* Skip owner references on user secrets when secret deletion is disabled
Kubernetes garbage-collects owner-referenced secrets as soon as the
owning Postgresql resource is deleted, regardless of the operator's
own EnableSecretsDeletion check in Delete() (which only guards the
operator's explicit deleteSecrets() call, not GC). This made
enable_secrets_deletion=false ineffective whenever
enable_owner_references was also enabled, since GC removed the
credential secrets anyway.
Now the generated secrets are not removed when
enable_owner_references: true, enable_secrets_deletion: false.
* Document skip-owner-refs on user secrets when deletion disabled
- refresh inline comment in generateSingleUserSecret
- extend enable_owner_references / enable_secrets_deletion docs in
operator_parameters.md to describe the interaction
- clarify in operator_parameters.md that the protection takes effect
on the cluster's next sync after the setting is applied
- add third exception in administrator.md "Owner References and Finalizers"
- add TestGenerateSingleUserSecret_OwnerReferences covering all four
flag combinations plus the cross-namespace cases
---------
Co-authored-by: Serdar Dalgıç <sd@serdardalgic.org>
* Use maxUnavailable for the critical-op PDB to stop idle alert noise
The critical-op PDB is created with minAvailable equal to
numberOfInstances while its selector (critical-operation=true) matches
no pods during normal operation. This leaves status.desiredHealthy at N
and currentHealthy at 0 permanently, so monitoring stacks fire alerts
like kube-prometheus-stack's KubePdbNotEnoughHealthyPods for every idle
cluster (#3020).
maxUnavailable: 0 provides the same protection while a critical
operation is running - no voluntary evictions of labeled pods - but
keeps the budget satisfied (desiredHealthy 0) when nothing matches.
When PDBs are disabled or there are no instances, the budget relaxes to
maxUnavailable 100% instead of minAvailable 0.
Fixes#3020
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Update PDB docs for critical-op maxUnavailable semantics
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Clarify why the two PDBs use different budget fields
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Felix Kunde <felix-kunde@gmx.de>
* Use minAvalable=SynchronousNodeCount + 1 in primary PDB when master selector is disabled
---------
Co-authored-by: Felix Kunde <felix-kunde@gmx.de>
Co-authored-by: Ida Novindasari <idanovinda@gmail.com>
* update golang and dependencies
* fix incorrect log formatting
* clean mod chache and introduce GOARCH in Dockerfile (choose dynamically)
* remove GO111MODULE mentions
* bump github actions from v2 to v3
* bump docker runners to v7
* use extra event store for backwards compatibility with existing codebase
* updated generated opconfig api
* feat(logical-backup): add configurable job history limits and TTL
Adds three new configuration options for logical backup cronjobs:
- logical_backup_successful_jobs_history_limit (default: 3)
- logical_backup_failed_jobs_history_limit (default: 3)
- logical_backup_ttl_seconds_after_finished (default: 86400)
These options control how many completed/failed backup jobs are
retained by Kubernetes and when finished jobs are automatically
deleted. This prevents accumulation of old backup jobs and pods
in namespaces with many PostgreSQL clusters.
Also updates the CronJob comparison logic to detect changes in
these new fields and trigger reconciliation when needed.
Closeszalando/postgres-operator#1092
* add added the 3 new fieldson crd
* updated gen api
---------
Co-authored-by: Jairo Llopis <jairo@moduon.team>
Co-authored-by: Felix Kunde <felix-kunde@gmx.de>
feat: implement service type NodePort
fix: handle LoadBalancer to NodePort service type transition
move NodePort check before LoadBalancer and remove redundant nodePor
add LB-specific DNS annotations again
* Add cluster_labels and annotations to logical backup CronJob and Jobs
When using the logical backup feature, the CronJob and its created Jobs
were missing the cluster_labels and annotations that are applied to
other cluster resources. This made it difficult to filter or identify
backup jobs using the same labels as other cluster components.
Changes:
- Added ObjectMeta with labels and annotations to JobTemplateSpec
- Updated CronJob ObjectMeta to use the merged labels (including
'application: spilo-logical-backup')
- Updated tests to expect the new labels
* fix: set password encryption default to scram-sha-256
According to the Postgres official documentation, md5 passwords is
deprecated in favor of scram-sha-256 encryption.
The change in this PR updates the default encryption to the new postgres
default.
Documentation link: https://www.postgresql.org/docs/18/auth-password.html
>Warning: Support for MD5-encrypted passwords is deprecated and will be removed in a future release of PostgreSQL.
Signed-off-by: Kadaffy Talavera <kadtalavera@gmail.com>
* fix: update user documentation about password encryption
Signed-off-by: Kadaffy Talavera <kadtalavera@gmail.com>
* Apply suggestion from @FxKu
---------
Signed-off-by: Kadaffy Talavera <kadtalavera@gmail.com>
Co-authored-by: Felix Kunde <felix-kunde@gmx.de>
* Add topologySpreadConstraints configuration to pod spec.
* Run update-codegen.sh to add deepcopy for new field to the api.
* Reuse configured TopologySpreadConstraints for logical backup.
