postgresql: Deploy Postgres Operator
While I was preparing to deploy PostgreSQL for Firefly III, I was thinking it would be a neat idea to write an operator that uses custom resources to manage PostgreSQL roles and databases. Then I though, surely something like that must exist already. As it turns out, the [Postgres Operator][0] does exactly that, and a whole lot more. The *Postgres Operator* handles deploying PostgreSQL server instances, including primary/standby replication with load balancers. It uses custom resources to manage the databases and users (roles) in an instance, and stores role passwords in Secret resources. It supports backing up instances using `pg_basebackup` and WAL archives (i.e. physical backups) via [WAL-E][1]/[WAL-G][2]. While various backup storage targets are supported, *Postgres Operator* really only works well with the cloud storage services like S3, Azure, and Google Cloud Platform. Fortunately, S3-compatible on-premises solutions like MinIO are just fine. I think for my use cases, a single PostgreSQL cluster with multiple databases will be sufficient. I know *Firefly III* will need a PostgreSQL database, and I will likely want to migrate *Paperless-ngx* to PostgreSQL eventually too. Having a single instance will save on memory resources, at the cost of per-application point-in-time recovery. For now, just one server in the cluster is probably sufficient, but luckily adding standby servers appears to be really easy should the need arise. [0]: https://postgres-operator.readthedocs.io/en/latest/ [1]: https://github.com/wal-e/wal-e [2]: https://github.com/wal-g/wal-gdch-webhooks-secrets
parent
d8aadb01af
commit
ffffe9d3c8
|
|
@ -0,0 +1 @@
|
||||||
|
pod.secrets
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: postgres-operator
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- port: 8080
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: 8080
|
||||||
|
selector:
|
||||||
|
name: postgres-operator
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
apiVersion: acid.zalan.do/v1
|
||||||
|
kind: postgresql
|
||||||
|
metadata:
|
||||||
|
name: default
|
||||||
|
namespace: postgresql
|
||||||
|
spec:
|
||||||
|
teamId: acid
|
||||||
|
volume:
|
||||||
|
size: 10Gi
|
||||||
|
numberOfInstances: 1
|
||||||
|
postgresql:
|
||||||
|
version: '15'
|
||||||
|
users:
|
||||||
|
dustin:
|
||||||
|
- superuser
|
||||||
|
- createdb
|
||||||
|
databases:
|
||||||
|
dustin: dustin
|
||||||
|
|
@ -0,0 +1,33 @@
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
|
||||||
|
namespace: postgresql
|
||||||
|
|
||||||
|
resources:
|
||||||
|
- namespace.yaml
|
||||||
|
- operatorconfiguration.crd.yaml
|
||||||
|
- postgresteam.crd.yaml
|
||||||
|
- postgresql-operator-configuration.yaml
|
||||||
|
- operator-service-account-rbac.yaml
|
||||||
|
- postgres-operator.yaml
|
||||||
|
- api-service.yaml
|
||||||
|
- default-cluster.yaml
|
||||||
|
|
||||||
|
secretGenerator:
|
||||||
|
- name: ssh-auth
|
||||||
|
files:
|
||||||
|
- ssh-backup.key
|
||||||
|
options:
|
||||||
|
disableNameSuffixHash: true
|
||||||
|
- name: pod-secrets
|
||||||
|
envs:
|
||||||
|
- pod.secrets
|
||||||
|
options:
|
||||||
|
disableNameSuffixHash: true
|
||||||
|
|
||||||
|
configMapGenerator:
|
||||||
|
- name: pod-env
|
||||||
|
envs:
|
||||||
|
- pod.env
|
||||||
|
options:
|
||||||
|
disableNameSuffixHash: true
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: postgresql
|
||||||
|
|
@ -0,0 +1,290 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: postgres-operator
|
||||||
|
namespace: default
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: postgres-operator
|
||||||
|
rules:
|
||||||
|
# all verbs allowed for custom operator resources
|
||||||
|
- apiGroups:
|
||||||
|
- acid.zalan.do
|
||||||
|
resources:
|
||||||
|
- postgresqls
|
||||||
|
- postgresqls/status
|
||||||
|
- operatorconfigurations
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- deletecollection
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
# operator only reads PostgresTeams
|
||||||
|
- apiGroups:
|
||||||
|
- acid.zalan.do
|
||||||
|
resources:
|
||||||
|
- postgresteams
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
# all verbs allowed for event streams (Zalando-internal feature)
|
||||||
|
# - apiGroups:
|
||||||
|
# - zalando.org
|
||||||
|
# resources:
|
||||||
|
# - fabriceventstreams
|
||||||
|
# verbs:
|
||||||
|
# - create
|
||||||
|
# - delete
|
||||||
|
# - deletecollection
|
||||||
|
# - get
|
||||||
|
# - list
|
||||||
|
# - patch
|
||||||
|
# - update
|
||||||
|
# - watch
|
||||||
|
# to create or get/update CRDs when starting up
|
||||||
|
- apiGroups:
|
||||||
|
- apiextensions.k8s.io
|
||||||
|
resources:
|
||||||
|
- customresourcedefinitions
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
# to read configuration from ConfigMaps
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
# to send events to the CRs
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
# to manage endpoints which are also used by Patroni
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- endpoints
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- deletecollection
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
