45 lines
1.8 KiB
YAML
45 lines
1.8 KiB
YAML
---
|
|
# Deploy Supabase on OpenShift (SNO) via the supabase-community Helm chart.
|
|
#
|
|
# Chart: https://github.com/supabase-community/supabase-kubernetes
|
|
#
|
|
# Prerequisites:
|
|
# - cert-manager installed (deploy_openshift.yml --tags sno_deploy_certmanager)
|
|
# - NFS StorageClass available (deploy_openshift.yml --tags sno_deploy_nfs)
|
|
# - supabase-deployer ServiceAccount provisioned and token saved to 1Password:
|
|
# ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
|
|
# - vault_supabase_deployer_token set in host_vars (see hashivault_secrets.yml)
|
|
#
|
|
# All Supabase secrets (JWT, DB password, etc.) are auto-generated on first run
|
|
# and stored in Vault at supabase_vault_path. No manual secret setup required.
|
|
#
|
|
# Usage:
|
|
# ansible-navigator run playbooks/deploy_supabase.yml --mode stdout
|
|
# ansible-navigator run playbooks/deploy_supabase.yml --mode stdout -e supabase_chart_version=0.0.9
|
|
# ansible-navigator run playbooks/deploy_supabase.yml --mode stdout -e supabase_db_storage_size=20Gi
|
|
|
|
- name: Deploy Supabase on OpenShift
|
|
hosts: sno.openshift.toal.ca
|
|
gather_facts: false
|
|
connection: local
|
|
|
|
environment:
|
|
K8S_AUTH_HOST: "{{ supabase_k8s_api_url }}"
|
|
K8S_AUTH_API_KEY: "{{ vault_supabase_deployer_token }}"
|
|
K8S_AUTH_VERIFY_SSL: "false"
|
|
|
|
pre_tasks:
|
|
- name: Verify supabase-deployer token is available
|
|
ansible.builtin.assert:
|
|
that:
|
|
- vault_supabase_deployer_token is defined
|
|
- vault_supabase_deployer_token | length > 0
|
|
fail_msg: >-
|
|
vault_supabase_deployer_token is not set.
|
|
Provision the ServiceAccount with:
|
|
ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
|
|
Then save the displayed token to 1Password and reference it as vault_supabase_deployer_token.
|
|
|
|
roles:
|
|
- role: supabase
|