stackrox · c-du · Mar 24, 2022 · Mar 22, 2022 · Mar 22, 2022 · Mar 22, 2022
diff --git a/deploy/common/deploy.sh b/deploy/common/deploy.sh
@@ -13,6 +13,12 @@ echo "StackRox image tag set to $MAIN_IMAGE_TAG"
 export MAIN_IMAGE="${MAIN_IMAGE_REPO}:${MAIN_IMAGE_TAG}"
 echo "StackRox image set to $MAIN_IMAGE"
 
+export CENTRAL_DB_IMAGE_REPO="${CENTRAL_DB_IMAGE_REPO:-stackrox/central-db}"
+echo "CENTRAL_DB_IMAGE_REPO set to $CENTRAL_DB_IMAGE_REPO"
+
+export CENTRAL_DB_IMAGE="${CENTRAL_DB_IMAGE:-${CENTRAL_DB_IMAGE_REPO}:${MAIN_IMAGE_TAG}}"
+echo "StackRox central db image set to $CENTRAL_DB_IMAGE"
+
 export ROXCTL_IMAGE_REPO="${ROXCTL_IMAGE_REPO:-stackrox/roxctl}"
 echo "ROXCTL_IMAGE_REPO set to $ROXCTL_IMAGE_REPO"
 

diff --git a/deploy/common/k8sbased.sh b/deploy/common/k8sbased.sh
@@ -158,6 +158,10 @@ function launch_central {
 
     add_args -i "${MAIN_IMAGE}"
 
+    if [[ "${ROX_POSTGRES_DATASTORE}" == "true" && -n "${CENTRAL_DB_IMAGE}" ]]; then
+        add_args "--central-db-image=${CENTRAL_DB_IMAGE}"
+    fi
+
     pkill -f kubectl'.*port-forward.*' || true    # terminate stale port forwarding from earlier runs
     pkill -9 -f kubectl'.*port-forward.*' || true
     command -v oc && pkill -f oc'.*port-forward.*' || true    # terminate stale port forwarding from earlier runs

@@ -41,6 +41,11 @@ central:
     name: null # string
     tag: null # string
     fullRef: null # string
+  dbImage:
+    registry: null # string
+    name: null # string
+    tag: null # string
+    fullRef: null # string
   adminPassword:
     value: null # string
     generate: null # bool

@@ -20,6 +20,12 @@ defaults:
     image:
       name: [< required "" .ImageRemote >]
       tag: [< required "" .ImageTag >]
+    [<- if .FeatureFlags.ROX_POSTGRES_DATASTORE >]
+    dbImage:
+      name: [< required "" .CentralDBImageRemote >]
+      tag: [< required "" .CentralDBImageTag >]
+
+    [<- end >]
 
     resources:
       requests:

@@ -62,7 +62,7 @@ spec:
       storage: {{ include "srox.formatStorageSize" $pvcCfg.size }}
 {{ if ._rox.central.enableCentralDB -}}
 ---
-{{- /* TODO(ROX-9249): Configure PVC for both Central and Central DB */}}
+{{- /* TODO(ROX-9807): Move customized PVC from Central to Central DB */}}
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:

@@ -30,7 +30,7 @@ spec:
       serviceAccountName: central-db
       initContainers:
       - name: init-db
-        image: {{ ._rox.central.image.fullRef | replace "main" "central-db" | quote }}
+        image: {{ ._rox.central.dbImage.fullRef | quote }}
         env:
         - name: PGDATA
           value: "/var/lib/postgresql/data/pgdata"
@@ -52,8 +52,7 @@ spec:
           runAsGroup: 70
       containers:
       - name: central-db
-        {{- /* TODO(ROX-9249): Need to provide Central DB configuration. Use the same image registry and tag for Central DB image for now. */}}
-        image: {{ ._rox.central.image.fullRef | replace "main" "central-db" | quote }}
+        image: {{ ._rox.central.dbImage.fullRef | quote }}
         env:
         - name: POSTGRES_HOST_AUTH_METHOD
           value: "password"

@@ -11,6 +11,7 @@
 
 {{/* Image settings */}}
 {{ include "srox.configureImage" (list $ $centralCfg.image) }}
+{{ include "srox.configureImage" (list $ $centralCfg.dbImage) }}
 
 {{/* Admin password */}}
 {{ include "srox.configurePassword" (list $ "central.adminPassword" "admin") }}

@@ -12,6 +12,8 @@ type MetaValues struct {
 	Versions                         version.Versions
 	MainRegistry                     string
 	ImageRemote                      string
+	CentralDBImageTag                string
+	CentralDBImageRemote             string
 	CollectorRegistry                string
 	CollectorFullImageRemote         string
 	CollectorSlimImageRemote         string
@@ -60,6 +62,8 @@ func GetMetaValuesForFlavor(imageFlavor defaults.ImageFlavor) *MetaValues {
 		MainRegistry:             imageFlavor.MainRegistry,
 		ImageRemote:              imageFlavor.MainImageName,
 		ImageTag:                 imageFlavor.MainImageTag,
+		CentralDBImageTag:        imageFlavor.CentralDBImageTag,
+		CentralDBImageRemote:     imageFlavor.CentralDBImageName,
 		CollectorRegistry:        imageFlavor.CollectorRegistry,
 		CollectorFullImageRemote: imageFlavor.CollectorImageName,
 		CollectorSlimImageRemote: imageFlavor.CollectorSlimImageName,

@@ -20,6 +20,8 @@ func customFlavor(t *testing.T) defaults.ImageFlavor {
 		MainRegistry:           "example.io",
 		MainImageName:          "custom-main",
 		MainImageTag:           "1.2.3",
+		CentralDBImageName:     "custom-central-db",
+		CentralDBImageTag:      "1.2.4",
 		ScannerImageName:       "custom-scanner",
 		ScannerSlimImageName:   "scanner-slim",
 		ScannerImageTag:        "3.2.1",

@@ -67,9 +67,11 @@ type ImagePullSecrets struct {
 // ImageFlavor represents default settings for pulling images.
 type ImageFlavor struct {
 	// MainRegistry is a registry for all images except of collector.
-	MainRegistry  string
-	MainImageName string
-	MainImageTag  string
+	MainRegistry       string
+	MainImageName      string
+	MainImageTag       string
+	CentralDBImageTag  string
+	CentralDBImageName string
 
 	// CollectorRegistry may be different from MainRegistry in case of stackrox.io.
 	CollectorRegistry      string
@@ -95,9 +97,11 @@ type ImageFlavor struct {
 func DevelopmentBuildImageFlavor() ImageFlavor {
 	v := version.GetAllVersionsDevelopment()
 	return ImageFlavor{
-		MainRegistry:  "docker.io/stackrox",
-		MainImageName: "main",
-		MainImageTag:  v.MainVersion,
+		MainRegistry:       "docker.io/stackrox",
+		MainImageName:      "main",
+		MainImageTag:       v.MainVersion,
+		CentralDBImageTag:  v.MainVersion,
+		CentralDBImageName: "central-db",
 
 		CollectorRegistry:      "docker.io/stackrox",
 		CollectorImageName:     "collector",
@@ -125,9 +129,11 @@ func DevelopmentBuildImageFlavor() ImageFlavor {
 func StackRoxIOReleaseImageFlavor() ImageFlavor {
 	v := version.GetAllVersionsUnified()
 	return ImageFlavor{
-		MainRegistry:  "stackrox.io",
-		MainImageName: "main",
-		MainImageTag:  v.MainVersion,
+		MainRegistry:       "stackrox.io",
+		MainImageName:      "main",
+		MainImageTag:       v.MainVersion,
+		CentralDBImageTag:  v.MainVersion,
+		CentralDBImageName: "central-db",
 
 		CollectorRegistry:      "collector.stackrox.io",
 		CollectorImageName:     "collector",
@@ -155,9 +161,13 @@ func StackRoxIOReleaseImageFlavor() ImageFlavor {
 func RHACSReleaseImageFlavor() ImageFlavor {
 	v := version.GetAllVersionsUnified()
 	return ImageFlavor{
-		MainRegistry:           "registry.redhat.io/advanced-cluster-security",
-		MainImageName:          "rhacs-main-rhel8",
-		MainImageTag:           v.MainVersion,
+		MainRegistry:  "registry.redhat.io/advanced-cluster-security",
+		MainImageName: "rhacs-main-rhel8",
+		MainImageTag:  v.MainVersion,
+		/* TODO(ROX-9858): Create repo rhacs-central-db-rhel8 when starting building rhacs */
+		CentralDBImageTag:  v.MainVersion,
+		CentralDBImageName: "rhacs-central-db-rhel8",
+
 		CollectorRegistry:      "registry.redhat.io/advanced-cluster-security",
 		CollectorImageName:     "rhacs-collector-rhel8",
 		CollectorImageTag:      v.CollectorVersion,
@@ -264,6 +274,11 @@ func (f *ImageFlavor) MainImageNoTag() string {
 	return fmt.Sprintf("%s/%s", f.MainRegistry, f.MainImageName)
 }
 
+// CentralDBImage is the container image reference (full name) for the central-db image.
+func (f *ImageFlavor) CentralDBImage() string {
+	return fmt.Sprintf("%s/%s:%s", f.MainRegistry, f.CentralDBImageName, f.CentralDBImageTag)
+}
+
 // CollectorFullImage is the container image reference (full name) for the "collector" image
 func (f *ImageFlavor) CollectorFullImage() string {
 	return fmt.Sprintf("%s/%s:%s", f.CollectorRegistry, f.CollectorImageName, f.CollectorImageTag)

@@ -17,6 +17,8 @@ func MakeImageFlavorForTest(t *testing.T) defaults.ImageFlavor {
 		MainRegistry:           "test.registry",
 		MainImageName:          "main",
 		MainImageTag:           "1.2.3",
+		CentralDBImageTag:      "1.2.4",
+		CentralDBImageName:     "central-db",
 		CollectorRegistry:      "test.registry",
 		CollectorImageName:     "collector",
 		CollectorImageTag:      "3.2.1-latest",

diff --git a/pkg/renderer/helm_values.go b/pkg/renderer/helm_values.go
@@ -69,7 +69,22 @@ central:
     tag: {{ .K8sConfig.ImageOverrides.Main.Tag }}
     {{- end }}
   {{- end }}
-
+  {{- if .K8sConfig.ImageOverrides.CentralDB }}
+  dbImage:
+    {{- if .K8sConfig.ImageOverrides.CentralDB.Registry }}
+    registry: {{ .K8sConfig.ImageOverrides.CentralDB.Registry }}
+    {{- end }}
+    {{- if .K8sConfig.ImageOverrides.CentralDB.Name }}
+    name: {{ .K8sConfig.ImageOverrides.CentralDB.Name }}
+    {{- end }}
+    {{- if .K8sConfig.ImageOverrides.CentralDB.Tag }}
+    # WARNING: You are using a non-default Central DB image tag. Upgrades via
+    # 'helm upgrade' will not work as expected. To ensure a smooth upgrade experience,
+    # make sure StackRox images are mirrored with the same tags as in the stackrox.io
+    # registry.
+    tag: {{ .K8sConfig.ImageOverrides.CentralDB.Tag }}
+    {{- end }}
+  {{- end }}
   persistence:
     {{- if .HostPath }}
     hostPath: {{ .HostPath.HostPath }}

diff --git a/pkg/renderer/images.go b/pkg/renderer/images.go
@@ -3,6 +3,7 @@ package renderer
 import (
 	"strings"
 
