public_git
/
postgres-operator
mirror of https://github.com/zalando/postgres-operator.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge 3d47849eed into 1af4c50ed0

This commit is contained in:
George Wilson 2025-10-21 15:03:18 +02:00 committed by GitHub
parent 1af4c50ed0 3d47849eed
commit 045b4ec03d
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
charts/postgres-operator/templates/clusterrole-postgres-pod.yaml
View File

@ -57,14 +57,14 @@ rules:
- services - services
verbs: verbs:
- create - create
{{- if toString .Values.configKubernetes.spilo_privileged | eq "true" }} {{- if or (toString .Values.configKubernetes.spilo_privileged | eq "true") (.Values.rbac.spiloRunWithPsp) }}
# to run privileged pods # to run privileged pods
- apiGroups: - apiGroups:
- extensions - extensions
resources: resources:
- podsecuritypolicies - podsecuritypolicies
resourceNames: resourceNames:
- privileged - {{ .Values.rbac.spiloPrivilegedPodSecurityPolicy }}
verbs: verbs:
- use - use
{{- end }} {{- end }}

4
charts/postgres-operator/templates/clusterrole.yaml
View File

@ -242,14 +242,14 @@ rules:
verbs: verbs:
- get - get
- create - create
{{- if toString .Values.configKubernetes.spilo_privileged | eq "true" }} {{- if or (toString .Values.configKubernetes.spilo_privileged | eq "true") (.Values.rbac.operatorRunWithPsp) }}
# to run privileged pods # to run privileged pods
- apiGroups: - apiGroups:
- extensions - extensions
resources: resources:
- podsecuritypolicies - podsecuritypolicies
resourceNames: resourceNames:
- privileged - {{ .Values.rbac.operatorPrivilegedPodSecurityPolicy }}
verbs: verbs:
- use - use
{{- end }} {{- end }}

5
charts/postgres-operator/values.yaml
View File

@ -461,6 +461,11 @@ rbac:
create: true create: true
# Specifies whether ClusterRoles that are aggregated into the K8s default roles should be created. (https://kubernetes.io/docs/reference/access-authn-authz/rbac/#default-roles-and-role-bindings) # Specifies whether ClusterRoles that are aggregated into the K8s default roles should be created. (https://kubernetes.io/docs/reference/access-authn-authz/rbac/#default-roles-and-role-bindings)
createAggregateClusterRoles: false createAggregateClusterRoles: false
# If cluster is set to run as privileged - which pod security policy should be used
operatorRunWithPsp: false
spiloRunWithPsp: false
spiloPrivilegedPodSecurityPolicy: privileged
operatorPrivilegedPodSecurityPolicy: privileged
serviceAccount: serviceAccount:
# Specifies whether a ServiceAccount should be created # Specifies whether a ServiceAccount should be created