.password | default (randAlphaNum 32)) "context" $) }}
-{{- end }}
diff --git a/charts/database/templates/database-service-account.yaml b/charts/database/templates/database-service-account.yaml
index 553f18e..d429cfa 100644
--- a/charts/database/templates/database-service-account.yaml
+++ b/charts/database/templates/database-service-account.yaml
@@ -1,8 +1,6 @@
-{{- if eq .Values.global.databaseLocation "on-cluster" }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: drycc-database
   labels:
     heritage: drycc
-{{- end }}
diff --git a/charts/database/templates/database-service-replica.yaml b/charts/database/templates/database-service-replica.yaml
index 0bc8c00..e168d0d 100644
--- a/charts/database/templates/database-service-replica.yaml
+++ b/charts/database/templates/database-service-replica.yaml
@@ -1,4 +1,3 @@
-{{- if eq .Values.global.databaseLocation "on-cluster" }}
 apiVersion: v1
 kind: Service
 metadata:
@@ -20,4 +19,3 @@ spec:
   selector:
     app: drycc-database
     role: replica
-{{- end }}
diff --git a/charts/database/templates/database-service.yaml b/charts/database/templates/database-service.yaml
index 5aa9fe9..0638885 100644
--- a/charts/database/templates/database-service.yaml
+++ b/charts/database/templates/database-service.yaml
@@ -1,4 +1,3 @@
-{{- if eq .Values.global.databaseLocation "on-cluster" }}
 apiVersion: v1
 kind: Service
 metadata:
@@ -14,4 +13,3 @@ spec:
   ports:
     - port: 5432
       targetPort: 5432
-{{- end }}
diff --git a/charts/database/templates/database-statefulset.yaml b/charts/database/templates/database-statefulset.yaml
index d958c29..66d235b 100644
--- a/charts/database/templates/database-statefulset.yaml
+++ b/charts/database/templates/database-statefulset.yaml
@@ -1,4 +1,3 @@
-{{- if eq .Values.global.databaseLocation "on-cluster" }}
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
@@ -97,4 +96,3 @@ spec:
       - name: database-data
         emptyDir: {}
   {{- end }}
-{{- end }}
diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index b060236..768ca11 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -71,19 +71,3 @@ user: ""
 password: ""
 initDatabases: "controller,passport"
 databaseExtensions: ""
-
-global:
-  # Set the location of Workflow's Object Storage
-  #
-  # Valid values are:
-  # - on-cluster: Run drycc storage within the Kubernetes cluster
-  # - off-cluster: Run Storage outside the Kubernetes cluster (Compatible with s3 API)
-  storageLocation: "on-cluster"
-  # Set the location of Workflow's PostgreSQL database
-  #
-  # Valid values are:
-  # - on-cluster: Run PostgreSQL within the Kubernetes cluster (credentials are generated
-  #   automatically; backups are sent to object storage
-  #   configured above)
-  # - off-cluster: Run PostgreSQL outside the Kubernetes cluster
-  databaseLocation: "on-cluster"

From cb85e66dc6bb193ae8a453f44202e7866b56b67a Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Mon, 12 May 2025 09:32:53 +0800
Subject: [PATCH 55/64] chore(charts): change resources format

---
 charts/database/templates/_helper.tpl         | 20 -------------------
 .../templates/database-statefulset.yaml       |  5 ++++-
 charts/database/values.yaml                   | 12 +++++++----
 3 files changed, 12 insertions(+), 25 deletions(-)

diff --git a/charts/database/templates/_helper.tpl b/charts/database/templates/_helper.tpl
index 2f9278f..38570fb 100644
--- a/charts/database/templates/_helper.tpl
+++ b/charts/database/templates/_helper.tpl
@@ -69,23 +69,3 @@ env:
       name: database-creds
       key: password
 {{- end }}
-
-{{/* Generate database deployment limits */}}
-{{- define "database.limits" -}}
-{{- if or (.Values.limitsCpu) (.Values.limitsMemory)}}
-resources:
-  limits:
-    {{- if (.Values.limitsCpu) }}
-    cpu: {{.Values.limitsCpu}}
-    {{- end }}
-    {{- if (.Values.limitsMemory) }}
-    memory: {{.Values.limitsMemory}}
-    {{- end }}
-    {{- if (.Values.limitsHugepages2Mi) }}
-    hugepages-2Mi: {{.Values.limitsHugepages2Mi}}
-    {{- end }}
-    {{- if (.Values.limitsHugepages1Gi) }}
-    hugepages-1Gi: {{.Values.limitsHugepages1Gi}}
-    {{- end }}
-{{- end }}
-{{- end }}
diff --git a/charts/database/templates/database-statefulset.yaml b/charts/database/templates/database-statefulset.yaml
index 66d235b..3cd2286 100644
--- a/charts/database/templates/database-statefulset.yaml
+++ b/charts/database/templates/database-statefulset.yaml
@@ -37,8 +37,11 @@ spec:
           protocol: TCP
         - containerPort: 5432
           protocol: TCP
-        {{- include "database.limits" . | indent 8 }}
         {{- include "database.envs" . | indent 8 }}
+        {{- with index .Values "resources" }}
+        resources:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
         {{- if not .Values.diagnosticMode.enabled }}
         lifecycle:
           preStop:
diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index 768ca11..8882548 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -2,10 +2,6 @@ imageOrg: "drycc"
 imagePullPolicy: "Always"
 imageTag: "canary"
 imageRegistry: "registry.drycc.cc"
-# limitsCpu: "100m"
-# limitsMemory: "50Mi"
-# limitsHugepages2Mi: 100Mi
-# limitsHugepages1Gi: 2Gi
 
 replicas: 3
 
@@ -24,6 +20,14 @@ diagnosticMode:
   args:
     - infinity
 
+resources: {}
+  # limits:
+  #   cpu: 200m
+  #   memory: 50Mi
+  # requests:
+  #   cpu: 100m
+  #   memory: 30Mi
+
 nodeAffinityPreset:
   key: "drycc.cc/node"
   type: "soft"

From 990391de57095b94e1c77c67e8ede6406f2d7c32 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Mon, 19 May 2025 17:28:29 +0800
Subject: [PATCH 56/64] chore(charts): add init grafana database

---
 charts/database/values.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index 8882548..b6ba3d9 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -73,5 +73,5 @@ replicator: "standby"
 replicatorPassword: ""
 user: ""
 password: ""
-initDatabases: "controller,passport"
+initDatabases: "controller,passport,grafana"
 databaseExtensions: ""

From ef5941c8c5658830005c77c3320be65af67c9f20 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Tue, 20 May 2025 11:00:33 +0800
Subject: [PATCH 57/64] chore(database): add postgres_exporter

---
 Dockerfile                                    |  4 +-
 .../templates/database-statefulset.yaml       | 58 +++++++++++++++++++
 rootfs/usr/share/scripts/patroni/post_init.sh |  1 +
 3 files changed, 62 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 7cb4b59..e03f5f6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,7 +5,8 @@ COPY rootfs/usr /usr/
 COPY rootfs/entrypoint.sh /entrypoint.sh
 ENV PG_MAJOR=15 \
   PG_MINOR=8 \
-  PYTHON_VERSION="3.12"
+  PYTHON_VERSION="3.12" \
+  POSTGRES_EXPORTER_VERSION="0.17.1"
 
