update codegen and merge with master
This commit is contained in:
Felix Kunde
commit
775aa34d0d
|
|
@ -43,13 +43,13 @@ spec:
|
|||
- name: "APP_URL"
|
||||
value: "http://localhost:8081"
|
||||
- name: "OPERATOR_API_URL"
|
||||
value: {{ .Values.envs.operatorApiUrl }}
|
||||
value: {{ .Values.envs.operatorApiUrl | quote }}
|
||||
- name: "OPERATOR_CLUSTER_NAME_LABEL"
|
||||
value: {{ .Values.envs.operatorClusterNameLabel }}
|
||||
value: {{ .Values.envs.operatorClusterNameLabel | quote }}
|
||||
- name: "RESOURCES_VISIBLE"
|
||||
value: "{{ .Values.envs.resourcesVisible }}"
|
||||
value: {{ .Values.envs.resourcesVisible | quote }}
|
||||
- name: "TARGET_NAMESPACE"
|
||||
value: "{{ .Values.envs.targetNamespace }}"
|
||||
value: {{ .Values.envs.targetNamespace | quote }}
|
||||
- name: "TEAMS"
|
||||
value: |-
|
||||
[
|
||||
|
|
|
|||
|
|
@ -51,3 +51,24 @@ Create chart name and version as used by the chart label.
|
|||
{{- define "postgres-operator.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Flatten nested config options when ConfigMap is used as ConfigTarget
|
||||
*/}}
|
||||
{{- define "flattenValuesForConfigMap" }}
|
||||
{{- range $key, $value := . }}
|
||||
{{- if or (kindIs "string" $value) (kindIs "int" $value) }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if kindIs "slice" $value }}
|
||||
{{ $key }}: {{ join "," $value | quote }}
|
||||
{{- end }}
|
||||
{{- if kindIs "map" $value }}
|
||||
{{- $list := list }}
|
||||
{{- range $subKey, $subValue := $value }}
|
||||
{{- $list = append $list (printf "%s:%s" $subKey $subValue) }}
|
||||
{{ $key }}: {{ join "," $list | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -13,16 +13,16 @@ data:
|
|||
pod_priority_class_name: {{ .Values.podPriorityClassName }}
|
||||
{{- end }}
|
||||
pod_service_account_name: {{ include "postgres-pod.serviceAccountName" . }}
|
||||
{{ toYaml .Values.configGeneral | indent 2 }}
|
||||
{{ toYaml .Values.configUsers | indent 2 }}
|
||||
{{ toYaml .Values.configMajorVersionUpgrade | indent 2 }}
|
||||
{{ toYaml .Values.configKubernetes | indent 2 }}
|
||||
{{ toYaml .Values.configTimeouts | indent 2 }}
|
||||
{{ toYaml .Values.configLoadBalancer | indent 2 }}
|
||||
{{ toYaml .Values.configAwsOrGcp | indent 2 }}
|
||||
{{ toYaml .Values.configLogicalBackup | indent 2 }}
|
||||
{{ toYaml .Values.configDebug | indent 2 }}
|
||||
{{ toYaml .Values.configLoggingRestApi | indent 2 }}
|
||||
{{ toYaml .Values.configTeamsApi | indent 2 }}
|
||||
{{ toYaml .Values.configConnectionPooler | indent 2 }}
|
||||
{{- include "flattenValuesForConfigMap" .Values.configGeneral | indent 2 }}
|
||||
{{- include "flattenValuesForConfigMap" .Values.configUsers | indent 2 }}
|
||||
{{- include "flattenValuesForConfigMap" .Values.configMajorVersionUpgrade | indent 2 }}
|
||||
{{- include "flattenValuesForConfigMap" .Values.configKubernetes | indent 2 }}
|
||||
{{- include "flattenValuesForConfigMap" .Values.configTimeouts | indent 2 }}
|
||||
{{- include "flattenValuesForConfigMap" .Values.configLoadBalancer | indent 2 }}
|
||||
{{- include "flattenValuesForConfigMap" .Values.configAwsOrGcp | indent 2 }}
|
||||
{{- include "flattenValuesForConfigMap" .Values.configLogicalBackup | indent 2 }}
|
||||
{{- include "flattenValuesForConfigMap" .Values.configDebug | indent 2 }}
|
||||
{{- include "flattenValuesForConfigMap" .Values.configLoggingRestApi | indent 2 }}
|
||||
{{- include "flattenValuesForConfigMap" .Values.configTeamsApi | indent 2 }}
|
||||
{{- include "flattenValuesForConfigMap" .Values.configConnectionPooler | indent 2 }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -1,406 +0,0 @@
|
|||
image:
|
||||
registry: registry.opensource.zalan.do
|
||||
repository: acid/postgres-operator
|
||||
tag: v1.6.3
|
||||
pullPolicy: "IfNotPresent"
