Merge branch 'master' into stand

2026-10-18 14:37:32 +02:00 · 2022-03-30 14:49:42 +02:00
parent eb990fd456 a081173f26
commit cc10c3ea27
50 changed files with 2315 additions and 918 deletions
@@ -3,6 +3,7 @@ kind: ConfigMap
 metadata:
  name: postgres-operator
 data:
+  # additional_owner_roles: "cron_admin"
  # additional_pod_capabilities: "SYS_NICE"
  # additional_secret_mount: "some-secret-name"
  # additional_secret_mount_path: "/some/dir"
@@ -44,6 +45,7 @@ data:
  # enable_init_containers: "true"
  # enable_lazy_spilo_upgrade: "false"
  enable_master_load_balancer: "false"
+  enable_master_pooler_load_balancer: "false"
  enable_password_rotation: "false"
  enable_pgversion_env_var: "true"
  # enable_pod_antiaffinity: "false"
@@ -51,6 +53,7 @@ data:
  # enable_postgres_team_crd: "false"
  # enable_postgres_team_crd_superusers: "false"
  enable_replica_load_balancer: "false"
+  enable_replica_pooler_load_balancer: "false"
  # enable_shm_volume: "true"
  # enable_sidecars: "true"
  enable_spilo_wal_path_compat: "true"
@@ -61,6 +64,7 @@ data:
  external_traffic_policy: "Cluster"
  # gcp_credentials: ""
  # kubernetes_use_configmaps: "false"
+  # ignored_annotations: ""
  # infrastructure_roles_secret_name: "postgresql-infrastructure-roles"
  # infrastructure_roles_secrets: "secretname:monitoring-roles,userkey:user,passwordkey:password,rolekey:inrole"
  # inherited_annotations: owned-by
@@ -77,6 +81,7 @@ data:
  # logical_backup_s3_endpoint: ""
  # logical_backup_s3_secret_access_key: ""
  logical_backup_s3_sse: "AES256"
+  # logical_backup_s3_retention_time: ""
  logical_backup_schedule: "30 00 * * *"
  major_version_upgrade_mode: "manual"
  # major_version_upgrade_team_allow_list: ""
@@ -93,6 +98,8 @@ data:
  # pam_configuration: |
  #  https://info.example.com/oauth2/tokeninfo?access_token= uid realm=/employees
  # pam_role_name: zalandos
+  patroni_api_check_interval: "1s"
+  patroni_api_check_timeout: "5s"
  # password_rotation_interval: "90"
  # password_rotation_user_retention: "180"
  pdb_name_format: "postgres-{cluster}-pdb"
@@ -109,7 +116,7 @@ data:
  # pod_service_account_role_binding_definition: ""
  pod_terminate_grace_period: 5m
  # postgres_superuser_teams: "postgres_superusers"
-  # protected_role_names: "admin"
+  # protected_role_names: "admin,cron_admin"
  ready_wait_interval: 3s
  ready_wait_timeout: 30s
  repair_period: 5m
@@ -0,0 +1,131 @@
+# Here we use https://github.com/prometheus-community/helm-charts/charts/kube-prometheus-stack
+# Please keep the ServiceMonitor's label same as the Helm release name of kube-prometheus-stack 
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: test-pg
+---
+apiVersion: "acid.zalan.do/v1"
+kind: postgresql
+metadata:
+  name: acid-minimal-cluster
+  namespace: test-pg
+  labels:
+    app: test-pg
+spec:
+  teamId: "acid"
+  volume:
+    size: 1Gi
+  numberOfInstances: 2
+  users:
+    zalando:  # database owner
+    - superuser
+    - createdb
+    foo_user: []  # role for application foo
+  databases:
+    foo: zalando  # dbname: owner
+  preparedDatabases:
+    bar: {}
+  postgresql:
+    version: "13"
+  sidecars:
+    - name: "exporter"
+      image: "wrouesnel/postgres_exporter"
+      ports:
+        - name: exporter
+          containerPort: 9187
+          protocol: TCP
+      resources:
+        limits:
+          cpu: 500m
+          memory: 256M
+        requests:
+          cpu: 100m
+          memory: 200M
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: acid-minimal-cluster-svc-metrics-master
+  namespace: test-pg
+  labels:
+    app: test-pg
+    spilo-role: master
+  annotations:
+      prometheus.io/scrape: "true"
+      prometheus.io/port: "9187"
+spec:
+  type: ClusterIP
+  ports:
+    - name: exporter
+      port: 9187
+      targetPort: exporter
+  selector:
+    application: spilo
+    cluster-name: acid-minimal-cluster
+    spilo-role: master
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: acid-minimal-cluster-svc-metrics-replica
+  namespace: test-pg
+  labels:
+    app: test-pg
+    spilo-role: replica
+  annotations:
+      prometheus.io/scrape: "true"
+      prometheus.io/port: "9187"
+spec:
+  type: ClusterIP
+  ports:
+    - name: exporter
+      port: 9187
+      targetPort: exporter
+  selector:
+    application: spilo
+    cluster-name: acid-minimal-cluster
+    spilo-role: replica
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: acid-minimal-cluster-svcm-master
+  namespace: test-pg
+  labels:
+    app: test-pg
+    spilo-role: master
+spec:
+  endpoints:
+    - port: exporter
+      interval: 15s
+      scrapeTimeout: 10s
+  namespaceSelector:
+    matchNames:
+      - test-pg
+  selector:
+    matchLabels:
+      app: test-pg
+      spilo-role: master
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: acid-minimal-cluster-svcm-replica
+  namespace: test-pg
+  labels:
+    app: test-pg
+    spilo-role: replica
+spec:
+  endpoints:
+    - port: exporter
+      interval: 15s
+      scrapeTimeout: 10s
+  namespaceSelector:
+    matchNames:
+      - test-pg
+  selector:
+    matchLabels:
+      app: test-pg
+      spilo-role: replica
@@ -128,6 +128,11 @@ spec:
              users:
                type: object
                properties:
+                  additional_owner_roles:
+                    type: array
+                    nullable: true
+                    items:
+                      type: string
                  enable_password_rotation:
                    type: boolean
                    default: false
@@ -205,6 +210,10 @@ spec:
                  enable_sidecars:
                    type: boolean
                    default: true
+                  ignored_annotations:
+                    type: array
+                    items:
+                      type: string
                  infrastructure_roles_secret_name:
                    type: string
                  infrastructure_roles_secrets:
@@ -347,6 +356,12 @@ spec:
              timeouts:
                type: object
                properties:
+                  patroni_api_check_interval:
+                    type: string
+                    default: "1s"
+                  patroni_api_check_timeout:
+                    type: string
+                    default: "5s"
                  pod_label_wait_timeout:
                    type: string
                    default: "10m"
@@ -378,9 +393,15 @@ spec:
                  enable_master_load_balancer:
                    type: boolean
                    default: true
+                  enable_master_pooler_load_balancer:
+                    type: boolean
+                    default: false
                  enable_replica_load_balancer:
                    type: boolean
                    default: false
+                  enable_replica_pooler_load_balancer:
+                    type: boolean
+                    default: false
                  external_traffic_policy:
                    type: string
                    enum:
@@ -448,6 +469,8 @@ spec:
                    type: string
                  logical_backup_s3_sse:
                    type: string
+                  logical_backup_s3_retention_time:
+                    type: string
                  logical_backup_schedule:
                    type: string
                    pattern: '^(\d+|\*)(/\d+)?(\s+(\d+|\*)(/\d+)?){4}$'
@@ -498,6 +521,7 @@ spec:
                      type: string
                    default:
                    - admin
+                    - cron_admin
                  role_deletion_suffix:
                    type: string
                    default: "_deleted"
@@ -26,6 +26,8 @@ configuration:
  #     protocol: TCP
  workers: 8
  users:
+    # additional_owner_roles: 
+    # - cron_admin
    enable_password_rotation: false
    password_rotation_interval: 90
    password_rotation_user_retention: 180
@@ -57,6 +59,8 @@ configuration:
    enable_pod_antiaffinity: false
    enable_pod_disruption_budget: true
    enable_sidecars: true
+    # ignored_annotations:
+    # - k8s.v1.cni.cncf.io/network-status
    # infrastructure_roles_secret_name: "postgresql-infrastructure-roles"
    # infrastructure_roles_secrets:
    # - secretname: "monitoring-roles"
@@ -107,6 +111,8 @@ configuration:
    # min_cpu_limit: 250m
    # min_memory_limit: 250Mi
  timeouts:
+    patroni_api_check_interval: 1s
+    patroni_api_check_timeout: 5s
    pod_label_wait_timeout: 10m
    pod_deletion_wait_timeout: 10m
    ready_wait_interval: 4s
@@ -119,7 +125,9 @@ configuration:
    #   keyy: valuey
    # db_hosted_zone: ""
    enable_master_load_balancer: false
+    enable_master_pooler_load_balancer: false
    enable_replica_load_balancer: false
+    enable_replica_pooler_load_balancer: false
    external_traffic_policy: "Cluster"
    master_dns_name_format: "{cluster}.{team}.{hostedzone}"
    replica_dns_name_format: "{cluster}-repl.{team}.{hostedzone}"
@@ -146,6 +154,7 @@ configuration:
    # logical_backup_s3_region: ""
    # logical_backup_s3_secret_access_key: ""
    logical_backup_s3_sse: "AES256"
+    # logical_backup_s3_retention_time: ""
    logical_backup_schedule: "30 00 * * *"
  debug:
    debug_logging: true
@@ -163,6 +172,7 @@ configuration:
    # - postgres_superusers
    protected_role_names:
    - admin
+    - cron_admin
    role_deletion_suffix: "_deleted"
    team_admin_role: admin
    team_api_role_configuration:
@@ -148,15 +148,9 @@ spec:
                    minimum: 1
                  resources:
                    type: object
-                    required:
-                      - requests
-                      - limits
                    properties:
                      limits:
                        type: object
-                        required:
-                          - cpu
-                          - memory
                        properties:
                          cpu:
                            type: string
@@ -166,9 +160,6 @@ spec:
                            pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$'
                      requests:
                        type: object
-                        required:
-                          - cpu
-                          - memory
                        properties:
                          cpu:
                            type: string
@@ -195,8 +186,12 @@ spec:
                type: boolean
              enableMasterLoadBalancer:
                type: boolean
+              enableMasterPoolerLoadBalancer:
+                type: boolean
              enableReplicaLoadBalancer:
                type: boolean
+              enableReplicaPoolerLoadBalancer:
+                type: boolean
              enableShmVolume:
                type: boolean
              init_containers:
@@ -400,15 +395,9 @@ spec:
                description: deprecated
              resources:
                type: object
-                required:
-                  - requests
-                  - limits
                properties:
                  limits:
                    type: object
-                    required:
-                      - cpu
-                      - memory
                    properties:
                      cpu:
                        type: string
@@ -437,9 +426,6 @@ spec:
                        # than the corresponding limit.
                  requests:
                    type: object
-                    required:
-                      - cpu
-                      - memory
                    properties:
                      cpu:
                        type: string
@@ -530,10 +516,6 @@ spec:
                type: array
                items:
                  type: object
-                  required:
-                    - key
-                    - operator
-                    - effect
                  properties:
                    key:
                      type: string