2.1 KiB
phpPgAdmin on Kubernetes
This repository builds the phpPgAdmin image and publishes its application-owned Helm chart. The chart owns the ConfigMap, Deployment, Service, probes, optional Ingress, and Traefik redirect Middleware. It is stateless and stores no database credentials or session data.
The homelab's live server list and Ingress hostname are in the separate homelab-gitops application. They contain endpoint names only; do not put PostgreSQL usernames or passwords in Git or chart values.
Image
The Dockerfile installs phpPgAdmin 7.14.7 on the shared
registry.brunner.ninja/feedc0de/php-apache image. Main-branch CI publishes an
immutable Git-describe-tagged image and a chart whose appVersion selects that exact
image. The chart repository tag follows the bundled phpPgAdmin fork release:
v7.14.7-mod publishes chart 7.14.7-mod; later chart commits append the Git
describe count and hash.
Install
For the homelab, Argo CD is the only Kubernetes writer. Elsewhere, install from the public chart repository with your own values:
helm repo add brunner.ninja https://brunner.ninja/charts
helm repo update brunner.ninja
helm upgrade --install phppgadmin brunner.ninja/phppgadmin \
--namespace default --create-namespace --wait --timeout 5m
To install the chart directly from a checkout, run ./chart/install.sh. Set
VALUES_FILE to a cluster-specific values file when configuring server
endpoints or Ingress.
The CI workflow needs QUAY_USERNAME and QUAY_TOKEN to publish its image,
PACKAGE_USERNAME and PACKAGE_TOKEN to publish the chart, and
GITOPS_TOKEN to promote the chart version in homelab-gitops. It has no
Kubernetes credentials.
Validate locally with:
./test.sh
Internet exposure
The homelab instance is public and presents direct PostgreSQL login. Use long,
unique database passwords, restrictive PostgreSQL roles and pg_hba.conf
rules, TLS for remote database connections, and suitable external access
controls. The chart retains phpPgAdmin's extra-login security defaults.