 ENV HOME /data
 ENV PGDATA $HOME/$PG_MAJOR
@@ -13,6 +14,7 @@ ENV PGDATA $HOME/$PG_MAJOR
 RUN install-packages vim gcc \
   && install-stack python $PYTHON_VERSION \
   && install-stack postgresql $PG_MAJOR.$PG_MINOR \
+  && install-stack postgres_exporter $POSTGRES_EXPORTER_VERSION \
   && . init-stack \
   && set -eux; pip3 install --disable-pip-version-check --no-cache-dir psycopg[binary] patroni[kubernetes] 2>/dev/null; set +eux \
   && apt-get purge -y --auto-remove gcc \
diff --git a/charts/database/templates/database-statefulset.yaml b/charts/database/templates/database-statefulset.yaml
index 3cd2286..300bc7b 100644
--- a/charts/database/templates/database-statefulset.yaml
+++ b/charts/database/templates/database-statefulset.yaml
@@ -15,6 +15,10 @@ spec:
       cluster-name: drycc-database
   template:
     metadata:
+      annotations:
+        prometheus.io/path: /metrics
+        prometheus.io/port: "9187"
+        prometheus.io/scrape: "true"
       labels: {{- include "common.labels.standard" . | nindent 8 }}
         app: drycc-database
         cluster-name: drycc-database
@@ -78,6 +82,60 @@ spec:
         volumeMounts:
         - name: database-data
           mountPath: /data
+      - name: drycc-database-metrics
+        image: {{.Values.imageRegistry}}/{{.Values.imageOrg}}/database:{{.Values.imageTag}}
+        imagePullPolicy: {{.Values.imagePullPolicy}}
+        {{- if .Values.diagnosticMode.enabled }}
+        command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 10 }}
+        args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 10 }}
+        {{- else }}
+        command:
+        - init-stack
+        args:
+        - postgres_exporter
+        {{- end }}
+        ports:
+        - containerPort: 9187
+          protocol: TCP
+        env:
+        - name: DATA_SOURCE_URI
+          value: "127.0.0.1:5432/postgres?sslmode=disable"
+        - name: DATA_SOURCE_USER
+          valueFrom:
+            secretKeyRef:
+              name: database-creds
+              key: user
+        - name: DATA_SOURCE_PASS
+          valueFrom:
+            secretKeyRef:
+              name: database-creds
+              key: password
+        startupProbe:
+          initialDelaySeconds: 10
+          tcpSocket:
+              port: 9187
+          periodSeconds: 10
+          timeoutSeconds: 1
+          failureThreshold: 15
+          successThreshold: 1
+        livenessProbe:
+          initialDelaySeconds: 5
+          httpGet:
+            path: /
+            port: 9187
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 6
+          successThreshold: 1
+        readinessProbe:
+          initialDelaySeconds: 5
+          httpGet:
+            path: /
+            port: 9187
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 6
+          successThreshold: 1
   {{- if .Values.persistence.enabled }}
   volumeClaimTemplates:
   - metadata:
diff --git a/rootfs/usr/share/scripts/patroni/post_init.sh b/rootfs/usr/share/scripts/patroni/post_init.sh
index 338c150..a8f75f5 100755
--- a/rootfs/usr/share/scripts/patroni/post_init.sh
+++ b/rootfs/usr/share/scripts/patroni/post_init.sh
@@ -4,6 +4,7 @@ set -Eeu
 if [[ ( -n "$DRYCC_DATABASE_USER") &&  ( -n "$DRYCC_DATABASE_PASSWORD")]]; then
   echo "Creating user ${DRYCC_DATABASE_USER}"
   psql "$1" -w -c "create user ${DRYCC_DATABASE_USER} WITH LOGIN ENCRYPTED PASSWORD '${DRYCC_DATABASE_PASSWORD}'"
+  psql "$1" -w -c "GRANT pg_monitor TO ${DRYCC_DATABASE_USER}"
   for dbname in ${DRYCC_DATABASE_INIT_NAMES//,/ }
   do
     echo "Creating database ${dbname}"

From d18b382d6b0513b5a3db40d718e60a3e9d97fcea Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Wed, 2 Jul 2025 16:23:42 +0800
Subject: [PATCH 58/64] chore(charts): add init quickwit database

---
 charts/database/values.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index b6ba3d9..e407b0a 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -73,5 +73,5 @@ replicator: "standby"
 replicatorPassword: ""
 user: ""
 password: ""
-initDatabases: "controller,passport,grafana"
+initDatabases: "controller,passport,grafana,quickwit"
 databaseExtensions: ""

