Merge branch 'master' into coderanger-disruption-budget

manifests/complete-postgres-manifest.yaml

@@ -11,6 +11,7 @@ spec:
   teamId: "ACID"
   volume:
     size: 1Gi
+    #storageClass: my-sc
   numberOfInstances: 2
   users: #Application/Robot users
     zalando:
@@ -46,13 +47,13 @@ spec:
     pg_hba:
     - hostssl all all 0.0.0.0/0 md5
     - host    all all 0.0.0.0/0 md5
-    slots:
-      permanent_physical_1:
-        type: physical
-      permanent_logical_1:
-        type: logical
-        database: foo
-        plugin: pgoutput
+    #slots:
+    #  permanent_physical_1:
+    #    type: physical
+    #  permanent_logical_1:
+    #    type: logical
+    #    database: foo
+    #    plugin: pgoutput
     ttl: 30
     loop_wait: &loop_wait 10
     retry_timeout: 10

manifests/postgres-operator.yaml

@@ -21,6 +21,10 @@ spec:
           limits:
             cpu: 2000m
             memory: 500Mi
+        securityContext:
+          runAsUser: 1000
+          runAsNonRoot: true
+          readOnlyRootFilesystem: true
         env:
         # provided additional ENV vars can overwrite individual config map entries  
         - name: CONFIG_MAP_NAME

manifests/user-facing-clusterroles.yaml

@@ -0,0 +1,51 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+  name: zalando-postgres-operator:users:admin
+rules:
+- apiGroups:
+  - acid.zalan.do
+  resources:
+  - postgresqls
+  - postgresqls/status
+  verbs:
+  - "*"
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+  name: zalando-postgres-operator:users:edit
+rules:
+- apiGroups:
+  - acid.zalan.do
+  resources:
+  - postgresqls
+  verbs:
+  - create
+  - update
+  - patch
+  - delete
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+  name: zalando-postgres-operator:users:view
+rules:
+- apiGroups:
+  - acid.zalan.do
+  resources:
+  - postgresqls
+  - postgresqls/status
+  verbs:
+  - get
+  - list
+  - watch
+