# to CRUD secrets for database access
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- update
|
||||||
|
# to check nodes for node readiness label
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- nodes
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
# to read or delete existing PVCs. Creation via StatefulSet
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- persistentvolumeclaims
|
||||||
|
verbs:
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
# to read existing PVs. Creation should be done via dynamic provisioning
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- persistentvolumes
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- update # only for resizing AWS volumes
|
||||||
|
# to watch Spilo pods and do rolling updates. Creation via StatefulSet
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- pods
|
||||||
|
verbs:
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
# to resize the filesystem in Spilo pods when increasing volume size
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- pods/exec
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
# to CRUD services to point to Postgres cluster instances
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- services
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
# to CRUD the StatefulSet which controls the Postgres cluster instances
|
||||||
|
- apiGroups:
|
||||||
|
- apps
|
||||||
|
resources:
|
||||||
|
- statefulsets
|
||||||
|
- deployments
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
# to CRUD cron jobs for logical backups
|
||||||
|
- apiGroups:
|
||||||
|
- batch
|
||||||
|
resources:
|
||||||
|
- cronjobs
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
# to get namespaces operator resources can run in
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- namespaces
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
# to define PDBs. Update happens via delete/create
|
||||||
|
- apiGroups:
|
||||||
|
- policy
|
||||||
|
resources:
|
||||||
|
- poddisruptionbudgets
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
# to create ServiceAccounts in each namespace the operator watches
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- serviceaccounts
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- create
|
||||||
|
# to create role bindings to the postgres-pod service account
|
||||||
|
- apiGroups:
|
||||||
|
- rbac.authorization.k8s.io
|
||||||
|
resources:
|
||||||
|
- rolebindings
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- create
|
||||||
|
# to grant privilege to run privileged pods (not needed by default)
|
||||||
|
#- apiGroups:
|
||||||
|
# - extensions
|
||||||
|
# resources:
|
||||||
|
# - podsecuritypolicies
|
||||||
|
# resourceNames:
|
||||||
|
# - privileged
|
||||||
|
# verbs:
|
||||||
|
# - use
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: postgres-operator
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: postgres-operator
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: postgres-operator
|
||||||
|
namespace: default
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: postgres-pod
|
||||||
|
rules:
|
||||||
|
# Patroni needs to watch and manage endpoints
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- endpoints
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- deletecollection
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
# Patroni needs to watch pods
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- pods
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
# to let Patroni create a headless service
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- services
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
# to grant privilege to run privileged pods (not needed by default)
|
||||||
|
#- apiGroups:
|
||||||
|
# - extensions
|
||||||
|
# resources:
|
||||||
|
# - podsecuritypolicies
|
||||||
|
# resourceNames:
|
||||||
|
# - privileged
|
||||||
|
# verbs:
|
||||||
|
# - use
|
||||||
|
|
@ -0,0 +1,677 @@
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
name: operatorconfigurations.acid.zalan.do
|
||||||
|
spec:
|
||||||
|
group: acid.zalan.do
|
||||||
|
names:
|
||||||
|
kind: OperatorConfiguration
|
||||||
|
listKind: OperatorConfigurationList
|
||||||
|
plural: operatorconfigurations
|
||||||
|
singular: operatorconfiguration
|
||||||
|
shortNames:
|
||||||
|
- opconfig
|
||||||
|
categories:
|
||||||
|
- all
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- name: v1
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
|
additionalPrinterColumns:
|
||||||
|
- name: Image
|
||||||
|
type: string
|
||||||
|
description: Spilo image to be used for Pods
|
||||||
|
jsonPath: .configuration.docker_image
|
||||||
|
- name: Cluster-Label
|
||||||
|
type: string
|
||||||
|
description: Label for K8s resources created by operator
|
||||||
|
jsonPath: .configuration.kubernetes.cluster_name_label
|
||||||
|
- name: Service-Account
|
||||||
|
type: string
|
||||||
|
description: Name of service account to be used
|
||||||
|
jsonPath: .configuration.kubernetes.pod_service_account_name
|
||||||
|
- name: Min-Instances
|
||||||
|
type: integer
|
||||||
|
description: Minimum number of instances per Postgres cluster
|
||||||
|
jsonPath: .configuration.min_instances
|
||||||
|
- name: Age
|
||||||
|
type: date
|
||||||
|
jsonPath: .metadata.creationTimestamp
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- kind
|
||||||
|
- apiVersion
|
||||||
|
- configuration
|
||||||
|
properties:
|
||||||
|
kind:
|
||||||
|
type: string
|
||||||
|
enum:
|
||||||
|
- OperatorConfiguration
|
||||||
|
apiVersion:
|
||||||
|
type: string
|
||||||
|
enum:
|
||||||
|
- acid.zalan.do/v1
|
||||||
|
configuration:
|
||||||
|
type: object
|
||||||
|
properties:
|
||||||
|
crd_categories:
|
||||||
|
type: array
|
||||||
|
nullable: true
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
docker_image:
|
||||||
|
type: string
|
||||||
|
default: "ghcr.io/zalando/spilo-15:3.0-p1"
|
||||||
|
enable_crd_registration:
|
||||||
|
type: boolean
|
||||||
|
default: true
|
||||||
|
enable_crd_validation:
|
||||||
|
type: boolean
|
||||||
|
description: deprecated
|
||||||
|
default: true
|
||||||
|
enable_lazy_spilo_upgrade:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
enable_pgversion_env_var:
|
||||||
|
type: boolean
|
||||||
|
default: true
|
||||||
|
enable_shm_volume:
|
||||||
|
type: boolean
|
||||||
|
default: true
|
||||||
|
enable_spilo_wal_path_compat:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
enable_team_id_clustername_prefix:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
etcd_host:
|
||||||
|
type: string
|
||||||
|
default: ""
|
||||||
|
ignore_instance_limits_annotation_key:
|
||||||
|
type: string
|
||||||
|
kubernetes_use_configmaps:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
max_instances:
|
||||||
|
type: integer
|
||||||
|
description: "-1 = disabled"
|
||||||
|
minimum: -1
|
||||||
|
default: -1
|
||||||
|
min_instances:
|
||||||
|
type: integer
|
||||||
|
description: "-1 = disabled"
|
||||||
|
minimum: -1
|
||||||
|
default: -1
|
||||||
|
resync_period:
|
||||||
|
type: string
|
||||||
|
default: "30m"
|
||||||
|
repair_period:
|
||||||
|
type: string
|
||||||
|
default: "5m"
|
||||||
|
set_memory_request_to_limit:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
sidecar_docker_images:
|
||||||
|
type: object
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
sidecars:
|
||||||
|
type: array
|
||||||
|
nullable: true
|
||||||
|
items:
|
||||||
|
type: object
|
||||||
|
x-kubernetes-preserve-unknown-fields: true
|
||||||
|
workers:
|
||||||
|
type: integer
|
||||||
|
minimum: 1
|
||||||
|
default: 8
|
||||||
|
users:
|
||||||
|
type: object
|
||||||
|
properties:
|
||||||
|
additional_owner_roles:
|
||||||
|
type: array
|
||||||
|
nullable: true
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
enable_password_rotation:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
password_rotation_interval:
|
||||||
|
type: integer
|
||||||
|
default: 90
|
||||||
|
password_rotation_user_retention:
|
||||||
|
type: integer
|
||||||
|
default: 180
|
||||||
|
replication_username:
|
||||||
|
type: string
|
||||||
|
default: standby
|
||||||
|
super_username:
|
||||||
|
type: string
|
||||||
|
default: postgres
|
||||||
|
major_version_upgrade:
|
||||||
|
type: object
|
||||||
|
properties:
|
||||||
|
major_version_upgrade_mode:
|
||||||
|
type: string
|
||||||
|
default: "off"
|
||||||
|
major_version_upgrade_team_allow_list:
|
||||||
|
type: array
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
minimal_major_version:
|
||||||
|
type: string
|
||||||
|
default: "11"
|
||||||
|
target_major_version:
|
||||||
|
type: string
|
||||||
|
default: "15"
|
||||||
|
kubernetes:
|
||||||
|
type: object
|
||||||
|
properties:
|
||||||
|
additional_pod_capabilities:
|
||||||
|
type: array
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
cluster_domain:
|
||||||
|
type: string
|
||||||
|
default: "cluster.local"
|
||||||
|
cluster_labels:
|
||||||
|
type: object
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
default:
|
||||||
|
application: spilo
|
||||||
|
cluster_name_label:
|
||||||
|
type: string
|
||||||
|
default: "cluster-name"
|
||||||
|
custom_pod_annotations:
|
||||||
|
type: object
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
delete_annotation_date_key:
|
||||||
|
type: string
|
||||||
|
delete_annotation_name_key:
|
||||||
|
type: string
|
||||||
|
downscaler_annotations:
|
||||||
|
type: array
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
enable_cross_namespace_secret:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
enable_init_containers:
|
||||||
|
type: boolean
|
||||||
|
default: true
|
||||||
|
enable_pod_antiaffinity:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
enable_pod_disruption_budget:
|
||||||
|
type: boolean
|
||||||
|
default: true
|
||||||
|
enable_readiness_probe:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
enable_sidecars:
|
||||||
|
type: boolean
|
||||||
|
default: true
|
||||||
|
ignored_annotations:
|
||||||
|
type: array
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
infrastructure_roles_secret_name:
|
||||||
|
type: string
|
||||||
|
infrastructure_roles_secrets:
|
||||||
|
type: array
|
||||||
|
nullable: true
|
||||||
|
items:
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- secretname
|
||||||
|
- userkey
|
||||||
|
- passwordkey
|
||||||
|
properties:
|
||||||
|