|
||||
|
||||
# Optionally specify an array of imagePullSecrets.
|
||||
# Secrets must be manually created in the namespace.
|
||||
# ref: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
|
||||
# imagePullSecrets:
|
||||
# - name: myRegistryKeySecretName
|
||||
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
configTarget: "OperatorConfigurationCRD"
|
||||
|
||||
# general top-level configuration parameters
|
||||
configGeneral:
|
||||
# choose if deployment creates/updates CRDs with OpenAPIV3Validation
|
||||
enable_crd_validation: true
|
||||
# update only the statefulsets without immediately doing the rolling update
|
||||
enable_lazy_spilo_upgrade: false
|
||||
# set the PGVERSION env var instead of providing the version via postgresql.bin_dir in SPILO_CONFIGURATION
|
||||
enable_pgversion_env_var: true
|
||||
# start any new database pod without limitations on shm memory
|
||||
enable_shm_volume: true
|
||||
# enables backwards compatible path between Spilo 12 and Spilo 13 images
|
||||
enable_spilo_wal_path_compat: false
|
||||
# etcd connection string for Patroni. Empty uses K8s-native DCS.
|
||||
etcd_host: ""
|
||||
# Select if setup uses endpoints (default), or configmaps to manage leader (DCS=k8s)
|
||||
# kubernetes_use_configmaps: false
|
||||
# Spilo docker image
|
||||
docker_image: registry.opensource.zalan.do/acid/spilo-13:2.0-p7
|
||||
# min number of instances in Postgres cluster. -1 = no limit
|
||||
min_instances: -1
|
||||
# max number of instances in Postgres cluster. -1 = no limit
|
||||
max_instances: -1
|
||||
# period between consecutive repair requests
|
||||
repair_period: 5m
|
||||
# period between consecutive sync requests
|
||||
resync_period: 30m
|
||||
# can prevent certain cases of memory overcommitment
|
||||
# set_memory_request_to_limit: false
|
||||
|
||||
# map of sidecar names to docker images
|
||||
# sidecar_docker_images
|
||||
# example: "exampleimage:exampletag"
|
||||
|
||||
# number of routines the operator spawns to process requests concurrently
|
||||
workers: 8
|
||||
|
||||
# parameters describing Postgres users
|
||||
configUsers:
|
||||
# postgres username used for replication between instances
|
||||
replication_username: standby
|
||||
# postgres superuser name to be created by initdb
|
||||
super_username: postgres
|
||||
|
||||
configMajorVersionUpgrade:
|
||||
# "off": no upgrade, "manual": manifest triggers action, "full": minimal version violation triggers too
|
||||
major_version_upgrade_mode: "off"
|
||||
# minimal Postgres major version that will not automatically be upgraded
|
||||
minimal_major_version: "9.5"
|
||||
# target Postgres major version when upgrading clusters automatically
|
||||
target_major_version: "13"
|
||||
|
||||
configKubernetes:
|
||||
# list of additional capabilities for postgres container
|
||||
# additional_pod_capabilities:
|
||||
# - "SYS_NICE"
|
||||
|
||||
# default DNS domain of K8s cluster where operator is running
|
||||
cluster_domain: cluster.local
|
||||
# additional labels assigned to the cluster objects
|
||||
cluster_labels:
|
||||
application: spilo
|
||||
# label assigned to Kubernetes objects created by the operator
|
||||
cluster_name_label: cluster-name
|
||||
# additional annotations to add to every database pod
|
||||
# custom_pod_annotations:
|
||||
# keya: valuea
|
||||
# keyb: valueb
|
||||
|
||||
# key name for annotation that compares manifest value with current date
|
||||
# delete_annotation_date_key: "delete-date"
|
||||
|
||||
# key name for annotation that compares manifest value with cluster name
|
||||
# delete_annotation_name_key: "delete-clustername"
|
||||
|
||||
# list of annotations propagated from cluster manifest to statefulset and deployment
|
||||
# downscaler_annotations:
|
||||
# - deployment-time
|
||||
# - downscaler/*
|
||||
|
||||
# enables initContainers to run actions before Spilo is started
|
||||
enable_init_containers: true
|
||||
# toggles pod anti affinity on the Postgres pods
|
||||
enable_pod_antiaffinity: false
|
||||
# toggles PDB to set to MinAvailabe 0 or 1
|
||||
enable_pod_disruption_budget: true
|
||||
# enables sidecar containers to run alongside Spilo in the same pod
|
||||
enable_sidecars: true
|
||||
# namespaced name of the secret containing infrastructure roles names and passwords
|
||||
# infrastructure_roles_secret_name: postgresql-infrastructure-roles
|
||||
|
||||
# list of annotation keys that can be inherited from the cluster manifest
|
||||
# inherited_annotations:
|
||||
# - owned-by
|
||||
|
||||
# list of label keys that can be inherited from the cluster manifest
|
||||
# inherited_labels:
|
||||
# - application
|
||||
# - environment
|
||||
|
||||
# timeout for successful migration of master pods from unschedulable node
|
||||
# master_pod_move_timeout: 20m
|
||||
|
||||
# set of labels that a running and active node should possess to be considered ready
|
||||
# node_readiness_label:
|
||||
# status: ready
|
||||
|
||||
# namespaced name of the secret containing the OAuth2 token to pass to the teams API
|
||||
# oauth_token_secret_name: postgresql-operator
|
||||
|
||||
# defines the template for PDB (Pod Disruption Budget) names
|
||||
pdb_name_format: "postgres-{cluster}-pdb"
|
||||
# override topology key for pod anti affinity
|
||||
pod_antiaffinity_topology_key: "kubernetes.io/hostname"
|
||||
# namespaced name of the ConfigMap with environment variables to populate on every pod
|
||||
# pod_environment_configmap: "default/my-custom-config"
|
||||
# name of the Secret (in cluster namespace) with environment variables to populate on every pod
|
||||
# pod_environment_secret: "my-custom-secret"
|
||||
|
||||
# specify the pod management policy of stateful sets of Postgres clusters
|
||||
pod_management_policy: "ordered_ready"
|
||||
# label assigned to the Postgres pods (and services/endpoints)
|
||||
pod_role_label: spilo-role
|
||||
# service account definition as JSON/YAML string to be used by postgres cluster pods
|
||||
# pod_service_account_definition: ""
|
||||
|
||||
# role binding definition as JSON/YAML string to be used by pod service account
|
||||
# pod_service_account_role_binding_definition: ""
|
||||
|
||||
# Postgres pods are terminated forcefully after this timeout
|
||||
pod_terminate_grace_period: 5m
|
||||
# template for database user secrets generated by the operator,
|
||||
# here username contains the namespace in the format namespace.username
|
||||
# if the secret is in different namespace than cluster and cross namespace secrets
|
||||
# are enabled via EnableNamespacedSecret flag.
|
||||
secret_name_template: "{username}.{cluster}.credentials.{tprkind}.{tprgroup}"
|
||||
# set user and group for the spilo container (required to run Spilo as non-root process)
|
||||
# spilo_runasuser: "101"
|
||||
# spilo_runasgroup: "103"
|
||||
# group ID with write-access to volumes (required to run Spilo as non-root process)
|
||||
# spilo_fsgroup: 103
|
||||
|
||||
# whether the Spilo container should run in privileged mode
|
||||
spilo_privileged: false
|
||||
# whether the Spilo container should run with additional permissions other than parent.
|
||||
# required by cron which needs setuid
|
||||
spilo_allow_privilege_escalation: true
|
||||
# storage resize strategy, available options are: ebs, pvc, off
|
||||
storage_resize_mode: pvc
|
||||
# operator watches for postgres objects in the given namespace
|
||||
watched_namespace: "*" # listen to all namespaces
|
||||
|
||||
# configure resource requests for the Postgres pods
|
||||
configPostgresPodResources:
|
||||
# CPU limits for the postgres containers
|
||||
default_cpu_limit: "1"
|
||||
# CPU request value for the postgres containers
|
||||
default_cpu_request: 100m
|
||||
# memory limits for the postgres containers
|
||||
default_memory_limit: 500Mi
|
||||
# memory request value for the postgres containers
|
||||
default_memory_request: 100Mi
|
||||
# hard CPU minimum required to properly run a Postgres cluster
|
||||
min_cpu_limit: 250m
|
||||
# hard memory minimum required to properly run a Postgres cluster
|
||||
min_memory_limit: 250Mi
|
||||
|
||||
# timeouts related to some operator actions
|
||||
configTimeouts:
|
||||
# timeout when waiting for the Postgres pods to be deleted
|
||||
pod_deletion_wait_timeout: 10m
|
||||
# timeout when waiting for pod role and cluster labels
|
||||
pod_label_wait_timeout: 10m
|
||||
# interval between consecutive attempts waiting for postgresql CRD to be created
|
||||
ready_wait_interval: 3s
|
||||
# timeout for the complete postgres CRD creation
|
||||
ready_wait_timeout: 30s
|
||||
# interval to wait between consecutive attempts to check for some K8s resources
|
||||
resource_check_interval: 3s
|
||||
# timeout when waiting for the presence of a certain K8s resource (e.g. Sts, PDB)
|
||||
resource_check_timeout: 10m
|
||||
|
||||
# configure behavior of load balancers
|
||||
configLoadBalancer:
|
||||
# DNS zone for cluster DNS name when load balancer is configured for cluster
|
||||
db_hosted_zone: db.example.com
|
||||
# annotations to apply to service when load balancing is enabled
|
||||
# custom_service_annotations:
|
||||
# keyx: valuez
|
||||
# keya: valuea
|
||||
|
||||
# toggles service type load balancer pointing to the master pod of the cluster
|
||||
enable_master_load_balancer: false
|
||||
# toggles service type load balancer pointing to the replica pod of the cluster
|
||||
enable_replica_load_balancer: false
|
||||
# define external traffic policy for the load balancer
|
||||
external_traffic_policy: "Cluster"
|
||||
# defines the DNS name string template for the master load balancer cluster
|
||||
master_dns_name_format: "{cluster}.{team}.{hostedzone}"
|
||||
# defines the DNS name string template for the replica load balancer cluster
|
||||
replica_dns_name_format: "{cluster}-repl.{team}.{hostedzone}"
|
||||
|
||||
# options to aid debugging of the operator itself
|
||||
configDebug:
|
||||
# toggles verbose debug logs from the operator
|
||||
debug_logging: true
|
||||
# toggles operator functionality that require access to the postgres database
|
||||
enable_database_access: true
|
||||
|
||||
# parameters affecting logging and REST API listener
|
||||
configLoggingRestApi:
|
||||
# REST API listener listens to this port
|
||||
api_port: 8080
|
||||
# number of entries in the cluster history ring buffer
|
||||
cluster_history_entries: 1000
|
||||
# number of lines in the ring buffer used to store cluster logs
|
||||
ring_log_lines: 100
|
||||
|
||||
# configure interaction with non-Kubernetes objects from AWS or GCP
|
||||
configAwsOrGcp:
|
||||
# Additional Secret (aws or gcp credentials) to mount in the pod
|
||||
# additional_secret_mount: "some-secret-name"
|
||||
|
||||
# Path to mount the above Secret in the filesystem of the container(s)
|
||||
# additional_secret_mount_path: "/some/dir"
|
||||
|
||||
# AWS region used to store ESB volumes
|
||||
aws_region: eu-central-1
|
||||
|
||||
# enable automatic migration on AWS from gp2 to gp3 volumes
|
||||
enable_ebs_gp3_migration: false
|
||||
# defines maximum volume size in GB until which auto migration happens
|
||||
# enable_ebs_gp3_migration_max_size: 1000
|
||||
|
||||
# GCP credentials that will be used by the operator / pods
|
||||
# gcp_credentials: ""
|
||||
|
||||
# AWS IAM role to supply in the iam.amazonaws.com/role annotation of Postgres pods
|
||||
# kube_iam_role: ""
|
||||
|
||||
# S3 bucket to use for shipping postgres daily logs
|
||||
# log_s3_bucket: ""
|
||||
|
||||
# GCS bucket to use for shipping WAL segments with WAL-E
|
||||
# wal_gs_bucket: ""
|
||||
|
||||
# S3 bucket to use for shipping WAL segments with WAL-E
|
||||
# wal_s3_bucket: ""
|
||||
|
||||
# configure K8s cron job managed by the operator
|
||||
configLogicalBackup:
|
||||
# image for pods of the logical backup job (example runs pg_dumpall)
|
||||
logical_backup_docker_image: "registry.opensource.zalan.do/acid/logical-backup:v1.6.3"
|
||||
# path of google cloud service account json file
|
||||
# logical_backup_google_application_credentials: ""
|
||||
|
||||
# prefix for the backup job name
|
||||
logical_backup_job_prefix: "logical-backup-"
|
||||
# storage provider - either "s3" or "gcs"
|
||||
logical_backup_provider: "s3"
|
||||
# S3 Access Key ID
|
||||
logical_backup_s3_access_key_id: ""
|
||||
# S3 bucket to store backup results
|
||||
logical_backup_s3_bucket: "my-bucket-url"
|
||||
# S3 region of bucket
|
||||
logical_backup_s3_region: ""
|
||||
# S3 endpoint url when not using AWS
|
||||
logical_backup_s3_endpoint: ""
|
||||
# S3 Secret Access Key
|
||||
logical_backup_s3_secret_access_key: ""
|
||||
# S3 server side encryption
|
||||
logical_backup_s3_sse: "AES256"
|
||||
# backup schedule in the cron format
|
||||
logical_backup_schedule: "30 00 * * *"
|
||||
|
||||
# automate creation of human users with teams API service
|
||||
configTeamsApi:
|
||||
# team_admin_role will have the rights to grant roles coming from PG manifests
|
||||
enable_admin_role_for_users: true
|
||||
# operator watches for PostgresTeam CRs to assign additional teams and members to clusters
|
||||
enable_postgres_team_crd: false
|
||||
# toogle to create additional superuser teams from PostgresTeam CRs
|
||||
enable_postgres_team_crd_superusers: false
|
||||
# toggle to automatically rename roles of former team members and deny LOGIN
|
||||
enable_team_member_deprecation: false
|
||||
# toggle to grant superuser to team members created from the Teams API
|
||||
enable_team_superuser: false
|
||||
# toggles usage of the Teams API by the operator
|
||||
enable_teams_api: false
|
||||
# should contain a URL to use for authentication (username and token)
|
||||
# pam_configuration: ""
|
||||
|
||||
# operator will add all team member roles to this group and add a pg_hba line
|
||||
pam_role_name: zalandos
|
||||
# List of teams which members need the superuser role in each Postgres cluster
|
||||
postgres_superuser_teams:
|
||||
- postgres_superusers
|
||||
# List of roles that cannot be overwritten by an application, team or infrastructure role
|
||||
protected_role_names:
|
||||
- admin
|
||||
# Suffix to add if members are removed from TeamsAPI or PostgresTeam CRD
|
||||
role_deletion_suffix: "_deleted"
|
||||
# role name to grant to team members created from the Teams API
|
||||
team_admin_role: admin
|
||||
# postgres config parameters to apply to each team member role
|
||||
team_api_role_configuration:
|
||||
log_statement: all
|
||||
# URL of the Teams API service
|
||||
# teams_api_url: http://fake-teams-api.default.svc.cluster.local
|
||||
|
||||
configConnectionPooler:
|
||||
# db schema to install lookup function into
|
||||
connection_pooler_schema: "pooler"
|
||||
# db user for pooler to use
|
||||
connection_pooler_user: "pooler"
|
||||
# docker image
|
||||
connection_pooler_image: "registry.opensource.zalan.do/acid/pgbouncer:master-16"
|
||||
# max db connections the pooler should hold
|
||||
connection_pooler_max_db_connections: 60
|
||||
# default pooling mode
|
||||
connection_pooler_mode: "transaction"
|
||||
# number of pooler instances
|
||||
connection_pooler_number_of_instances: 2
|
||||
# default resources
|
||||
connection_pooler_default_cpu_request: 500m
|
||||
connection_pooler_default_memory_request: 100Mi
|
||||
connection_pooler_default_cpu_limit: "1"
|
||||
connection_pooler_default_memory_limit: 100Mi
|
||||
|
||||
rbac:
|
||||
# Specifies whether RBAC resources should be created
|
||||
create: true
|
||||
|
||||
crd:
|
||||
# Specifies whether custom resource definitions should be created
|
||||
# When using helm3, this is ignored; instead use "--skip-crds" to skip.
|
||||
create: true
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a ServiceAccount should be created
|
||||
create: true
|
||||
# The name of the ServiceAccount to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name:
|
||||
|
||||
podServiceAccount:
|
||||
# The name of the ServiceAccount to be used by postgres cluster pods
|
||||
# If not set a name is generated using the fullname template and "-pod" suffix
|
||||
name: "postgres-pod"
|
||||
|
||||
# priority class for operator pod
|
||||
priorityClassName: ""
|
||||
|
||||
# priority class for database pods
|
||||
podPriorityClassName: ""
|
||||
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 500Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 250Mi
|
||||
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsNonRoot: true
|
||||
readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
|
||||
# Affinity for pod assignment
|
||||
# Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
||||
affinity: {}
|
||||
|
||||
# Node labels for pod assignment
|
||||
# Ref: https://kubernetes.io/docs/user-guide/node-selection/
|
||||
nodeSelector: {}
|
||||
|
||||
# Tolerations for pod assignment
|
||||
# Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
|
||||
tolerations: []
|
||||
|
||||
controllerID:
|
||||
# Specifies whether a controller ID should be defined for the operator
|
||||
# Note, all postgres manifest must then contain the following annotation to be found by this operator
|
||||
# "acid.zalan.do/controller": <controller-ID-of-the-operator>
|
||||
create: false
|
||||
# The name of the controller ID to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name:
|
||||
|
|
@ -4,16 +4,16 @@ image:
|
|||
tag: v1.6.3
|
||||
pullPolicy: "IfNotPresent"
|
||||
|
||||
# Optionally specify an array of imagePullSecrets.
|
||||
# Secrets must be manually created in the namespace.
|
||||
# ref: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
|
||||
# imagePullSecrets:
|
||||
# Optionally specify an array of imagePullSecrets.
|
||||
# Secrets must be manually created in the namespace.
|
||||
# ref: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
|
||||
# imagePullSecrets:
|
||||
# - name: myRegistryKeySecretName
|
||||
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
configTarget: "ConfigMap"
|
||||
configTarget: "OperatorConfigurationCRD"
|
||||
|
||||
# JSON logging format
|
||||
enableJsonLogging: false
|
||||
|
|
@ -21,37 +21,38 @@ enableJsonLogging: false
|
|||
# general configuration parameters
|
||||
configGeneral:
|
||||
# choose if deployment creates/updates CRDs with OpenAPIV3Validation
|
||||
enable_crd_validation: "true"
|
||||
enable_crd_validation: true
|
||||
# update only the statefulsets without immediately doing the rolling update
|
||||
enable_lazy_spilo_upgrade: "false"
|
||||
enable_lazy_spilo_upgrade: false
|
||||
# set the PGVERSION env var instead of providing the version via postgresql.bin_dir in SPILO_CONFIGURATION
|
||||
enable_pgversion_env_var: "true"
|
||||
enable_pgversion_env_var: true
|
||||
# start any new database pod without limitations on shm memory
|
||||
enable_shm_volume: "true"
|
||||
enable_shm_volume: true
|
||||
# enables backwards compatible path between Spilo 12 and Spilo 13 images
|
||||
enable_spilo_wal_path_compat: "false"
|
||||
enable_spilo_wal_path_compat: false
|
||||
# etcd connection string for Patroni. Empty uses K8s-native DCS.
|
||||
etcd_host: ""
|
||||
# Select if setup uses endpoints (default), or configmaps to manage leader (DCS=k8s)
|
||||
# kubernetes_use_configmaps: "false"
|
||||
# kubernetes_use_configmaps: false
|
||||
# Spilo docker image
|
||||
docker_image: registry.opensource.zalan.do/acid/spilo-13:2.0-p7
|
||||
# min number of instances in Postgres cluster. -1 = no limit
|
||||
min_instances: "-1"
|
||||
min_instances: -1
|
||||
# max number of instances in Postgres cluster. -1 = no limit
|
||||
max_instances: "-1"
|
||||
max_instances: -1
|
||||
# period between consecutive repair requests
|
||||
repair_period: 5m
|
||||
# period between consecutive sync requests
|
||||
resync_period: 30m
|
||||
# can prevent certain cases of memory overcommitment
|
||||
# set_memory_request_to_limit: "false"
|
||||
# set_memory_request_to_limit: false
|
||||
|
||||
# map of sidecar names to docker images
|
||||
# sidecar_docker_images: ""
|
||||
# sidecar_docker_images:
|
||||
# example: "exampleimage:exampletag"
|
||||
|
||||
# number of routines the operator spawns to process requests concurrently
|
||||
workers: "8"
|
||||
workers: 8
|
||||
|
||||
# parameters describing Postgres users
|
||||
configUsers:
|
||||
|
|
@ -70,16 +71,20 @@ configMajorVersionUpgrade:
|
|||
|
||||
configKubernetes:
|
||||
# list of additional capabilities for postgres container
|
||||
# additional_pod_capabilities: "SYS_NICE"
|
||||
# additional_pod_capabilities:
|
||||
# - "SYS_NICE"
|
||||
|
||||
# default DNS domain of K8s cluster where operator is running
|
||||
cluster_domain: cluster.local
|
||||
# additional labels assigned to the cluster objects
|
||||
cluster_labels: application:spilo
|
||||
cluster_labels:
|
||||
application: spilo
|
||||
# label assigned to Kubernetes objects created by the operator
|
||||
cluster_name_label: cluster-name
|
||||
# annotations attached to each database pod
|
||||
# custom_pod_annotations: "keya:valuea,keyb:valueb"
|
||||
# additional annotations to add to every database pod
|
||||
# custom_pod_annotations:
|
||||
# keya: valuea
|
||||
# keyb: valueb
|
||||
|
||||
# key name for annotation that compares manifest value with current date
|
||||
# delete_annotation_date_key: "delete-date"
|
||||
|
|
@ -88,30 +93,36 @@ configKubernetes:
|
|||
# delete_annotation_name_key: "delete-clustername"
|
||||
|
||||
# list of annotations propagated from cluster manifest to statefulset and deployment
|
||||
# downscaler_annotations: "deployment-time,downscaler/*"
|
||||
# downscaler_annotations:
|
||||
# - deployment-time
|
||||
# - downscaler/*
|
||||
|
||||
# enables initContainers to run actions before Spilo is started
|
||||
enable_init_containers: "true"
|
||||
enable_init_containers: true
|
||||
# toggles pod anti affinity on the Postgres pods
|
||||
enable_pod_antiaffinity: "false"
|
||||
enable_pod_antiaffinity: false
|
||||
# toggles PDB to set to MinAvailabe 0 or 1
|
||||
enable_pod_disruption_budget: "true"
|
||||
enable_pod_disruption_budget: true
|
||||
# enables sidecar containers to run alongside Spilo in the same pod
|
||||
enable_sidecars: "true"
|
||||
enable_sidecars: true
|
||||
# namespaced name of the secret containing infrastructure roles names and passwords
|
||||
# infrastructure_roles_secret_name: postgresql-infrastructure-roles
|
||||
|
||||
# list of annotation keys that can be inherited from the cluster manifest
|
||||
# inherited_annotations: owned-by
|
||||
# inherited_annotations:
|
||||
# - owned-by
|
||||
|
||||
# list of label keys that can be inherited from the cluster manifest
|
||||
# inherited_labels: application,environment
|
||||
# inherited_labels:
|
||||
# - application
|
||||
# - environment
|
||||
|
||||
# timeout for successful migration of master pods from unschedulable node
|
||||
# master_pod_move_timeout: 20m
|
||||
|
||||
# set of labels that a running and active node should possess to be considered ready
|
||||
# node_readiness_label: ""
|
||||
# node_readiness_label:
|
||||
# status: ready
|
||||
|
||||
# namespaced name of the secret containing the OAuth2 token to pass to the teams API
|
||||
# oauth_token_secret_name: postgresql-operator
|
||||
|
|
@ -143,16 +154,16 @@ configKubernetes:
|
|||
# are enabled via EnableNamespacedSecret flag.
|
||||
secret_name_template: "{username}.{cluster}.credentials.{tprkind}.{tprgroup}"
|
||||
# set user and group for the spilo container (required to run Spilo as non-root process)
|
||||
# spilo_runasuser: "101"
|
||||
# spilo_runasgroup: "103"
|
||||
# spilo_runasuser: 101
|
||||
# spilo_runasgroup: 103
|
||||
# group ID with write-access to volumes (required to run Spilo as non-root process)
|
||||
# spilo_fsgroup: "103"
|
||||
# spilo_fsgroup: 103
|
||||
|
||||
# whether the Spilo container should run in privileged mode
|
||||
spilo_privileged: "false"
|
||||
spilo_privileged: false
|
||||
# whether the Spilo container should run with additional permissions other than parent.
|
||||
# required by cron which needs setuid
|
||||
spilo_allow_privilege_escalation: "true"
|
||||
spilo_allow_privilege_escalation: true
|
||||
# storage resize strategy, available options are: ebs, pvc, off
|
||||
storage_resize_mode: pvc
|
||||
# operator watches for postgres objects in the given namespace
|
||||
|
|
@ -193,34 +204,36 @@ configLoadBalancer:
|
|||
# DNS zone for cluster DNS name when load balancer is configured for cluster
|
||||
db_hosted_zone: db.example.com
|
||||
# annotations to apply to service when load balancing is enabled
|
||||
# custom_service_annotations: "keyx:valuez,keya:valuea"
|
||||
# custom_service_annotations:
|
||||
# keyx: valuez
|
||||
# keya: valuea
|
||||
|
||||
# toggles service type load balancer pointing to the master pod of the cluster
|
||||
enable_master_load_balancer: "false"
|
||||
enable_master_load_balancer: false
|
||||
# toggles service type load balancer pointing to the replica pod of the cluster
|
||||
enable_replica_load_balancer: "false"
|
||||
enable_replica_load_balancer: false
|
||||
# define external traffic policy for the load balancer
|
||||
external_traffic_policy: "Cluster"
|
||||
# defines the DNS name string template for the master load balancer cluster
|
||||
master_dns_name_format: '{cluster}.{team}.{hostedzone}'
|
||||
master_dns_name_format: "{cluster}.{team}.{hostedzone}"
|
||||
# defines the DNS name string template for the replica load balancer cluster
|
||||
replica_dns_name_format: '{cluster}-repl.{team}.{hostedzone}'
|
||||
replica_dns_name_format: "{cluster}-repl.{team}.{hostedzone}"
|
||||
|
||||
# options to aid debugging of the operator itself
|
||||
configDebug:
|
||||
# toggles verbose debug logs from the operator
|
||||
debug_logging: "true"
|
||||
debug_logging: true
|
||||
# toggles operator functionality that require access to the postgres database
|
||||
enable_database_access: "true"
|
||||
enable_database_access: true
|
||||
|
||||
# parameters affecting logging and REST API listener
|
||||
configLoggingRestApi:
|
||||
# REST API listener listens to this port
|
||||
api_port: "8080"
|
||||
api_port: 8080
|
||||
# number of entries in the cluster history ring buffer
|
||||
cluster_history_entries: "1000"
|
||||
cluster_history_entries: 1000
|
||||
# number of lines in the ring buffer used to store cluster logs
|
||||
ring_log_lines: "100"
|
||||
ring_log_lines: 100
|
||||
|
||||
# configure interaction with non-Kubernetes objects from AWS or GCP
|
||||
configAwsOrGcp:
|
||||
|
|
@ -234,11 +247,11 @@ configAwsOrGcp:
|
|||
aws_region: eu-central-1
|
||||
|
||||
# enable automatic migration on AWS from gp2 to gp3 volumes
|
||||
enable_ebs_gp3_migration: "false"
|
||||
enable_ebs_gp3_migration: false
|
||||
# defines maximum volume size in GB until which auto migration happens
|
||||
# enable_ebs_gp3_migration_max_size: "1000"
|
||||
# enable_ebs_gp3_migration_max_size: 1000
|
||||
|
||||
# GCP credentials for setting the GOOGLE_APPLICATION_CREDNETIALS environment variable
|
||||
# GCP credentials that will be used by the operator / pods
|
||||
# gcp_credentials: ""
|
||||
|
||||
# AWS IAM role to supply in the iam.amazonaws.com/role annotation of Postgres pods
|
||||
|
|
@ -268,10 +281,10 @@ configLogicalBackup:
|
|||
logical_backup_s3_access_key_id: ""
|
||||
# S3 bucket to store backup results
|
||||
logical_backup_s3_bucket: "my-bucket-url"
|
||||
# S3 endpoint url when not using AWS
|
||||
logical_backup_s3_endpoint: ""
|
||||
# S3 region of bucket
|
||||
logical_backup_s3_region: ""
|
||||
# S3 endpoint url when not using AWS
|
||||
logical_backup_s3_endpoint: ""
|
||||
# S3 Secret Access Key
|
||||
logical_backup_s3_secret_access_key: ""
|
||||
# S3 server side encryption
|
||||
|
|
@ -279,36 +292,38 @@ configLogicalBackup:
|
|||
# backup schedule in the cron format
|
||||
logical_backup_schedule: "30 00 * * *"
|
||||
|
||||
|
||||
# automate creation of human users with teams API service
|
||||
configTeamsApi:
|
||||
# team_admin_role will have the rights to grant roles coming from PG manifests
|
||||
enable_admin_role_for_users: "true"
|
||||
enable_admin_role_for_users: true
|
||||
# operator watches for PostgresTeam CRs to assign additional teams and members to clusters
|
||||
enable_postgres_team_crd: "false"
|
||||
enable_postgres_team_crd: false
|
||||
# toogle to create additional superuser teams from PostgresTeam CRs
|
||||
enable_postgres_team_crd_superusers: "false"
|
||||
enable_postgres_team_crd_superusers: false
|
||||
# toggle to automatically rename roles of former team members and deny LOGIN
|
||||
enable_team_member_deprecation: "false"
|
||||
enable_team_member_deprecation: false
|
||||
# toggle to grant superuser to team members created from the Teams API
|
||||
enable_team_superuser: "false"
|
||||
enable_team_superuser: false
|
||||
# toggles usage of the Teams API by the operator
|
||||
enable_teams_api: "false"
|
||||
enable_teams_api: false
|
||||
# should contain a URL to use for authentication (username and token)
|
||||
# pam_configuration: https://info.example.com/oauth2/tokeninfo?access_token= uid realm=/employees
|
||||
|
||||
# operator will add all team member roles to this group and add a pg_hba line
|
||||
pam_role_name: "zalandos"
|
||||
pam_role_name: zalandos
|
||||
# List of teams which members need the superuser role in each Postgres cluster
|
||||
postgres_superuser_teams: "postgres_superusers"
|
||||
postgres_superuser_teams:
|
||||
- postgres_superusers
|
||||
# List of roles that cannot be overwritten by an application, team or infrastructure role
|
||||
protected_role_names: "admin"
|
||||
protected_role_names:
|
||||
- admin
|
||||
# Suffix to add if members are removed from TeamsAPI or PostgresTeam CRD
|
||||
role_deletion_suffix: "_deleted"
|
||||
# role name to grant to team members created from the Teams API
|
||||
team_admin_role: "admin"
|
||||
team_admin_role: admin
|
||||
# postgres config parameters to apply to each team member role
|
||||
team_api_role_configuration: "log_statement:all"
|
||||
team_api_role_configuration:
|
||||
log_statement: all
|
||||
# URL of the Teams API service
|
||||
# teams_api_url: http://fake-teams-api.default.svc.cluster.local
|
||||
|
||||
|
|
@ -321,11 +336,11 @@ configConnectionPooler:
|
|||
# docker image
|
||||
connection_pooler_image: "registry.opensource.zalan.do/acid/pgbouncer:master-16"
|
||||
# max db connections the pooler should hold
|
||||
connection_pooler_max_db_connections: "60"
|
||||
connection_pooler_max_db_connections: 60
|
||||
# default pooling mode
|
||||
connection_pooler_mode: "transaction"
|
||||
# number of pooler instances
|
||||
connection_pooler_number_of_instances: "2"
|
||||
connection_pooler_number_of_instances: 2
|
||||
# default resources
|
||||
connection_pooler_default_cpu_request: 500m
|
||||
connection_pooler_default_memory_request: 100Mi
|
||||
|
|
|
|||
|
|
@ -314,13 +314,12 @@ Please, reflect your changes in tests, for example in:
|
|||
|
||||
For the CRD-based configuration, please update the following files:
|
||||
* the default [OperatorConfiguration](../manifests/postgresql-operator-default-configuration.yaml)
|
||||
* the Helm chart's [values-crd file](../charts/postgres-operator/values.yaml)
|
||||
* the CRD's [validation](../manifests/operatorconfiguration.crd.yaml)
|
||||
* the CRD's validation in the [Helm chart](../charts/postgres-operator/crds/operatorconfigurations.yaml)
|
||||
|
||||
Reflect the changes in the ConfigMap configuration as well (note that numeric
|
||||
and boolean parameters have to use double quotes here):
|
||||
* [ConfigMap](../manifests/configmap.yaml) manifest
|
||||
* the Helm chart's default [values file](../charts/postgres-operator/values.yaml)
|
||||
Add new options also to the Helm chart's [values file](../charts/postgres-operator/values.yaml) file.
|
||||
It follows the OperatorConfiguration CRD layout. Nested values will be flattened for the ConfigMap.
|
||||
Last but no least, update the [ConfigMap](../manifests/configmap.yaml) manifest example as well.
|
||||
|
||||
### Updating documentation
|
||||
|
||||
|
|
|
|||
|
|
@ -81,12 +81,6 @@ the repo root. With Helm v3 installed you should be able to run:
|
|||
helm install postgres-operator ./charts/postgres-operator
|
||||
```
|
||||
|
||||
To use CRD-based configuration you need to specify the [values-crd yaml file](../charts/postgres-operator/values-crd.yaml).
|
||||
|
||||
```bash
|
||||
helm install postgres-operator ./charts/postgres-operator -f ./charts/postgres-operator/values-crd.yaml
|
||||
```
|
||||
|
||||
The chart works with both Helm 2 and Helm 3. The `crd-install` hook from v2 will
|
||||
be skipped with warning when using v3. Documentation for installing applications
|
||||
with Helm 2 can be found in the [v2 docs](https://v2.helm.sh/docs/).
|
||||
|
|
|
|||
|
|
@ -614,6 +614,11 @@ func (in *PostgresSpec) DeepCopyInto(out *PostgresSpec) {
|
|||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.EnableNamespacedSecret != nil {
|
||||
in, out := &in.EnableNamespacedSecret, &out.EnableNamespacedSecret
|
||||
*out = new(bool)
|
||||
**out = **in
|
||||
}
|
||||
if in.Users != nil {
|
||||
in, out := &in.Users, &out.Users
|
||||
*out = make(map[string]UserFlags, len(*in))
|
||||
|
|
|
|||
Loading…
Reference in New Issue