[PM-18448] self-host: support other external database providers

charts/self-host/README.md

@@ -49,6 +49,7 @@ Edit the `my-values.yaml` file and fill out the values. Required values that mus
 - general.emal.smtpPort
 - general.email.smtpSsl
 - sharedStorageClassName
+- databaseProvider ("sqlserver" by default, alternative values require existing external server of that provider)
 - database.enabled (set to disbled if using an external SQL server)
 
 Note that default values for Nginx have been setup for the ingress in the values.yaml file. Some other ingress controller examples are provided later in this document.
@@ -75,10 +76,12 @@ Create a secret to set the following values.
 - globalSettings__hibpApiKey
 - SA_PASSWORD (if using the Bitwarden SQL pod)
 - globalSettings__sqlServer__connectionString (if using your own SQL server)
+- globalSettings__mysql__connectionString (if using an external MySQL/MariaDB server)
+- globalSettings__postgreSql__connectionString (if using an external PostgreSQL server)
 
 Here we document the process of creating the secret using the command line. However, you can also use a CSI secret provider class, which we document an example of under "Installing the Azure Key Vault CSI Driver" later in this README.
 
-Examples of kubectl secret creation are provided below. One is for use with SQL deployed in a pod. The other is for usage with an external SQL server.
+Examples of kubectl secret creation are provided below. One is for use with SQL deployed in a pod. The others are for usage with an external database server.
 