secretname:
|
||||||
|
type: string
|
||||||
|
userkey:
|
||||||
|
type: string
|
||||||
|
passwordkey:
|
||||||
|
type: string
|
||||||
|
rolekey:
|
||||||
|
type: string
|
||||||
|
defaultuservalue:
|
||||||
|
type: string
|
||||||
|
defaultrolevalue:
|
||||||
|
type: string
|
||||||
|
details:
|
||||||
|
type: string
|
||||||
|
template:
|
||||||
|
type: boolean
|
||||||
|
inherited_annotations:
|
||||||
|
type: array
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
inherited_labels:
|
||||||
|
type: array
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
master_pod_move_timeout:
|
||||||
|
type: string
|
||||||
|
default: "20m"
|
||||||
|
node_readiness_label:
|
||||||
|
type: object
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
node_readiness_label_merge:
|
||||||
|
type: string
|
||||||
|
enum:
|
||||||
|
- "AND"
|
||||||
|
- "OR"
|
||||||
|
oauth_token_secret_name:
|
||||||
|
type: string
|
||||||
|
default: "postgresql-operator"
|
||||||
|
pdb_name_format:
|
||||||
|
type: string
|
||||||
|
default: "postgres-{cluster}-pdb"
|
||||||
|
pod_antiaffinity_preferred_during_scheduling:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
pod_antiaffinity_topology_key:
|
||||||
|
type: string
|
||||||
|
default: "kubernetes.io/hostname"
|
||||||
|
pod_environment_configmap:
|
||||||
|
type: string
|
||||||
|
pod_environment_secret:
|
||||||
|
type: string
|
||||||
|
pod_management_policy:
|
||||||
|
type: string
|
||||||
|
enum:
|
||||||
|
- "ordered_ready"
|
||||||
|
- "parallel"
|
||||||
|
default: "ordered_ready"
|
||||||
|
pod_priority_class_name:
|
||||||
|
type: string
|
||||||
|
pod_role_label:
|
||||||
|
type: string
|
||||||
|
default: "spilo-role"
|
||||||
|
pod_service_account_definition:
|
||||||
|
type: string
|
||||||
|
default: ""
|
||||||
|
pod_service_account_name:
|
||||||
|
type: string
|
||||||
|
default: "postgres-pod"
|
||||||
|
pod_service_account_role_binding_definition:
|
||||||
|
type: string
|
||||||
|
default: ""
|
||||||
|
pod_terminate_grace_period:
|
||||||
|
type: string
|
||||||
|
default: "5m"
|
||||||
|
secret_name_template:
|
||||||
|
type: string
|
||||||
|
default: "{username}.{cluster}.credentials.{tprkind}.{tprgroup}"
|
||||||
|
share_pgsocket_with_sidecars:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
spilo_allow_privilege_escalation:
|
||||||
|
type: boolean
|
||||||
|
default: true
|
||||||
|
spilo_runasuser:
|
||||||
|
type: integer
|
||||||
|
spilo_runasgroup:
|
||||||
|
type: integer
|
||||||
|
spilo_fsgroup:
|
||||||
|
type: integer
|
||||||
|
spilo_privileged:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
storage_resize_mode:
|
||||||
|
type: string
|
||||||
|
enum:
|
||||||
|
- "ebs"
|
||||||
|
- "mixed"
|
||||||
|
- "pvc"
|
||||||
|
- "off"
|
||||||
|
default: "pvc"
|
||||||
|
toleration:
|
||||||
|
type: object
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
watched_namespace:
|
||||||
|
type: string
|
||||||
|
postgres_pod_resources:
|
||||||
|
type: object
|
||||||
|
properties:
|
||||||
|
default_cpu_limit:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+m|\d+(\.\d{1,3})?)$'
|
||||||
|
default: "1"
|
||||||
|
default_cpu_request:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+m|\d+(\.\d{1,3})?)$'
|
||||||
|
default: "100m"
|
||||||
|
default_memory_limit:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$'
|
||||||
|
default: "500Mi"
|
||||||
|
default_memory_request:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$'
|
||||||
|
default: "100Mi"
|
||||||
|
max_cpu_request:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+m|\d+(\.\d{1,3})?)$'
|
||||||
|
max_memory_request:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$'
|
||||||
|
min_cpu_limit:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+m|\d+(\.\d{1,3})?)$'
|
||||||
|
default: "250m"
|
||||||
|
min_memory_limit:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$'
|
||||||
|
default: "250Mi"
|
||||||
|
timeouts:
|
||||||
|
type: object
|
||||||
|
properties:
|
||||||
|
patroni_api_check_interval:
|
||||||
|
type: string
|
||||||
|
default: "1s"
|
||||||
|
patroni_api_check_timeout:
|
||||||
|
type: string
|
||||||
|
default: "5s"
|
||||||
|
pod_label_wait_timeout:
|
||||||
|
type: string
|
||||||
|
default: "10m"
|
||||||
|
pod_deletion_wait_timeout:
|
||||||
|
type: string
|
||||||
|
default: "10m"
|
||||||
|
ready_wait_interval:
|
||||||
|
type: string
|
||||||
|
default: "4s"
|
||||||
|
ready_wait_timeout:
|
||||||
|
type: string
|
||||||
|
default: "30s"
|
||||||
|
resource_check_interval:
|
||||||
|
type: string
|
||||||
|
default: "3s"
|
||||||
|
resource_check_timeout:
|
||||||
|
type: string
|
||||||
|
default: "10m"
|
||||||
|
load_balancer:
|
||||||
|
type: object
|
||||||
|
properties:
|
||||||
|
custom_service_annotations:
|
||||||
|
type: object
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
db_hosted_zone:
|
||||||
|
type: string
|
||||||
|
default: "db.example.com"
|
||||||
|
enable_master_load_balancer:
|
||||||
|
type: boolean
|
||||||
|
default: true
|
||||||
|
enable_master_pooler_load_balancer:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
enable_replica_load_balancer:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
