diff --git a/Makefile b/Makefile index be2300e6..729b5e1a 100644 --- a/Makefile +++ b/Makefile @@ -135,12 +135,7 @@ configmap: > config/manager/configmap.yaml svc-postgres-operator-yaml: - kubectl apply \ - -f $(POSTGRES_OPERATOR_URL)/configmap.yaml \ - -f $(POSTGRES_OPERATOR_URL)/operator-service-account-rbac.yaml \ - -f $(POSTGRES_OPERATOR_URL)/postgres-operator.yaml \ - -f $(POSTGRES_OPERATOR_URL)/api-service.yaml \ - --dry-run=client -o yaml > external/svc-postgres-operator.yaml + ./gen-operator-yaml.sh $(POSTGRES_OPERATOR_VERSION) external/svc-postgres-operator.yaml @# deep-merge every external/patches/*.yaml into the list item matching its kind and name @for p in external/patches/*.yaml; do echo "patching with $$p"; PATCH=$$p yq -i \ diff --git a/external/svc-postgres-operator.yaml b/external/svc-postgres-operator.yaml index 40b12071..33f95480 100644 --- a/external/svc-postgres-operator.yaml +++ b/external/svc-postgres-operator.yaml @@ -1,8 +1,16 @@ # THIS FILE IS GENERATED by `make svc-postgres-operator-yaml`. DO NOT EDIT MANUALLY apiVersion: v1 +kind: List items: - apiVersion: v1 + kind: ConfigMap + metadata: + name: postgres-operator data: + # additional_owner_roles: "cron_admin" + # additional_pod_capabilities: "SYS_NICE" + # additional_secret_mount: "some-secret-name" + # additional_secret_mount_path: "/some/dir" api_port: "8080" aws_region: eu-central-1 cluster_domain: cluster.local @@ -10,36 +18,43 @@ items: cluster_labels: application:spilo cluster_name_label: cluster-name connection_pooler_default_cpu_limit: "1" - connection_pooler_default_cpu_request: 500m + connection_pooler_default_cpu_request: "500m" connection_pooler_default_memory_limit: 100Mi connection_pooler_default_memory_request: 100Mi - connection_pooler_image: ghcr.io/zalando/postgres-operator/pgbouncer:v2.0.1 + connection_pooler_image: "registry.opensource.zalan.do/acid/pgbouncer:master-32" connection_pooler_max_db_connections: "60" - connection_pooler_mode: transaction + connection_pooler_mode: "transaction" connection_pooler_number_of_instances: "2" - connection_pooler_schema: pooler - connection_pooler_user: pooler - crd_categories: all + connection_pooler_schema: "pooler" + connection_pooler_user: "pooler" + crd_categories: "all" + # custom_service_annotations: "keyx:valuez,keya:valuea" + # custom_pod_annotations: "keya:valuea,keyb:valueb" db_hosted_zone: db.example.com debug_logging: "true" default_cpu_limit: "1" default_cpu_request: 100m default_memory_limit: 500Mi default_memory_request: 100Mi - docker_image: ghcr.io/zalando/spilo-18:4.1-p2 + # delete_annotation_date_key: delete-date + # delete_annotation_name_key: delete-clustername + docker_image: ghcr.io/zalando/spilo-17:4.0-p3 + # downscaler_annotations: "deployment-time,downscaler/*" enable_admin_role_for_users: "true" enable_crd_registration: "true" + enable_crd_validation: "true" enable_cross_namespace_secret: "false" - enable_database_access: "true" enable_finalizers: "false" + enable_database_access: "true" + enable_ebs_gp3_migration: "false" + enable_ebs_gp3_migration_max_size: "1000" enable_init_containers: "true" enable_lazy_spilo_upgrade: "false" - enable_maintenance_windows: "true" enable_master_load_balancer: "false" enable_master_pooler_load_balancer: "false" - enable_owner_references: "false" enable_password_rotation: "false" enable_patroni_failsafe_mode: "false" + enable_owner_references: "false" enable_persistent_volume_claim_deletion: "true" enable_pgversion_env_var: "true" enable_pod_antiaffinity: "false" @@ -58,99 +73,120 @@ items: enable_team_superuser: "false" enable_teams_api: "false" etcd_host: "" - external_traffic_policy: Cluster + external_traffic_policy: "Cluster" + # gcp_credentials: "" + # ignored_annotations: "" + # infrastructure_roles_secret_name: "postgresql-infrastructure-roles" + # infrastructure_roles_secrets: "secretname:monitoring-roles,userkey:user,passwordkey:password,rolekey:inrole" + # ignore_instance_limits_annotation_key: "" + # inherited_annotations: owned-by + # inherited_labels: application,environment + # kube_iam_role: "" kubernetes_use_configmaps: "false" + # log_s3_bucket: "" + # logical_backup_azure_storage_account_name: "" + # logical_backup_azure_storage_container: "" + # logical_backup_azure_storage_account_key: "" + # logical_backup_cpu_limit: "" + # logical_backup_cpu_request: "" logical_backup_cronjob_environment_secret: "" - logical_backup_docker_image: ghcr.io/zalando/postgres-operator/logical-backup:v2.0.1 - logical_backup_job_prefix: logical-backup- - logical_backup_provider: s3 + logical_backup_docker_image: "ghcr.io/zalando/postgres-operator/logical-backup:v1.15.1" + # logical_backup_google_application_credentials: "" + logical_backup_job_prefix: "logical-backup-" + # logical_backup_memory_limit: "" + # logical_backup_memory_request: "" + logical_backup_provider: "s3" logical_backup_s3_access_key_id: "" - logical_backup_s3_bucket: my-bucket-url - logical_backup_s3_bucket_prefix: spilo - logical_backup_s3_endpoint: "" + logical_backup_s3_bucket: "my-bucket-url" + logical_backup_s3_bucket_prefix: "spilo" logical_backup_s3_region: "" - logical_backup_s3_retention_time: "" + logical_backup_s3_endpoint: "" logical_backup_s3_secret_access_key: "" - logical_backup_s3_sse: AES256 - logical_backup_schedule: 30 00 * * * - major_version_upgrade_mode: manual - master_dns_name_format: '{cluster}.{namespace}.{hostedzone}' - master_legacy_dns_name_format: '{cluster}.{team}.{hostedzone}' + logical_backup_s3_sse: "AES256" + logical_backup_s3_retention_time: "" + logical_backup_schedule: "30 00 * * *" + major_version_upgrade_mode: "manual" + # major_version_upgrade_team_allow_list: "" + master_dns_name_format: "{cluster}.{namespace}.{hostedzone}" + master_legacy_dns_name_format: "{cluster}.{team}.{hostedzone}" master_pod_move_timeout: 20m + # max_cpu_request: "1" max_instances: "-1" + # max_memory_request: 4Gi min_cpu_limit: 250m min_instances: "-1" min_memory_limit: 250Mi - minimal_major_version: "14" + minimal_major_version: "13" + # node_readiness_label: "status:ready" + # node_readiness_label_merge: "OR" oauth_token_secret_name: postgresql-operator - pam_configuration: https://info.example.com/oauth2/tokeninfo?access_token= uid realm=/employees + pam_configuration: "https://info.example.com/oauth2/tokeninfo?access_token= uid realm=/employees" pam_role_name: zalandos + patroni_api_check_interval: "1s" + patroni_api_check_timeout: "5s" password_rotation_interval: "90" password_rotation_user_retention: "180" - patroni_api_check_interval: 1s - patroni_api_check_timeout: 5s pdb_master_label_selector: "true" - pdb_name_format: postgres-{cluster}-pdb - persistent_volume_claim_retention_policy: when_deleted:retain,when_scaled:retain + pdb_name_format: "postgres-{cluster}-pdb" + persistent_volume_claim_retention_policy: "when_deleted:retain,when_scaled:retain" pod_antiaffinity_preferred_during_scheduling: "false" - pod_antiaffinity_topology_key: kubernetes.io/hostname + pod_antiaffinity_topology_key: "kubernetes.io/hostname" pod_deletion_wait_timeout: 10m + # pod_environment_configmap: "default/my-custom-config" + # pod_environment_secret: "my-custom-secret" pod_label_wait_timeout: 10m - pod_management_policy: ordered_ready + pod_management_policy: "ordered_ready" + # pod_priority_class_name: "postgres-pod-priority" pod_role_label: spilo-role pod_service_account_definition: "" - pod_service_account_name: postgres-pod + pod_service_account_name: "postgres-pod" pod_service_account_role_binding_definition: "" pod_terminate_grace_period: 5m - postgres_superuser_teams: postgres_superusers - protected_role_names: admin,cron_admin + postgres_superuser_teams: "postgres_superusers" + protected_role_names: "admin,cron_admin" ready_wait_interval: 3s ready_wait_timeout: 30s repair_period: 5m - replica_dns_name_format: '{cluster}-repl.{namespace}.{hostedzone}' - replica_legacy_dns_name_format: '{cluster}-repl.{team}.{hostedzone}' + replica_dns_name_format: "{cluster}-repl.{namespace}.{hostedzone}" + replica_legacy_dns_name_format: "{cluster}-repl.{team}.{hostedzone}" replication_username: standby resource_check_interval: 3s resource_check_timeout: 10m resync_period: 30m ring_log_lines: "100" - role_deletion_suffix: _deleted - secret_name_template: '{username}.{cluster}.credentials.{tprkind}.{tprgroup}' - set_memory_request_to_limit: "false" + role_deletion_suffix: "_deleted" + secret_name_template: "{username}.{cluster}.credentials.{tprkind}.{tprgroup}" share_pgsocket_with_sidecars: "false" + # sidecar_docker_images: "" + set_memory_request_to_limit: "false" spilo_allow_privilege_escalation: "true" + # spilo_runasuser: 101 + # spilo_runasgroup: 103 + # spilo_fsgroup: 103 spilo_privileged: "false" - storage_resize_mode: pvc + storage_resize_mode: "pvc" super_username: postgres - target_major_version: "18" - team_admin_role: admin - team_api_role_configuration: log_statement:all + target_major_version: "17" + team_admin_role: "admin" + team_api_role_configuration: "log_statement:all" teams_api_url: http://fake-teams-api.default.svc.cluster.local - watched_namespace: '*' + # toleration: "key:db-only,operator:Exists,effect:NoSchedule" + # wal_az_storage_account: "" + # wal_gs_bucket: "" + # wal_s3_bucket: "" + watched_namespace: "*" # listen to all namespaces workers: "8" - kind: ConfigMap - metadata: - annotations: - kubectl.kubernetes.io/last-applied-configuration: | - {"apiVersion":"v1","data":{"api_port":"8080","aws_region":"eu-central-1","cluster_domain":"cluster.local","cluster_history_entries":"1000","cluster_labels":"application:spilo","cluster_name_label":"cluster-name","connection_pooler_default_cpu_limit":"1","connection_pooler_default_cpu_request":"500m","connection_pooler_default_memory_limit":"100Mi","connection_pooler_default_memory_request":"100Mi","connection_pooler_image":"ghcr.io/zalando/postgres-operator/pgbouncer:v2.0.1","connection_pooler_max_db_connections":"60","connection_pooler_mode":"transaction","connection_pooler_number_of_instances":"2","connection_pooler_schema":"pooler","connection_pooler_user":"pooler","crd_categories":"all","db_hosted_zone":"db.example.com","debug_logging":"true","default_cpu_limit":"1","default_cpu_request":"100m","default_memory_limit":"500Mi","default_memory_request":"100Mi","docker_image":"ghcr.io/zalando/spilo-18:4.1-p2","enable_admin_role_for_users":"true","enable_crd_registration":"true","enable_cross_namespace_secret":"false","enable_database_access":"true","enable_finalizers":"false","enable_init_containers":"true","enable_lazy_spilo_upgrade":"false","enable_maintenance_windows":"true","enable_master_load_balancer":"false","enable_master_pooler_load_balancer":"false","enable_owner_references":"false","enable_password_rotation":"false","enable_patroni_failsafe_mode":"false","enable_persistent_volume_claim_deletion":"true","enable_pgversion_env_var":"true","enable_pod_antiaffinity":"false","enable_pod_disruption_budget