Datarocks/ open source

Provisioners

Declarative, idempotent bootstrapping for the services your stack depends on. One small Go binary per service — describe what should exist, run it as an init container, and your app starts against a ready environment.

How they work

  1. Describe

    Declare the resources that should exist in a YAML file. Secrets come in through ${VAR} expansion.

    config.yaml

  2. Provision

    Run the provisioner as an init container or Kubernetes Job. It waits for the service, then creates or updates.

    docker compose up

  3. Start

    Your application starts once provisioning has completed — against an environment that is guaranteed to be ready.

    service_completed_successfully

The tools

keycloak-provisioner

v1.13.0

Idempotently provisions Keycloak realms, clients, roles, users and groups from a YAML file. Built to run as a Docker Compose init container.

  • realms
  • clients
  • protocol mappers
  • roles
  • users
  • groups
ghcr.io/datarocks-ag/keycloak-provisioner
Details →GitHub ↗

postgres-provisioner

v2.0.0

Everything a PostgreSQL database needs before your app connects — down to privileges, migrations and publications.

  • roles
  • databases
  • schemas
  • privileges
  • extensions
  • migrations
  • publications
ghcr.io/datarocks-ag/postgres-provisioner
Details →GitHub ↗

nats-provisioner

v1.1.0

JetStream streams and consumers, with warnings when immutable fields drift.

  • streams
  • consumers
ghcr.io/datarocks-ag/nats-provisioner
Details →GitHub ↗

redpanda-provisioner

v2.0.0

Topics, Schema Registry and access control for Redpanda and Kafka. Never deletes, never shrinks partitions.

  • topics
  • schemas
  • SASL users
  • ACLs
ghcr.io/datarocks-ag/redpanda-provisioner
Details →GitHub ↗

gcp-emulator-provisioner

v2.0.1

Pub/Sub and Cloud Storage state for local GCP emulators — and the same config runs against real Google Cloud.

  • Pub/Sub topics
  • subscriptions
  • Cloud Storage buckets
ghcr.io/datarocks-ag/gcp-emulator-provisioner
Details →GitHub ↗

seaweedfs-provisioner

v1.0.0

S3 buckets, identities and policies for SeaweedFS. Policies applied only when they drift; never deletes.

  • S3 buckets
  • IAM identities
  • bucket policies
  • lifecycle rules
ghcr.io/datarocks-ag/seaweedfs-provisioner
Details →GitHub ↗

Shared conventions

ConventionKeycloakPostgreSQLNATSRedpandaGCP emulatorsSeaweedFS
Idempotent YAML config✓✓✓✓✓✓
${VAR} environment expansion✓✓✓✓✓✓
update / create strategy✓✓✓✓✓✓
Retry with exponential backoff✓✓✓✓✓✓
Structured logs✓✓✓✓✓✓
--dry-run✓✓——✓✓

Use them together

[HOW TO USE THE PROVISIONERS TOGETHER]

docker-compose.yaml
services:
  postgres-provisioner:
    image: ghcr.io/datarocks-ag/postgres-provisioner:2.0.0
    depends_on: [postgres]
    environment:
      POSTGRES_HOST: postgres
      PGHELPER_CONFIG_PATH: /config.yaml
    volumes: ["./provision/postgres.yaml:/config.yaml:ro"]

  keycloak-provisioner:
    image: ghcr.io/datarocks-ag/keycloak-provisioner:1.13.0
    depends_on: [keycloak]
    environment:
      KEYCLOAK_URL: http://keycloak:8080
      KEYCLOAK_CONFIG_PATH: /config.yaml
    volumes: ["./provision/keycloak.yaml:/config.yaml:ro"]

  app:
    depends_on:
      postgres-provisioner:
        condition: service_completed_successfully
      keycloak-provisioner:
        condition: service_completed_successfully

Step-by-step:Run provisioners in a Compose stack →· All guides

Data Rocks AG

[ONE OR TWO LINES ON WHAT DATA ROCKS DOES AND FOR WHOM]

Visit datarocks.ch →