Repo Radius: externalize control-plane and Terraform state (rad startup / rad shutdown)

cmd/rad/cmd/root.go

@@ -86,6 +86,8 @@ import (
 	"github.com/radius-project/radius/pkg/cli/cmd/rollback"
 	rollback_kubernetes "github.com/radius-project/radius/pkg/cli/cmd/rollback/kubernetes"
 	"github.com/radius-project/radius/pkg/cli/cmd/run"
+	cmd_shutdown "github.com/radius-project/radius/pkg/cli/cmd/shutdown"
+	cmd_startup "github.com/radius-project/radius/pkg/cli/cmd/startup"
 	"github.com/radius-project/radius/pkg/cli/cmd/uninstall"
 	uninstall_kubernetes "github.com/radius-project/radius/pkg/cli/cmd/uninstall/kubernetes"
 	"github.com/radius-project/radius/pkg/cli/cmd/upgrade"
@@ -361,6 +363,12 @@ func initSubCommands() {
 	wirePreviewSubcommand(initCmd, previewInitCmd)
 	RootCmd.AddCommand(initCmd)
 
+	startupCmd, _ := cmd_startup.NewCommand(framework)
+	RootCmd.AddCommand(startupCmd)
+
+	shutdownCmd, _ := cmd_shutdown.NewCommand(framework)
+	RootCmd.AddCommand(shutdownCmd)
+
 	envCreateCmd, _ := env_create.NewCommand(framework)
 	previewCreateCmd, _ := env_create_preview.NewCommand(framework)
 	wirePreviewSubcommand(envCreateCmd, previewCreateCmd)

deploy/Chart/templates/database/configmap-initdb.yaml

@@ -0,0 +1,53 @@
+{{- if .Values.database.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: database-initdb
+  namespace: {{ .Release.Namespace }}
+  labels:
+    control-plane: database
+    app.kubernetes.io/name: database
+    app.kubernetes.io/part-of: radius
+data:
+  init-db.sh: |
+    #!/bin/bash
+    set -e
+
+    RESOURCE_PROVIDERS=("ucp" "applications_rp" "dynamic_rp")
+
+    for RESOURCE_PROVIDER in "${RESOURCE_PROVIDERS[@]}"; do
+        echo "Creating database and user for $RESOURCE_PROVIDER"
+        psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
+            DO \$\$
+            BEGIN
+                IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '$RESOURCE_PROVIDER') THEN
+                    CREATE USER $RESOURCE_PROVIDER WITH PASSWORD '$POSTGRES_PASSWORD';
+                END IF;
+            END
+            \$\$;
+            SELECT 'CREATE DATABASE $RESOURCE_PROVIDER OWNER $RESOURCE_PROVIDER' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '$RESOURCE_PROVIDER')\gexec
+            GRANT ALL PRIVILEGES ON DATABASE $RESOURCE_PROVIDER TO $RESOURCE_PROVIDER;
+    EOSQL
+    done
+
+    for RESOURCE_PROVIDER in "${RESOURCE_PROVIDERS[@]}"; do
+        echo "Creating tables in database $RESOURCE_PROVIDER"
+        psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$RESOURCE_PROVIDER" <<-EOSQL
+            CREATE TABLE IF NOT EXISTS resources (
+                id TEXT PRIMARY KEY NOT NULL,
+                original_id TEXT NOT NULL,
+                resource_type TEXT NOT NULL,
+                root_scope TEXT NOT NULL,
+                routing_scope TEXT NOT NULL,
+                etag TEXT NOT NULL,
+                created_at TIMESTAMP(6) WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP,
+                resource_data JSONB NOT NULL
+            );
+            CREATE INDEX IF NOT EXISTS idx_resource_query ON resources (resource_type, root_scope);
+            -- The table is created by the superuser, so grant the per-RP user the privileges it
+            -- needs to read and write its own data (matches build/scripts/start-radius.sh).
+            GRANT ALL PRIVILEGES ON TABLE resources TO "$RESOURCE_PROVIDER";
+            GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO "$RESOURCE_PROVIDER";
+    EOSQL
+    done
+{{- end }}

deploy/Chart/templates/database/configmaps.yaml

@@ -11,5 +11,5 @@ metadata:
 stringData:
   POSTGRES_USER: "{{ .Values.database.postgres_user }}"
   POSTGRES_PASSWORD: "{{ randAlphaNum 16 }}"
-  POSTGRES_DB: POSTGRES_DB
+  POSTGRES_DB: "radius"
 {{- end }}

deploy/Chart/templates/database/statefulset.yaml

@@ -62,6 +62,12 @@ spec:
         - name: database
           mountPath: /var/lib/postgresql/data
           subPath: postgres
+        - name: initdb-scripts
+          mountPath: /docker-entrypoint-initdb.d
+      volumes:
+      - name: initdb-scripts
+        configMap:
+          name: database-initdb
 
