Merge pull request #22 from tclift/metabase-google-cloud-sql

Metabase: Google Cloud SQL support
pmint93 · Nov 8, 2021 · 648f588 · 648f588
2 parents 4396116 + b22cd4c
commit 648f588
Show file tree

Hide file tree

Showing 4 changed files with 32 additions and 1 deletion.
diff --git a/charts/metabase/Chart.yaml b/charts/metabase/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
 description: The easy, open source way for everyone in your company to ask questions
   and learn from data.
 name: metabase
-version: 1.2.0
+version: 1.3.0
 appVersion: v0.41.0
 maintainers:
   - name: pmint93

diff --git a/charts/metabase/README.md b/charts/metabase/README.md
@@ -78,6 +78,9 @@ The following table lists the configurable parameters of the Metabase chart and
 | database.existingSecretUsernameKey | Username key for exising secret                           | null              |
 | database.existingSecretPasswordKey | Password key for exising secret                           | null              |
 | database.existingSecretConnectionURIKey | ConnectionURI key for exising secret                 | null              |
+| database.googleCloudSQL.instanceConnectionNames | Google Cloud SQL instance connection names. See `values.yaml` for details. | [] |
+| database.googleCloudSQL.sidecarImageTag | Specific tag for the Google Cloud SQL Auth proxy sidecar image | latest  |
+| database.googleCloudSQL.resources | Google Cloud SQL Auth proxy resource requests and limits   | {}                |
 | password.complexity              | Complexity requirement for Metabase account's password      | normal            |
 | password.length                  | Minimum length required for Metabase account's password     | 6                 |
 | timeZone                         | Service time zone                                           | UTC               |

diff --git a/charts/metabase/templates/deployment.yaml b/charts/metabase/templates/deployment.yaml
@@ -172,6 +172,17 @@ spec:
           {{- end }}
           resources:
 {{ toYaml .Values.resources | indent 12 }}
+        {{- if gt (len .Values.database.googleCloudSQL.instanceConnectionNames) 0 }}
+        - name: cloudsql-proxy
+          image: "gcr.io/cloudsql-docker/gce-proxy:{{ or .Values.database.googleCloudSQL.sidecarImageTag "latest" }}"
+          command:
+            - "/cloud_sql_proxy"
+            - "-instances={{ join "," .Values.database.googleCloudSQL.instanceConnectionNames }}"
+          securityContext:
+            runAsNonRoot: true
+          resources:
+{{ toYaml .Values.database.googleCloudSQL.resources | indent 12 }}
+        {{- end }}
     {{- with .Values.nodeSelector }}
       nodeSelector:
 {{ toYaml . | indent 8 }}

diff --git a/charts/metabase/values.yaml b/charts/metabase/values.yaml
@@ -52,6 +52,23 @@ database:
   # existingSecretUsernameKey:
   # existingSecretPasswordKey:
   # existingSecretConnectionURIKey:
+  ## One or more Google Cloud SQL database instances can be made available to Metabase via the *Cloud SQL Auth proxy*.
+  ## These can be used for Metabase's internal database (by specifying `host: localhost` and the port above), or as
+  ## additional databases (configured at Admin → Databases). Workload Identity should be used for authentication, so
+  ## that when `serviceAccount.create=true`, `serviceAccount.annotations` should contain:
+  ##   iam.gke.io/gcp-service-account: your-gsa@email
+  ## Ref: https://cloud.google.com/sql/docs/postgres/connect-kubernetes-engine
+  googleCloudSQL:
+    ## Found in Cloud Console "Cloud SQL Instance details" or using `gcloud sql instances describe INSTANCE_ID`
+    ## example format: $project:$region:$instance=tcp:$port
+    ## Each connection must have a unique TCP port.
+    instanceConnectionNames: []
+    ## Option to use a specific version of the *Cloud SQL Auth proxy* sidecar image.
+    ## ref: https://console.cloud.google.com/gcr/images/cloudsql-docker/GLOBAL/gce-proxy
+    # sidecarImageTag: latest
+    ## ref: https://cloud.google.com/sql/docs/postgres/connect-kubernetes-engine#running_the_as_a_sidecar
+    resources:
+      {}
 
 password:
   # Changing Metabase password complexity: