public_git/postgres-operator
1
0
Fork 0
mirror of https://github.com/zalando/postgres-operator.git synced 2026-10-04 07:11:50 +02:00
Code Issues Projects Releases Wiki Activity

TLS - add OpenShift compatibility (#885)

Browse Source 
* solves https://github.com/zalando/postgres-operator/pull/798#issuecomment-605201260
Co-authored-by: Felix Kunde <felix-kunde@gmx.de>
This commit is contained in:
ReSearchITEng
2020-04-01 09:39:54 +02:00
committed by GitHub
parent 64d816c556
commit 6ed1030838
3 changed files with 13 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/user.md
+9 -4
View File
@@ -572,10 +572,15 @@ However, this certificate cannot be verified and thus doesn't protect from
active MITM attacks. In this section we show how to specify a custom TLS
certificate which is mounted in the database pods via a K8s Secret.
Before applying these changes, the operator must also be configured with the
`spilo_fsgroup` set to the GID matching the postgres user group. If the value
is not provided, the cluster will default to `103` which is the GID from the
default spilo image.
Before applying these changes, in k8s the operator must also be configured with
the `spilo_fsgroup` set to the GID matching the postgres user group. If you
don't know the value, use `103` which is the GID from the default spilo image
(`spilo_fsgroup=103` in the cluster request spec).
OpenShift allocates the users and groups dynamically (based on scc), and their
range is different in every namespace. Due to this dynamic behaviour, it's not
trivial to know at deploy time the uid/gid of the user in the cluster.
This way, in OpenShift, you may want to skip the spilo_fsgroup setting.
Upload the cert as a kubernetes secret:
```sh