enable_replica_pooler_load_balancer:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
external_traffic_policy:
|
||||||
|
type: string
|
||||||
|
enum:
|
||||||
|
- "Cluster"
|
||||||
|
- "Local"
|
||||||
|
default: "Cluster"
|
||||||
|
master_dns_name_format:
|
||||||
|
type: string
|
||||||
|
default: "{cluster}.{namespace}.{hostedzone}"
|
||||||
|
master_legacy_dns_name_format:
|
||||||
|
type: string
|
||||||
|
default: "{cluster}.{team}.{hostedzone}"
|
||||||
|
replica_dns_name_format:
|
||||||
|
type: string
|
||||||
|
default: "{cluster}-repl.{namespace}.{hostedzone}"
|
||||||
|
replica_legacy_dns_name_format:
|
||||||
|
type: string
|
||||||
|
default: "{cluster}-repl.{team}.{hostedzone}"
|
||||||
|
aws_or_gcp:
|
||||||
|
type: object
|
||||||
|
properties:
|
||||||
|
additional_secret_mount:
|
||||||
|
type: string
|
||||||
|
additional_secret_mount_path:
|
||||||
|
type: string
|
||||||
|
default: "/meta/credentials"
|
||||||
|
aws_region:
|
||||||
|
type: string
|
||||||
|
default: "eu-central-1"
|
||||||
|
enable_ebs_gp3_migration:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
enable_ebs_gp3_migration_max_size:
|
||||||
|
type: integer
|
||||||
|
default: 1000
|
||||||
|
gcp_credentials:
|
||||||
|
type: string
|
||||||
|
kube_iam_role:
|
||||||
|
type: string
|
||||||
|
log_s3_bucket:
|
||||||
|
type: string
|
||||||
|
wal_az_storage_account:
|
||||||
|
type: string
|
||||||
|
wal_gs_bucket:
|
||||||
|
type: string
|
||||||
|
wal_s3_bucket:
|
||||||
|
type: string
|
||||||
|
logical_backup:
|
||||||
|
type: object
|
||||||
|
properties:
|
||||||
|
logical_backup_azure_storage_account_name:
|
||||||
|
type: string
|
||||||
|
logical_backup_azure_storage_container:
|
||||||
|
type: string
|
||||||
|
logical_backup_azure_storage_account_key:
|
||||||
|
type: string
|
||||||
|
logical_backup_cpu_limit:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+m|\d+(\.\d{1,3})?)$'
|
||||||
|
logical_backup_cpu_request:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+m|\d+(\.\d{1,3})?)$'
|
||||||
|
logical_backup_docker_image:
|
||||||
|
type: string
|
||||||
|
default: "registry.opensource.zalan.do/acid/logical-backup:v1.10.0"
|
||||||
|
logical_backup_google_application_credentials:
|
||||||
|
type: string
|
||||||
|
logical_backup_job_prefix:
|
||||||
|
type: string
|
||||||
|
default: "logical-backup-"
|
||||||
|
logical_backup_memory_limit:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$'
|
||||||
|
logical_backup_memory_request:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$'
|
||||||
|
logical_backup_provider:
|
||||||
|
type: string
|
||||||
|
enum:
|
||||||
|
- "az"
|
||||||
|
- "gcs"
|
||||||
|
- "s3"
|
||||||
|
default: "s3"
|
||||||
|
logical_backup_s3_access_key_id:
|
||||||
|
type: string
|
||||||
|
logical_backup_s3_bucket:
|
||||||
|
type: string
|
||||||
|
logical_backup_s3_endpoint:
|
||||||
|
type: string
|
||||||
|
logical_backup_s3_region:
|
||||||
|
type: string
|
||||||
|
logical_backup_s3_secret_access_key:
|
||||||
|
type: string
|
||||||
|
logical_backup_s3_sse:
|
||||||
|
type: string
|
||||||
|
logical_backup_s3_retention_time:
|
||||||
|
type: string
|
||||||
|
logical_backup_schedule:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+|\*)(/\d+)?(\s+(\d+|\*)(/\d+)?){4}$'
|
||||||
|
default: "30 00 * * *"
|
||||||
|
debug:
|
||||||
|
type: object
|
||||||
|
properties:
|
||||||
|
debug_logging:
|
||||||
|
type: boolean
|
||||||
|
default: true
|
||||||
|
enable_database_access:
|
||||||
|
type: boolean
|
||||||
|
default: true
|
||||||
|
teams_api:
|
||||||
|
type: object
|
||||||
|
properties:
|
||||||
|
enable_admin_role_for_users:
|
||||||
|
type: boolean
|
||||||
|
default: true
|
||||||
|
enable_postgres_team_crd:
|
||||||
|
type: boolean
|
||||||
|
default: true
|
||||||
|
enable_postgres_team_crd_superusers:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
enable_team_member_deprecation:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
enable_team_superuser:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
enable_teams_api:
|
||||||
|
type: boolean
|
||||||
|
default: true
|
||||||
|
pam_configuration:
|
||||||
|
type: string
|
||||||
|
default: "https://info.example.com/oauth2/tokeninfo?access_token= uid realm=/employees"
|
||||||
|
pam_role_name:
|
||||||
|
type: string
|
||||||
|
default: "zalandos"
|
||||||
|
postgres_superuser_teams:
|
||||||
|
type: array
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
protected_role_names:
|
||||||
|
type: array
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
default:
|
||||||
|
- admin
|
||||||
|
- cron_admin
|
||||||
|
role_deletion_suffix:
|
||||||
|
type: string
|
||||||
|
default: "_deleted"
|
||||||
|
team_admin_role:
|
||||||
|
type: string
|
||||||
|
default: "admin"
|
||||||
|
team_api_role_configuration:
|
||||||
|
type: object
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
default:
|
||||||
|
log_statement: all
|
||||||
|
teams_api_url:
|
||||||
|
type: string
|
||||||
|
default: "https://teams.example.com/api/"
|
||||||
|
logging_rest_api:
|
||||||
|
type: object
|
||||||
|
properties:
|
||||||
|
api_port:
|
||||||
|
type: integer
|
||||||
|
default: 8080
|
||||||
|
cluster_history_entries:
|
||||||
|
type: integer
|
||||||
|