":"true","enable_postgres_team_crd":"false","enable_postgres_team_crd_superusers":"false","enable_readiness_probe":"false","enable_replica_load_balancer":"false","enable_replica_pooler_load_balancer":"false","enable_secrets_deletion":"true","enable_shm_volume":"true","enable_sidecars":"true","enable_spilo_wal_path_compat":"true","enable_team_id_clustername_prefix":"false","enable_team_member_deprecation":"false","enable_team_superuser":"false","enable_teams_api":"false","etcd_host":"","external_traffic_policy":"Cluster","kubernetes_use_configmaps":"false","logical_backup_cronjob_environment_secret":"","logical_backup_docker_image":"ghcr.io/zalando/postgres-operator/logical-backup:v2.0.1","logical_backup_job_prefix":"logical-backup-","logical_backup_provider":"s3","logical_backup_s3_access_key_id":"","logical_backup_s3_bucket":"my-bucket-url","logical_backup_s3_bucket_prefix":"spilo","logical_backup_s3_endpoint":"","logical_backup_s3_region":"","logical_backup_s3_retention_time":"","logical_backup_s3_secret_access_key":"","logical_backup_s3_sse":"AES256","logical_backup_schedule":"30 00 * * *","major_version_upgrade_mode":"manual","master_dns_name_format":"{cluster}.{namespace}.{hostedzone}","master_legacy_dns_name_format":"{cluster}.{team}.{hostedzone}","master_pod_move_timeout":"20m","max_instances":"-1","min_cpu_limit":"250m","min_instances":"-1","min_memory_limit":"250Mi","minimal_major_version":"14","oauth_token_secret_name":"postgresql-operator","pam_configuration":"https://info.example.com/oauth2/tokeninfo?access_token= uid realm=/employees","pam_role_name":"zalandos","password_rotation_interval":"90","password_rotation_user_retention":"180","patroni_api_check_interval":"1s","patroni_api_check_timeout":"5s","pdb_master_label_selector":"true","pdb_name_format":"postgres-{cluster}-pdb","persistent_volume_claim_retention_policy":"when_deleted:retain,when_scaled:retain","pod_antiaffinity_preferred_during_scheduling":"false","pod_antiaffinity_topology_key":"kubernetes.io/hostname","pod_deletion_wait_timeout":"10m","pod_label_wait_timeout":"10m","pod_management_policy":"ordered_ready","pod_role_label":"spilo-role","pod_service_account_definition":"","pod_service_account_name":"postgres-pod","pod_service_account_role_binding_definition":"","pod_terminate_grace_period":"5m","postgres_superuser_teams":"postgres_superusers","protected_role_names":"admin,cron_admin","ready_wait_interval":"3s","ready_wait_timeout":"30s","repair_period":"5m","replica_dns_name_format":"{cluster}-repl.{namespace}.{hostedzone}","replica_legacy_dns_name_format":"{cluster}-repl.{team}.{hostedzone}","replication_username":"standby","resource_check_interval":"3s","resource_check_timeout":"10m","resync_period":"30m","ring_log_lines":"100","role_deletion_suffix":"_deleted","secret_name_template":"{username}.{cluster}.credentials.{tprkind}.{tprgroup}","set_memory_request_to_limit":"false","share_pgsocket_with_sidecars":"false","spilo_allow_privilege_escalation":"true","spilo_privileged":"false","storage_resize_mode":"pvc","super_username":"postgres","target_major_version":"18","team_admin_role":"admin","team_api_role_configuration":"log_statement:all","teams_api_url":"http://fake-teams-api.default.svc.cluster.local","watched_namespace":"*","workers":"8"},"kind":"ConfigMap","metadata":{"annotations":{},"name":"postgres-operator","namespace":"default"}} - name: postgres-operator - namespace: default - apiVersion: v1 kind: ServiceAccount metadata: - annotations: - kubectl.kubernetes.io/last-applied-configuration: | - {"apiVersion":"v1","kind":"ServiceAccount","metadata":{"annotations":{},"name":"postgres-operator","namespace":"default"}} name: postgres-operator namespace: default - apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - annotations: - kubectl.kubernetes.io/last-applied-configuration: | - {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRole","metadata":{"annotations":{},"name":"postgres-operator"},"rules":[{"apiGroups":["acid.zalan.do"],"resources":["postgresqls","postgresqls/status","operatorconfigurations"],"verbs":["create","delete","deletecollection","get","list","patch","update","watch"]},{"apiGroups":["acid.zalan.do"],"resources":["postgresteams"],"verbs":["get","list","watch"]},{"apiGroups":["apiextensions.k8s.io"],"resources":["customresourcedefinitions"],"verbs":["create","get","patch","update"]},{"apiGroups":[""],"resources":["configmaps"],"verbs":["create","delete","deletecollection","get","list","patch","update","watch"]},{"apiGroups":[""],"resources":["events"],"verbs":["create","get","list","patch","update","watch"]},{"apiGroups":[""],"resources":["endpoints"],"verbs":["create","delete","deletecollection","get","list","patch","update","watch"]},{"apiGroups":[""],"resources":["secrets"],"verbs":["create","delete","get","update","patch"]},{"apiGroups":[""],"resources":["nodes"],"verbs":["get","list","watch"]},{"apiGroups":[""],"resources":["persistentvolumeclaims"],"verbs":["delete","get","list","patch","update"]},{"apiGroups":[""],"resources":["persistentvolumes"],"verbs":["get","list","update"]},{"apiGroups":[""],"resources":["pods"],"verbs":["delete","get","list","patch","update","watch"]},{"apiGroups":[""],"resources":["pods/exec"],"verbs":["create"]},{"apiGroups":[""],"resources":["services"],"verbs":["create","delete","get","patch","update"]},{"apiGroups":["apps"],"resources":["statefulsets","deployments"],"verbs":["create","delete","get","list","patch","update"]},{"apiGroups":["batch"],"resources":["cronjobs"],"verbs":["create","delete","get","list","patch","update"]},{"apiGroups":[""],"resources":["namespaces"],"verbs":["get"]},{"apiGroups":["policy"],"resources":["poddisruptionbudgets"],"verbs":["create","delete","get"]},{"apiGroups":[""],"resources":["serviceaccounts"],"verbs":["get","create"]},{"apiGroups":["rbac.authorization.k8s.io"],"resources":["rolebindings"],"verbs":["get","create"]}]} name: postgres-operator rules: + # all verbs allowed for custom operator resources - apiGroups: - acid.zalan.do resources: @@ -166,6 +202,7 @@ items: - patch - update - watch + # operator only reads PostgresTeams - apiGroups: - acid.zalan.do resources: @@ -174,6 +211,21 @@ items: - get - list - watch + # all verbs allowed for event streams (Zalando-internal feature) + # - apiGroups: + # - zalando.org + # resources: + # - fabriceventstreams + # verbs: + # - create + # - delete + # - deletecollection + # - get + # - list + # - patch + # - update + # - watch + # to create or get/update CRDs when starting up - apiGroups: - apiextensions.k8s.io resources: @@ -183,6 +235,7 @@ items: - get - patch - update + # to read configuration from ConfigMaps and help Patroni manage the cluster if endpoints are not used - apiGroups: - "" resources: @@ -196,6 +249,7 @@ items: - patch - update - watch + # to send events to the CRs - apiGroups: - "" resources: @@ -207,6 +261,7 @@ items: - patch - update - watch + # to manage endpoints which are also used by Patroni (if it is using config maps) - apiGroups: - "" resources: @@ -220,6 +275,7 @@ items: - patch - update - watch + # to CRUD secrets for database access - apiGroups: - "" resources: @@ -230,6 +286,7 @@ items: - get - update - patch + # to check nodes for node readiness label - apiGroups: - "" resources: @@ -238,6 +295,7 @@ items: - get - list - watch + # to read or delete existing PVCs. Creation via StatefulSet - apiGroups: - "" resources: @@ -248,6 +306,7 @@ items: - list - patch - update + # to read existing PVs. Creation should be done via dynamic provisioning - apiGroups: - "" resources: @@ -255,7 +314,8 @@ items: verbs: - get - list - - update + - update # only for resizing AWS volumes + # to watch Spilo pods and do rolling updates. Creation via StatefulSet - apiGroups: - "" resources: @@ -267,12 +327,14 @@ items: - patch - update - watch + # to resize the filesystem in Spilo pods when increasing volume size - apiGroups: - "" resources: - pods/exec verbs: - create + # to CRUD services to point to Postgres cluster instances - apiGroups: - "" resources: @@ -283,6 +345,7 @@ items: - get - patch - update + # to CRUD the StatefulSet which controls the Postgres cluster instances - apiGroups: - apps resources: @@ -295,6 +358,7 @@ items: - list - patch - update + # to CRUD cron jobs for logical backups - apiGroups: - batch resources: @@ -306,12 +370,14 @@ items: - list - patch - update + # to get namespaces operator resources can run in - apiGroups: - "" resources: - namespaces verbs: - get + # to define PDBs. Update happens via delete/create - apiGroups: - policy resources: @@ -320,6 +386,7 @@ items: - create - delete - get + # to create ServiceAccounts in each namespace the operator watches - apiGroups: - "" resources: @@ -327,6 +394,7 @@ items: verbs: - get - create + # to create role bindings to the postgres-pod service account - apiGroups: - rbac.authorization.k8s.io resources: @@ -334,12 +402,18 @@ items: verbs: - get - create + # to grant privilege to run privileged pods (not needed by default) + #- apiGroups: + # - extensions + # resources: + # - podsecuritypolicies + # resourceNames: + # - privileged + # verbs: + # - use - apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - annotations: - kubectl.kubernetes.io/last-applied-configuration: | - {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRoleBinding","metadata":{"annotations":{},"name":"postgres-operator"},"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"postgres-operator"},"subjects":[{"kind":"ServiceAccount","name":"postgres-operator","namespace":"default"}]} name: postgres-operator roleRef: apiGroup: rbac.authorization.k8s.io @@ -352,11 +426,9 @@ items: - apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - annotations: - kubectl.kubernetes.io/last-applied-configuration: | - {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRole","metadata":{"annotations":{},"name":"postgres-pod"},"rules":[{"apiGroups":[""],"resources":["configmaps"],"verbs":["create","delete","deletecollection","get","list","patch","update","watch"]},{"apiGroups":[""],"resources":["endpoints"],"verbs":["create","delete","deletecollection","get","list","patch","update","watch"]},{"apiGroups":[""],"resources":["pods"],"verbs":["get","list","patch","update","watch"]},{"apiGroups":[""],"resources":["services"],"verbs":["create"]}]} name: postgres-pod rules: + # Patroni needs to watch and manage config maps (or endpoints) - apiGroups: - "" resources: @@ -370,6 +442,7 @@ items: - patch - update - watch + # Patroni needs to watch and manage endpoints (or config maps) - apiGroups: - "" resources: @@ -383,6 +456,7 @@ items: - patch - update - watch + # Patroni needs to watch pods - apiGroups: - "" resources: @@ -393,74 +467,76 @@ items: - patch - update - watch + # to let Patroni create a headless service - apiGroups: - "" resources: - services verbs: - create + # to grant privilege to run privileged pods (not needed by default) + #- apiGroups: + # - extensions + # resources: + # - podsecuritypolicies + # resourceNames: + # - privileged + # verbs: + # - use - apiVersion: apps/v1 kind: Deployment metadata: - annotations: - kubectl.kubernetes.io/last-applied-configuration: | - {"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{},"labels":{"application":"postgres-operator"},"name":"postgres-operator","namespace":"default"},"spec":{"replicas":1,"selector":{"matchLabels":{"name":"postgres-operator"}},"strategy":{"type":"Recreate"},"template":{"metadata":{"labels":{"name":"postgres-operator"}},"spec":{"containers":[{"env":[{"name":"CONFIG_MAP_NAME","value":"postgres-operator"}],"image":"ghcr.io/zalando/postgres-operator:v2.0.1","imagePullPolicy":"IfNotPresent","name":"postgres-operator","resources":{"limits":{"cpu":"500m","memory":"500Mi"},"requests":{"cpu":"100m","memory":"250Mi"}},"securityContext":{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"runAsUser":1000}}],"serviceAccountName":"postgres-operator"}}}} + name: postgres-operator labels: application: postgres-operator - name: postgres-operator - namespace: default spec: replicas: 1 + strategy: + type: "Recreate" selector: matchLabels: name: postgres-operator - strategy: - type: Recreate template: metadata: labels: name: postgres-operator spec: + serviceAccountName: postgres-operator containers: - - env: - - name: CONFIG_MAP_NAME - value: postgres-operator - image: ghcr.io/zalando/postgres-operator:v2.0.1 + - name: postgres-operator + image: ghcr.io/zalando/postgres-operator:v1.15.1 imagePullPolicy: IfNotPresent - name: postgres-operator resources: - limits: - cpu: 500m - memory: 500Mi requests: cpu: 100m memory: 250Mi + limits: + cpu: 500m + memory: 500Mi securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - capabilities: - drop: - - ALL - serviceAccountName: postgres-operator + runAsNonRoot: true + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + env: + # provided additional ENV vars can overwrite individual config map entries + - name: CONFIG_MAP_NAME + value: "postgres-operator" + # In order to use the CRD OperatorConfiguration instead, uncomment these lines and comment out the two lines above + # - name: POSTGRES_OPERATOR_CONFIGURATION_OBJECT + # value: postgresql-operator-default-configuration + # Define an ID to isolate controllers from each other + # - name: CONTROLLER_ID + # value: "second-operator" - apiVersion: v1 kind: Service metadata: - annotations: - kubectl.kubernetes.io/last-applied-configuration: | - {"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"name":"postgres-operator","namespace":"default"},"spec":{"ports":[{"port":8080,"protocol":"TCP","targetPort":8080}],"selector":{"name":"postgres-operator"},"type":"ClusterIP"}} name: postgres-operator - namespace: default spec: + type: ClusterIP ports: - port: 8080 protocol: TCP targetPort: 8080 selector: name: postgres-operator - type: ClusterIP -kind: List -metadata: {} diff --git a/gen-operator-yaml.sh b/gen-operator-yaml.sh new file mode 100755 index 00000000..bbbd3211 --- /dev/null +++ b/gen-operator-yaml.sh @@ -0,0 +1,21 @@ +#!/bin/bash + +# Generate a single corev1.List of the zalando operator's default manifests, +# as consumed by pkg/operatormanager. + +set -euo pipefail + +if [ -z "${2:-}" ]; then + >&2 echo "Usage: $0 " + exit 1 +fi + +url="https://raw.githubusercontent.com/zalando/postgres-operator/$1/manifests" + +yq eval-all '[.] | {"apiVersion": "v1", "kind": "List", "items": .}' \ + <(curl -sSf "${url}/configmap.yaml") \ + <(curl -sSf "${url}/operator-service-account-rbac.yaml") \ + <(curl -sSf "${url}/postgres-operator.yaml") \ + <(curl -sSf "${url}/api-service.yaml") \ + > "$2" +