declare tools (#1)

Reviewed-on: https://gitea.arcodange.duckdns.org/arcodange-org/tools/pulls/1
Co-authored-by: Gabriel Radureau <arcodange@gmail.com>
Co-committed-by: Gabriel Radureau <arcodange@gmail.com>

.gitea/workflows/helmcharts.yaml

@@ -0,0 +1,178 @@
+---
+# template source: https://github.com/bretfisher/docker-build-workflow/blob/main/templates/call-docker-build.yaml
+name: Helm Charts
+
+on: [push,pull_request]
+  # push: &helmPaths # turns out gitea don't handle well the paths filter
+  #   paths:
+  #     - '*/\.yaml'
+  #     - '*/\.tpl'
+  #     - '*/NOTES.txt'
+  #     - '*/\.helmignore'
+  # pull_request: *helmPaths
+
+# cancel any previously-started, yet still active runs of this workflow on the same branch
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
+.helm_install_dependencies_sh: &helm_install_dependencies_sh |-
+  helm_install_dependencies() {
+    chart_file="$1/Chart.yaml"
+    [[ ! -f "$chart_file" ]] && echo "Chart.yaml not found in $1" && return 1
+
+    yq eval '.dependencies[]' "$chart_file" -o=json | jq -c '.' | while IFS= read -r dep; do
+      name=$(jq -r '.name' <<< "$dep")
+      version=$(jq -r '.version' <<< "$dep")
+      repo=$(jq -r '.repository' <<< "$dep")
+      url=$(curl -s "${repo}/index.yaml" | yq eval ".entries.${name}[] | select(.version == \"${version}\") | .urls[0]" -)
+
+      echo "Dependency: $name, Version: $version, URL: $url"
+      mkdir -p "$1/charts" && curl -sL "$url" -o "$1/charts/${name}-${version}.tgz"
+    done
+  }
+  helm_install_dependencies $chart
+
+
+jobs:
+  filter-chart:
+    name: Detect changed charts
+    runs-on: ubuntu-latest
+    outputs:
+      library_charts: ${{steps.filter-charts.outputs.library_charts}}
+      application_charts: ${{steps.filter-charts.outputs.application_charts}}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Get changed files
+        id: changed-files
+        uses: tj-actions/changed-files@v45
+
+      - name: Filter modified charts
+        id: filter-charts
+        run: |
+          echo "Changed files:"
+          echo "${{ steps.changed-files.outputs.all_changed_files }}"
+
+          # Find unique directories that contain Chart.yaml among the changed files
+          modified_dirs=$(echo "${{ steps.changed-files.outputs.all_changed_files }}" | tr ' ' '\n' | xargs -n1 dirname | sort -u || true)
+
+          # Initialize an array to store directories that contain Chart.yaml
+          helm_chart_dirs=()
+
+          # Function to find the closest directory containing Chart.yaml
+          find_chart_root() {
+            dir="$1"
+            while [[ "$dir" != "/" && "$dir" != "." ]]; do
+              if [[ -f "$dir/Chart.yaml" ]]; then
+                echo "$dir"
+                return
+              fi
+              dir=$(dirname "$dir")
+            done
+          }
+
+          # Iterate over each modified directory and find the root chart directory
+          for dir in $modified_dirs; do
+            chart_dir=$(find_chart_root "$dir")
+            if [[ -n "$chart_dir" && ! " ${helm_chart_dirs[*]} " =~ " ${chart_dir} " ]]; then
+              helm_chart_dirs+=("$chart_dir")
+            fi
+          done
+
+          # Initialize arrays for library and application charts
+          library_dirs=()
+          application_dirs=()
+
+          # Iterate over each modified directory and check the 'type' field in Chart.yaml
+          for dir in ${helm_chart_dirs[@]}; do
