feedc0de/phppgadmin-kubernetes
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove legacy Kubernetes CD bootstrap
Test, publish phpPgAdmin image and chart / validate (push) Successful in 2s
Details
Test, publish phpPgAdmin image and chart / publish-image (push) Successful in 6s
Details
Test, publish phpPgAdmin image and chart / publish-chart (push) Successful in 2s
Details

Browse Source
This commit is contained in:
feedc0de committed 2026-10-19 08:50:17 +02:00
1 parent f2fb39ca62
commit 1add377fb7
3 files changed
-471
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

ci-deployer.yaml
-88
View File
@@ -1,88 +0,0 @@
# Bootstrap this file once with an administrator identity. CI can update only
# the existing phpPgAdmin resources and cannot call the Kubernetes Secrets API.
apiVersion: v1
kind: ServiceAccount
metadata:
name: phppgadmin-deployer
namespace: default
automountServiceAccountToken: false
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: phppgadmin-deployer
namespace: default
rules:
- apiGroups:
- ""
resources:
- configmaps
resourceNames:
- phppgadmin-config
verbs:
- get
- patch
- update
- apiGroups:
- ""
resources:
- services
resourceNames:
- phppgadmin
verbs:
- get
- patch
- update
- apiGroups:
- apps
resources:
- deployments
resourceNames:
- phppgadmin
verbs:
- get
- patch
- update
- apiGroups:
- networking.k8s.io
resources:
- ingresses
resourceNames:
- phppgadmin
verbs:
- get
- patch
- update
- apiGroups:
- traefik.io
resources:
- middlewares
resourceNames:
- phppgadmin-root-redirect
verbs:
- get
- patch
- update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: phppgadmin-deployer
namespace: default
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: phppgadmin-deployer
subjects:
- kind: ServiceAccount
name: phppgadmin-deployer
namespace: default
---
apiVersion: v1
kind: Secret
metadata:
name: phppgadmin-deployer-token
namespace: default
annotations:
kubernetes.io/service-account.name: phppgadmin-deployer
type: kubernetes.io/service-account-token
create-ci-kubeconfig.sh
-50
View File
@@ -1,50 +0,0 @@
#!/usr/bin/env bash
set -euo pipefail
project_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
namespace=${NAMESPACE:-default}
service_account=${SERVICE_ACCOUNT:-phppgadmin-deployer}
secret=${TOKEN_SECRET:-phppgadmin-deployer-token}
[[ $(kubectl config current-context) == kubernetes-admin@kubernetes ]] || { echo "Wrong Kubernetes context" >&2; exit 1; }
kubectl apply --dry-run=server --filename "${project_dir}/ci-deployer.yaml" >&2
kubectl apply --filename "${project_dir}/ci-deployer.yaml" >&2
for attempt in {1..30}; do
if kubectl --namespace "${namespace}" get secret "${secret}" \
--output=jsonpath='{.data.token}' 2>/dev/null | grep -q .; then
break
fi
if [[ "${attempt}" == 30 ]]; then
echo "Timed out waiting for the service-account token" >&2
exit 1
fi
sleep 1
done
workdir=$(mktemp --directory)
trap 'rm -rf "${workdir}"' EXIT
server=$(kubectl config view --minify --output=jsonpath='{.clusters[0].cluster.server}')
kubectl --namespace "${namespace}" get secret "${secret}" \
--output=jsonpath='{.data.ca\.crt}' | base64 --decode > "${workdir}/ca.crt"
token=$(kubectl --namespace "${namespace}" get secret "${secret}" \
--output=jsonpath='{.data.token}' | base64 --decode)
export KUBECONFIG="${workdir}/config"
kubectl config set-cluster cluster \
--server="${server}" \
--certificate-authority="${workdir}/ca.crt" \
--embed-certs=true >/dev/null
kubectl config set-credentials "${service_account}" --token="${token}" >/dev/null
kubectl config set-context phppgadmin \
--cluster=cluster \
--user="${service_account}" \
--namespace="${namespace}" >/dev/null
kubectl config use-context phppgadmin >/dev/null
echo "Store the following single line as the Gitea Actions secret KUBE_CONFIG_BASE64." >&2
echo "Treat it as a password; do not commit it." >&2
base64 --wrap=0 "${KUBECONFIG}"
printf '\n'
phppgadmin.yaml
-333
View File
@@ -1,333 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: phppgadmin-config
namespace: default
labels:
app.kubernetes.io/name: phppgadmin
data:
config.inc.php: |
<?php
/**
* Central phpPgAdmin configuration. As a user you may modify the
* settings here for your particular configuration.
*
* $Id: config.inc.php-dist,v 1.55 2008/02/18 21:10:31 xzilla Exp $
*/
// An example server. Create as many of these as you wish,
// indexed from zero upwards.
// Display name for the server on the login screen
$conf['servers'][0]['desc'] = 'arschrock';
// Hostname or IP address for server. Use '' for UNIX domain socket.
