K8TRE base infrastructure - Database

[vvcb]

Several core applications including Keycloak and JupyterHub require a database (typically PostgreSQL) either as a mandatory requirement or as a preference (eg. jupyterhub normally uses sqlite but recommends PostgreSQL).

K8TRE should standardise how such databases are deployed and managed on cluster. Alternatively, the host organisation may choose to deploy these databases off cluster (eg. Azure managed PostgreSQL, etc.) and configure the applications accordingly.

CloudNativePG allows declarative setup and management of PostgreSQL databases on k8s and plays nicely with ArgoCD as well.

There may be other options that we can discuss here.

[gsvarovsky]

K8TRE should standardise how such databases are deployed and managed on cluster.

I suggest (also as a general rule) we be very light-touch in this, e.g.

• Databases should be attached resources, explicitly referenced (e.g. no implicit names/usernames)
• Generic good database security practice should apply (e.g. no default passwords; q: do we link out to something or inline it?)
• ?? Additional security measures mandatory/optional for a TRE (beyond what is specified elsewhere, e.g. network) ??

[manics]

I also think we shouldn't be too proscriptive about how Databases are deployed. Spinning up a single new database is easy, but maintaining a long-running production database is much harder and ideally involves an database admin, which means K8TRE should integrate with an organisation's existing databases where appropriate.

K8TRE will define how applications interact with or are deployed in a K8TRE compliant TRE, but we could have specialisations of this for some application types like databases?

[vvcb]

Agree. I am only referring to in-cluster databases that we will need as part of the default deployment. This will be postgres. But, of course, organisations are free to swap this out with whatever they want.

If we don't have a mechanism for doing this in-cluster, we are adding additional dependencies which we won't have control over during initial deployment.

Or we end up with a bunch of application-specific database installations that have been deployed through different Helm charts and it becomes a maintenance nightmare.

[gsvarovsky]

My interpretation:

1. The K8TRE implementation includes a default Postgres DB, for the general use of apps.
2. The K8TRE specification nicely asks K8TRE-compliant apps to allow the use of the default DB.

To me, the latter boils down, again, to requiring apps to treat the database as an attached resource (not e.g. hard-wired in their charts).

[manics]

Separate to this it sounds like there's a higher level principle around how apps should decouple themselves from other resources, not just databases