public_git/postgres-operator
1
0
Fork 0
mirror of https://github.com/zalando/postgres-operator.git synced 2026-10-07 07:13:09 +02:00
Code Issues Projects Releases Wiki Activity

improve RBAC setup for postgres pods

Browse Source 
changed the default name, updated helm chart and docs
allow role to use privileged podsecurtitypolicies
This commit is contained in:
Felix Kunde
2020-02-17 11:37:59 +01:00
parent 702a194c41
commit cb96454a56
24 changed files with 382 additions and 129 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/operator_parameters.md
+19 -11
View File
@@ -152,21 +152,29 @@ configuration they are grouped under the `kubernetes` key.
service account used by Patroni running on individual Pods to communicate
with the operator. Required even if native Kubernetes support in Patroni is
not used, because Patroni keeps pod labels in sync with the instance role.
The default is `operator`.
The default is `postgres-pod`.
* **pod_service_account_definition**
The operator tries to create the pod Service Account in the namespace that
doesn't define such an account using the YAML definition provided by this
option. If not defined, a simple definition that contains only the name will
be used. The default is empty.
on Postgres cluster creation the operator tries to create the service account
for the Postgres pods if it does not exist in the namespace. The internal
default service account definition (defines only the name) can be overwritten
with this parameter. Make sure to provide a valid YAML or JSON string. The
default is empty.
* **pod_service_account_role_definition**
operator will try to create a role in the namespace to be used by pod service
account. The internal default definition contains permissions to manage pods
and endpoints necessary for Patroni to work. Therefore, when overwriting the
definition with this parameter make sure to provide sufficient access rights
in a valid YAML/JSON string. The default is empty.
* **pod_service_account_role_binding_definition**
This definition must bind pod service account to a role with permission
sufficient for the pods to start and for Patroni to access K8s endpoints;
service account on its own lacks any such rights starting with K8s v1.8. If
not explicitly defined by the user, a simple definition that binds the
account to the operator's own 'zalando-postgres-operator' cluster role will
be used. The default is empty.
the created service account and role are referenced with a role binding. When
overwriting its definition with this parameters using a valid YAML/JSON string
check that the specified service account and role either exist in the K8s
cluster or will be created by the operator. While it's possible to also
reference cluster roles, the binding itself can only be of kind `RoleBinding`,
not `ClusterRoleBinding`. The default is empty.
* **pod_terminate_grace_period**
Postgres pods are [terminated forcefully](https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods)