feat(apps): Add pgweb

apps/pgweb/bookmark-grafana.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pgweb-bookmark-grafana
+  namespace: pgweb
+data:
+  grafana.toml: |
+    host = "postgres-rw.postgres.svc.cluster.local"
+    user = "pgweb"
+    passwordvar = "DATABASE_PASSWORD"
+    database = "grafana"
+    sslmode = "require"
+    readonly = true

apps/pgweb/bookmark-legislative.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pgweb-bookmark-legislative
+  namespace: pgweb
+data:
+  legislative.toml: |
+    host = "postgres-rw.postgres.svc.cluster.local"
+    user = "pgweb"
+    passwordvar = "DATABASE_PASSWORD"
+    database = "legislative"
+    sslmode = "require"
+    readonly = true

apps/pgweb/bookmark-redoost.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pgweb-bookmark-redoost
+  namespace: pgweb
+data:
+  redoost.toml: |
+    host = "postgres-rw.postgres.svc.cluster.local"
+    user = "pgweb"
+    passwordvar = "DATABASE_PASSWORD"
+    database = "redoost"
+    sslmode = "require"
+    readonly = true

apps/pgweb/deployment.yaml

@@ -0,0 +1,77 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pgweb
+  namespace: pgweb
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: pgweb
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: pgweb
+    spec:
+      containers:
+        # Only bookmarked databases can be connected to, picked on the
+        # connect screen; there is one bookmark per app database.
+        - args:
+            - --bookmarks-dir=/bookmarks
+            - --bookmarks-only
+            - --no-ssh
+            - --readonly
+            - --skip-open
+          env:
+            - name: DATABASE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  key: password
+                  name: pgweb
+          image: docker.io/sosedoff/pgweb:0.17.0
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+          name: pgweb
+          ports:
+            - containerPort: 8081
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+          resources:
+            limits:
+              cpu: 500m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - mountPath: /bookmarks
+              name: bookmarks
+              readOnly: true
+      securityContext:
+        runAsGroup: 1000
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        - name: bookmarks
+          projected:
+            sources:
+              - configMap:
+                  name: pgweb-bookmark-grafana
+              - configMap:
+                  name: pgweb-bookmark-legislative
+              - configMap:
+                  name: pgweb-bookmark-redoost

apps/pgweb/httproute.yaml

@@ -0,0 +1,37 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: pgweb
+  namespace: pgweb
+spec:
+  hostnames:
+    - pgweb.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: authentik-server
+          namespace: authentik
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /outpost.goauthentik.io
+    - backendRefs:
+        - name: pgweb
+          port: 8081
+      filters:
+        - extensionRef:
+            group: traefik.io
+            kind: Middleware
+            name: authentik
+          type: ExtensionRef
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/pgweb/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sealed-secret.yaml
+  - bookmark-grafana.yaml
+  - bookmark-legislative.yaml
+  - bookmark-redoost.yaml
+  - deployment.yaml
+  - service.yaml
+  - networkpolicy.yaml
+  - middleware.yaml
+  - httproute.yaml

apps/pgweb/middleware.yaml

@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: authentik
+  namespace: pgweb
+spec:
+  forwardAuth:
+    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+    trustForwardHeader: true

apps/pgweb/networkpolicy.yaml

@@ -0,0 +1,45 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: pgweb
+  namespace: pgweb
+spec:
+  # Only traefik may reach pgweb, so authentik can't be bypassed from inside
+  # the cluster, and pgweb may only reach postgres.
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+    - ports:
+        - port: 5432
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: postgres
+          podSelector:
+            matchLabels:
+              cnpg.io/cluster: postgres
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 8081
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: pgweb
+  policyTypes:
+    - Ingress
+    - Egress

apps/pgweb/sealed-secret.yaml

@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: pgweb
+  namespace: pgweb
+spec:
+  encryptedData:
+    password: AgAZE1EB8YzFvC/qgXm8Mvb9Cy2eRubqST3Hxc42LB6/xGW6ZGj9fVYIw4WcVGTOYKXGfEB4JyP+hidluf20kynufYynHXJZw9zBR15ZHIEDVPnbtW1Z+iMua9Hd8gRwug75IeM9wFHMI6dcXQk164GsJQa77vB1EBts8bN78iSuQwuk4YcIUsMfhbx9NI+SGvV+Ih3B5XrUonhDnEIW2d4D46P/1SYXxqd2HhJPOdyTEWws0pSV191RltpKpEJAb/iJNHP6w1++O2Ld6eRTTgmHBAtJf8NtlRxpeZQ1SixAhpsspaPx1FbDrvq17a8JtY60Zyn4a4JnSY/rgErNadR0C82NkYsokePGZ8KMT1QI+jvz7M1NKQLee4GG9+khBAILmlstuXoZPMACB/HAt+nxJAOA8fAYJYxwCP7AsOEpCR/osK1zX2jlaIB2pvBOx7k3/aqamCWt8QUNOiDfqd5G7SH1PI5bAjOA4YjOVxm89t01MzTE9tIdSlDGMoAfodZDwyjA+zenBKe/ha4lddKUGMtucHlyL2e+CPHhfWSWSRw/aimcRkTZf4fVf+17tF6lm5byp9kRbAOW4ymMtfZLikQqTWJ6Aec1bMCLYD2SagrXMkVgnpuu6Z6W1U0p2f3ZHU8tuOZ4avCz53EjmLw+8gdcD2MXZGlJVtq1kxXGpK9sKRcyD4i05VbtESgZ2XmOiUNrbVAzmu2QhSn/k5NGZpDKg0uWMT3X7igQWSz8Af9S53mPDv6aJ2z/q65D7+BBAMwuE+gO2V7cyK37G2ze
+  template:
+    metadata:
+      name: pgweb
+      namespace: pgweb

apps/pgweb/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: pgweb
+  namespace: pgweb
+spec:
+  ports:
+    - name: http
+      port: 8081
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: pgweb