Add Percona Server for PostgreSQL + pg_tde image for KubeDB TDE#24
Open
tamalsaha wants to merge 3 commits into
Open
Add Percona Server for PostgreSQL + pg_tde image for KubeDB TDE#24tamalsaha wants to merge 3 commits into
tamalsaha wants to merge 3 commits into
Conversation
Build Percona Server for PostgreSQL (the fork tde_heap requires) with pg_tde on debian:bookworm, laid out to match the Docker official postgres:<major>-bookworm image so KubeDB's init-container run scripts work unchanged: postgres user at uid/gid 999, binaries on PATH at /usr/lib/postgresql/<major>/bin, and the official docker-entrypoint.sh plus gosu borrowed from that image. The build verifies pg_tde_basebackup and pg_tde_rewind are present, which the operator and pg-coordinator depend on for encrypted replica seeding and safe failback. Published as ghcr.io/appscode-images/percona-distribution-postgresql, matching the KubeDB naming convention used for other Percona products. Signed-off-by: Tamal Saha <tamal@appscode.com>
…e name Three fixes found building the image for a real amd64 cluster: - Makefile declared PLATFORM but the container target used plain docker build, so it produced a host-arch image. Cross-build via docker buildx --platform and push directly with --push. - The base layer lacked curl, which percona-release depends on, so dpkg -i of the repo package failed. Add curl and install the .deb via apt-get install so dependencies resolve. - The pg_tde package is percona-pg-tde<major> (for example percona-pg-tde17), not percona-postgresql-<major>-pg-tde. It ships the pg_tde CLI tools (pg_tde_basebackup, pg_tde_rewind, ...) at /usr/lib/postgresql/<major>/bin, which the build asserts. Verified: the image builds Percona Server for PostgreSQL 17.10.2 with pg_tde and the CLI tools present. Signed-off-by: Tamal Saha <tamal@appscode.com>
The coordinator's failback path on a WAL-encrypted cluster uses pg_tde_waldump (checkpoint-end decode) and pg_tde_resetwal in addition to pg_tde_basebackup and pg_tde_rewind. Plain pg_waldump/pg_resetwal cannot read encrypted WAL, so a Percona package that dropped these tools would silently break TDE HA failback. Assert all four in the build-time sanity check. Signed-off-by: Tamal Saha <tamal@appscode.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Builds the Percona Server for PostgreSQL + `pg_tde` db image that KubeDB's Transparent Data Encryption support needs. `pg_tde`'s `tde_heap` access method requires the Percona Server for PostgreSQL fork, so TDE cannot run on the stock `postgres:-bookworm` image.
The image is laid out to match the Docker official `postgres:-bookworm` that KubeDB already relies on, so the existing init-container run scripts work against it unchanged:
Published as `ghcr.io/appscode-images/percona-distribution-postgresql`, matching the KubeDB naming convention used for other Percona products.
Verified: `docker build --check` passes clean, and the three `COPY --from` paths exist in `postgres:17-bookworm`.