diff --git a/charts/postgres-operator/.helmignore b/charts/postgres-operator/.helmignore new file mode 100644 index 000000000..f0c131944 --- /dev/null +++ b/charts/postgres-operator/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/charts/postgres-operator/Chart.yaml b/charts/postgres-operator/Chart.yaml new file mode 100644 index 000000000..3b55a37e9 --- /dev/null +++ b/charts/postgres-operator/Chart.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +name: postgres-operator +version: 0.1.0 +appVersion: 1.1.0 +home: https://github.com/zalando/postgres-operator +description: Postgres operator creates and manages PostgreSQL clusters running in Kubernetes +keywords: +- postgres +- operator +maintainers: +- name: kimxogus + email: kgyoo8232@gmail.com +sources: +- https://github.com/zalando-incubator/postgres-operator +engine: gotpl diff --git a/charts/postgres-operator/templates/NOTES.txt b/charts/postgres-operator/templates/NOTES.txt new file mode 100644 index 000000000..f1fe05060 --- /dev/null +++ b/charts/postgres-operator/templates/NOTES.txt @@ -0,0 +1,3 @@ +To verify that postgres-operator has started, run: + + kubectl --namespace={{ .Release.Namespace }} get pods -l "app.kubernetes.io/name={{ template "postgres-operator.name" . }}" diff --git a/charts/postgres-operator/templates/_helpers.tpl b/charts/postgres-operator/templates/_helpers.tpl new file mode 100644 index 000000000..b0a0d20e5 --- /dev/null +++ b/charts/postgres-operator/templates/_helpers.tpl @@ -0,0 +1,32 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "postgres-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "postgres-operator.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "postgres-operator.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/charts/postgres-operator/templates/clusterrole.yaml b/charts/postgres-operator/templates/clusterrole.yaml new file mode 100644 index 000000000..cdd58f5ba --- /dev/null +++ b/charts/postgres-operator/templates/clusterrole.yaml @@ -0,0 +1,141 @@ +{{ if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + name: {{ template "postgres-operator.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + helm.sh/chart: {{ template "postgres-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +rules: +- apiGroups: + - acid.zalan.do + resources: + - postgresqls + - operatorconfigurations + verbs: + - "*" +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - create + - get +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get +- apiGroups: + - "" + resources: + - endpoints + verbs: + - create + - delete + - get + - list + - patch + - watch # needed if zalando-postgres-operator account is used for pods as well +- apiGroups: + - "" + resources: + - secrets + verbs: + - create + - update + - delete + - get +- apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - delete + - get + - list +- apiGroups: + - "" + resources: + - persistentvolumes + verbs: + - get + - list + - update # only for resizing AWS volumes +- apiGroups: + - "" + resources: + - pods + verbs: + - delete + - get + - list + - watch + - patch +- apiGroups: + - "" + resources: + - services + verbs: + - create + - delete + - get + - patch +- apiGroups: + - apps + resources: + - statefulsets + verbs: + - create + - delete + - get + - list + - patch +- apiGroups: + - "" + resources: + - namespaces + verbs: + - get +- apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - create + - delete + - get +- apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - get + - create +- apiGroups: + - "rbac.authorization.k8s.io" + resources: + - rolebindings + verbs: + - get + - create +- apiGroups: + - "rbac.authorization.k8s.io" + resources: + - clusterroles + verbs: + - bind + resourceNames: + - {{ template "postgres-operator.fullname" . }} +{{ end }} diff --git a/charts/postgres-operator/templates/clusterrolebinding.yaml b/charts/postgres-operator/templates/clusterrolebinding.yaml new file mode 100644 index 000000000..88c95128f --- /dev/null +++ b/charts/postgres-operator/templates/clusterrolebinding.yaml @@ -0,0 +1,21 @@ +{{ if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "postgres-operator.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + helm.sh/chart: {{ template "postgres-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "postgres-operator.fullname" . }} +subjects: +- kind: ServiceAccount +# note: the cluster role binding needs to be defined +# for every namespace the operator service account lives in. + name: {{ template "postgres-operator.fullname" . }} + namespace: {{ .Release.Namespace }} +{{ end }} diff --git a/charts/postgres-operator/templates/configmap.yaml b/charts/postgres-operator/templates/configmap.yaml new file mode 100644 index 000000000..db8f0bda8 --- /dev/null +++ b/charts/postgres-operator/templates/configmap.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "postgres-operator.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + helm.sh/chart: {{ template "postgres-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +data: + pod_service_account_name: {{ template "postgres-operator.fullname" . }} +{{ toYaml .Values.config | indent 2 }} diff --git a/charts/postgres-operator/templates/deployment.yaml b/charts/postgres-operator/templates/deployment.yaml new file mode 100644 index 000000000..613e42f33 --- /dev/null +++ b/charts/postgres-operator/templates/deployment.yaml @@ -0,0 +1,52 @@ +apiVersion: apps/v1beta2 +kind: Deployment +metadata: + labels: + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + helm.sh/chart: {{ template "postgres-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} + name: {{ template "postgres-operator.fullname" . }} +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + template: + metadata: + annotations: + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + {{- if .Values.podAnnotations }} +{{ toYaml .Values.podAnnotations | indent 8 }} + {{- end }} + labels: + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + {{- if .Values.podLabels }} +{{ toYaml .Values.podLabels | indent 8 }} + {{- end }} + spec: + serviceAccountName: {{ template "postgres-operator.fullname" . }} + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + env: + - name: CONFIG_MAP_NAME + value: {{ template "postgres-operator.fullname" . }} + resources: +{{ toYaml .Values.resources | indent 10 }} + {{- if .Values.imagePullSecrets }} + imagePullSecrets: +{{ toYaml .Values.imagePullSecrets | indent 8 }} + {{- end }} + affinity: +{{ toYaml .Values.affinity | indent 8 }} + nodeSelector: +{{ toYaml .Values.nodeSelector | indent 8 }} + tolerations: +{{ toYaml .Values.tolerations | indent 8 }} + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName }} + {{- end }} diff --git a/charts/postgres-operator/templates/serviceaccount.yaml b/charts/postgres-operator/templates/serviceaccount.yaml new file mode 100644 index 000000000..dc996fc00 --- /dev/null +++ b/charts/postgres-operator/templates/serviceaccount.yaml @@ -0,0 +1,11 @@ +{{ if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "postgres-operator.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + helm.sh/chart: {{ template "postgres-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +{{ end }} diff --git a/charts/postgres-operator/values.yaml b/charts/postgres-operator/values.yaml new file mode 100644 index 000000000..5a4c48974 --- /dev/null +++ b/charts/postgres-operator/values.yaml @@ -0,0 +1,92 @@ +image: + registry: registry.opensource.zalan.do + repository: acid/postgres-operator + tag: v1.1.0 + pullPolicy: "IfNotPresent" + +# Optionally specify an array of imagePullSecrets. +# Secrets must be manually created in the namespace. +# ref: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod +# imagePullSecrets: + # - name: myRegistryKeySecretName + +podAnnotations: {} +podLabels: {} + +config: + watched_namespace: "*" # listen to all namespaces + cluster_labels: application:spilo + cluster_name_label: version + pod_role_label: spilo-role + + debug_logging: "true" + workers: "4" + docker_image: registry.opensource.zalan.do/acid/spilo-cdp-10:1.5-p35 + secret_name_template: '{username}.{cluster}.credentials' + super_username: postgres + enable_teams_api: "false" + # set_memory_request_to_limit: "true" + # postgres_superuser_teams: "postgres_superusers" + # enable_team_superuser: "false" + # team_admin_role: "admin" + # teams_api_url: http://fake-teams-api.default.svc.cluster.local + # team_api_role_configuration: "log_statement:all" + # infrastructure_roles_secret_name: postgresql-infrastructure-roles + # oauth_token_secret_name: postgresql-operator + # pam_role_name: zalandos + # pam_configuration: | + # https://info.example.com/oauth2/tokeninfo?access_token= uid realm=/employees + aws_region: eu-central-1 + db_hosted_zone: db.example.com + master_dns_name_format: '{cluster}.{team}.staging.{hostedzone}' + replica_dns_name_format: '{cluster}-repl.{team}.staging.{hostedzone}' + enable_master_load_balancer: "true" + enable_replica_load_balancer: "false" + + pdb_name_format: "postgres-{cluster}-pdb" + + api_port: "8080" + ring_log_lines: "100" + cluster_history_entries: "1000" + pod_terminate_grace_period: 5m + pod_deletion_wait_timeout: 10m + pod_label_wait_timeout: 10m + ready_wait_interval: 3s + ready_wait_timeout: 30s + replication_username: standby + resource_check_interval: 3s + resource_check_timeout: 10m + resync_period: 5m + +rbac: + # Specifies whether RBAC resources should be created + create: true + +serviceAccount: + # Specifies whether a ServiceAccount should be created + create: true + # The name of the ServiceAccount to use. + # If not set and create is true, a name is generated using the fullname template + name: + +priorityClassName: "" + +resources: {} + # limits: + # cpu: 100m + # memory: 300Mi + # requests: + # cpu: 100m + # memory: 300Mi + +# Affinity for pod assignment +# Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity +affinity: {} + +# Tolerations for pod assignment +# Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ +tolerations: [] + +# Node labels for pod assignment +# Ref: https://kubernetes.io/docs/user-guide/node-selection/ +nodeSelector: {} diff --git a/docs/developer.md b/docs/developer.md index 8132be018..5857c2266 100644 --- a/docs/developer.md +++ b/docs/developer.md @@ -29,6 +29,16 @@ ConfigMap is used to store the configuration of the operator ## Deploying the operator +### - Helm chart + +You can install postgres-operator with helm chart. + +```bash + $ helm install --name my-release ./charts/postgres-operator +``` + +### - Kubernetes manifest + First you need to install the service account definition in your Minikube cluster. ```bash @@ -153,7 +163,7 @@ minikube. The following steps will get you the docker image built and deployed. # Code generation -The operator employs k8s-provided code generation to obtain deep copy methods and Kubernetes-like APIs for its custom resource definitons, namely the Postgres CRD and the operator CRD. The usage of the code generation follows conventions from the k8s community. Relevant scripts live in the `hack` directory: the `update-codegen.sh` triggers code generation for the APIs defined in `pkg/apis/acid.zalan.do/`, +The operator employs k8s-provided code generation to obtain deep copy methods and Kubernetes-like APIs for its custom resource definitons, namely the Postgres CRD and the operator CRD. The usage of the code generation follows conventions from the k8s community. Relevant scripts live in the `hack` directory: the `update-codegen.sh` triggers code generation for the APIs defined in `pkg/apis/acid.zalan.do/`, the `verify-codegen.sh` checks if the generated code is up-to-date (to be used within CI). The `/pkg/generated/` contains the resultant code. To make these scripts work, you may need to `export GOPATH=$(go env GOPATH)` References for code generation are: @@ -282,5 +292,5 @@ To test the multinamespace setup, you can use ``` It will automatically create an `acid-minimal-cluster` in the namespace `test`. Then you can for example check the Patroni logs: ``` -kubectl logs acid-minimal-cluster-0 +kubectl logs acid-minimal-cluster-0 ``` diff --git a/docs/quickstart.md b/docs/quickstart.md index 7b662e420..bdf5bd5d0 100644 --- a/docs/quickstart.md +++ b/docs/quickstart.md @@ -18,11 +18,30 @@ cd postgres-operator minikube start -# start the operator; may take a few seconds +# start the operator using one of helm chart or yaml manifests; + +# - install postgres-operator with helm chart. +# 1) initialize helm +helm init +# 2) install postgres-operator chart +helm install --name postgres-operator ./charts/postgres-operator + +# - install postgres-operator with yaml manifests. kubectl create -f manifests/configmap.yaml # configuration kubectl create -f manifests/operator-service-account-rbac.yaml # identity and permissions kubectl create -f manifests/postgres-operator.yaml # deployment + +# starting the operator may take a few seconds +# check if operator pod is running + +# - if you've created the operator using helm chart +kubectl get po -l app.kubernetes.io/name=postgres-operator + +# - if you've created the operator using yaml manifests +kubectl get po -l name=postgres-operator + + # create a Postgres cluster kubectl create -f manifests/minimal-postgres-manifest.yaml