From e0f6ecd0602b9ae7ae5ed40d243037e2ddce0e93 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Sun, 14 Sep 2025 11:14:55 +0800
Subject: [PATCH 59/64] chore(database): bump new version

---
 Dockerfile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index e03f5f6..0391d0c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,9 +3,9 @@ FROM registry.drycc.cc/drycc/base:${CODENAME}
 
 COPY rootfs/usr /usr/
 COPY rootfs/entrypoint.sh /entrypoint.sh
-ENV PG_MAJOR=15 \
-  PG_MINOR=8 \
-  PYTHON_VERSION="3.12" \
+ENV PG_MAJOR=17 \
+  PG_MINOR=6 \
+  PYTHON_VERSION="3.13" \
   POSTGRES_EXPORTER_VERSION="0.17.1"
 
 ENV HOME /data

From 1d6230d9eea73d5c5adc464e03aaca0f2bf4dc57 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Thu, 6 Nov 2025 17:07:41 +0800
Subject: [PATCH 60/64] chore(database): change env to build arg

---
 Dockerfile | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 0391d0c..f59c819 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,12 +3,14 @@ FROM registry.drycc.cc/drycc/base:${CODENAME}
 
 COPY rootfs/usr /usr/
 COPY rootfs/entrypoint.sh /entrypoint.sh
-ENV PG_MAJOR=17 \
-  PG_MINOR=6 \
-  PYTHON_VERSION="3.13" \
+
+
+ARG PYTHON_VERSION="3.13" \
   POSTGRES_EXPORTER_VERSION="0.17.1"
 
-ENV HOME /data
+ENV HOME /data \
+  PG_MAJOR=17 \
+  PG_MINOR=6
 ENV PGDATA $HOME/$PG_MAJOR
 
 RUN install-packages vim gcc \

From 32ca19996c3140ccfdd84c726a734da8de936ef3 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Fri, 7 Nov 2025 16:36:54 +0800
Subject: [PATCH 61/64] chore(database): bump postgres to 18.0

---
 Dockerfile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index f59c819..8704907 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,9 +8,9 @@ COPY rootfs/entrypoint.sh /entrypoint.sh
 ARG PYTHON_VERSION="3.13" \
   POSTGRES_EXPORTER_VERSION="0.17.1"
 
-ENV HOME /data \
-  PG_MAJOR=17 \
-  PG_MINOR=6
+ENV HOME=/data \
+  PG_MAJOR=18 \
+  PG_MINOR=0
 ENV PGDATA $HOME/$PG_MAJOR
 
 RUN install-packages vim gcc \

From 6dd5ac96dbb416a12622b71576617b563a7660a3 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Thu, 20 Nov 2025 09:49:37 +0800
Subject: [PATCH 62/64] chore(postgresql): bump version to 18.1

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 8704907..952be0d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,7 +10,7 @@ ARG PYTHON_VERSION="3.13" \
 
 ENV HOME=/data \
   PG_MAJOR=18 \
-  PG_MINOR=0
+  PG_MINOR=1
 ENV PGDATA $HOME/$PG_MAJOR
 
 RUN install-packages vim gcc \

From f04b3cf9e8ea5b26b040c640563375a60de3abd7 Mon Sep 17 00:00:00 2001
From: duanhongyi <duanhongyi@doopai.com>
Date: Thu, 20 Nov 2025 09:56:34 +0800
Subject: [PATCH 63/64] chore(postgres_exporter): bump version to 0.18.1

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 952be0d..d8c2cb9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,7 +6,7 @@ COPY rootfs/entrypoint.sh /entrypoint.sh
 
 
 ARG PYTHON_VERSION="3.13" \
-  POSTGRES_EXPORTER_VERSION="0.17.1"
+  POSTGRES_EXPORTER_VERSION="0.18.1"
 
 ENV HOME=/data \
   PG_MAJOR=18 \

From 246389efb378f088e0f193e9da933231531b306b Mon Sep 17 00:00:00 2001
From: Eamon <zhang.eamon@hotmail.com>
Date: Mon, 22 Dec 2025 10:14:03 +0800
Subject: [PATCH 64/64] chore(postgresql): add logical backup (#18)

Co-authored-by: zhangeamon <EamonZhang>
---
 .gitignore                                    |  4 +-
 Dockerfile                                    | 33 +++++-----
 charts/database/templates/_helper.tpl         | 46 +++++++++++++
 .../templates/database-cronjob-backup.yaml    | 29 ++++++++
 .../templates/database-secret-creds.yaml      |  7 ++
 charts/database/values.yaml                   | 19 +++++-
 rootfs/entrypoint.sh                          |  9 +--
 rootfs/usr/share/scripts/backup.sh            | 66 +++++++++++++++++++
 rootfs/usr/share/scripts/create_bucket        | 19 ++++++
 9 files changed, 211 insertions(+), 21 deletions(-)
 create mode 100644 charts/database/templates/database-cronjob-backup.yaml
 create mode 100755 rootfs/usr/share/scripts/backup.sh
 create mode 100755 rootfs/usr/share/scripts/create_bucket

diff --git a/.gitignore b/.gitignore
index 1ee9ef0..4573d78 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,4 @@
 contrib/ci/tmp
-.vscode/
\ No newline at end of file
+.vscode/
+charts/database/Chart.lock
+charts/database/charts/
diff --git a/Dockerfile b/Dockerfile
index d8c2cb9..f0764de 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,12 +10,15 @@ ARG PYTHON_VERSION="3.13" \
 
 ENV HOME=/data \
   PG_MAJOR=18 \
-  PG_MINOR=1
-ENV PGDATA $HOME/$PG_MAJOR
+  PG_MINOR=1 \
+  S3_RCLONE_VERSION="1.71.1" 
 
-RUN install-packages vim gcc \
+ENV PGDATA=$HOME/$PG_MAJOR
+
+RUN install-packages vim gcc pigz jq\
   && install-stack python $PYTHON_VERSION \
   && install-stack postgresql $PG_MAJOR.$PG_MINOR \
+  && install-stack rclone $S3_RCLONE_VERSION \
   && install-stack postgres_exporter $POSTGRES_EXPORTER_VERSION \
   && . init-stack \
   && set -eux; pip3 install --disable-pip-version-check --no-cache-dir psycopg[binary] patroni[kubernetes] 2>/dev/null; set +eux \
@@ -23,18 +26,18 @@ RUN install-packages vim gcc \
   && apt-get autoremove -y \
   && apt-get clean -y \
   && rm -rf \
-    /usr/share/doc \
-    /usr/share/man \
-    /usr/share/info \
-    /usr/share/locale \
-    /var/lib/apt/lists/* \
-    /var/log/* \
-    /var/cache/debconf/* \
-    /etc/systemd \
-    /lib/lsb \
-    /lib/udev \
-    /usr/lib/`echo $(uname -m)`-linux-gnu/gconv/IBM* \
-    /usr/lib/`echo $(uname -m)`-linux-gnu/gconv/EBC* \
+  /usr/share/doc \
+  /usr/share/man \
+  /usr/share/info \
+  /usr/share/locale \
+  /var/lib/apt/lists/* \
+  /var/log/* \
+  /var/cache/debconf/* \
+  /etc/systemd \
+  /lib/lsb \
+  /lib/udev \
+  /usr/lib/`echo $(uname -m)`-linux-gnu/gconv/IBM* \
+  /usr/lib/`echo $(uname -m)`-linux-gnu/gconv/EBC* \
   && mkdir -p /usr/share/man/man{1..8} \
   && mkdir -p $PGDATA \
   && groupadd postgres && useradd -g postgres postgres \
diff --git a/charts/database/templates/_helper.tpl b/charts/database/templates/_helper.tpl
index 38570fb..3d1638f 100644
--- a/charts/database/templates/_helper.tpl
+++ b/charts/database/templates/_helper.tpl
@@ -1,5 +1,51 @@
 {{- define "database.envs" }}
 env:
+- name: RETAIN_BACKUPS_AGE
+  value: "{{.Values.cronjob.retainBackupsAge}}"
+{{- if (.Values.storageEndpoint) }}
+- name: "DRYCC_STORAGE_BUCKET"
+  valueFrom:
+    secretKeyRef:
+      name: database-creds
+      key: storage-bucket
+- name: "DRYCC_STORAGE_ENDPOINT"
+  valueFrom:
+    secretKeyRef:
+      name: database-creds
+      key: storage-endpoint
+- name: "DRYCC_STORAGE_ACCESSKEY"
+  valueFrom:
+    secretKeyRef:
+      name: database-creds
+      key: storage-accesskey
+- name: "DRYCC_STORAGE_SECRETKEY"
+  valueFrom:
+    secretKeyRef:
+      name: database-creds
+      key: storage-secretkey
+- name: "DRYCC_STORAGE_PATH_STYLE"
+  valueFrom:
+    secretKeyRef:
+      name: database-creds
+      key: storage-path-style
+{{- else if .Values.storage.enabled  }}
+- name: "DRYCC_STORAGE_BUCKET"
+  value: "database"
+- name: "DRYCC_STORAGE_ENDPOINT"
+  value: http://drycc-storage:9000
+- name: "DRYCC_STORAGE_ACCESSKEY"
+  valueFrom:
+    secretKeyRef:
+      name: storage-creds
+      key: accesskey
+- name: "DRYCC_STORAGE_SECRETKEY"
+  valueFrom:
+    secretKeyRef:
+      name: storage-creds
+      key: secretkey
+- name: "DRYCC_STORAGE_PATH_STYLE"
+  value: "true"
+{{- end }}
 {{- if eq .Values.debug "true" }}
 - name: PATRONI_LOG_LEVEL
   value: DEBUG
diff --git a/charts/database/templates/database-cronjob-backup.yaml b/charts/database/templates/database-cronjob-backup.yaml
new file mode 100644
index 0000000..ee4e042
--- /dev/null
+++ b/charts/database/templates/database-cronjob-backup.yaml
@@ -0,0 +1,29 @@
+{{- if .Values.cronjob.enabled }}
+apiVersion: {{ include "common.capabilities.cronjob.apiVersion" . }}
+kind: CronJob
+metadata:
+  name: drycc-database-cronjob-backup
+  labels:
+    heritage: drycc
+  annotations:
+    component.drycc.cc/version: {{ .Values.imageTag }}
+
+spec:
+  schedule: "{{ .Values.cronjob.scheduleCronJob }}"
+  failedJobsHistoryLimit: 1
+  successfulJobsHistoryLimit: 1
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: OnFailure              
+          containers:         
+          - name: drycc-database-cronjob-backup
+            image: {{.Values.imageRegistry}}/{{.Values.imageOrg}}/database:{{.Values.imageTag}}
+            imagePullPolicy: {{.Values.imagePullPolicy}}
+            command:
+            - init-stack
+            args:  
+            - /usr/share/scripts/backup.sh
+            {{- include "database.envs" . | indent 12 }}
+{{- end -}}
\ No newline at end of file
diff --git a/charts/database/templates/database-secret-creds.yaml b/charts/database/templates/database-secret-creds.yaml
index 1f5eddc..6b7f01d 100644
--- a/charts/database/templates/database-secret-creds.yaml
+++ b/charts/database/templates/database-secret-creds.yaml
@@ -12,3 +12,10 @@ data:
   replicator-password: {{ include "common.secrets.lookup" (dict "secret" "database-creds" "key" "replicator-password" "defaultValue" (.Values.replicatorPassword | default (randAlphaNum 32) | lower) "context" $) }}
   user: {{ include "common.secrets.lookup" (dict "secret" "database-creds" "key" "user" "defaultValue" (.Values.user | default (randAlpha 32) | lower) "context" $) }}
   password: {{ include "common.secrets.lookup" (dict "secret" "database-creds" "key" "password" "defaultValue" (.Values.password | default (randAlphaNum 32)) "context" $) }}
+  {{- if (.Values.storageEndpoint) }}
+  storage-bucket: {{ .Values.storageBucket | b64enc }}
+  storage-endpoint: {{ .Values.storageEndpoint | b64enc }}
+  storage-accesskey: {{ .Values.storageAccesskey | b64enc }}
+  storage-secretkey: {{ .Values.storageSecretkey | b64enc }}
+  storage-path-style: {{ .Values.storagePathStyle | b64enc }}
+  {{- end }}
diff --git a/charts/database/values.yaml b/charts/database/values.yaml
index e407b0a..e856429 100644
--- a/charts/database/values.yaml
+++ b/charts/database/values.yaml
@@ -45,7 +45,24 @@ podAntiAffinityPreset:
     app: "drycc-database"
 