// use 'localhost' for TCP/IP connection on this computer
$conf['servers'][0]['host'] = 'arschrock';
// Database port on server (5432 is the PostgreSQL default)
$conf['servers'][0]['port'] = 5432;
// Database SSL mode
// Possible options: disable, allow, prefer, require
// To require SSL on older servers use option: legacy
// To ignore the SSL mode, use option: unspecified
$conf['servers'][0]['sslmode'] = 'allow';
// Change the default database only if you cannot connect to template1.
// For a PostgreSQL 8.1+ server, you can set this to 'postgres'.
$conf['servers'][0]['defaultdb'] = 'template1';
// Specify the path to the database dump utilities for this server.
// You can set these to '' if no dumper is available.
$conf['servers'][0]['pg_dump_path'] = '/usr/bin/pg_dump';
$conf['servers'][0]['pg_dumpall_path'] = '/usr/bin/pg_dumpall';
$conf['servers'][1]['desc'] = 'nextcloud-postgresql.nextcloud.svc.cluster.local';
$conf['servers'][1]['host'] = 'nextcloud-postgresql.nextcloud.svc.cluster.local';
$conf['servers'][1]['port'] = 5432;
$conf['servers'][1]['sslmode'] = 'allow';
$conf['servers'][1]['defaultdb'] = 'template1';
$conf['servers'][2]['desc'] = 'postgresql.default.svc.cluster.local';
$conf['servers'][2]['host'] = 'postgresql.default.svc.cluster.local';
$conf['servers'][2]['port'] = 5432;
$conf['servers'][2]['sslmode'] = 'allow';
$conf['servers'][2]['defaultdb'] = 'template1';
$conf['servers'][3]['desc'] = 'postgresql.authentik.svc.cluster.local';
$conf['servers'][3]['host'] = 'postgresql.authentik.svc.cluster.local';
$conf['servers'][3]['port'] = 5432;
$conf['servers'][3]['sslmode'] = 'allow';
$conf['servers'][3]['defaultdb'] = 'template1';
$conf['servers'][4]['desc'] = 'postgresql.gramps.svc.cluster.local';
$conf['servers'][4]['host'] = 'postgresql.gramps.svc.cluster.local';
$conf['servers'][4]['port'] = 5432;
$conf['servers'][4]['sslmode'] = 'allow';
$conf['servers'][4]['defaultdb'] = 'template1';
$conf['servers'][5]['desc'] = 'postgresql.matrix.svc.cluster.local';
$conf['servers'][5]['host'] = 'postgresql.matrix.svc.cluster.local';
$conf['servers'][5]['port'] = 5432;
$conf['servers'][5]['sslmode'] = 'allow';
$conf['servers'][5]['defaultdb'] = 'template1';
/* Groups definition */
/* Groups allow administrators to logicaly group servers together under
* group nodes in the left browser tree
*
* The group '0' description
*/
//$conf['srv_groups'][0]['desc'] = 'group one';
/* Add here servers indexes belonging to the group '0' separated by comma */
//$conf['srv_groups'][0]['servers'] = '0,1,2';
/* A server can belong to multi groups. Here server 1 is referenced in both
* 'group one' and 'group two'*/
//$conf['srv_groups'][1]['desc'] = 'group two';
//$conf['srv_groups'][1]['servers'] = '3,1';
/* A group can be nested in one or more existing groups using the 'parents'
* parameter. Here the group 'group three' contains only one server and will
* appear as a subgroup in both 'group one' and 'group two':
*/
//$conf['srv_groups'][2]['desc'] = 'group three';
//$conf['srv_groups'][2]['servers'] = '4';
//$conf['srv_groups'][2]['parents'] = '0,1';
/* Warning: Only groups with no parents appears at the root of the tree. */
/* You can apply specific theme depending on servers, users and databases
* The priority order is :
* * the theme defined for a server
* * the theme defined for a database apply over the server one
* * the theme defined for a user apply over the database one
*/
/* Example for servers */
//$conf['servers'][0]['theme']['default'] = 'default';
/* Example for users */
//$conf['servers'][0]['theme']['user']['specific_user'] = 'default';
/* Example for databases */
//$conf['servers'][0]['theme']['db']['specific_db'] = 'default';
// Default language. E.g.: 'english', 'polish', etc. See lang/ directory
// for all possibilities. If you specify 'auto' (the default) it will use
// your browser preference.
$conf['default_lang'] = 'auto';
// If extra session security is true, then PHP's session cookies will have
// SameSite cookie flags set to prevent CSRF attacks. If you're using
// auto-start sessions, autostarted sessions will be destroyed and
// restarted with SameSite on. If this this solution is not acceptable for
// your situation, you will need to either turn off auot-start sessions, or
// turn off secure sessions. Versions of PHP below 7.3 do not have access
// to this feature and will be vulnerable to CSRF attacks.
