@bluedynamics/cdk8s-plone 0.1.43 → 0.1.44

package/examples/blicca/main.ts

@@ -5,7 +5,7 @@ import * as kplus from 'cdk8s-plus-30';
 import * as path from 'path';
 import { IngressChart } from './ingress';
 import { config } from 'dotenv';
-import { PGBitnamiChart } from './postgres.bitnami';
+import { PGPlainChart } from './postgres.plain';
 import { PGCloudNativePGChart } from './postgres.cloudnativepg';
 
 
@@ -17,10 +17,10 @@ export class BliccaChart extends Chart {
 
     // ================================================================================================================
     // Postgresql
-    let db: PGBitnamiChart | PGCloudNativePGChart;
+    let db: PGPlainChart | PGCloudNativePGChart;
     let postgresql_username;
     let postgresql_password;
-    if ((process.env.DATABASE ?? 'bitnami') == 'cloudnativepg') {
+    if ((process.env.DATABASE ?? 'plain') == 'cloudnativepg') {
       const cloudnativepgDb = new PGCloudNativePGChart(this, 'db');
       db = cloudnativepgDb;
       // CloudNativePG creates secrets with format: {cluster-name}-app
@@ -29,10 +29,11 @@ export class BliccaChart extends Chart {
       postgresql_username = { valueFrom: { secretKeyRef: { name: secretName, key: 'username' }}};
       postgresql_password = { valueFrom: { secretKeyRef: { name: secretName, key: 'password' }}};
     } else {
-      const bitnamiDb = new PGBitnamiChart(this, 'db');
-      db = bitnamiDb;
-      postgresql_username = { value: 'plone' };
-      postgresql_password = { valueFrom: { secretKeyRef: { name: `${bitnamiDb.dbServiceName}`, key: 'password' }}};
+      // Operator-free single-instance PostgreSQL using the official image.
+      const plainDb = new PGPlainChart(this, 'db');
+      db = plainDb;
+      postgresql_username = { valueFrom: { secretKeyRef: { name: plainDb.secretName, key: 'username' }}};
+      postgresql_password = { valueFrom: { secretKeyRef: { name: plainDb.secretName, key: 'password' }}};
     }
 
     // ================================================================================================================