 debug: "false"
+# Patroni pg_ctl timeout
 timeout: "1200"
+
+# The following parameters will no longer use the built-in storage component.
+storageBucket: "database"
+storageEndpoint: ""
+storageAccesskey: ""
+storageSecretkey: ""
+storagePathStyle: "true"
+
+storage:
+  enabled: true
+
+cronjob:
+  enabled: true
+  scheduleCronJob: "0 3 * * *"
+  retainBackupsAge: 30d
+
 # Service
 service:
   # Provide any additional service annotations
@@ -66,7 +83,7 @@ persistence:
   storageClass: ""
 # The username and password to be used by the on-cluster database.
 # If left empty they will be generated
-# The user name should be set to lowercase letters 
+# The user name should be set to lowercase letters
 superuser: "postgres"
 superuserPassword: ""
 replicator: "standby"
diff --git a/rootfs/entrypoint.sh b/rootfs/entrypoint.sh
index 4f005a8..8865438 100755
--- a/rootfs/entrypoint.sh
+++ b/rootfs/entrypoint.sh
@@ -1,5 +1,4 @@
 #!/bin/bash
-
 if [[ $UID -ge 10000 ]]; then
     GID=$(id -g)
     sed -e "s/^postgres:x:[^:]*:[^:]*:/postgres:x:$UID:$GID:/" /etc/passwd > /tmp/passwd
@@ -19,14 +18,14 @@ bootstrap:
       use_pg_rewind: true
       use_slots: true
   initdb:
-  - auth-host: md5
+  - auth-host: scram-sha-256
   - auth-local: trust
   - encoding: UTF8
   - locale: ${LANG}
   - data-checksums
   pg_hba:
-  - host all all 0.0.0.0/0 md5
-  - host replication ${DRYCC_DATABASE_REPLICATOR} ${PATRONI_KUBERNETES_POD_IP}/16 md5
+  - host all all 0.0.0.0/0 scram-sha-256
+  - host replication ${DRYCC_DATABASE_REPLICATOR} ${PATRONI_KUBERNETES_POD_IP}/16 scram-sha-256
   post_bootstrap: /usr/share/scripts/patroni/post_init.sh
 restapi:
   connect_address: '${PATRONI_KUBERNETES_POD_IP}:8008'
@@ -43,6 +42,7 @@ postgresql:
     max_prepared_transactions: 0
     max_locks_per_transaction: 64
     wal_log_hints: "on"
+    wal_level: logical
     track_commit_timestamp: "off"
     archive_mode: "on"
     archive_timeout: 300s
@@ -50,6 +50,7 @@ postgresql:
     log_min_duration_statement: 1000
     log_lock_waits: on
     log_statement: 'ddl' 
+    jit: off
   connect_address: '${PATRONI_KUBERNETES_POD_IP}:5432'
   authentication:
     superuser:
diff --git a/rootfs/usr/share/scripts/backup.sh b/rootfs/usr/share/scripts/backup.sh
new file mode 100755
index 0000000..441c33e
--- /dev/null
+++ b/rootfs/usr/share/scripts/backup.sh
@@ -0,0 +1,66 @@
+#!/bin/bash
+set -e
+
+# Setup Rclone 
+/usr/share/scripts/create_bucket
+
+# Backup PostgreSQL databases to S3-compatible object storage
+export PGPASSWORD=$DRYCC_DATABASE_SUPERUSER_PASSWORD
+PGPORT=$DRYCC_DATABASE_REPLICA_SERVICE_PORT_POSTGRES
