Flux - set of continuous and progressive delivery solutions for Kubernetes
Database
Managed solution
Aidbox supports all popular managed Postgresql databases. Supported versions - 13 and higher. See more details in this article — Run Aidbox on managed PostgreSQL.
For a self-managed solution, we recommend use AidboxDB image . This image contains all required extensions, backup tool, and pre-build replication support. Read more information in the documentation — AidboxDB.
First step — create volume
Persistent Volume
apiVersion:v1kind:PersistentVolumeClaimmetadata:name:db-master-datanamespace:prodspec:accessModes: - ReadWriteOnceresources:requests:storage:300Gi# depend on your cloud provider. Use SSD volumesstorageClassName:managed-premium
Next - create all required configs, like postgresql.conf, required container parameters and credentials.
For backups and WAL archivation we are recommended cloud-native solution WAL-G. You can find full information about configuration and usage on documentation page.
Configure storage access — WAL-G can store backups in S3, Google Cloud Storage, Azure, or a local file system.
Recommended backup policy — Full backup every week, incremental backup every day.
Alternative solutions
A set of tools to perform HA PostgreSQL with fail and switchover, automated backups.
Patroni — A Template for PostgreSQL HA with ZooKeeper, ETCD or Consul.
Postgres operator — The Postgres Operator delivers an easy to run HA PostgreSQL clusters on Kubernetes.
Create ConfigMap with all required config and database connection
Aidbox ConfigMap
apiVersion:v1kind:ConfigMapmetadata:name:aidboxnamespace:proddata:AIDBOX_BASE_URL:https://my.box.urlAIDBOX_BOX_ID:aidboxAIDBOX_FHIR_VERSION:4.0.1AIDBOX_PORT:'8080'AIDBOX_STDOUT_PRETTY:allBOX_INSTANCE_NAME:aidboxBOX_METRICS_PORT:'8765'PGDATABASE:aidboxPGHOST:db.prod.svc.cluster.local# database addressPGPORT:'5432'# database port
Aidbox Secret
apiVersion:v1kind:Secretmetadata:name:aidboxnamespace:proddata:AIDBOX_ADMIN_ID:<admin_login>AIDBOX_ADMIN_PASSWORD:<admin_password>AIDBOX_CLIENT_ID:<root_client_id>AIDBOX_CLIENT_SECRET:<root_client_password>AIDBOX_LICENSE:<JWT-LICENSE># JWT license from aidbox user portalPGPASSWORD:<db_password># database passwordPGUSER:<db_user># database username
To provide a secure HTTPS connection you can use paid SSL certificates, issued for your domain, or use LetsEncrypt-issued certificates. In case of using LetsEcrypt, we recommend install and configure Cert Manager Operator
Install Cert Manager
helmrepoaddjetstackhttps://charts.jetstack.iohelmrepoupdatehelminstall \cert-managerjetstack/cert-manager \--namespacecert-manager \--create-namespace \--versionv1.10.0 \ # Or latest available version--setinstallCRDs=true
Configure Cluster Issuer:
apiVersion:cert-manager.io/v1kind:ClusterIssuermetadata:name:letsencryptspec:acme:email:hello@my-domain.compreferredChain:''privateKeySecretRef:name:issuer-keyserver:https://acme-v02.api.letsencrypt.org/directorysolvers: - http01:ingress:class:nginx# Ingress class name
If you use Multibox image and want to use cert manger — you should configure DNS01 authorization to provide wildcard certificates
pg_exporter — Prometheus exporter for PostgreSQL server metrics
Alerting
Alerting rules allow you to define alert conditions based on Prometheus expression language expressions and to send notifications about firing alerts to an external service.
Alert rules
Alert for long-running HTTP queries with P99 > 5s in 5m interval