default: 1000
|
||||||
|
ring_log_lines:
|
||||||
|
type: integer
|
||||||
|
default: 100
|
||||||
|
scalyr: # deprecated
|
||||||
|
type: object
|
||||||
|
properties:
|
||||||
|
scalyr_api_key:
|
||||||
|
type: string
|
||||||
|
scalyr_cpu_limit:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+m|\d+(\.\d{1,3})?)$'
|
||||||
|
default: "1"
|
||||||
|
scalyr_cpu_request:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+m|\d+(\.\d{1,3})?)$'
|
||||||
|
default: "100m"
|
||||||
|
scalyr_image:
|
||||||
|
type: string
|
||||||
|
scalyr_memory_limit:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$'
|
||||||
|
default: "500Mi"
|
||||||
|
scalyr_memory_request:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$'
|
||||||
|
default: "50Mi"
|
||||||
|
scalyr_server_url:
|
||||||
|
type: string
|
||||||
|
default: "https://upload.eu.scalyr.com"
|
||||||
|
connection_pooler:
|
||||||
|
type: object
|
||||||
|
properties:
|
||||||
|
connection_pooler_schema:
|
||||||
|
type: string
|
||||||
|
default: "pooler"
|
||||||
|
connection_pooler_user:
|
||||||
|
type: string
|
||||||
|
default: "pooler"
|
||||||
|
connection_pooler_image:
|
||||||
|
type: string
|
||||||
|
default: "registry.opensource.zalan.do/acid/pgbouncer:master-27"
|
||||||
|
connection_pooler_max_db_connections:
|
||||||
|
type: integer
|
||||||
|
default: 60
|
||||||
|
connection_pooler_mode:
|
||||||
|
type: string
|
||||||
|
enum:
|
||||||
|
- "session"
|
||||||
|
- "transaction"
|
||||||
|
default: "transaction"
|
||||||
|
connection_pooler_number_of_instances:
|
||||||
|
type: integer
|
||||||
|
minimum: 1
|
||||||
|
default: 2
|
||||||
|
connection_pooler_default_cpu_limit:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+m|\d+(\.\d{1,3})?)$'
|
||||||
|
default: "1"
|
||||||
|
connection_pooler_default_cpu_request:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+m|\d+(\.\d{1,3})?)$'
|
||||||
|
default: "500m"
|
||||||
|
connection_pooler_default_memory_limit:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$'
|
||||||
|
default: "100Mi"
|
||||||
|
connection_pooler_default_memory_request:
|
||||||
|
type: string
|
||||||
|
pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$'
|
||||||
|
default: "100Mi"
|
||||||
|
patroni:
|
||||||
|
type: object
|
||||||
|
properties:
|
||||||
|
enable_patroni_failsafe_mode:
|
||||||
|
type: boolean
|
||||||
|
default: false
|
||||||
|
status:
|
||||||
|
type: object
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
WAL_S3_BUCKET=pgbackup
|
||||||
|
AWS_ENDPOINT=https://burp.pyrocufflink.blue:9000
|
||||||
|
|
@ -0,0 +1,45 @@
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: postgres-operator
|
||||||
|
labels:
|
||||||
|
application: postgres-operator
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
strategy:
|
||||||
|
type: "Recreate"
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
name: postgres-operator
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
name: postgres-operator
|
||||||
|
spec:
|
||||||
|
serviceAccountName: postgres-operator
|
||||||
|
containers:
|
||||||
|
- name: postgres-operator
|
||||||
|
image: registry.opensource.zalan.do/acid/postgres-operator:v1.10.0
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 250Mi
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 500Mi
|
||||||
|
securityContext:
|
||||||
|
runAsUser: 1000
|
||||||
|
runAsNonRoot: true
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
env:
|
||||||
|
# provided additional ENV vars can overwrite individual config map entries
|
||||||
|
#- name: CONFIG_MAP_NAME
|
||||||
|
# value: "postgres-operator"
|
||||||
|
# In order to use the CRD OperatorConfiguration instead, uncomment these lines and comment out the two lines above
|
||||||
|
- name: POSTGRES_OPERATOR_CONFIGURATION_OBJECT
|
||||||
|
value: postgresql-operator-configuration
|
||||||
|
# Define an ID to isolate controllers from each other
|
||||||
|
# - name: CONTROLLER_ID
|
||||||
|
# value: "second-operator"
|
||||||
|
|
@ -0,0 +1,213 @@
|
||||||
|
apiVersion: "acid.zalan.do/v1"
|
||||||
|
kind: OperatorConfiguration
|
||||||
|
metadata:
|
||||||
|
name: postgresql-operator-configuration
|
||||||
|
configuration:
|
||||||
|
docker_image: ghcr.io/zalando/spilo-15:3.0-p1
|
||||||
|
# enable_crd_registration: true
|
||||||
|
# crd_categories:
|
||||||
|
# - all
|
||||||
|
# enable_lazy_spilo_upgrade: false
|
||||||
|
enable_pgversion_env_var: true
|
||||||
|
# enable_shm_volume: true
|
||||||
|
enable_spilo_wal_path_compat: false
|
||||||
|
enable_team_id_clustername_prefix: false
|
||||||
|
etcd_host: ""
|
||||||
|
# ignore_instance_limits_annotation_key: ""
|
||||||
|
# kubernetes_use_configmaps: false
|
||||||
|
max_instances: -1
|
||||||
|
min_instances: -1
|
||||||
|
resync_period: 30m
|
||||||
|
repair_period: 5m
|
||||||
|
# set_memory_request_to_limit: false
|
||||||
|
# sidecars:
|
||||||
|
# - image: image:123
|
||||||
|
# name: global-sidecar-1
|
||||||
|
# ports:
|
||||||
|
# - containerPort: 80
|
||||||
|
# protocol: TCP
|
||||||
|
workers: 2
|
||||||
|
users:
|
||||||
|
# additional_owner_roles:
|
||||||
|
# - cron_admin
|
||||||
|
enable_password_rotation: false
|
||||||
|
password_rotation_interval: 90
|
||||||
|
password_rotation_user_retention: 180