 - With included SQL pod
 
@@ -108,6 +111,34 @@ Examples of kubectl secret creation are provided below. One is for use with SQL
       --from-literal=globalSettings__hibpApiKey="REPLACE" \
   ```
 
+- With external MySQL/MariaDB server
+
+  ```shell
+  kubectl create secret generic custom-secret -n bitwarden\
+      --from-literal=globalSettings__installation__id="REPLACE" \
+      --from-literal=globalSettings__installation__key="REPLACE" \
+      --from-literal=globalSettings__mail__smtp__username="REPLACE" \
+      --from-literal=globalSettings__mail__smtp__password="REPLACE" \
+      --from-literal=globalSettings__mysql__connectionString="server=<SERVERNAME>;port=3306;database=<DATABASE>;user=<USER>;password=<PASSWORD>" \
+      --from-literal=globalSettings__yubico__clientId="REPLACE" \
+      --from-literal=globalSettings__yubico__key="REPLACE" \
+      --from-literal=globalSettings__hibpApiKey="REPLACE" \
+  ```
+
+- With external PostgreSQL server
+
+  ```shell
+  kubectl create secret generic custom-secret -n bitwarden\
+      --from-literal=globalSettings__installation__id="REPLACE" \
+      --from-literal=globalSettings__installation__key="REPLACE" \
+      --from-literal=globalSettings__mail__smtp__username="REPLACE" \
+      --from-literal=globalSettings__mail__smtp__password="REPLACE" \
+      --from-literal=globalSettings__postgreSql__connectionString="Host=<SERVERNAME>;Port=5432;Database=<DATABASE>;Username=<USER>;Password=<PASSWORD>" \
+      --from-literal=globalSettings__yubico__clientId="REPLACE" \
+      --from-literal=globalSettings__yubico__key="REPLACE" \
+      --from-literal=globalSettings__hibpApiKey="REPLACE" \
+  ```
+
 __*NOTE: These commands are recorded in your shell history. To avoid this, consider setting up a CSI secret provider class.*__
 
 Set `secrets.secretName` to the name of the secret created above.

charts/self-host/templates/admin.yaml

@@ -53,10 +53,12 @@ spec:
               name: {{ .Values.secrets.secretName | quote }}
           - secretRef:
               name: {{ template "bitwarden.keyssecret" . }}
+          {{- if eq "sqlserver" (default "sqlserver" .Values.databaseProvider) }}
           {{- if .Values.database.enabled }}
           - secretRef:
               name: {{ .Release.Name }}-sql-connection-string
           {{- end }}
+          {{- end }}
         env:
           - name: ASPNETCORE_URLS
             value: http://+:5000

charts/self-host/templates/api.yaml

@@ -53,10 +53,12 @@ spec:
               name: {{ .Values.secrets.secretName | quote }}
           - secretRef:
               name: {{ template "bitwarden.keyssecret" . }}
+          {{- if eq "sqlserver" (default "sqlserver" .Values.databaseProvider) }}
           {{- if .Values.database.enabled }}
           - secretRef:
               name: {{ .Release.Name }}-sql-connection-string
           {{- end }}
+          {{- end }}
         env:
           - name: ASPNETCORE_URLS
             value: http://+:5000

charts/self-host/templates/attachments.yaml

@@ -39,10 +39,12 @@ spec:
               name: {{ .Values.secrets.secretName | quote }}
           - secretRef:
               name: {{ template "bitwarden.keyssecret" . }}
+          {{- if eq "sqlserver" (default "sqlserver" .Values.databaseProvider) }}
           {{- if .Values.database.enabled }}
           - secretRef:
               name: {{ .Release.Name }}-sql-connection-string
           {{- end }}
+          {{- end }}
         env:
           - name: ASPNETCORE_URLS
             value: http://+:5000

charts/self-host/templates/events.yaml

@@ -53,10 +53,12 @@ spec:
               name: {{ .Values.secrets.secretName | quote }}
           - secretRef:
               name: {{ template "bitwarden.keyssecret" . }}
+          {{- if eq "sqlserver" (default "sqlserver" .Values.databaseProvider) }}
           {{- if .Values.database.enabled }}
           - secretRef:
               name: {{ .Release.Name }}-sql-connection-string
           {{- end }}
+          {{- end }}
         env:
           - name: ASPNETCORE_URLS
             value: http://+:5000

charts/self-host/templates/helpers.tpl

@@ -72,7 +72,6 @@ Generate basic labels
 "helm.sh/hook-weight": "0"
 {{- end -}}
 
-
 {{/*
 Name of Web components
 */}}
@@ -175,7 +174,6 @@ Name of Logs volume
 {{ template "bitwarden.fullname" . }}-applogs
 {{- end -}}
 
-
 {{/*
 Name of MSSQL Backups volume
 */}}

charts/self-host/templates/icons.yaml

@@ -53,10 +53,12 @@ spec:
               name: "{{ .Values.secrets.secretName }}"
           - secretRef:
               name: {{ template "bitwarden.keyssecret" . }}
+          {{- if eq "sqlserver" (default "sqlserver" .Values.databaseProvider) }}
           {{- if .Values.database.enabled }}
           - secretRef:
               name: {{ .Release.Name }}-sql-connection-string
           {{- end }}
+          {{- end }}
         env:
           - name: ASPNETCORE_URLS
             value: http://+:5000

charts/self-host/templates/identity.yaml

@@ -53,10 +53,12 @@ spec:
               name: {{ .Values.secrets.secretName | quote }}
           - secretRef:
               name: {{ template "bitwarden.keyssecret" . }}
+          {{- if eq "sqlserver" (default "sqlserver" .Values.databaseProvider) }}
           {{- if .Values.database.enabled }}
           - secretRef:
               name: {{ .Release.Name }}-sql-connection-string
           {{- end }}
+          {{- end }}
           - secretRef:
               name: {{ .Release.Name }}-identity-cert-password
         env:

charts/self-host/templates/mssql.yaml

@@ -1,3 +1,4 @@
+{{- if eq "sqlserver" (default "sqlserver" .Values.databaseProvider) }}
 {{- if .Values.database.enabled }}
 ---
 apiVersion: apps/v1
@@ -129,3 +130,4 @@ spec:
   selector:
     app: {{ template "bitwarden.mssql" . }}
 {{- end }}
+{{- end }}

charts/self-host/templates/notifications.yaml

