BC-7024-migration-to-ionos-postgres-dev

[YannickEvers]

Description

Switch to IONOS Postgres Cluster for the dev stage. Automatically create and delete branch- and application-specific databases and users for calendar, hydra and erwinidm.

• Split WITH_DATABASES into WITH_MONGO_DATABASES and WITH_POSTGRES_DATABASES to control them individually
• Disable WITH_POSTGRES_DATABASES and activate new WITH_BRANCH_POSTGRES_DB_MANAGEMENT
• Role creates Secrets for the database cluster (from 1Password) and the three application databases (branch as prefix)
• Role creates the users and database in a Kubernetes Job
• Role prepares a suspended job for deleting the databases and users
• Add parts that conditionally (WITH_BRANCH_POSTGRES_DB_MANAGEMENT) overwrite the database config/credentials for erwinidm, calendar (see PR BC-7024-migration-to-ionos-postgres-dev schulcloud-calendar#160) and hydra
• Add steps to the Github clean_workflow for triggering the suspended job and waiting for it's completion (=deletion)

Links to Tickets or other pull requests

OPS-6241
hpi-schul-cloud/schulcloud-calendar#160

Changes

Datasecurity

Deployment

New Repos, NPM pakages or vendor scripts

Screenshots of UI changes

Approval for review

• All points were discussed with the ticket creator, support-team or product owner. The code upholds all quality guidelines from the PR-template.

Notice: Please remove the WIP label if the PR is ready to review, otherwise nobody will review it.

[mamutmk5]

it's a great idea but, the looping part for the ansible task it's not so great and it's also violating the part that at least the creating of thing should be in the ansible role where it's needed.
For example the creating and initzialising of the Postgres DB for the calendar shoud be in the calendar ansible role.

[YannickEvers]

it's a great idea but, the looping part for the ansible task it's not so great and it's also violating the part that at least the creating of thing should be in the ansible role where it's needed. For example the creating and initzialising of the Postgres DB for the calendar shoud be in the calendar ansible role.

Putting that part in each role would result in many redundancies. The role is more of a replacement for dof_postgres, which previously created the database deployment needed for the applications (and a schema specific for erwinidm). The specific initialization parts are still in the roles.
For the other stages the database creation is part of the infra-schulcloud deployment.

[Loki-Afro]

does that really work if the operator is not fast enough?

[YannickEvers]

You probably mean the onepassword-operator, right? The secret checked here is not managed by it. There are two separate secrets: One coming from 1Password with the credentials for the whole Postgres cluster and one with the branch/database specific credentials that is created directly with a random password.