# Job to sync db and db user with external postgres for Anchore's primary data store
apiVersion:batch/v1
kind:Job
metadata:
name:ensure-anchore-db
annotations:
"helm.sh/hook-weight":"-4"
"helm.sh/hook":pre-install,pre-upgrade
"helm.sh/hook-delete-policy":before-hook-creation
spec:
template:
metadata:
name:ensure-anchore-db
annotations:
sidecar.istio.io/inject:'false'
spec:
imagePullSecrets:
-name:{{.Values.postgresql.imagePullSecrets}}
containers:
-name:psql
image:{{.Values.postgresql.image}}
command:
-/bin/bash
--exc
-|
echo "Ensure Anchore DB..."
psql -tc "SELECT 1 FROM pg_database WHERE datname = '$ANCHORE_DB'" | grep -q 1 || psql -c "CREATE DATABASE $ANCHORE_DB"
psql -tc "SELECT 1 FROM pg_roles WHERE rolname = '$PGUSER'" | grep -q 1 && psql -c "ALTER USER $PGUSER WITH PASSWORD '$PGPASSWORD'; GRANT ALL PRIVILEGES ON DATABASE $ANCHORE_DB TO $PGUSER;" | grep -q GRANT || psql -c "CREATE USER $PGUSER WITH PASSWORD '$PGPASSWORD'; GRANT ALL PRIVILEGES ON DATABASE $ANCHORE_DB TO $PGUSER;"
psql -tc "SELECT 1 FROM pg_database WHERE datname = '$FEEDS_DB'" | grep -q 1 || psql -c "CREATE DATABASE $FEEDS_DB"
psql -tc "SELECT 1 FROM pg_roles WHERE rolname = '$PGUSER'" | grep -q 1 && psql -c "ALTER USER $PGUSER WITH PASSWORD '$PGPASSWORD'; GRANT ALL PRIVILEGES ON DATABASE $FEEDS_DB TO $PGUSER;" | grep -q GRANT || psql -c "CREATE USER $PGUSER WITH PASSWORD '$PGPASSWORD'; GRANT ALL PRIVILEGES ON DATABASE $FEEDS_DB TO $PGUSER;"
Anchore relies on a single Postgres instance by default, as well as an additional Postgres database and Redis server if certain Enterprise configs are enabled. For development work and non-production workflows you can use the embedded dependency charts to automatically spin these dependencies up. In this case you don't need to provide any values but may still wish to override the default user or password.
Anchore relies on a single Postgres instance by default, as well as an additional Postgres database and Redis server if certain Enterprise configs are enabled. For development work and non-production workflows you can use the embedded dependency charts to automatically spin these dependencies up. In this case you don't need to provide any values.
```yaml
```yaml
stringData:
stringData:
values.yaml:|-
values.yaml:|-
addons:
addons:
anchore:
anchore:
postgresql:
database:
external: false
host: ""
user: "username"
port: ""
password: "password"
username: ""
password: ""
database: ""
feeds_database: ""
```
```
Big Bang does not currently provide a production solution to be utilized, so it is recommended that you connect to existing external instances. Using the embedded instances in production is AT YOUR OWN RISK.
Big Bang does not currently provide a production solution to be utilized, so it is recommended that you connect to existing external instances. Using the embedded instances in production is AT YOUR OWN RISK.
To externalize the dependency on postgres see the values below. Since some of these values are sensitive they should be added to your encrypted `secrets.enc.yaml` file.
To externalize the dependency on postgres see the values below. Since some of these values are sensitive they should be added to your encrypted `secrets.enc.yaml` file (be sure you don't name your databases with hyphens or psql will throw errors).
```yaml
```yaml
stringData:
stringData:
values.yaml:|-
values.yaml:|-
addons:
addons:
anchore:
anchore:
postgresql:
database:
external: true
host: "testing.amazon.rds.com"
user: "username"
password: "password"
host: "postgres.mydomain.com"
port: "5432"
port: "5432"
mainDB: "databaseName"
username: "username"
feedsDB: "databaseName" # Only used for enterprise deployments
password: "password"
database: "anchore"
feeds_database: "anchorefeeds"
```
```
If you plan to use the UI:
By default, when using an external postgres setup, the `feeds_database` will use the same username, password, host, and port as the main `database`. This is for streamlined ease of use for customers. However, if you'd like to configure the `feeds_database` with separate credentials, you can do so by overriding the upstream values (be sure you don't name your databases with hyphens or psql will throw errors):
You should at a minimum set a non-default password for the redis instance:
