Add CRD configuration to Helm chart values.yaml (#559)

* add templates for CRDs incl. crd-install hooks
* support both config styles in values.yaml
* fix ServiceAccount naming in values.yaml

charts/postgres-operator/Chart.yaml

@@ -1,13 +1,18 @@
 apiVersion: v1
 name: postgres-operator
-version: 0.1.0
-appVersion: 1.1.0
+version: 1.2.0
+appVersion: 1.2.0
 home: https://github.com/zalando/postgres-operator
 description: Postgres operator creates and manages PostgreSQL clusters running in Kubernetes
 keywords:
 - postgres
 - operator
+- cloud-native
+- patroni
+- spilo
 maintainers:
+- name: Zalando
+  email: opensource@zalando.de
 - name: kimxogus
   email: kgyoo8232@gmail.com
 sources:

charts/postgres-operator/templates/clusterrole.yaml

@@ -2,7 +2,11 @@
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
-  name: {{ template "postgres-operator.fullname" . }}
+  name: {{- if eq .Values.serviceAccount.name "" }}
+            {{ template "postgres-operator.fullname" . }}
+        {{- else }}
+            {{ .Values.serviceAccount.name }}
+        {{- end }}
   labels:
     app.kubernetes.io/name: {{ template "postgres-operator.name" . }}
     helm.sh/chart: {{ template "postgres-operator.chart" . }}
@@ -140,7 +144,11 @@ rules:
   verbs:
   - bind
   resourceNames:
-  - {{ template "postgres-operator.fullname" . }}
+  - {{- if eq .Values.serviceAccount.name "" }}
+      {{ template "postgres-operator.fullname" . }}
+    {{- else }}
+      {{ .Values.serviceAccount.name }}
+    {{- end }}
 - apiGroups:
   - batch
   resources:

charts/postgres-operator/templates/clusterrolebinding.yaml

@@ -2,7 +2,11 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ template "postgres-operator.fullname" . }}
+  name: {{- if eq .Values.serviceAccount.name "" }}
+            {{ template "postgres-operator.fullname" . }}
+        {{- else }}
+            {{ .Values.serviceAccount.name }}
+        {{- end }}
   labels:
     app.kubernetes.io/name: {{ template "postgres-operator.name" . }}
     helm.sh/chart: {{ template "postgres-operator.chart" . }}
@@ -11,11 +15,19 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ template "postgres-operator.fullname" . }}
+  name: {{- if eq .Values.serviceAccount.name "" }}
+            {{ template "postgres-operator.fullname" . }}
+        {{- else }}
+            {{ .Values.serviceAccount.name }}
+        {{- end }}
 subjects:
 - kind: ServiceAccount
 # note: the cluster role binding needs to be defined
 # for every namespace the operator service account lives in.
-  name: {{ template "postgres-operator.fullname" . }}
+  name: {{- if eq .Values.serviceAccount.name "" }}
+            {{ template "postgres-operator.fullname" . }}
+        {{- else }}
+            {{ .Values.serviceAccount.name }}
+        {{- end }}
   namespace: {{ .Release.Namespace }}
 {{ end }}

charts/postgres-operator/templates/configmap.yaml

@@ -8,5 +8,25 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
 data:
-  pod_service_account_name: {{ template "postgres-operator.fullname" . }}
-{{ toYaml .Values.config | indent 2 }}
+  pod_service_account_name: {{- if eq .Values.serviceAccount.name "" }}
+                                {{ template "postgres-operator.fullname" . }}
+                            {{- else }}
+                                {{ .Values.serviceAccount.name }}
+                            {{- end }}
+  api_port: "{{ .Values.configLoggingRestApi.api_port }}"
+  cluster_history_entries: "{{ .Values.configLoggingRestApi.cluster_history_entries }}"
+  docker_image: {{ .Values.docker_image }}
+  debug_logging: "{{ .Values.configDebug.debug_logging }}"
+  enable_database_access: "{{ .Values.configDebug.enable_database_access }}"
+  repair_period: {{ .Values.repair_period }}
+  resync_period: {{ .Values.resync_period }}
+  ring_log_lines: "{{ .Values.configLoggingRestApi.ring_log_lines }}"
+  spilo_privileged: "{{ .Values.spilo_privileged }}"
+  workers: "{{ .Values.workers }}"
+{{ toYaml .Values.configMap | indent 2 }}
+{{ toYaml .Values.configUsers | indent 2 }}
+{{ toYaml .Values.configKubernetes | indent 2 }}
+{{ toYaml .Values.configTimeouts | indent 2 }}
+{{ toYaml .Values.configLoadBalancer | indent 2 }}
+{{ toYaml .Values.configAwsOrGcp | indent 2 }}
+{{ toYaml .Values.configTeamsApi | indent 2 }}

charts/postgres-operator/templates/customrresourcedefinition.yaml

@@ -0,0 +1,39 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: postgresqls.acid.zalan.do
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: acid.zalan.do
+  names:
+    kind: postgresql
+    listKind: postgresqlList
+    plural: postgresqls
+    singular: postgresql
+    shortNames:
+    - pg
+  scope: Namespaced
+  subresources:
+    status: {}
+  version: v1
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: operatorconfigurations.acid.zalan.do
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: acid.zalan.do
+  names:
+    kind: OperatorConfiguration
+    listKind: OperatorConfigurationList
+    plural: operatorconfigurations
+    singular: operatorconfiguration
+    shortNames:
+    - pgc
+  scope: Namespaced
+  subresources:
+    status: {}
+  version: v1

charts/postgres-operator/templates/deployment.yaml

@@ -17,6 +17,8 @@ spec:
     metadata:
       annotations:
         checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        # In order to use the checksum of CRD OperatorConfiguration instead, use the following line instead
+        # {{ include (print $.Template.BasePath "/operatorconfiguration.yaml") . | sha256sum }}
     {{- if .Values.podAnnotations }}
 {{ toYaml .Values.podAnnotations | indent 8 }}
     {{- end }}
@@ -27,7 +29,11 @@ spec:
 {{ toYaml .Values.podLabels | indent 8 }}
       {{- end }}
     spec:
-      serviceAccountName: {{ template "postgres-operator.fullname" . }}
+      serviceAccountName: {{- if eq .Values.serviceAccount.name "" }}
+                            {{ template "postgres-operator.fullname" . }}
+                          {{- else }}
+                            {{ .Values.serviceAccount.name }}
+                          {{- end }}
       containers:
       - name: {{ .Chart.Name }}
         image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@@ -35,6 +41,9 @@ spec:
         env:
         - name: CONFIG_MAP_NAME
           value: {{ template "postgres-operator.fullname" . }}
+        # In order to use the CRD OperatorConfiguration instead, uncomment these lines and comment out the two lines above
+        # - name: POSTGRES_OPERATOR_CONFIGURATION_OBJECT
+        #  value: {{ template "postgres-operator.fullname" . }}
         resources:
 {{ toYaml .Values.resources | indent 10 }}
       {{- if .Values.imagePullSecrets }}

charts/postgres-operator/templates/operatorconfiguration.yaml

@@ -0,0 +1,41 @@
+apiVersion: "acid.zalan.do/v1"
+kind: OperatorConfiguration
+metadata:
+  name: {{ template "postgres-operator.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ template "postgres-operator.name" . }}
+    helm.sh/chart: {{ template "postgres-operator.chart" . }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+configuration:
+  docker_image: {{ .Values.docker_image }}
+  repair_period: {{ .Values.repair_period }}
+  resync_period: {{ .Values.resync_period }}
+  workers: {{ .Values.workers }}
+{{ toYaml .Values.configCRD | indent 2 }}
+  users:
+{{ toYaml .Values.configUsers | indent 4 }}
+  kubernetes:
+    oauth_token_secret_name: {{ template "postgres-operator.fullname" . }}
+    pod_service_account_name: operator
+    spilo_privileged: {{ .Values.spilo_privileged }}
+{{ toYaml .Values.configKubernetes | indent 4 }}
+{{ toYaml .Values.configKubernetesCRD | indent 4 }}
+  postgres_pod_resources:
+{{ toYaml .Values.configPostgresPodResources | indent 4 }}
+  timeouts:
+{{ toYaml .Values.configTimeouts | indent 4 }}
+  load_balancer:
+{{ toYaml .Values.configLoadBalancerCRD | indent 4 }}
+  aws_or_gcp:
+{{ toYaml .Values.configAwsOrGcp | indent 4 }}
+  logical_backup:
+{{ toYaml .Values.configLogicalBackup | indent 4 }}
+  debug:
+{{ toYaml .Values.configDebug | indent 4 }}
+  teams_api:
+{{ toYaml .Values.configTeamsApiCRD | indent 4 }}
+  logging_rest_api:
+{{ toYaml .Values.configLoggingRestApi | indent 4 }}
+  scalyr:
+{{ toYaml .Values.configScalyr | indent 4 }}