+	"github.com/stackrox/rox/pkg/features"
 	"github.com/stackrox/rox/pkg/images/defaults"
 	"github.com/stackrox/rox/pkg/stringutils"
 )
@@ -86,7 +87,10 @@ func configureImageOverrides(c *Config, imageFlavor defaults.ImageFlavor) {
 		delete(mainOverrides, "Registry")
 	}
 	imageOverrides["Main"] = mainOverrides
-
+	if features.PostgresDatastore.Enabled() {
+		imageOverrides["CentralDB"] = ComputeImageOverrides(c.K8sConfig.CentralDBImage, registry, imageFlavor.CentralDBImageName,
+			imageFlavor.CentralDBImageTag)
+	}
 	imageOverrides["Scanner"] = ComputeImageOverrides(c.K8sConfig.ScannerImage, registry, imageFlavor.ScannerImageName,
 		imageFlavor.ScannerImageTag)
 	imageOverrides["ScannerDB"] = ComputeImageOverrides(c.K8sConfig.ScannerDBImage, registry, imageFlavor.ScannerDBImageName,

diff --git a/pkg/renderer/kubernetes.go b/pkg/renderer/kubernetes.go
@@ -41,6 +41,9 @@ func postProcessConfig(c *Config, mode mode, imageFlavor defaults.ImageFlavor) e
 	if c.K8sConfig.MainImage == "" {
 		c.K8sConfig.MainImage = imageFlavor.MainImage()
 	}
+	if c.K8sConfig.CentralDBImage == "" {
+		c.K8sConfig.CentralDBImage = imageFlavor.CentralDBImage()
+	}
 	if c.K8sConfig.ScannerImage == "" {
 		c.K8sConfig.ScannerImage = imageFlavor.ScannerImage()
 	}

diff --git a/pkg/renderer/templater.go b/pkg/renderer/templater.go
@@ -48,6 +48,7 @@ func (h *HostPathPersistence) WithNodeSelector() bool {
 // at the top level
 type CommonConfig struct {
 	MainImage      string
+	CentralDBImage string
 	ScannerImage   string
 	ScannerDBImage string
 }

@@ -317,7 +317,7 @@ func processFlagWraps(argSlice *argSlice, fws []flagWrap) {
 		}
 
 		// set default values for image-{main,scanner,scanner-db} flags
-		if fw.Flag.Name == flags.FlagNameMainImage || fw.Flag.Name == flags.FlagNameScannerImage || fw.Flag.Name == flags.FlagNameScannerDBImage {
+		if fw.Flag.Name == flags.FlagNameMainImage || fw.Flag.Name == flags.FlagNameScannerImage || fw.Flag.Name == flags.FlagNameScannerDBImage || fw.Flag.Name == flags.FlagNameCentralDBImage {
 			imgDefArg := argSlice.findArgByName(flags.FlagNameImageDefaults)
 			if imgDefArg == nil {
 				panic(fmt.Sprintf("unable to find flag '%s'", flags.FlagNameImageDefaults))
@@ -339,6 +339,10 @@ func processFlagWraps(argSlice *argSlice, fws []flagWrap) {
 				if fw.Flag.DefValue == "" {
 					fw.Flag.DefValue = flavor.ScannerDBImage()
 				}
+			case flags.FlagNameCentralDBImage:
+				if fw.Flag.DefValue == "" {
+					fw.Flag.DefValue = flavor.CentralDBImage()
+				}
 			}
 		}
 