+            chart_type=$(yq eval '.type' "$dir/Chart.yaml" || echo "undefined")
+
+            # Add directories to corresponding arrays based on the 'type'
+            if [[ "$chart_type" == "library" ]]; then
+              library_dirs+=("$dir")
+            elif [[ "$chart_type" == "application" ]]; then
+              application_dirs+=("$dir")
+            fi
+          done
+
+          # Convert the arrays to JSON format
+          library_json=$(printf '%s\n' "${library_dirs[@]}" | jq -R . | jq -cs 'map(select(. != ""))')
+          application_json=$(printf '%s\n' "${application_dirs[@]}" | jq -R . | jq -cs 'map(select(. != ""))')
+
+          # Output the JSON arrays
+          echo "Modified Helm library charts directories: $library_json"
+          echo "library_charts=$library_json" >> $GITHUB_OUTPUT
+
+          echo "Modified Helm application charts directories: $application_json"
+          echo "application_charts=$application_json" >> $GITHUB_OUTPUT
+
+  library-charts: &charts-matrix-job
+    name: Library charts ${{ matrix.chart }}
+    runs-on: ubuntu-latest
+    needs: filter-chart
+    strategy:
+      matrix:
+        chart: [tool] # turns out gitea doesn't support dynamic matrix
+        # chart: ${{ fromJson(needs.filter-chart.outputs.library_charts) }}
+        type: [library]
+    if: >-
+      ${{
+      always() && !contains(needs.*.result, 'failure') && needs.filter-chart.result == 'success'
+      && (
+        contains(fromJson(needs.filter-chart.outputs.library_charts), matrix.chart)
+        || contains(fromJson(needs.filter-chart.outputs.application_charts), matrix.chart)
+      )
+      && (
+        contains(fromJSON('["","pull_request"]'), github.event_name)
+        || github.ref == 'refs/heads/main'
+      ) }}
+    env:
+      chart: ${{ matrix.chart }}
+    steps:
+
+      - uses: actions/checkout@v4
+
+      - run: *helm_install_dependencies_sh
+
+      - name: Install Helm for test
+        if: >-
+          ${{
+            matrix.type != 'library'
+            && (
+              contains(fromJSON('["","pull_request"]'), github.event_name)
+              || github.ref != 'refs/heads/main'
+            )
+          }}
+        uses: azure/setup-helm@v4
+      - name: Helm template
+        if: >-
+          ${{
+            matrix.type != 'library'
+            && (
+              contains(fromJSON('["","pull_request"]'), github.event_name)
+              || github.ref != 'refs/heads/main'
+            )
+          }}
+        run: helm template $chart --debug
+
+      - name: publish ${{ matrix.chart }} helm chart
+        if: ${{ contains(fromJSON('["","push"]'), github.event_name) && github.ref == 'refs/heads/main' }}
+        run: |
+          set -x
+          chart=${chart:-tool}
+          chart_version=`yq eval .version ${chart}/Chart.yaml`
+          chart_package=${chart}-${chart_version}.tgz
+          # helm package ${chart}
+          tar -X ${chart}/.helmignore -czf ${chart_package} ${chart}
+          curl --user ${{ github.actor }}:${{ secrets.PACKAGES_TOKEN }} -X POST --upload-file ./${chart_package} https://gitea.arcodange.duckdns.org/api/packages/${{ github.repository_owner }}/helm/api/charts
+
+  application-charts:
+    <<: *charts-matrix-job
+    name: Application charts ${{ matrix.chart }}
+    needs: [filter-chart,library-charts]
+    strategy:
+      matrix:
+        # chart: ${{ fromJson(needs.filter-chart.outputs.application_charts) }}
+        chart: [pgcat]
+        type: [application]