   volumeClaimTemplates:
   - metadata:

deploy/Chart/templates/dynamic-rp/configmaps.yaml

@@ -14,10 +14,16 @@ data:
       name: self-hosted
       roleLocation: "global"
     databaseProvider:
+    {{- if .Values.database.enabled }}
+      provider: "postgresql"
+      postgresql:
+        url: "postgresql://dynamic_rp:${POSTGRES_PASSWORD}@database.{{ .Release.Namespace }}:5432/dynamic_rp?sslmode=disable"
+    {{- else }}
       provider: "apiserver"
       apiserver:
         context: ""
         namespace: "radius-system"
+    {{- end }}
     queueProvider:
       provider: "apiserver"
       name: "dynamic-rp"

deploy/Chart/templates/dynamic-rp/deployment.yaml

@@ -213,6 +213,13 @@ spec:
         args:
         - --config-file=/etc/config/radius-self-host.yaml
         env:
+        {{- if .Values.database.enabled }}
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: database-secret
+              key: POSTGRES_PASSWORD
+        {{- end }}
         - name: SKIP_ARM
           value: 'false'
         - name: ARM_AUTH_METHOD

deploy/Chart/templates/rp/configmaps.yaml

@@ -14,10 +14,16 @@ data:
       name: self-hosted
       roleLocation: "global"
     databaseProvider:
+    {{- if .Values.database.enabled }}
+      provider: "postgresql"
+      postgresql:
+        url: "postgresql://applications_rp:${POSTGRES_PASSWORD}@database.{{ .Release.Namespace }}:5432/applications_rp?sslmode=disable"
+    {{- else }}
       provider: "apiserver"
       apiserver:
         context: ""
         namespace: "radius-system"
+    {{- end }}
     queueProvider:
       provider: "apiserver"
       name: "radius"

deploy/Chart/templates/rp/deployment.yaml

@@ -162,6 +162,13 @@ spec:
         args:
         - --config-file=/etc/config/radius-self-host.yaml
         env:
+        {{- if .Values.database.enabled }}
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: database-secret
+              key: POSTGRES_PASSWORD
+        {{- end }}
         - name: SKIP_ARM
           value: 'false'
         - name: ARM_AUTH_METHOD

deploy/Chart/templates/ucp/configmaps.yaml

@@ -18,10 +18,16 @@ data:
       pathBase: /apis/api.ucp.dev/v1alpha3
       tlsCertificateDirectory: /var/tls/cert
     databaseProvider:
+    {{- if .Values.database.enabled }}
+      provider: "postgresql"
+      postgresql:
+        url: "postgresql://ucp:${POSTGRES_PASSWORD}@database.{{ .Release.Namespace }}:5432/ucp?sslmode=disable"
+    {{- else }}
       provider: "apiserver"
       apiserver:
         context: ""
         namespace: "radius-system"
+    {{- end }}
 
     secretProvider:
       provider: kubernetes

deploy/Chart/templates/ucp/deployment.yaml

@@ -61,6 +61,13 @@ spec:
           value: '/var/tls/cert'
         - name: PORT
           value: '9443'
+        {{- if .Values.database.enabled }}
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: database-secret
+              key: POSTGRES_PASSWORD
+        {{- end }}
         {{- if .Values.global.rootCA.cert }}
         - name: {{ .Values.global.rootCA.sslCertDirEnvVar }}
           value: {{ .Values.global.rootCA.mountPath }}

deploy/Chart/tests/database_test.yaml

@@ -0,0 +1,204 @@
+suite: test database (postgresql) provider configuration
+templates:
+  - database/configmaps.yaml
+  - database/configmap-initdb.yaml
+  - database/statefulset.yaml
+  - ucp/configmaps.yaml
+  - ucp/deployment.yaml
+  - rp/configmaps.yaml
+  - rp/deployment.yaml
+  - dynamic-rp/configmaps.yaml
+  - dynamic-rp/deployment.yaml
+tests:
+  # --- database.enabled=false (default) ---
+  - it: should not render the database secret when database is disabled
+    set:
+      database.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+        template: database/configmaps.yaml
+
+  - it: should not render the initdb configmap when database is disabled
+    set:
+      database.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+        template: database/configmap-initdb.yaml
+
+  - it: should use the apiserver provider for UCP when database is disabled
+    set:
+      database.enabled: false
+    asserts:
+      - matchRegex:
+          path: data["ucp-config.yaml"]
+          pattern: 'provider: "apiserver"'
+        template: ucp/configmaps.yaml
+
+  - it: should use the apiserver provider for applications-rp when database is disabled
+    set:
+      database.enabled: false
+    asserts:
+      - matchRegex:
+          path: data["radius-self-host.yaml"]
+          pattern: 'provider: "apiserver"'
+        template: rp/configmaps.yaml
+
+  - it: should use the apiserver provider for dynamic-rp when database is disabled
+    set:
+      database.enabled: false
+    asserts:
+      - matchRegex:
+          path: data["radius-self-host.yaml"]
+          pattern: 'provider: "apiserver"'
+        template: dynamic-rp/configmaps.yaml
+
+  # --- database.enabled=true ---
+  - it: should render the database secret with a literal radius database name
+    set:
+      database.enabled: true
+    asserts:
+      - isKind:
+          of: Secret
+        template: database/configmaps.yaml
+      - equal:
+          path: stringData.POSTGRES_DB
+          value: "radius"
+        template: database/configmaps.yaml
+
+  - it: should render the initdb configmap when database is enabled
+    set:
+      database.enabled: true
+    asserts:
+      - isKind:
+          of: ConfigMap
+        template: database/configmap-initdb.yaml
+      - equal:
+          path: metadata.name
+          value: database-initdb
+        template: database/configmap-initdb.yaml
+
+  - it: should grant the per-RP users privileges on the resources table
+    set:
+      database.enabled: true
+    asserts:
+      # Guards against the "permission denied for table resources" startup crash: the table is
+      # created by the superuser, so the per-RP user must be granted access.
+      - matchRegex:
+          path: data["init-db.sh"]
+          pattern: 'GRANT ALL PRIVILEGES ON TABLE resources TO "\$RESOURCE_PROVIDER"'
+        template: database/configmap-initdb.yaml
+      - matchRegex:
+          path: data["init-db.sh"]
+          pattern: 'GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO "\$RESOURCE_PROVIDER"'
+        template: database/configmap-initdb.yaml
+
+  - it: should use a pullable postgres image reference
+    set:
+      database.enabled: true
+    asserts:
+      # Guards against pointing at a registry-mirror tag that does not exist (ImagePullBackOff).
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: "docker.io/library/postgres:16-alpine"
+        template: database/statefulset.yaml
+
+  - it: should mount the initdb scripts into the database statefulset
+    set:
+      database.enabled: true
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: initdb-scripts
+            configMap:
+              name: database-initdb
+        template: database/statefulset.yaml
+
+  - it: should use the postgresql provider for UCP when database is enabled
+    set:
+      database.enabled: true
+    asserts:
+      - matchRegex:
+          path: data["ucp-config.yaml"]
+          pattern: 'provider: "postgresql"'
+        template: ucp/configmaps.yaml
+      - matchRegex:
+          path: data["ucp-config.yaml"]
+          pattern: 'postgresql://ucp:\$\{POSTGRES_PASSWORD\}@database\.'
+        template: ucp/configmaps.yaml
+
+  - it: should use the postgresql provider for applications-rp when database is enabled
+    set:
+      database.enabled: true
+    asserts:
+      - matchRegex:
+          path: data["radius-self-host.yaml"]
+          pattern: 'postgresql://applications_rp:\$\{POSTGRES_PASSWORD\}@database\.'
+        template: rp/configmaps.yaml
+
+  - it: should use the postgresql provider for dynamic-rp when database is enabled
+    set:
+      database.enabled: true
+    asserts:
+      - matchRegex:
+          path: data["radius-self-host.yaml"]
+          pattern: 'postgresql://dynamic_rp:\$\{POSTGRES_PASSWORD\}@database\.'
+        template: dynamic-rp/configmaps.yaml
+
+  - it: should inject POSTGRES_PASSWORD into UCP when database is enabled
+    set:
+      database.enabled: true
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: POSTGRES_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: database-secret
+                key: POSTGRES_PASSWORD
+        template: ucp/deployment.yaml
+
+  - it: should inject POSTGRES_PASSWORD into applications-rp when database is enabled
+    set:
+      database.enabled: true
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: POSTGRES_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: database-secret
+                key: POSTGRES_PASSWORD
+        template: rp/deployment.yaml
+
+  - it: should inject POSTGRES_PASSWORD into dynamic-rp when database is enabled
+    set:
+      database.enabled: true
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: POSTGRES_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: database-secret
+                key: POSTGRES_PASSWORD
+        template: dynamic-rp/deployment.yaml
+
+  - it: should not inject POSTGRES_PASSWORD into dynamic-rp when database is disabled
+    set:
+      database.enabled: false
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: POSTGRES_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: database-secret
+                key: POSTGRES_PASSWORD
+        template: dynamic-rp/deployment.yaml