charts/postgres-operator/templates/serviceaccount.yaml

@@ -2,7 +2,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ template "postgres-operator.fullname" . }}
+  name: {{- if eq .Values.serviceAccount.name "" }}
+            {{ template "postgres-operator.fullname" . }}
+        {{- else }}
+            {{ .Values.serviceAccount.name }}
+        {{- end }}
   labels:
     app.kubernetes.io/name: {{ template "postgres-operator.name" . }}
     helm.sh/chart: {{ template "postgres-operator.chart" . }}

charts/postgres-operator/values.yaml

@@ -1,7 +1,7 @@
 image:
   registry: registry.opensource.zalan.do
   repository: acid/postgres-operator
-  tag: v1.1.0
+  tag: v1.1.0-28-g24d412a
   pullPolicy: "IfNotPresent"
 
 # Optionally specify an array of imagePullSecrets.
@@ -13,59 +13,143 @@ image:
 podAnnotations: {}
 podLabels: {}
 
-config:
-  watched_namespace: "*" # listen to all namespaces
-  cluster_labels: application:spilo
-  cluster_name_label: version
-  pod_role_label: spilo-role
+# config shared from ConfigMap and CRD
+docker_image: registry.opensource.zalan.do/acid/spilo-11:1.5-p7
+repair_period: 5m
+resync_period: 5m
+spilo_privileged: false
+workers: 4
 