.gitignore

@@ -0,0 +1,3 @@
+.DS_Store
+Chart.lock
+*/charts/*.tgz

README.md

@@ -1,7 +1,17 @@
 # Tools
 
+```txt
+CICD:
+pousser la library helm dans le registre helm de gitea
+
+pour chaque dossier de premier niveau contenant un fichier Chart.yaml (sauf les dossier library et chart)
+le pousser dans le registre helm de gitea
+```
+
 ## pgbouncer
 
 ## prometheus
 
-## hashicorp vault
+## hashicorp vault
+
+### experiment with [sops](https://github.com/getsops/sops)

chart/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

chart/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: chart
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

chart/templates/apps.yaml

@@ -0,0 +1,25 @@
+{{- range $app_name := .Values.tools -}}
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: {{ $app_name }}
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: tools
+  source:
+    repoURL: https://gitea.arcodange.duckdns.org/arcodange-org/tools
+    targetRevision: HEAD
+    path: {{ $app_name }}
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: tools
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+{{ end }}

chart/templates/project.yaml

@@ -0,0 +1,17 @@
+# https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#projects
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: tools
+  namespace: argocd
+  # Finalizer that ensures that project is not deleted until it is not referenced by any application
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  description: Arcodange tools (monitoring, cache, connection pool, secret management...)
+  sourceRepos:
+  - 'https://gitea.arcodange.duckdns.org/arcodange-org/tools'
+  # Only permit applications to deploy to the tools namespace in the same cluster
+  destinations:
+  - namespace: tools
+    server: https://kubernetes.default.svc

chart/values.yaml

@@ -0,0 +1,5 @@
+tools:
+  - pgbouncer
+  #- pgcat # trop contraignant: lister tous les databases/users et auth_type md5 uniquement
+  # - prometheus
+  # - hashicorp_vault

pgbouncer/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

pgbouncer/Chart.yaml

@@ -0,0 +1,32 @@
+apiVersion: v2
+name: pgbouncer
+description: A Helm chart for Kubernetes
+
+dependencies:
+- name: tool
+  version: 0.1.0
+  repository: https://gitea.arcodange.duckdns.org/api/packages/arcodange-org/helm
+- name: pgbouncer
+  version: 2.3.1
+  repository: https://icoretech.github.io/helm
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+# appVersion: "1.16.0"

pgbouncer/NOTES.txt

@@ -0,0 +1,7 @@
+Try connectivity with
+
+kubectl run --rm -i postgres --image=postgres --env PGCONNECT_TIMEOUT=2 --env PGPASSWORD=pgbouncer_auth --restart=Never -- psql -h pgbouncer.tools -p 5432 -U 'pgbouncer_auth' -d postgres -tc "SELECT 1;"
+
+kubectl run --rm -i postgres --image=postgres --env PGCONNECT_TIMEOUT=2 --env PGPASSWORD=admin --restart=Never -- psql -h pgbouncer.tools -p 5432 -U 'admin' -d pgbouncer -tc "SHOW DATABASES;"
+
+kubectl run --rm -i postgres --image=postgres --env PGCONNECT_TIMEOUT=2 --env PGPASSWORD=pgbouncer_auth --restart=Never -- psql -h 192.168.1.202 -p 5432 -U 'pgbouncer_auth' -d postgres -tc "SELECT 1;"

pgbouncer/templates/helm-chart-config.yaml

@@ -0,0 +1,3 @@
+{{- if eq .Values.tool.kind "HelmChart" -}}
+{{- include "tool.helm-chart-config.tpl" . -}}
+{{- end -}}

pgbouncer/templates/helm-chart.yaml

@@ -0,0 +1,3 @@
+{{- if eq .Values.tool.kind "HelmChart" -}}
+{{- include "tool.helm-chart.tpl" . -}}
+{{- end -}}

pgbouncer/values.yaml

@@ -0,0 +1,24 @@
+pgbouncer: &pgbouncer_config
+  nodeSelector: kubernetes.io/hostname=pi2 # close to postgres instance
+  config:
+    adminUser: "admin"
+    adminPassword: "admin"
+    authUser: &authUser pgbouncer_auth
+    authPassword: *authUser
+    databases:
+      "*":
+        host: "192.168.1.202" # kubernetes.io/hostname=pi2 ip
+        port: 5432
+    pgbouncer:
+      auth_type: scram-sha-256
+      auth_query: SELECT uname, phash FROM user_lookup($1)
+  pgbouncerExporter:
+    enabled: false
+
+tool:
+  # kind: 'SubChart' or 'HelmChart', if subchart then uncomment Chart.yaml dependency, else comment and use tool library with helm chart template
+  kind: 'SubChart'
+  repo: https://icoretech.github.io/helm
+  chart: pgbouncer
+  version: 2.3.1
+  values: *pgbouncer_config

pgcat/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

pgcat/Chart.yaml

@@ -0,0 +1,32 @@
+apiVersion: v2
+name: pgbouncer
+description: A Helm chart for Kubernetes
+
+dependencies:
+- name: tool
+  version: 0.1.0
+  repository: https://gitea.arcodange.duckdns.org/api/packages/arcodange-org/helm
+- name: pgcat
+  version: 0.1.0
+  repository: https://improwised.github.io/charts/
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+# appVersion: "1.16.0"