package/examples/blicca/postgres.plain.ts

@@ -0,0 +1,115 @@
+import { Construct } from 'constructs';
+import * as k8s from './imports/k8s';
+
+/**
+ * Operator-free PostgreSQL for the example.
+ *
+ * Deploys a single-instance PostgreSQL StatefulSet using the official
+ * `postgres` Docker image. No operator and no third-party Helm chart are
+ * required, which keeps the dependency surface minimal. It is intended for
+ * development and small production setups; for high availability, point-in-time
+ * recovery, and automated failover use the CloudNativePG variant instead.
+ */
+export class PGPlainChart extends Construct {
+    public readonly dbServiceName: string;
+    public readonly secretName: string;
+
+    constructor(scope: Construct, id: string) {
+        super(scope, id);
+
+        const dbname = 'plone';
+        const dbuser = 'plone';
+        const dbpass = 'admin@plone';
+
+        const labels = {
+            'app.kubernetes.io/name': 'plone-postgresql',
+            'app.kubernetes.io/instance': 'postgresql',
+            'app.kubernetes.io/component': 'database',
+            'app.kubernetes.io/part-of': 'plone',
+        };
+
+        const secret = new k8s.KubeSecret(this, 'secret', {
+            metadata: { labels },
+            stringData: { username: dbuser, password: dbpass, database: dbname },
+        });
+        this.secretName = secret.name;
+
+        const service = new k8s.KubeService(this, 'service', {
+            metadata: { labels },
+            spec: {
+                selector: labels,
+                ports: [
+                    { port: 5432, targetPort: k8s.IntOrString.fromNumber(5432), name: 'postgresql' },
+                ],
+            },
+        });
+        this.dbServiceName = service.name;
+
+        new k8s.KubeStatefulSet(this, 'db', {
+            metadata: { labels },
+            spec: {
+                serviceName: service.name,
+                replicas: 1,
+                selector: { matchLabels: labels },
+                template: {
+                    metadata: { labels },
+                    spec: {
+                        // The official postgres image runs as uid/gid 999.
+                        // fsGroup makes the mounted volume group-writable for it.
+                        securityContext: { fsGroup: 999 },
+                        containers: [
+                            {
+                                name: 'postgresql',
+                                image: 'postgres:18',
+                                ports: [{ containerPort: 5432, name: 'postgresql' }],
+                                env: [
+                                    { name: 'POSTGRES_USER', valueFrom: { secretKeyRef: { name: secret.name, key: 'username' } } },
+                                    { name: 'POSTGRES_PASSWORD', valueFrom: { secretKeyRef: { name: secret.name, key: 'password' } } },
+                                    { name: 'POSTGRES_DB', valueFrom: { secretKeyRef: { name: secret.name, key: 'database' } } },
+                                    // Keep PGDATA in a subdirectory so the volume root can hold lost+found.
+                                    { name: 'PGDATA', value: '/var/lib/postgresql/data/pgdata' },
+                                ],
+                                volumeMounts: [
+                                    { name: 'data', mountPath: '/var/lib/postgresql/data' },
+                                ],
+                                readinessProbe: {
+                                    exec: { command: ['pg_isready', '-U', dbuser, '-d', dbname] },
+                                    initialDelaySeconds: 10,
+                                    periodSeconds: 10,
+                                    timeoutSeconds: 5,
+                                },
+                                livenessProbe: {
+                                    exec: { command: ['pg_isready', '-U', dbuser, '-d', dbname] },
+                                    initialDelaySeconds: 30,
+                                    periodSeconds: 15,
+                                    timeoutSeconds: 5,
+                                },
+                                resources: {
+                                    requests: {
+                                        cpu: k8s.Quantity.fromString('100m'),
+                                        memory: k8s.Quantity.fromString('256Mi'),
+                                    },
+                                    limits: {
+                                        cpu: k8s.Quantity.fromString('1'),
+                                        memory: k8s.Quantity.fromString('1Gi'),
+                                    },
+                                },
+                            },
+                        ],
+                    },
+                },
+                volumeClaimTemplates: [
+                    {
+                        metadata: { name: 'data', labels },
+                        spec: {
+                            accessModes: ['ReadWriteOnce'],
+                            resources: {
+                                requests: { storage: k8s.Quantity.fromString('10Gi') },
+                            },
+                        },
+                    },
+                ],
+            },
+        });
+    }
+}

package/examples/blicca/tsconfig.json

@@ -0,0 +1,33 @@
+{
+  "compilerOptions": {
+    "alwaysStrict": true,
+    "declaration": true,
+    "experimentalDecorators": true,
+    "inlineSourceMap": true,
+    "inlineSources": true,
+    "lib": [
+      "ES2020"
+    ],
+    "module": "CommonJS",
+    "noEmit": false,
+    "noEmitOnError": true,
+    "noFallthroughCasesInSwitch": true,
+    "noImplicitAny": true,
+    "noImplicitReturns": true,
+    "noImplicitThis": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "resolveJsonModule": true,
+    "strict": true,
+    "strictNullChecks": true,
+    "strictPropertyInitialization": true,
+    "stripInternal": true,
+    "target": "ES2020"
+  },
+  "include": [
+    "**/*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}

package/examples/{production-volto → volto}/.env.example

@@ -16,5 +16,6 @@ CLUSTER_ISSUER=letsencrypt-prod
 #PLONE_BACKEND_IMAGE=plone/plone-backend:6.1.3
 
 # Configure database backend
-# Options: 'bitnami' (default, simple) or 'cloudnativepg' (production-ready)
-DATABASE=cloudnativepg
+# Options: 'plain' (default, operator-free single instance) or
+#          'cloudnativepg' (production HA, requires the CloudNativePG operator)
+DATABASE=plain

package/examples/{production-volto → volto}/README.md

@@ -1,4 +1,4 @@
-# Production Volto Example
+# Volto Example
 
 This example demonstrates a **production-ready Plone deployment** using the [@bluedynamics/cdk8s-plone](https://www.npmjs.com/package/@bluedynamics/cdk8s-plone) TypeScript package.
 