@@ -53,10 +53,12 @@ spec:
               name: {{ .Values.secrets.secretName | quote }}
           - secretRef:
               name: {{ template "bitwarden.keyssecret" . }}
+          {{- if eq "sqlserver" (default "sqlserver" .Values.databaseProvider) }}
           {{- if .Values.database.enabled }}
           - secretRef:
               name: {{ .Release.Name }}-sql-connection-string
           {{- end }}
+          {{- end }}
         env:
           - name: ASPNETCORE_URLS
             value: http://+:5000

charts/self-host/templates/post-delete-hook.yaml

@@ -27,9 +27,11 @@ spec:
         args: ['
           kubectl delete configmap {{ .Release.Name }}-config-map -n {{ .Release.Namespace }};
           kubectl delete configmap {{ .Release.Name }}-config-map-web -n {{ .Release.Namespace }};
+          {{- if eq "sqlserver" (default "sqlserver" .Values.databaseProvider) }}
           {{- if .Values.database.enabled }}
           kubectl delete secret "{{ .Release.Name }}-sql-connection-string" -n {{ .Release.Namespace }};
           {{- end }}
+          {{- end }}
           kubectl delete secret {{ .Release.Name }}-identity-cert -n {{ .Release.Namespace }};
           kubectl delete secret {{ .Release.Name }}-identity-cert-password  -n {{ .Release.Namespace }};
           kubectl delete job {{ .Release.Name }}-setup;

charts/self-host/templates/post-install-db-migrator-job.yaml

@@ -1,3 +1,4 @@
+{{- if eq "sqlserver" (default "sqlserver" .Values.databaseProvider) }}
 ---
 apiVersion: batch/v1
 kind: Job
@@ -88,3 +89,4 @@ spec:
             volumeAttributes:
               secretProviderClass: {{ .Values.secrets.secretProviderClass }}
         {{- end }}
+{{- end }}

charts/self-host/templates/pre-install-db-migrator-job.yaml

@@ -1,3 +1,4 @@
+{{- if eq "sqlserver" (default "sqlserver" .Values.databaseProvider) }}
 ---
 apiVersion: batch/v1
 kind: Job
@@ -52,3 +53,4 @@ spec:
             volumeAttributes:
               secretProviderClass: {{ .Values.secrets.secretProviderClass }}
         {{- end }}
+{{- end }}

charts/self-host/templates/pre-install-hook-configmap.yaml

@@ -12,6 +12,7 @@ data:
   MSSQL_PID: "Express"
   ASPNETCORE_ENVIRONMENT: "Production"
   globalSettings__selfHosted: "true"
+  globalSettings__databaseProvider: "{{ .Values.databaseProvider }}"
   globalSettings__baseServiceUri__vault: "https://{{ .Values.general.domain }}"
   globalSettings__baseServiceUri__api: "https://{{ .Values.general.domain }}/api"
   globalSettings__baseServiceUri__identity: "https://{{ .Values.general.domain }}/identity"

charts/self-host/templates/pre-install-secret-sql.yaml

@@ -1,3 +1,4 @@
+{{- if eq "sqlserver" (default "sqlserver" .Values.databaseProvider) }}
 {{- if .Values.database.enabled }}
 {{- $dbServiceName := include "bitwarden.mssql" . }}
 
@@ -59,3 +60,4 @@ spec:
               secretProviderClass: {{ .Values.secrets.secretProviderClass }}
         {{- end }}
 {{- end }}
+{{- end }}

charts/self-host/templates/scim.yaml

@@ -54,10 +54,12 @@ spec:
               name: {{ .Values.secrets.secretName | quote }}
           - secretRef:
               name: {{ template "bitwarden.keyssecret" . }}
+          {{- if eq "sqlserver" (default "sqlserver" .Values.databaseProvider) }}
           {{- if .Values.database.enabled }}
           - secretRef:
               name: {{ .Release.Name }}-sql-connection-string
           {{- end }}
+          {{- end }}
         env:
           - name: ASPNETCORE_URLS
             value: http://+:5000

charts/self-host/templates/sso.yaml

@@ -55,10 +55,12 @@ spec:
               name: {{ template "bitwarden.keyssecret" . }}
           - secretRef:
               name: {{ .Release.Name }}-identity-cert-password
+          {{- if eq "sqlserver" (default "sqlserver" .Values.databaseProvider) }}
           {{- if .Values.database.enabled }}
           - secretRef:
               name: {{ .Release.Name }}-sql-connection-string
           {{- end }}
+          {{- end }}
         env:
           - name: ASPNETCORE_URLS
             value: http://+:5000

charts/self-host/templates/volumes.yaml

@@ -121,6 +121,7 @@ spec:
 #################
 # MSSQL Volumes #
 #################
+{{- if eq "sqlserver" (default "sqlserver" .Values.databaseProvider) }}
 {{- if .Values.database.enabled }}
 
 {{- if not .Values.database.volume.log.existingClaim }}
@@ -214,3 +215,4 @@ spec:
 {{- end }}
 
 {{- end }}
+{{- end }}

charts/self-host/templates/web.yaml

@@ -39,10 +39,12 @@ spec:
               name: {{ .Values.secrets.secretName | quote }}
           - secretRef:
               name: {{ template "bitwarden.keyssecret" . }}
+          {{- if eq "sqlserver" (default "sqlserver" .Values.databaseProvider) }}
           {{- if .Values.database.enabled }}
           - secretRef:
               name: {{ .Release.Name }}-sql-connection-string
           {{- end }}
+          {{- end }}
         env:
           - name: ASPNETCORE_URLS
             value: http://+:5000

charts/self-host/values.yaml

@@ -372,10 +372,18 @@ serviceAccount:
   deployRolesOnly: false
 
 #
-# Configure database
+# Select database provider
+#
+# Available providers are sqlserver, postgresql, mysql/mariadb
+# Using sqlserver offers providing a mssql pod integrated with this chart, see option "database.enabled"
+# Otherwise the connection string needs to be provided through one of the configuration providers
+databaseProvider: "sqlserver"
+
+#
+# Configure MSSQL database
 #
 database:
-  # deploy the database pod?  if false, a connection string to a SQL Server will need to be provided through one of the configuration providers.
+  # deploy the MSSQL database pod? if false, a connection string to a SQL Server will need to be provided through one of the configuration providers.
   enabled: true
   # Labels to add to the MSSQL deployment
   labels: {}