* Remove x-kubernetes-preserve-unknown-fields and XPreserveUnknownFields.
* Add topologySpreadConstraint example in the complete manifest.
* Add support for helm chart.
* Add documentation for topologySpreadConstraint.
* Update e2e test to patch topologySpreadConstraints into the postgresqls manifest.
* For e2e test, updated the PVC retention policy to remove redundant PVCs.
* Fix e2e test, expected PVC count in end-to-end test after config changes.
* Sort postgresql.crd.yaml
* Generate postgresql CRD from go structs
* Expand sidecars, env and initcontainers
* Embed CRD to be submitted by the operator
Signed-off-by: Mikkel Oscar Lyderik Larsen <mikkel.larsen@zalando.de>
---------
Signed-off-by: Mikkel Oscar Lyderik Larsen <mikkel.larsen@zalando.de>
* Replace `golang.org/x/exp` with stdlib
These experimental packages are now available in the Go standard
library since Go 1.21.
1. golang.org/x/exp/slices -> slices [1]
2. golang.org/x/exp/maps -> maps [2]
[1]: https://go.dev/doc/go1.21#slices
[2]: https://go.dev/doc/go1.21#maps
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
* Run go mod tidy
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
---------
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
Co-authored-by: Felix Kunde <felix-kunde@gmx.de>
Create the second PDB to cover Pods with a special "critical operation" label set.
This label is going to be assigned to all pg cluster's Pods by the Operator during a PG major version upgrade, by Patroni during a cluster/replica bootstrap. It can also be set manually or by any other automation tool.
* Feat: Support Running Sidecard with a Command.
This PR addresses issue #2448 . Some containers may not have entry points, if this is the case they would need to be run using a command. This change extends the definition of sidecar so that there is an optional command field. If the field is present then the container will be run using that command. This is a two line change that is fully backward compatible.
* sync all resources to cluster fields (CronJob, Streams, Patroni resources)
* separated sync and delete logic for Patroni resources
* align delete streams and secrets logic with other resources
* rename gatherApplicationIds to getDistinctApplicationIds
* improve slot check before syncing streams CRD
* add ownerReferences and annotations diff to Patroni objects
* add extra sync code for config service so it does not get too ugly
* some bugfixes when comparing annotations and return err on found
* sync Patroni resources on update event and extended unit tests
* add config service/endpoint owner references check to e2e tes
* feat(498): Add ownerReferences to managed entities
* empty owner reference for cross namespace secret and more tests
* update ownerReferences of existing resources
* removing ownerReference requires Update API call
* CR ownerReference on PVC blocks pvc retention policy of statefulset
* make ownerreferences optional and disabled by default
* update unit test to check len ownerReferences
* update codegen
* add owner references e2e test
* update unit test
* add block_owner_deletion field to test owner reference
* fix typos and update docs once more
* reflect code feedback
---------
Co-authored-by: Max Begenau <max@begenau.com>
* Annotate PVC on Sync/Update, not only change PVC template
* Don't rotate pods when only annotations changed
* Annotate Logical Backup's and Pooler's pods
* Annotate PDB, Endpoints created by the Operator, Secrets, Logical Backup jobs
Inherited annotations are only added/updated, not removed
* Fix logical backup job toleration (now cluster and operator-wide instructions will be not ignored)
---------
Co-authored-by: Felix Kunde <felix-kunde@gmx.de>
* make bucket prefix for logical backup configurable
* include container comparison in logical backup diff
* add unit test and update description for compareContainers
* don't rely on users putting / in the config - reflect other comments from review
* allow empty resources when defaults are empty
* update codegen
* add more unit tests and remove internal resources defaults
* a unit test for min limit and raising to request
* uncomment defaults in example configmap
* simplifying pooler pod generation unit test
* Add hugepages-2Mi and 1Gi to ResourceDescription type and crd (#1549, #1788)
* Add tests for hugepages resource requests/limits
* Add tests for hugepages resource requests/limits on sidecars, too
* Add docs for hugepages support
* Add link to kubernetes docs on hugepages
* Add tests for hugepages not being set on container if not requested in custom resource
* Add hugepages resources fields to manifest docs
* Add hugepages resources fields to complete manifest example
* Add hugepages resources fields to chart crd
---------
Co-authored-by: Felix Kunde <felix-kunde@gmx.de>
* Adding custom pod labels to logical backup job
* Adding custom annotations to logical backup job pod
* Adding job InheritedAnnotations and InheritedLabel tests
adshin21
Juhani Pelli
annielzy
Tiago Condeixa
Felix Kunde
Jociele Padilha
Lucas Nikola Pape
Raphael Torquato
Kadaffy Talavera
laiminhtrung1997
Polina Bungina
Andreas Mårtensson
Mikkel Oscar Lyderik Larsen
ovnozdrach
Eng Zer Jun
Morten Lied Johansen
Tabby
Rob Nickmans
fahed dorgaa
Samuel Mutel
Vasily Oleynikov
Silas
Davide Bizzarri
andrejshapal
Stef Graces
Ida Novindasari