|
||||||
|
replication_username: standby
|
||||||
|
super_username: postgres
|
||||||
|
major_version_upgrade:
|
||||||
|
major_version_upgrade_mode: "off"
|
||||||
|
# major_version_upgrade_team_allow_list:
|
||||||
|
# - acid
|
||||||
|
minimal_major_version: "11"
|
||||||
|
target_major_version: "15"
|
||||||
|
kubernetes:
|
||||||
|
# additional_pod_capabilities:
|
||||||
|
# - "SYS_NICE"
|
||||||
|
cluster_domain: cluster.local
|
||||||
|
cluster_labels:
|
||||||
|
application: spilo
|
||||||
|
cluster_name_label: cluster-name
|
||||||
|
# custom_pod_annotations:
|
||||||
|
# keya: valuea
|
||||||
|
# keyb: valueb
|
||||||
|
# delete_annotation_date_key: delete-date
|
||||||
|
# delete_annotation_name_key: delete-clustername
|
||||||
|
# downscaler_annotations:
|
||||||
|
# - deployment-time
|
||||||
|
# - downscaler/*
|
||||||
|
enable_cross_namespace_secret: true
|
||||||
|
enable_init_containers: true
|
||||||
|
enable_pod_antiaffinity: false
|
||||||
|
enable_pod_disruption_budget: true
|
||||||
|
enable_readiness_probe: false
|
||||||
|
enable_sidecars: true
|
||||||
|
# ignored_annotations:
|
||||||
|
# - k8s.v1.cni.cncf.io/network-status
|
||||||
|
# infrastructure_roles_secret_name: "postgresql-infrastructure-roles"
|
||||||
|
# infrastructure_roles_secrets:
|
||||||
|
# - secretname: "monitoring-roles"
|
||||||
|
# userkey: "user"
|
||||||
|
# passwordkey: "password"
|
||||||
|
# rolekey: "inrole"
|
||||||
|
# - secretname: "other-infrastructure-role"
|
||||||
|
# userkey: "other-user-key"
|
||||||
|
# passwordkey: "other-password-key"
|
||||||
|
# inherited_annotations:
|
||||||
|
# - owned-by
|
||||||
|
# inherited_labels:
|
||||||
|
# - application
|
||||||
|
# - environment
|
||||||
|
master_pod_move_timeout: 20m
|
||||||
|
# node_readiness_label:
|
||||||
|
# status: ready
|
||||||
|
# node_readiness_label_merge: "OR"
|
||||||
|
oauth_token_secret_name: postgresql-operator
|
||||||
|
pdb_name_format: "postgres-{cluster}-pdb"
|
||||||
|
pod_antiaffinity_preferred_during_scheduling: false
|
||||||
|
pod_antiaffinity_topology_key: "kubernetes.io/hostname"
|
||||||
|
pod_environment_configmap: postgresql/pod-env
|
||||||
|
pod_environment_secret: pod-secrets
|
||||||
|
pod_management_policy: "ordered_ready"
|
||||||
|
# pod_priority_class_name: "postgres-pod-priority"
|
||||||
|
pod_role_label: spilo-role
|
||||||
|
# pod_service_account_definition: ""
|
||||||
|
pod_service_account_name: postgres-pod
|
||||||
|
# pod_service_account_role_binding_definition: ""
|
||||||
|
pod_terminate_grace_period: 5m
|
||||||
|
secret_name_template: "{username}.{cluster}.credentials.{tprkind}.{tprgroup}"
|
||||||
|
share_pgsocket_with_sidecars: false
|
||||||
|
spilo_allow_privilege_escalation: true
|
||||||
|
# spilo_runasuser: 101
|
||||||
|
# spilo_runasgroup: 103
|
||||||
|
# spilo_fsgroup: 103
|
||||||
|
spilo_privileged: false
|
||||||
|
storage_resize_mode: pvc
|
||||||
|
# toleration:
|
||||||
|
# key: db-only
|
||||||
|
# operator: Exists
|
||||||
|
# effect: NoSchedule
|
||||||
|
# watched_namespace: ""
|
||||||
|
postgres_pod_resources:
|
||||||
|
default_cpu_limit: "1"
|
||||||
|
default_cpu_request: 100m
|
||||||
|
default_memory_limit: 500Mi
|
||||||
|
default_memory_request: 100Mi
|
||||||
|
# max_cpu_request: "1"
|
||||||
|
# max_memory_request: 4Gi
|
||||||
|
# min_cpu_limit: 250m
|
||||||
|
# min_memory_limit: 250Mi
|
||||||
|
timeouts:
|
||||||
|
patroni_api_check_interval: 1s
|
||||||
|
patroni_api_check_timeout: 5s
|
||||||
|
pod_label_wait_timeout: 10m
|
||||||
|
pod_deletion_wait_timeout: 10m
|
||||||
|
ready_wait_interval: 4s
|
||||||
|
ready_wait_timeout: 30s
|
||||||
|
resource_check_interval: 3s
|
||||||
|
resource_check_timeout: 10m
|
||||||
|
load_balancer:
|
||||||
|
# custom_service_annotations:
|
||||||
|
# keyx: valuex
|
||||||
|
# keyy: valuey
|
||||||
|
# db_hosted_zone: ""
|
||||||
|
enable_master_load_balancer: false
|
||||||
|
enable_master_pooler_load_balancer: false
|
||||||
|
enable_replica_load_balancer: false
|
||||||
|
enable_replica_pooler_load_balancer: false
|
||||||
|
external_traffic_policy: "Cluster"
|
||||||
|
master_dns_name_format: "{cluster}.{namespace}.{hostedzone}"
|
||||||
|
# master_legacy_dns_name_format: "{cluster}.{team}.{hostedzone}"
|
||||||
|
replica_dns_name_format: "{cluster}-repl.{namespace}.{hostedzone}"
|
||||||
|
# replica_dns_old_name_format: "{cluster}-repl.{team}.{hostedzone}"
|
||||||
|
aws_or_gcp:
|
||||||
|
additional_secret_mount: ssh-auth
|
||||||
|
additional_secret_mount_path: /run/secrets/ssh-auth
|
||||||
|
aws_region: eu-central-1
|
||||||
|
enable_ebs_gp3_migration: false
|
||||||
|
# enable_ebs_gp3_migration_max_size: 1000
|
||||||
|
# gcp_credentials: ""
|
||||||
|
# kube_iam_role: ""
|
||||||
|
# log_s3_bucket: ""
|
||||||
|
# wal_az_storage_account: ""
|
||||||
|
# wal_gs_bucket: ""
|
||||||
|
# wal_s3_bucket: ""
|
||||||
|
logical_backup:
|
||||||
|
# logical_backup_azure_storage_account_name: ""
|
||||||
|
# logical_backup_azure_storage_container: ""
|
||||||
|
# logical_backup_azure_storage_account_key: ""
|
||||||
|
# logical_backup_cpu_limit: ""
|
||||||
|
# logical_backup_cpu_request: ""
|
||||||
|
# logical_backup_memory_limit: ""
|
||||||
|
