clusterdatabase-as-a-servicedata-infrastructuregolangkubernetesmanaged-servicesoperatorpostgrespostgres-operatorpostgresql
7831e2b729
With password_encryption = scram-sha-256, syncSecrets compared the stored rolpassword with a freshly generated verifier. SCRAM verifiers embed a random salt, so the strings never match and every sync cycle re-issued ALTER ROLE ... PASSWORD for every managed role, re-salting the verifier each time. Besides the WAL and audit noise, this invalidates SCRAM pass-through credentials cached by connection poolers (e.g. pgbouncer behind auth_query), causing a short window of 'password authentication failed' server logins after every sync. Verify the stored hash against the desired password instead: for SCRAM verifiers the salt and iteration count are taken from the stored value and the derived keys are compared. Hashes whose type does not match the configured password_encryption are still reported as outdated, so switching between md5 and scram-sha-256 keeps re-hashing roles as before. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .github | ||
| charts | ||
| cmd | ||
| docker | ||
| docs | ||
| e2e | ||
| hack | ||
| logical-backup | ||
| manifests | ||
| mocks | ||
| pkg | ||
| pooler | ||
| ui | ||
| .flake8 | ||
| .gitignore | ||
| .golangci.yml | ||
| .zappr.yaml | ||
| CODEOWNERS | ||
| CONTRIBUTING.md | ||
| LICENSE | ||
| MAINTAINERS | ||
| Makefile | ||
| README.md | ||
| SECURITY.md | ||
| build-ci.sh | ||
| delivery.yaml | ||
| go.mod | ||
| go.sum | ||
| mkdocs.yml | ||
| run_operator_locally.sh | ||
README.md
Postgres Operator
The Postgres Operator delivers an easy to run highly-available PostgreSQL clusters on Kubernetes (K8s) powered by Patroni. It is configured only through Postgres manifests (CRDs) to ease integration into automated CI/CD pipelines with no access to Kubernetes API directly, promoting infrastructure as code vs manual operations.
Operator features
- Rolling updates on Postgres cluster changes, incl. quick minor version updates
- Live volume resize without pod restarts (AWS EBS, PVC)
- Database connection pooling with PGBouncer
- Support fast in place major version upgrade. Supports global upgrade of all clusters.
- Pod protection during bootstrap phase and configurable maintenance windows
- Restore and cloning Postgres clusters on AWS, GCS and Azure
- Additionally logical backups to S3 or GCS bucket can be configured
- Standby cluster from S3 or GCS WAL archive or remote host
- Configurable for non-cloud environments
- Basic credential and user management on K8s, eases application deployments
- Support for custom TLS certificates
- UI to create and edit Postgres cluster manifests
- Compatible with OpenShift
- Multi-arch support
PostgreSQL features
- Supports PostgreSQL 18, starting from 14+
- Streaming replication cluster via Patroni
- Point-In-Time-Recovery with pg_basebackup / WAL-G or WAL-E via Spilo
- Preload libraries: bg_mon, pg_stat_statements, pgextwlist, pg_auth_mon
- Incl. popular Postgres extensions such as decoderbufs, hypopg, pg_cron, pg_repack, pg_partman, pg_stat_kcache, pg_audit, pgfaceting, pgq, pgvector, plpgsql_check, plproxy, postgis, roaringbitmap, set_user and timescaledb
The Postgres Operator has been developed at Zalando and is being used in production for over five years.
Supported Postgres & K8s versions
| Release | Postgres versions | K8s versions | Golang |
|---|---|---|---|
| v2.0.1 | 14 → 18 | 1.27+ | 1.26.4 |
| v1.15.1 | 13 → 17 | 1.27+ | 1.25.3 |
| v1.14.0 | 13 → 17 | 1.27+ | 1.23.4 |
| v1.13.0 | 12 → 16 | 1.27+ | 1.22.5 |
| v1.12.0 | 11 → 16 | 1.27+ | 1.22.3 |
| v1.11.0 | 11 → 16 | 1.27+ | 1.21.7 |
Getting started
For a quick first impression follow the instructions of this tutorial.
Migrating from v1 to v2 operator
If you have been using Postgres Operator since v1.x (thank you), make sure you have read the migration docs before deploying a v2 operator.
Documentation
There is a browser-friendly version of this documentation at postgres-operator.readthedocs.io