+PGUSER=postgres
+POSTGRES_HOST=$DRYCC_DATABASE_REPLICA_SERVICE_HOST
+RETAIN_BACKUPS_AGE=$RETAIN_BACKUPS_AGE
+
+# PostgreSQL global objects backup 
+BACKUP_PATH="${DRYCC_STORAGE_BUCKET}/$(date +%Y%m%d%H%M)"
+echo "DB: ${POSTGRES_USER}@${POSTGRES_HOST}"
+echo "S3 Storage: storage:${BACKUP_PATH}"
+# Backup global objects
+if pg_dumpall -g -U "${POSTGRES_USER}" -h "${POSTGRES_HOST}" \
+  | pigz -c -p 4 -6 \
+  | rclone rcat \
+      "storage:${BACKUP_PATH}/roles_globals.sql.gz" \
+      --bwlimit 10M \
+      --transfers 4 \
+      --s3-chunk-size 64M \
+      --stats 5s \
+      --progress \
+      --retries 3; then  
+  echo "✅ PostgreSQL global objects backup complated!" 
+fi 
+  # fetch the list of databases
+  DATABASES=$(psql -U "$POSTGRES_USER" -h "$POSTGRES_HOST" -t -c "SELECT datname FROM pg_database WHERE datistemplate = false;")
+
+  # backup each database individually
+  for DB in $DATABASES; do
+    echo "Backing up $DB to $MINIO_PATH/$DB.sql.gz"
+    if pg_dump -U "${POSTGRES_USER}" -h "${POSTGRES_HOST}" "$DB" \
+        | pigz -c -p 4 -6 \
+        | rclone rcat \
+            "storage:${BACKUP_PATH}/$DB.sql.gz" \
+            --bwlimit 10M \
+            --transfers 4 \
+            --s3-chunk-size 64M \
+            --stats 5s \
+            --progress \
+            --retries 3; then
+        echo "✅ PostgreSQL $DB global objects backup completed!"
+    fi
+  done
+
+  echo "Backup process completed!"
+
+  echo "delete storage before ${RETAIN_BACKUPS_AGE} ..."
+  rclone delete "storage:${DRYCC_STORAGE_BUCKET}" \
+    --min-age ${RETAIN_BACKUPS_AGE} \
+    --include "*.sql.gz" \
+    --dry-run \
+    -v  || true
+
+  rclone delete "storage:${DRYCC_STORAGE_BUCKET}" \
+    --min-age ${RETAIN_BACKUPS_AGE} \
+    --include "*.sql.gz" \
+    || true
+  echo "delete completed."
+
+echo "=== backup completed: $(date) ==="
diff --git a/rootfs/usr/share/scripts/create_bucket b/rootfs/usr/share/scripts/create_bucket
new file mode 100755
index 0000000..addadaa
--- /dev/null
+++ b/rootfs/usr/share/scripts/create_bucket
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+set -e
+
+mkdir -p ~/.config/rclone
+touch ~/.config/rclone/rclone.conf
+rclone config create storage s3 \
+  provider=Other \
+  access_key_id="${DRYCC_STORAGE_ACCESSKEY}" \
+  secret_access_key="${DRYCC_STORAGE_SECRETKEY}" \
+  endpoint="${DRYCC_STORAGE_ENDPOINT}" \
+  force_path_style="${DRYCC_STORAGE_PATH_STYLE:-true}" --no-output
+
+if ! rclone lsd storage: > /dev/null 2>&1; then
+  sleep 9s
+  echo "waiting for object storage to become ready..."
+fi
+
+rclone mkdir "storage:${DRYCC_STORAGE_BUCKET}"