@@ -8,8 +8,8 @@ This example includes:
 
 - **Plone 6.1 with Volto** (React frontend + REST API backend)
 - **PostgreSQL with RelStorage** - Choose between:
+  - Plain single-instance PostgreSQL using the official `postgres` image (default, operator-free, for dev and small setups)
   - [CloudNativePG](https://cloudnative-pg.io/) (CNCF project, production-ready with HA)
-  - [Bitnami PostgreSQL](https://github.com/bitnami/charts/tree/main/bitnami/postgresql) Helm chart (simple, for dev/testing)
 - **HTTP Caching with Varnish** - Using [kube-httpcache](https://github.com/mittwald/kube-httpcache)
 - **Ingress** - Supports both Traefik and Kong with TLS/cert-manager
 - **Three access domains**:
@@ -35,13 +35,12 @@ npm install
 
 Your cluster needs:
 
-1. **PostgreSQL Operator** (choose one):
-   - **CloudNativePG** (recommended for production):
+1. **PostgreSQL** (choose one):
+   - **Plain** (default, no operator needed): the example deploys a single-instance PostgreSQL StatefulSet using the official `postgres` image, so there is nothing to install.
+   - **CloudNativePG** (recommended for production HA): install the operator
      ```bash
      kubectl apply -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.24/releases/cnpg-1.24.0.yaml
      ```
-   - **Bitnami** (no operator needed, uses Helm):
-     - Requires namespace `plone` to exist: `kubectl create namespace plone`
 
 2. **Ingress Controller** (choose one):
    - Traefik v3 with CRDs installed
@@ -89,8 +88,8 @@ CLUSTER_ISSUER=letsencrypt-prod
 PLONE_BACKEND_IMAGE=plone/plone-backend:6.1.3
 PLONE_FRONTEND_IMAGE=plone/plone-frontend:latest
 
-# Database backend: 'bitnami' (default) or 'cloudnativepg'
-DATABASE=cloudnativepg
+# Database backend: 'plain' (default) or 'cloudnativepg'
+DATABASE=plain
 ```
 
 ### 3. Generate Kubernetes Manifests
@@ -133,24 +132,24 @@ DATABASE=cloudnativepg
 - `username` - Database user
 - `password` - Database password
 
-### Bitnami PostgreSQL (Development/Testing)
+### Plain PostgreSQL (default, operator-free)
 
 **Pros:**
-- No operator required
-- Simple setup
-- Good for development and testing
-- Helm-based deployment
+- No operator and no third-party Helm chart required
+- Uses the official `postgres` image, which is actively maintained
+- Single-instance StatefulSet with a PersistentVolumeClaim
+- Good for development and small production setups
 
 **Cons:**
-- Requires namespace `plone` to be pre-created
-- No built-in HA features
-- Less suitable for production
+- No built-in high availability, failover, or automated backups
 
 **Configuration:**
 ```bash
-DATABASE=bitnami
+DATABASE=plain
 ```
 
+**Secrets:** the example creates a Secret with `username`, `password`, and `database` keys.
+
 ## Architecture
 
 ```
@@ -266,13 +265,11 @@ kubectl get cluster plone-postgresql
 kubectl get secret plone-postgresql-app -o yaml
 ```
 
-**Bitnami:**
+**Plain PostgreSQL:**
 ```bash
-# Check service
-kubectl get svc -l app.kubernetes.io/part-of=plone
-
-# Check secret
-kubectl get secret <service-name> -o yaml
+# Check the StatefulSet and pod
+kubectl get statefulset -l app.kubernetes.io/name=plone-postgresql
+kubectl get pods -l app.kubernetes.io/name=plone-postgresql
 ```
 
 ### Access Logs