-  debug_logging: "true"
-  workers: "4"
-  docker_image: registry.opensource.zalan.do/acid/spilo-cdp-11:1.5-p70
-  secret_name_template: '{username}.{cluster}.credentials'
-  cluster_domain: cluster.local
+configUsers:
+  replication_username: standby
   super_username: postgres
-  enable_teams_api: "false"
-  spilo_privileged: "false"
-  # set_memory_request_to_limit: "true"
-  # postgres_superuser_teams: "postgres_superusers"
-  # enable_team_superuser: "false"
-  # team_admin_role: "admin"
-  # teams_api_url: http://fake-teams-api.default.svc.cluster.local
-  # team_api_role_configuration: "log_statement:all"
-  # infrastructure_roles_secret_name: postgresql-infrastructure-roles
-  # oauth_token_secret_name: postgresql-operator
-  # pam_role_name: zalandos
-  # pam_configuration: |
-  #  https://info.example.com/oauth2/tokeninfo?access_token= uid realm=/employees
+
+configKubernetes:
+  cluster_domain: cluster.local
   # inherited_labels: ""
-  aws_region: eu-central-1
-  db_hosted_zone: db.example.com
-  master_dns_name_format: '{cluster}.{team}.staging.{hostedzone}'
-  replica_dns_name_format: '{cluster}-repl.{team}.staging.{hostedzone}'
-  enable_master_load_balancer: "true"
-  enable_replica_load_balancer: "false"
-
+  # infrastructure_roles_secret_name: postgresql-infrastructure-roles
+  # node_readiness_label: ""
+  # oauth_token_secret_name: postgresql-operator
+  # pod_environment_configmap: ""
+  pod_management_policy: "ordered_ready"
   pdb_name_format: "postgres-{cluster}-pdb"
-
-  api_port: "8080"
-  ring_log_lines: "100"
-  cluster_history_entries: "1000"
+  pod_role_label: spilo-role
   pod_terminate_grace_period: 5m
+  secret_name_template: '{username}.{cluster}.credentials'
+
+configPostgresPodResources:
+  default_cpu_request: 100m
+  default_memory_request: 100Mi
+  default_cpu_limit: "3"
+  default_memory_limit: 1Gi
+  # set_memory_request_to_limit: true
+
+configTimeouts:
+  # master_pod_move_timeout: 10m
   pod_deletion_wait_timeout: 10m
   pod_label_wait_timeout: 10m
   ready_wait_interval: 3s
   ready_wait_timeout: 30s
-  replication_username: standby
   resource_check_interval: 3s
   resource_check_timeout: 10m
-  resync_period: 5m
-  pod_management_policy: "ordered_ready"
-  enable_pod_antiaffinity: "false"
-  pod_antiaffinity_topology_key: "kubernetes.io/hostname"
+
+configDebug:
+  debug_logging: true
+  enable_database_access: true
+
+configLoggingRestApi:
+  api_port: 8080
+  cluster_history_entries: 1000
+  ring_log_lines: 100
+
+configAwsOrGcp:
+  aws_region: eu-central-1
+  db_hosted_zone: db.example.com
+  # kube_iam_role: ""
+  # log_s3_bucket: ""
+  # wal_s3_bucket: ""
+
+configLogicalBackup:
   logical_backup_schedule: "30 00 * * *"
   logical_backup_docker_image: "registry.opensource.zalan.do/acid/logical-backup"
   logical_backup_s3_bucket: ""
+
+# config exclusive to ConfigMap
+configMap:
+  cluster_labels: application:spilo
+  cluster_name_label: version
+  watched_namespace: "*" # listen to all namespaces
+
+configLoadBalancer:
+  # custom_service_annotations:
+  #   "keyx:valuez,keya:valuea"
+  enable_master_load_balancer: "true"
+  enable_replica_load_balancer: "false"
+  master_dns_name_format: '{cluster}.{team}.staging.{hostedzone}'
+  replica_dns_name_format: '{cluster}-repl.{team}.staging.{hostedzone}'
+
+configTeamsApi:
+  enable_teams_api: "false"
+  # enable_admin_role_for_users: "true"
+  # enable_team_superuser: "false"
+  # pam_configuration: https://info.example.com/oauth2/tokeninfo?access_token= uid realm=/employees
+  # pam_role_name: zalandos
+  # postgres_superuser_teams: "postgres_superusers"
+  # team_admin_role: "admin"
+  # team_api_role_configuration: "log_statement:all"
+  # teams_api_url: http://fake-teams-api.default.svc.cluster.local
+
+# config exclusive to CRD
+configCRD:
+  etcd_host: ""
+  min_instances: -1
+  max_instances: -1
+  # sidecar_docker_images
+  #  example: "exampleimage:exampletag"
+
+configKubernetesCRD:
+  cluster_labels:
+      application: spilo
+  cluster_name_label: cluster-name
+  enable_pod_antiaffinity: false
+  pod_antiaffinity_topology_key: "kubernetes.io/hostname"
+  secret_name_template: "{username}.{cluster}.credentials.{tprkind}.{tprgroup}"
+  # inherited_labels:
+  # - application
+  # - app
+  # watched_namespace: ""
+
+configLoadBalancerCRD:
+  # custom_service_annotations:
+  #   keyx: valuez
+  #   keya: valuea
+  enable_master_load_balancer: false
+  enable_replica_load_balancer: false
+  master_dns_name_format: "{cluster}.{team}.{hostedzone}"
+  replica_dns_name_format: "{cluster}-repl.{team}.{hostedzone}"
+
+configTeamsApiCRD:
+  enable_teams_api: false
+  enable_team_superuser: false
+  # pam_configuration: ""
+  pam_role_name: zalandos
+  # postgres_superuser_teams: "postgres_superusers"
+  protected_role_names:
+  - admin
+  team_admin_role: admin
+  team_api_role_configuration:
+    log_statement: all
+  # teams_api_url: ""
+
+scalyr:
+  scalyr_cpu_request: 100m
+  scalyr_memory_request: 50Mi
+  scalyr_cpu_limit: "1"
+  scalyr_memory_limit: 1Gi
+  # scalyr_api_key: ""
+  # scalyr_image: ""
+  # scalyr_server_url: ""
+
 rbac:
   # Specifies whether RBAC resources should be created
   create: true
@@ -75,7 +159,9 @@ serviceAccount:
   create: true
   # The name of the ServiceAccount to use.
   # If not set and create is true, a name is generated using the fullname template
-  name:
+  # When relying solely on the OperatorConfiguration CRD, set this value to "operator"
+  # Otherwise, the operator tries to use the "default" service account which is forbidden 
+  name: ""
 
 priorityClassName: ""