Merge branch 'master' into default-privileges-for-users

docs/administrator.md

@@ -168,6 +168,10 @@ operator checks during Sync all pods run images specified in their respective
 statefulsets. The operator triggers a rolling upgrade for PG clusters that
 violate this condition.
 
+Changes in $SPILO\_CONFIGURATION under path bootstrap.dcs are ignored when
+StatefulSets are being compared, if there are changes under this path, they are
+applied through rest api interface and following restart of patroni instance
+
 ## Delete protection via annotations
 
 To avoid accidental deletes of Postgres clusters the operator can check the

docs/developer.md

@@ -314,13 +314,12 @@ Please, reflect your changes in tests, for example in:
 
 For the CRD-based configuration, please update the following files:
 * the default [OperatorConfiguration](../manifests/postgresql-operator-default-configuration.yaml)
-* the Helm chart's [values-crd file](../charts/postgres-operator/values.yaml)
 * the CRD's [validation](../manifests/operatorconfiguration.crd.yaml)
+* the CRD's validation in the [Helm chart](../charts/postgres-operator/crds/operatorconfigurations.yaml)
 
-Reflect the changes in the ConfigMap configuration as well (note that numeric
-and boolean parameters have to use double quotes here):
-* [ConfigMap](../manifests/configmap.yaml) manifest
-* the Helm chart's default [values file](../charts/postgres-operator/values.yaml)
+Add new options also to the Helm chart's [values file](../charts/postgres-operator/values.yaml) file.
+It follows the OperatorConfiguration CRD layout. Nested values will be flattened for the ConfigMap.
+Last but no least, update the [ConfigMap](../manifests/configmap.yaml) manifest example as well.
 
 ### Updating documentation
 

docs/quickstart.md

@@ -81,12 +81,6 @@ the repo root. With Helm v3 installed you should be able to run:
 helm install postgres-operator ./charts/postgres-operator
 ```
 
-To use CRD-based configuration you need to specify the [values-crd yaml file](../charts/postgres-operator/values-crd.yaml).
-
-```bash
-helm install postgres-operator ./charts/postgres-operator -f ./charts/postgres-operator/values-crd.yaml
-```
-
 The chart works with both Helm 2 and Helm 3. The `crd-install` hook from v2 will
 be skipped with warning when using v3. Documentation for installing applications
 with Helm 2 can be found in the [v2 docs](https://v2.helm.sh/docs/).

docs/reference/operator_parameters.md

@@ -172,11 +172,11 @@ under the `users` key.
 
 ## Major version upgrades
 
-Parameters configuring automatic major version upgrades. In a 
+Parameters configuring automatic major version upgrades. In a
 CRD-configuration, they are grouped under the `major_version_upgrade` key.
 
 * **major_version_upgrade_mode**
-  Postgres Operator supports [in-place major version upgrade](../administrator.md#in-place-major-version-upgrade) 
+  Postgres Operator supports [in-place major version upgrade](../administrator.md#in-place-major-version-upgrade)
   with three different modes:
   `"off"` = no upgrade by the operator,
   `"manual"` = manifest triggers action,
@@ -275,11 +275,14 @@ configuration they are grouped under the `kubernetes` key.
 
 * **secret_name_template**
   a template for the name of the database user secrets generated by the
-  operator. `{username}` is replaced with name of the secret, `{cluster}` with
-  the name of the cluster, `{tprkind}` with the kind of CRD (formerly known as
-  TPR) and `{tprgroup}` with the group of the CRD. No other placeholders are
-  allowed. The default is
-  `{username}.{cluster}.credentials.{tprkind}.{tprgroup}`.
+  operator. `{namespace}` is replaced with name of the namespace (if cross
+  namespace secrets are enabled via EnableNamespacedSecret flag, otherwise the
+  secret is in cluster's namespace and in that case it is not present in secret
+  name), `{username}` is replaced with name of the secret, `{cluster}` with the
+  name of the cluster, `{tprkind}` with the kind of CRD (formerly known as TPR)
+  and `{tprgroup}` with the group of the CRD. No other placeholders are allowed.
+  The default is
+  `{namespace}.{username}.{cluster}.credentials.{tprkind}.{tprgroup}`.
 
 * **cluster_domain**
   defines the default DNS domain for the kubernetes cluster the operator is

docs/user.md

@@ -139,6 +139,25 @@ secret, without ever sharing it outside of the cluster.
 At the moment it is not possible to define membership of the manifest role in
 other roles.
 
+To define the secrets for the users in a different namespace than that of the cluster,
+one can use the flag `EnableNamespacedSecret` and declare the namespace for the
+secrets in the manifest in the following manner,
+
+```yaml
+spec:
+  users:
+  #users with secret in dfferent namespace
+   appspace.db_user:
+    - createdb
+```
+Here, anything before the first dot is taken as the namespace and the text after
+the first dot is the username. Also, the postgres roles of these usernames would
+be in the form of `namespace.username`.
+
+For such usernames, the secret is created in the given namespace and its name is
+of the following form,
+`{namespace}.{username}.{team}-{clustername}.credentials.postgresql.acid.zalan.do`
+
 ### Infrastructure roles
 
 An infrastructure role is a role that should be present on every PostgreSQL
@@ -330,7 +349,7 @@ spec:
 
 This creates roles for members of the `c-team` team not only in all clusters
 owned by `a-team`, but as well in cluster owned by `b-team`, as `a-team` is
-an `additionalTeam` to `b-team` 
+an `additionalTeam` to `b-team`
 
 Not, you can also define `additionalSuperuserTeams` in the `PostgresTeam`
 manifest. By default, this option is disabled and must be configured with