# logical_backup_memory_request: ""
|
||||||
|
logical_backup_docker_image: "registry.opensource.zalan.do/acid/logical-backup:v1.10.0"
|
||||||
|
# logical_backup_google_application_credentials: ""
|
||||||
|
logical_backup_job_prefix: "logical-backup-"
|
||||||
|
logical_backup_provider: "s3"
|
||||||
|
# logical_backup_s3_access_key_id: ""
|
||||||
|
logical_backup_s3_bucket: "my-bucket-url"
|
||||||
|
# logical_backup_s3_endpoint: ""
|
||||||
|
# logical_backup_s3_region: ""
|
||||||
|
# logical_backup_s3_secret_access_key: ""
|
||||||
|
logical_backup_s3_sse: "AES256"
|
||||||
|
# logical_backup_s3_retention_time: ""
|
||||||
|
logical_backup_schedule: "30 00 * * *"
|
||||||
|
debug:
|
||||||
|
debug_logging: true
|
||||||
|
enable_database_access: true
|
||||||
|
teams_api:
|
||||||
|
# enable_admin_role_for_users: true
|
||||||
|
# enable_postgres_team_crd: false
|
||||||
|
# enable_postgres_team_crd_superusers: false
|
||||||
|
enable_team_member_deprecation: false
|
||||||
|
enable_team_superuser: false
|
||||||
|
enable_teams_api: false
|
||||||
|
# pam_configuration: ""
|
||||||
|
pam_role_name: zalandos
|
||||||
|
# postgres_superuser_teams:
|
||||||
|
# - postgres_superusers
|
||||||
|
protected_role_names:
|
||||||
|
- admin
|
||||||
|
- cron_admin
|
||||||
|
role_deletion_suffix: "_deleted"
|
||||||
|
team_admin_role: admin
|
||||||
|
team_api_role_configuration:
|
||||||
|
log_statement: all
|
||||||
|
# teams_api_url: ""
|
||||||
|
logging_rest_api:
|
||||||
|
api_port: 8080
|
||||||
|
cluster_history_entries: 1000
|
||||||
|
ring_log_lines: 100
|
||||||
|
connection_pooler:
|
||||||
|
connection_pooler_default_cpu_limit: "1"
|
||||||
|
connection_pooler_default_cpu_request: "500m"
|
||||||
|
connection_pooler_default_memory_limit: 100Mi
|
||||||
|
connection_pooler_default_memory_request: 100Mi
|
||||||
|
connection_pooler_image: "registry.opensource.zalan.do/acid/pgbouncer:master-27"
|
||||||
|
# connection_pooler_max_db_connections: 60
|
||||||
|
connection_pooler_mode: "transaction"
|
||||||
|
connection_pooler_number_of_instances: 2
|
||||||
|
# connection_pooler_schema: "pooler"
|
||||||
|
# connection_pooler_user: "pooler"
|
||||||
|
patroni:
|
||||||
|
enable_patroni_failsafe_mode: false
|
||||||
|
|
@ -0,0 +1,68 @@
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
name: postgresteams.acid.zalan.do
|
||||||
|
spec:
|
||||||
|
group: acid.zalan.do
|
||||||
|
names:
|
||||||
|
kind: PostgresTeam
|
||||||
|
listKind: PostgresTeamList
|
||||||
|
plural: postgresteams
|
||||||
|
singular: postgresteam
|
||||||
|
shortNames:
|
||||||
|
- pgteam
|
||||||
|
categories:
|
||||||
|
- all
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- name: v1
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- kind
|
||||||
|
- apiVersion
|
||||||
|
- spec
|
||||||
|
properties:
|
||||||
|
kind:
|
||||||
|
type: string
|
||||||
|
enum:
|
||||||
|
- PostgresTeam
|
||||||
|
apiVersion:
|
||||||
|
type: string
|
||||||
|
enum:
|
||||||
|
- acid.zalan.do/v1
|
||||||
|
spec:
|
||||||
|
type: object
|
||||||
|
properties:
|
||||||
|
additionalSuperuserTeams:
|
||||||
|
type: object
|
||||||
|
description: "Map for teamId and associated additional superuser teams"
|
||||||
|
additionalProperties:
|
||||||
|
type: array
|
||||||
|
nullable: true
|
||||||
|
description: "List of teams to become Postgres superusers"
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
additionalTeams:
|
||||||
|
type: object
|
||||||
|
description: "Map for teamId and associated additional teams"
|
||||||
|
additionalProperties:
|
||||||
|
type: array
|
||||||
|
nullable: true
|
||||||
|
description: "List of teams whose members will also be added to the Postgres cluster"
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
additionalMembers:
|
||||||
|
type: object
|
||||||
|
description: "Map for teamId and associated additional users"
|
||||||
|
additionalProperties:
|
||||||
|
type: array
|
||||||
|
nullable: true
|
||||||
|
description: "List of users who will also be added to the Postgres cluster"
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
|
@ -0,0 +1,38 @@
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
|
||||||
|
namespace: postgresql
|
||||||
|
|
||||||
|
resources:
|
||||||
|
- github.com/zalando/postgres-operator/ui/manifests?ref=v1.9.0
|
||||||
|
|
||||||
|
patches:
|
||||||
|
- patch: |-
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: postgres-operator-ui
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: service
|
||||||
|
env:
|
||||||
|
- name: TARGET_NAMESPACE
|
||||||
|
value: '*'
|
||||||
|
- target:
|
||||||
|
kind: Ingress
|
||||||
|
labelSelector: application=postgres-operator-ui
|
||||||
|
patch: |-
|
||||||
|
- op: replace
|
||||||
|
path: /spec/rules/0/host
|
||||||
|
value: psqlui.pyrocufflink.blue
|
||||||
|
- patch: |-
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
name: postgres-operator-ui
|
||||||
|
annotations:
|
||||||
|
nginx.ingress.kubernetes.io/auth-method: GET
|
||||||
|
nginx.ingress.kubernetes.io/auth-url: http://authelia.authelia.svc.cluster.local:9091/api/verify
|
||||||
|
nginx.ingress.kubernetes.io/auth-signin: https://auth.pyrocufflink.blue/?rm=$request_method
|
||||||
Loading…
Reference in New Issue