pgcat/NOTES.txt

@@ -0,0 +1,5 @@
+Try connectivity with
+
+kubectl run --rm -i postgres --image=postgres --env PGCONNECT_TIMEOUT=2 --env PGPASSWORD=pgcat_auth --restart=Never -- psql -h pgcat.tools -p 6432 -U 'pgcat_auth' -d postgres -tc "SELECT 1;"
+
+kubectl run --rm -i postgres --image=postgres --env PGCONNECT_TIMEOUT=2 --env PGPASSWORD=pgcat_auth --restart=Never -- psql -h 192.168.1.202 -p 5432 -U 'pgcat_auth' -d postgres -tc "SELECT 1;"

pgcat/templates/helm-chart-config.yaml

@@ -0,0 +1,3 @@
+{{- if eq .Values.tool.kind "HelmChart" -}}
+{{- include "tool.helm-chart-config.tpl" . -}}
+{{- end -}}

pgcat/templates/helm-chart.yaml

@@ -0,0 +1,3 @@
+{{- if eq .Values.tool.kind "HelmChart" -}}
+{{- include "tool.helm-chart.tpl" . -}}
+{{- end -}}

pgcat/values.yaml

@@ -0,0 +1,236 @@
+pgcat: &pgcat_config
+  image:
+    tag: latest #default tag main doesn't support arm64
+  service:
+    port: 6432
+  nodeSelector: {}
+
+  configuration:
+    ## General pooler settings
+    ## @param [object]
+    general:
+      ## @param configuration.general.host What IP to run on, 0.0.0.0 means accessible from everywhere.
+      host: "0.0.0.0"
+
+      ## @param configuration.general.port Port to run on, same as PgBouncer used in this example.
+      port: 6432
+
+      ## @param configuration.general.enable_prometheus_exporter Whether to enable prometheus exporter or not.
+      enable_prometheus_exporter: false
+
+      ## @param configuration.general.prometheus_exporter_port Port at which prometheus exporter listens on.
+      prometheus_exporter_port: 9930
+
+      # @param configuration.general.connect_timeout How long to wait before aborting a server connection (ms).
+      connect_timeout: 5000
+
+      # How long an idle connection with a server is left open (ms).
+      idle_timeout: 30000    # milliseconds
+
+      # Max connection lifetime before it's closed, even if actively used.
+      server_lifetime: 86400000    # 24 hours
+
+      # How long a client is allowed to be idle while in a transaction (ms).
+      idle_client_in_transaction_timeout: 0    # milliseconds
+
+      # @param configuration.general.healthcheck_timeout How much time to give `SELECT 1` health check query to return with a result (ms).
+      healthcheck_timeout: 1000
+
+      # @param configuration.general.healthcheck_delay How long to keep connection available for immediate re-use, without running a healthcheck query on it
+      healthcheck_delay: 30000
+
+      # @param configuration.general.shutdown_timeout How much time to give clients during shutdown before forcibly killing client connections (ms).
+      shutdown_timeout: 60000
+
+      # @param configuration.general.ban_time For how long to ban a server if it fails a health check (seconds).
+      ban_time: 60    # seconds
+
+      # @param configuration.general.log_client_connections If we should log client connections
+      log_client_connections: false
+
+      # @param configuration.general.log_client_disconnections If we should log client disconnections
+      log_client_disconnections: false
+
+      # TLS
+      # tls_certificate: "server.cert"
+      # tls_private_key: "server.key"
+      tls_certificate: "-"
+      tls_private_key: "-"
+
+      # Credentials to access the virtual administrative database (pgbouncer or pgcat)
+      # Connecting to that database allows running commands like `SHOW POOLS`, `SHOW DATABASES`, etc..
+      admin_username: "postgres"
+      admin_password: "postgres"
+
+      # Query to be sent to servers to obtain the hash used for md5 authentication. The connection will be
+      # established using the database configured in the pool. This parameter is inherited by every pool and
+      # can be redefined in pool configuration.
+      auth_query: SELECT usename, passwd FROM user_search($1)
+
+      # User to be used for connecting to servers to obtain the hash used for md5 authentication by sending
+      # the query specified in auth_query_user. The connection will be established using the database configured
+      # in the pool. This parameter is inherited by every pool and can be redefined in pool configuration.
+      #
+      # @param configuration.general.auth_query_user
+      auth_query_user: pgcat_auth
+
+      # Password to be used for connecting to servers to obtain the hash used for md5 authentication by sending
+      # the query specified in auth_query_user. The connection will be established using the database configured
+      # in the pool. This parameter is inherited by every pool and can be redefined in pool configuration.
+      #
+      # @param configuration.general.auth_query_password
+      auth_query_password: pgcat_auth
+
+      # Number of seconds of connection idleness to wait before sending a keepalive packet to the server.
+      tcp_keepalives_idle: 5
+
+      # Number of unacknowledged keepalive packets allowed before giving up and closing the connection.
+      tcp_keepalives_count: 5
+
+      # Number of seconds between keepalive packets.
+      tcp_keepalives_interval: 5
+
+    ## pool
+    ## configs are structured as pool.<pool_name>
+    ## the pool_name is what clients use as database name when connecting
+    ## For the example below a client can connect using "postgres://sharding_user:sharding_user@pgcat_host:pgcat_port/sharded"
+    ## @param [object]
+    pools:
+      - name: passthrough
+        users:
+          - username: ""  # required et pas vide
+            password: "" # requis par le chart. Préférer md5 plutot qu'en clair
+            pool_size: 9
+            statement_timeout: 0
+        shards:
+          - servers:
+            - host: "198.168.1.202"
+              port: 5432
+              role: "primary"
+            database: "" # required et pas vide
+      # - ## default values
+      #   ##
+      #   ##
+      #   ##
+      #   name: "db"
+
+      #  ## Pool mode (see PgBouncer docs for more).
+      #  ## session: one server connection per connected client
+      #  ## transaction: one server connection per client transaction
+      #  ## @param configuration.poolsPostgres.pool_mode
+      #  pool_mode: "transaction"
+
+      #  ## Load balancing mode
+      #  ## `random` selects the server at random
+      #  ## `loc` selects the server with the least outstanding busy connections
+      #  ##
+      #  ## @param configuration.poolsPostgres.load_balancing_mode
+      #  load_balancing_mode: "random"
+
+      #  ## Prepared statements cache size.
+      #  ## TODO: update documentation
+      #  ##
+      #  ## @param configuration.poolsPostgres.prepared_statements_cache_size
+      #  prepared_statements_cache_size: 500
+
+      #  ## If the client doesn't specify, route traffic to
+      #  ## this role by default.
+      #  ##
+      #  ## any: round-robin between primary and replicas,
+      #  ## replica: round-robin between replicas only without touching the primary,
+      #  ## primary: all queries go to the primary unless otherwise specified.
+      #  ## @param configuration.poolsPostgres.default_role
+      #  default_role: "any"
+
+      #  ## Query parser. If enabled, we'll attempt to parse
+      #  ## every incoming query to determine if it's a read or a write.
+      #  ## If it's a read query, we'll direct it to a replica. Otherwise, if it's a write,
+      #  ## we'll direct it to the primary.
+      #  ## @param configuration.poolsPostgres.query_parser_enabled
+      #  query_parser_enabled: true
+
+      #  ## If the query parser is enabled and this setting is enabled, we'll attempt to
+      #  ## infer the role from the query itself.
+      #  ## @param configuration.poolsPostgres.query_parser_read_write_splitting
+      #  query_parser_read_write_splitting: true
+
+      #  ## If the query parser is enabled and this setting is enabled, the primary will be part of the pool of databases used for
+      #  ## load balancing of read queries. Otherwise, the primary will only be used for write
+      #  ## queries. The primary can always be explicitly selected with our custom protocol.
+      #  ## @param configuration.poolsPostgres.primary_reads_enabled
+      #  primary_reads_enabled: true
+
+      #  ## So what if you wanted to implement a different hashing function,
+      #  ## or you've already built one and you want this pooler to use it?
+      #  ##
+      #  ## Current options:
+      #  ##
+      #  ## pg_bigint_hash: PARTITION BY HASH (Postgres hashing function)
+      #  ## sha1: A hashing function based on SHA1
+      #  ##
+      #  ## @param configuration.poolsPostgres.sharding_function
+      #  sharding_function: "pg_bigint_hash"
+
+      #  ## Credentials for users that may connect to this cluster
+      #  ## @param users [array]
+      #  ## @param users[0].username Name of the env var (required)
+      #  ## @param users[0].password Value for the env var (required)
+      #  ## @param users[0].pool_size Maximum number of server connections that can be established for this user
+      #  ## @param users[0].statement_timeout Maximum query duration. Dangerous, but protects against DBs that died in a non-obvious way.
+      #  users: []
+      #    # - username: "user"
+      #    #   password: "pass"
+      #    #
+      #    #  # The maximum number of connection from a single Pgcat process to any database in the cluster
+      #    #  # is the sum of pool_size across all users.
+      #    #  pool_size: 9
+      #    #
+      #    #  # Maximum query duration. Dangerous, but protects against DBs that died in a non-obvious way.
+      #    #  statement_timeout: 0
+      #    #
+      #    #  # PostgreSQL username used to connect to the server.
+      #    #  server_username: "postgres
+      #    #
+      #    #  # PostgreSQL password used to connect to the server.
+      #    #  server_password: "postgres
+
+      #  ## @param shards [array]
+      #  ## @param shards[0].server[0].host Host for this shard
+      #  ## @param shards[0].server[0].port Port for this shard
+      #  ## @param shards[0].server[0].role Role for this shard
+      #  shards: []
+      #      # [ host, port, role ]
+      #    # - servers:
+      #    #     - host: "postgres"
+      #    #       port: 5432
+      #    #       role: "primary"
+      #    #     - host: "postgres"
+      #    #       port: 5432
+      #    #       role: "replica"
+      #    #   database: "postgres"
+      #    #   # [ host, port, role ]
+      #    # - servers:
+      #    #     - host: "postgres"
+      #    #       port: 5432
+      #    #       role: "primary"
+      #    #     - host: "postgres"
+      #    #       port: 5432
+      #    #       role: "replica"
+      #    #   database: "postgres"
+      #    #   # [ host, port, role ]
+      #    # - servers:
+      #    #     - host: "postgres"
+      #    #       port: 5432
+      #    #       role: "primary"
+      #    #     - host: "postgres"
+      #    #       port: 5432
+      #    #       role: "replica"
+      #    #   database: "postgres"
+
+tool:
+  # kind: 'SubChart' or 'HelmChart', if subchart then uncomment Chart.yaml dependency, else comment and use tool library with helm chart template
+  kind: 'SubChart'
+  repo: https://improwised.github.io/charts/
+  chart: pgcat
+  version: 0.1.0
+  values: *pgcat_config