@@ -89,7 +89,9 @@ func k8sBasedOrchestrator(cliEnvironment environment.Environment, k8sConfig *ren
 	defaultImageHelp := fmt.Sprintf("(if unset, a default will be used according to --%s)", flags.ImageDefaultsFlagName)
 	flagWrap.StringVarP(&k8sConfig.MainImage, flags.FlagNameMainImage, "i", "", "main image to use"+defaultImageHelp, "central")
 	flagWrap.BoolVar(&k8sConfig.OfflineMode, "offline", false, "whether to run StackRox in offline mode, which avoids reaching out to the Internet", "central")
-
+	if features.PostgresDatastore.Enabled() {
+		flagWrap.StringVar(&k8sConfig.CentralDBImage, flags.FlagNameCentralDBImage, "", "central-db image to use"+defaultImageHelp, "central")
+	}
 	flagWrap.StringVar(&k8sConfig.ScannerImage, flags.FlagNameScannerImage, "", "scanner image to use"+defaultImageHelp, "scanner")
 	flagWrap.StringVar(&k8sConfig.ScannerDBImage, flags.FlagNameScannerDBImage, "", "scanner-db image to use"+defaultImageHelp, "scanner")
 

@@ -14,6 +14,8 @@ const (
 	FlagNameImageDefaults = "image-defaults"
 	// FlagNameMainImage is a shared constant for --main-image command line flag.
 	FlagNameMainImage = "main-image"
+	// FlagNameCentralDBImage is a shared constant for --central-db-image command line flag.
+	FlagNameCentralDBImage = "central-db-image"
 	// FlagNameScannerImage is a shared constant for --scanner-image command line flag.
 	FlagNameScannerImage = "scanner-image"
 	// FlagNameScannerDBImage is a shared constant for --scanner-db-image command line flag.

@@ -272,6 +272,10 @@ func derivePublicLocalValuesForCentralServices(ctx context.Context, namespace st
 				"registry": extractImageRegistry(k8s.evaluateToString(ctx, "deployment", "central",
 					`{.spec.template.spec.containers[?(@.name == "central")].image}`, ""), "main"),
 			},
+			"dbImage": map[string]interface{}{
+				"registry": extractImageRegistry(k8s.evaluateToString(ctx, "deployment", "central-db",
+					`{.spec.template.spec.containers[?(@.name == "central-db")].image}`, ""), "central-db"),
+			},
 			"resources": k8s.evaluateToObject(ctx, "deployment", "central",
 				`{.spec.template.spec.containers[?(@.name == "central")].resources}`, nil),
 			"persistence": map[string]interface{}{

@@ -181,6 +181,9 @@ assert_components_registry() {
       main)
         assert_registry_version_file "${dir}/01-central-13-deployment.yaml" 0 "central" "$regex"
         ;;
+      central-db)
+        assert_registry_version_file "${dir}/01-central-12-central-db.yaml" 0 "central-db" "$regex"
+        ;;
       scanner)
         assert_registry_version_file "${dir}/02-scanner-06-deployment.yaml" 0 "scanner" "$regex"
         ;;
@@ -211,6 +214,13 @@ assert_file_exist() {
   fi
 }
 
+assert_file_not_exist() {
+  local -r file="$1"
+  if [[ -e "$file" ]]; then
+    fail "ERROR: file '$file' exists"
+  fi
+}
+
 image_reference_regex() {
   local registry_slug="$1"
   local component="$2"
@@ -264,6 +274,11 @@ run_image_defaults_registry_test() {
   assert_success
   assert_components_registry "$out_dir/central" "$expected_main_registry" "$any_version" 'main'
   assert_components_registry "$out_dir/scanner" "$expected_scanner_registry" "$any_version" 'scanner' 'scanner-db'
+  if [[ "$ROX_POSTGRES_DATASTORE" =~ "true" ]]; then
+    assert_components_registry "$out_dir/central" "$expected_main_registry" "$any_version" 'central-db'
+  else
+    assert_file_not_exist "$out_dir/central/01-central-12-central-db.yaml"
+  fi
 }
 
 # run_no_rhacs_flag_test asserts that 'roxctl central generate' fails when presented with `--rhacs` parameter