$conf['extra_session_security'] = true;
// AutoComplete uses AJAX interaction to list foreign key values
// on insert fields. It currently only works on single column
// foreign keys. You can choose one of the following values:
// 'default on' enables AutoComplete and turns it on by default.
// 'default off' enables AutoComplete but turns it off by default.
// 'disable' disables AutoComplete.
$conf['autocomplete'] = 'default on';
// If extra login security is true, then logins via phpPgAdmin with no
// password or certain usernames (pgsql, postgres, root, administrator)
// will be denied. Only set this false once you have read the FAQ and
// understand how to change PostgreSQL's pg_hba.conf to enable
// passworded local connections.
$conf['extra_login_security'] = true;
// Only show owned databases?
// Note: This will simply hide other databases in the list - this does
// not in any way prevent your users from seeing other database by
// other means. (e.g. Run 'SELECT * FROM pg_database' in the SQL area.)
$conf['owned_only'] = false;
// Display comments on objects? Comments are a good way of documenting
// a database, but they do take up space in the interface.
$conf['show_comments'] = true;
// Display "advanced" objects? Setting this to true will show
// aggregates, types, operators, operator classes, conversions,
// languages and casts in phpPgAdmin. These objects are rarely
// administered and can clutter the interface.
$conf['show_advanced'] = false;
// Display "system" objects?
$conf['show_system'] = false;
// Minimum length users can set their password to.
$conf['min_password_length'] = 1;
// Width of the left frame in pixels (object browser)
$conf['left_width'] = 200;
// Which look & feel theme to use
$conf['theme'] = 'default';
// Show OIDs when browsing tables?
// Only supported in versions <=11
$conf['show_oids'] = false;
// Max rows to show on a page when browsing record sets
$conf['max_rows'] = 30;
// Max chars of each field to display by default in browse mode
$conf['max_chars'] = 50;
// Send XHTML strict headers?
$conf['use_xhtml_strict'] = false;
// Base URL for PostgreSQL documentation.
// '%s', if present, will be replaced with the PostgreSQL version
// (e.g. 8.4 )
$conf['help_base'] = 'http://www.postgresql.org/docs/%s/interactive/';
// Configuration for ajax scripts
// Time in seconds. If set to 0, refreshing data using ajax will be disabled (locks and activity pages)
$conf['ajax_refresh'] = 3;
/** Plugins management
* Add plugin names to the following array to activate them
* Example:
* $conf['plugins'] = array(
* 'Example',
* 'Slony'
* );
*/
$conf['plugins'] = array();
/*****************************************
* Don't modify anything below this line *
*****************************************/
$conf['version'] = 19;
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: phppgadmin
namespace: default
labels:
app: phppgadmin
app.kubernetes.io/name: phppgadmin
spec:
replicas: 1
revisionHistoryLimit: 3
minReadySeconds: 5
progressDeadlineSeconds: 600
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 0
maxSurge: 1
selector:
matchLabels:
app: phppgadmin
template:
metadata:
annotations:
deployment.brunner.ninja/revision: manual
labels:
app: phppgadmin
app.kubernetes.io/name: phppgadmin
spec:
automountServiceAccountToken: false
terminationGracePeriodSeconds: 30
containers:
- name: phppgadmin
# CI replaces latest with the immutable source commit tag on main.
image: registry.brunner.ninja/feedc0de/phppgadmin:latest
imagePullPolicy: Always
ports:
- name: http
containerPort: 80
protocol: TCP
startupProbe:
httpGet:
path: /phppgadmin/
port: http
periodSeconds: 2
timeoutSeconds: 2
failureThreshold: 60
readinessProbe:
httpGet:
path: /phppgadmin/
port: http
periodSeconds: 5
timeoutSeconds: 3
failureThreshold: 2
livenessProbe:
httpGet:
path: /phppgadmin/
port: http
periodSeconds: 15
timeoutSeconds: 3
failureThreshold: 3
volumeMounts:
- name: phppgadmin-config
mountPath: /etc/phppgadmin/config.inc.php
subPath: config.inc.php
volumes:
- name: phppgadmin-config
configMap:
name: phppgadmin-config
---
apiVersion: v1
kind: Service
metadata:
name: phppgadmin
namespace: default
labels:
app: phppgadmin
app.kubernetes.io/name: phppgadmin
spec:
ports:
- name: http
port: 80
protocol: TCP
targetPort: http
selector:
app: phppgadmin
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: phppgadmin
namespace: default
labels:
app.kubernetes.io/name: phppgadmin
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.middlewares: default-phppgadmin-root-redirect@kubernetescrd
spec:
ingressClassName: traefik
rules:
- host: phppgadmin.brunner.ninja
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: phppgadmin
port:
name: http
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: phppgadmin-root-redirect
namespace: default
labels:
app.kubernetes.io/name: phppgadmin
spec:
redirectRegex:
regex: ^https://phppgadmin\.brunner\.ninja/?$
replacement: https://phppgadmin.brunner.ninja/phppgadmin/
permanent: true