tool/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

tool/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: tool
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: library
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+# appVersion: "1.16.0"

tool/templates/_helm-chart-config.yaml

@@ -0,0 +1,13 @@
+{{- define "tool.helm-chart-config.tpl" -}}
+{{- $name := .Release.Name -}}
+{{ with ( .Values.values ) }}
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: {{ $name }}
+  namespace: tools
+spec:
+  valuesContent: |-
+    {{- toYaml . | nindent 4 }} 
+{{- end -}}
+{{- end -}}

tool/templates/_helm-chart.yaml

@@ -0,0 +1,14 @@
+{{- define "tool.helm-chart.tpl" -}}
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: {{ .Release.Name }}
+  namespace: tools
+spec:
+  repo: {{ .Values.repo  }}
+  chart: {{ .Values.chart }}
+  {{ with .Values.version -}}
+  version: {{ . }}
+  {{ end -}}
+  targetNamespace: tools
+{{- end -}}

tool/templates/helm-chart-config.yaml

@@ -0,0 +1,3 @@
+# {{- if eq .Values.kind "HelmChart" -}}
+# {{- include "tool.helm-chart-config.tpl" . -}}
+# {{- end -}}

tool/templates/helm-chart.yaml

@@ -0,0 +1,3 @@
+# {{- if eq .Values.kind "HelmChart" -}}
+# {{- include "tool.helm-chart.tpl" . -}}
+# {{- end -}}

tool/values.yaml

@@ -0,0 +1,4 @@
+# kind: HelmChart or SubChart, optionnal. SubChart means another chart is being used instead
+kind: 'SubChart'
+repo: '' # required
+chart: '' # required