diff --git a/charts/postgres-operator/crds/operatorconfigurations.yaml b/charts/postgres-operator/crds/operatorconfigurations.yaml
index ebe4e7089..d90da0c50 100644
--- a/charts/postgres-operator/crds/operatorconfigurations.yaml
+++ b/charts/postgres-operator/crds/operatorconfigurations.yaml
@@ -942,6 +942,25 @@ spec:
super_username:
default: postgres
type: string
+ pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$'
+ connection_pooler_generate_config:
+ type: boolean
+ default: false
+ connection_pooler_command:
+ type: array
+ items:
+ type: string
+ connection_pooler_args:
+ type: array
+ items:
+ type: string
+ connection_pooler_auth_type:
+ type: string
+ default: "scram-sha-256"
+ connection_pooler_config_path:
+ type: string
+ default: "/etc/pgbouncer/pgbouncer.ini"
+ patroni:
type: object
workers:
default: 8
diff --git a/charts/postgres-operator/values.yaml b/charts/postgres-operator/values.yaml
index 4ea5b6319..3ebd118d9 100644
--- a/charts/postgres-operator/values.yaml
+++ b/charts/postgres-operator/values.yaml
@@ -479,6 +479,15 @@ configConnectionPooler:
connection_pooler_default_memory_request: 100Mi
connection_pooler_default_cpu_limit: "1"
connection_pooler_default_memory_limit: 100Mi
+ # whether the operator should generate the pgbouncer.ini config map and
+ # override the pooler container command/args (needed for images without an
+ # entrypoint that renders the config, e.g. the Chainguard FIPS pgbouncer image)
+ connection_pooler_generate_config: false
+ # connection_pooler_command: []
+ # connection_pooler_args:
+ # - "/etc/pgbouncer/pgbouncer.ini"
+ connection_pooler_auth_type: "scram-sha-256"
+ connection_pooler_config_path: "/etc/pgbouncer/pgbouncer.ini"
configPatroni:
# enable Patroni DCS failsafe_mode feature
diff --git a/docs/pgbouncer-generated-config.md b/docs/pgbouncer-generated-config.md
new file mode 100644
index 000000000..d2c670689
--- /dev/null
+++ b/docs/pgbouncer-generated-config.md
@@ -0,0 +1,133 @@
+Operator-generated PgBouncer config (Helm)
+
+By default the connection pooler relies on the PgBouncer image's entrypoint to render `pgbouncer.ini` from environment variables (this is what the bundled `ghcr.io/zalando/postgres-operator/pgbouncer` image does). Some images — for example the **Chainguard FIPS PgBouncer** image — ship no such entrypoint.
+
+When `connection_pooler_generate_config` is enabled, the operator renders the config itself instead of relying on the image. For every pooler it:
+
+- renders `pgbouncer.ini` and stores it in a ConfigMap named `-config` (e.g. `acid-minimal-cluster-pooler-config`);
+- mounts that ConfigMap into the pooler container at `connection_pooler_config_path` using a `subPath`;
+- overrides the container `command`/`args` (when set) so PgBouncer reads the mounted file;
+- stamps the pod template with an `acid.zalan.do/pgbouncer-config-checksum` annotation, so the pooler restarts automatically when the rendered config changes.
+
+The feature is **opt-in**; with the default `connection_pooler_generate_config: false` nothing changes for existing clusters.
+
+## 1. Configure the operator via the Helm chart
+
+These settings are operator-wide defaults and live under `configConnectionPooler` in the chart's `values.yaml`.
+
+```yaml
+configConnectionPooler:
+ # Point the pooler at an image whose entrypoint does NOT render pgbouncer.ini.
+ # Replace with your actual image reference.
+ connection_pooler_image: "cgr.dev/chainguard/pgbouncer-fips:latest"
+
+ # Let the operator render and own pgbouncer.ini.
+ connection_pooler_generate_config: true
+
+ # Optional: override the container entrypoint. Leave unset to keep the image's
+ # own entrypoint. Set it when the image has no entrypoint that starts pgbouncer.
+ connection_pooler_command:
+ - "pgbouncer"
+ # Args are applied only when generate_config is true. The default already points
+ # pgbouncer at the mounted config file, so you usually don't need to change it.
+ connection_pooler_args:
+ - "/etc/pgbouncer/pgbouncer.ini"
+
+ # Written into the generated pgbouncer.ini.
+ connection_pooler_auth_type: "scram-sha-256"
+ # Where the ConfigMap is mounted (and where args/command should point).
+ connection_pooler_config_path: "/etc/pgbouncer/pgbouncer.ini"
+```
+
+Install or upgrade the operator with these values:
+
+```bash
+helm upgrade --install postgres-operator ./charts/postgres-operator \
+ --namespace postgres-operator --create-namespace \
+ -f values-pooler.yaml
+```
+
+Or set individual values inline:
+
+```bash
+helm upgrade --install postgres-operator ./charts/postgres-operator \
+ --namespace postgres-operator --create-namespace \
+ --set configConnectionPooler.connection_pooler_generate_config=true \
+ --set configConnectionPooler.connection_pooler_image="cgr.dev/chainguard/pgbouncer-fips:latest"
+```
+
+| Value (under `configConnectionPooler`) | Default | Purpose |
+|---|---|---|
+| `connection_pooler_generate_config` | `false` | Master switch — render `pgbouncer.ini` into an operator-owned ConfigMap. |
+| `connection_pooler_command` | _(unset)_ | Container `command` override; unset keeps the image entrypoint. Applied only when generating. |
+| `connection_pooler_args` | `["/etc/pgbouncer/pgbouncer.ini"]` | Container `args`; applied only when generating. |
+| `connection_pooler_auth_type` | `scram-sha-256` | `auth_type` written into the rendered config. |
+| `connection_pooler_config_path` | `/etc/pgbouncer/pgbouncer.ini` | Mount path of the generated config. |
+
+## 2. Enable the pooler on a Postgres cluster
+
+The operator settings above only take effect for clusters that actually run a pooler. Enable it in the `postgresql` manifest:
+
+```yaml
+apiVersion: "acid.zalan.do/v1"
+kind: postgresql
+metadata:
+ name: acid-minimal-cluster
+ namespace: default
+spec:
+ teamId: "acid"
+ postgresql:
+ version: "17"
+ numberOfInstances: 2
+ volume:
+ size: 1Gi
+
+ # Run a master connection pooler for this cluster.
+ enableConnectionPooler: true
+ # Optionally also pool replica connections:
+ # enableReplicaConnectionPooler: true
+
+ # Per-cluster pooler overrides are optional; defaults come from the operator config.
+ connectionPooler:
+ numberOfInstances: 2
+ mode: "transaction"
+```
+
+## 3. Verify
+
+```bash
+# The operator-owned config map for the master pooler:
+kubectl get configmap acid-minimal-cluster-pooler-config -o yaml
+
+# Inspect the rendered pgbouncer.ini:
+kubectl get configmap acid-minimal-cluster-pooler-config \
+ -o jsonpath='{.data.pgbouncer\.ini}'
+
+# Confirm the pooler pod mounts it and carries the checksum annotation:
+kubectl get pod -l connection-pooler=acid-minimal-cluster-pooler \
+ -o jsonpath='{.items[0].metadata.annotations.acid\.zalan\.do/pgbouncer-config-checksum}'
+```
+
+A rendered config looks roughly like:
+
+```ini
+[databases]
+* = host=acid-minimal-cluster port=5432
+
+[pgbouncer]
+pool_mode = transaction
+auth_type = scram-sha-256
+auth_file = /etc/pgbouncer/userlist.txt
+auth_query = SELECT * FROM pooler.user_lookup($1)
+server_tls_sslmode = require
+default_pool_size = 15
+max_db_connections = 30
+```
+
+When the cluster has TLS configured (`spec.tls`), the operator additionally renders `client_tls_sslmode`, `client_tls_key_file`, and `client_tls_cert_file`.
+
+## Notes
+
+- `connection_pooler_command` and `connection_pooler_args` are applied **only** when `connection_pooler_generate_config` is `true`. With generation off, the image entrypoint runs unchanged.
+- Changing any input that affects the rendered config (mode, auth type, sizes, TLS) updates the ConfigMap and changes the checksum annotation, which rolls the pooler pods automatically.
+- The same parameters are available on the `OperatorConfiguration` CRD as `connection_pooler_generate_config`, `connection_pooler_command`, `connection_pooler_args`, `connection_pooler_auth_type`, and `connection_pooler_config_path`.
diff --git a/docs/reference/operator_parameters.md b/docs/reference/operator_parameters.md
index 02c6db8d0..24136d19c 100644
--- a/docs/reference/operator_parameters.md
+++ b/docs/reference/operator_parameters.md
@@ -1105,3 +1105,27 @@ operator being able to provide some reasonable defaults.
**connection_pooler_default_cpu_limit**
**connection_pooler_default_memory_limit**
Default resource configuration for connection pooler deployment.
+
+* **connection_pooler_generate_config**
+ When `true`, the operator renders a `pgbouncer.ini` into an operator-owned
+ ConfigMap, mounts it into the pooler pod, and overrides the container
+ command/args. Use for pgbouncer images that do not ship an entrypoint that
+ renders the config (e.g. FIPS/distroless images). The default `false`
+ preserves the stock behavior of relying on the image entrypoint.
+
+* **connection_pooler_command**
+ Container `command` override applied only when `connection_pooler_generate_config`
+ is enabled. Empty (default) keeps the image entrypoint.
+
+* **connection_pooler_args**
+ Container `args` applied only when `connection_pooler_generate_config` is
+ enabled. The default `["/etc/pgbouncer/pgbouncer.ini"]` points pgbouncer at the
+ mounted config.
+
+* **connection_pooler_auth_type**
+ `auth_type` written into the generated `pgbouncer.ini`. The default is
+ `scram-sha-256`.
+
+* **connection_pooler_config_path**
+ Mount path of the generated `pgbouncer.ini` inside the pooler container. The
+ default is `/etc/pgbouncer/pgbouncer.ini`.
diff --git a/manifests/acid.zalan.do_operatorconfigurations.yaml b/manifests/acid.zalan.do_operatorconfigurations.yaml
new file mode 100644
index 000000000..27d546ed8
--- /dev/null
+++ b/manifests/acid.zalan.do_operatorconfigurations.yaml
@@ -0,0 +1,986 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ app.kubernetes.io/name: postgres-operator
+ name: operatorconfigurations.acid.zalan.do
+spec:
+ group: acid.zalan.do
+ names:
+ categories:
+ - all
+ kind: OperatorConfiguration
+ listKind: OperatorConfigurationList
+ plural: operatorconfigurations
+ shortNames:
+ - opconfig
+ singular: operatorconfiguration
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - description: Spilo image to be used for Pods
+ jsonPath: .configuration.docker_image
+ name: Image
+ type: string
+ - description: Label for K8s resources created by operator
+ jsonPath: .configuration.kubernetes.cluster_name_label
+ name: Cluster-Label
+ type: string
+ - description: Name of service account to be used
+ jsonPath: .configuration.kubernetes.pod_service_account_name
+ name: Service-Account
+ type: string
+ - description: Minimum number of instances per Postgres cluster
+ jsonPath: .configuration.min_instances
+ name: Min-Instances
+ type: integer
+ - description: Age of the OperatorConfiguration resource
+ jsonPath: .metadata.creationTimestamp
+ name: Age
+ type: date
+ name: v1
+ schema:
+ openAPIV3Schema:
+ description: OperatorConfiguration defines the specification for the OperatorConfiguration.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ configuration:
+ description: OperatorConfigurationData defines the operation config
+ properties:
+ aws_or_gcp:
+ description: AWSGCPConfiguration defines the configuration for AWS
+ properties:
+ additional_secret_mount:
+ type: string
+ additional_secret_mount_path:
+ type: string
+ aws_region:
+ default: eu-central-1
+ type: string
+ enable_ebs_gp3_migration:
+ type: boolean
+ enable_ebs_gp3_migration_max_size:
+ format: int64
+ type: integer
+ gcp_credentials:
+ type: string
+ kube_iam_role:
+ type: string
+ log_s3_bucket:
+ type: string
+ wal_az_storage_account:
+ type: string
+ wal_gs_bucket:
+ type: string
+ wal_s3_bucket:
+ type: string
+ type: object
+ connection_pooler:
+ description: ConnectionPoolerConfiguration defines default configuration
+ for connection pooler
+ properties:
+ connection_pooler_args:
+ default:
+ - /etc/pgbouncer/pgbouncer.ini
+ items:
+ type: string
+ type: array
+ connection_pooler_auth_type:
+ default: scram-sha-256
+ type: string
+ connection_pooler_command:
+ items:
+ type: string
+ type: array
+ connection_pooler_config_path:
+ default: /etc/pgbouncer/pgbouncer.ini
+ type: string
+ connection_pooler_default_cpu_limit:
+ pattern: ^(\d+m|\d+(\.\d{1,3})?)$
+ type: string
+ connection_pooler_default_cpu_request:
+ pattern: ^(\d+m|\d+(\.\d{1,3})?)$
+ type: string
+ connection_pooler_default_memory_limit:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ connection_pooler_default_memory_request:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ connection_pooler_generate_config:
+ default: false
+ type: boolean
+ connection_pooler_image:
+ default: ghcr.io/zalando/postgres-operator/pgbouncer:latest
+ type: string
+ connection_pooler_max_db_connections:
+ format: int32
+ type: integer
+ connection_pooler_mode:
+ default: transaction
+ enum:
+ - session
+ - transaction
+ type: string
+ connection_pooler_number_of_instances:
+ default: 2
+ format: int32
+ minimum: 1
+ type: integer
+ connection_pooler_schema:
+ default: pooler
+ type: string
+ connection_pooler_user:
+ default: pooler
+ type: string
+ type: object
+ crd_categories:
+ items:
+ type: string
+ type: array
+ debug:
+ description: OperatorDebugConfiguration defines options for the debug
+ mode
+ properties:
+ debug_logging:
+ default: true
+ type: boolean
+ enable_database_access:
+ default: true
+ type: boolean
+ type: object
+ docker_image:
+ default: ghcr.io/zalando/spilo-18:4.1-p1
+ type: string
+ enable_crd_registration:
+ default: true
+ type: boolean
+ enable_lazy_spilo_upgrade:
+ type: boolean
+ enable_maintenance_windows:
+ default: true
+ type: boolean
+ enable_pgversion_env_var:
+ default: true
+ type: boolean
+ enable_shm_volume:
+ default: true
+ type: boolean
+ enable_spilo_wal_path_compat:
+ type: boolean
+ enable_team_id_clustername_prefix:
+ type: boolean
+ etcd_host:
+ default: ""
+ type: string
+ ignore_instance_limits_annotation_key:
+ type: string
+ ignore_resources_limits_annotation_key:
+ type: string
+ kubernetes:
+ description: KubernetesMetaConfiguration defines k8s conf required
+ for all Postgres clusters and the operator itself
+ properties:
+ additional_pod_capabilities:
+ items:
+ type: string
+ type: array
+ cluster_domain:
+ default: cluster.local
+ type: string
+ cluster_labels:
+ additionalProperties:
+ type: string
+ default:
+ application: spilo
+ type: object
+ cluster_name_label:
+ default: cluster-name
+ type: string
+ custom_pod_annotations:
+ additionalProperties:
+ type: string
+ type: object
+ delete_annotation_date_key:
+ type: string
+ delete_annotation_name_key:
+ type: string
+ downscaler_annotations:
+ items:
+ type: string
+ type: array
+ enable_cross_namespace_secret:
+ type: boolean
+ enable_finalizers:
+ type: boolean
+ enable_init_containers:
+ default: true
+ type: boolean
+ enable_owner_references:
+ type: boolean
+ enable_persistent_volume_claim_deletion:
+ default: true
+ type: boolean
+ enable_pod_antiaffinity:
+ type: boolean
+ enable_pod_disruption_budget:
+ default: true
+ type: boolean
+ enable_readiness_probe:
+ type: boolean
+ enable_secrets_deletion:
+ default: true
+ type: boolean
+ enable_sidecars:
+ default: true
+ type: boolean
+ ignored_annotations:
+ items:
+ type: string
+ type: array
+ infrastructure_roles_secret_name:
+ description: |-
+ NamespacedName comprises a resource name, with a mandatory namespace,
+ rendered as "/". Being a type captures intent and
+ helps make sure that UIDs, namespaced names and non-namespaced names
+ do not get conflated in code. For most use cases, namespace and name
+ will already have been format validated at the API entry point, so we
+ don't do that here. Where that's not the case (e.g. in testing),
+ consider using NamespacedNameOrDie() in testing.go in this package.
+
+ from: https://github.com/kubernetes/apimachinery/blob/master/pkg/types/namespacedname.go
+ properties:
+ name:
+ type: string
+ namespace:
+ type: string
+ required:
+ - name
+ type: object
+ infrastructure_roles_secrets:
+ description: namespaced name of the secret containing infrastructure
+ roles names and passwords
+ items:
+ properties:
+ defaultrolevalue:
+ type: string
+ defaultuservalue:
+ type: string
+ details:
+ description: This field point out the detailed yaml definition
+ of the role, if exists
+ type: string
+ passwordkey:
+ type: string
+ rolekey:
+ type: string
+ secretname:
+ description: |-
+ Name of a secret which describes the role, and optionally name of a
+ configmap with an extra information
+ properties:
+ name:
+ type: string
+ namespace:
+ type: string
+ required:
+ - name
+ type: object
+ template:
+ type: boolean
+ userkey:
+ type: string
+ type: object
+ type: array
+ inherited_annotations:
+ items:
+ type: string
+ type: array
+ inherited_labels:
+ items:
+ type: string
+ type: array
+ liveness_probe:
+ description: |-
+ Probe describes a health check to be performed against a container to determine whether it is
+ alive or ready to receive traffic.
+ properties:
+ exec:
+ description: Exec specifies a command to execute in the container.
+ properties:
+ command:
+ description: |-
+ Command is the command line to execute inside the container, the working directory for the
+ command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+ not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+ a shell, you need to explicitly call out to that shell.
+ Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ failureThreshold:
+ description: |-
+ Minimum consecutive failures for the probe to be considered failed after having succeeded.
+ Defaults to 3. Minimum value is 1.
+ format: int32
+ type: integer
+ grpc:
+ description: GRPC specifies a GRPC HealthCheckRequest.
+ properties:
+ port:
+ description: Port number of the gRPC service. Number must
+ be in the range 1 to 65535.
+ format: int32
+ type: integer
+ service:
+ default: ""
+ description: |-
+ Service is the name of the service to place in the gRPC HealthCheckRequest
+ (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+ If this is not specified, the default behavior is defined by gRPC.
+ type: string
+ required:
+ - port
+ type: object
+ httpGet:
+ description: HTTPGet specifies an HTTP GET request to perform.
+ properties:
+ host:
+ description: |-
+ Host name to connect to, defaults to the pod IP. You probably want to set
+ "Host" in httpHeaders instead.
+ type: string
+ httpHeaders:
+ description: Custom headers to set in the request. HTTP
+ allows repeated headers.
+ items:
+ description: HTTPHeader describes a custom header to
+ be used in HTTP probes
+ properties:
+ name:
+ description: |-
+ The header field name.
+ This will be canonicalized upon output, so case-variant names will be understood as the same header.
+ type: string
+ value:
+ description: The header field value
+ type: string
+ required:
+ - name
+ - value
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ path:
+ description: Path to access on the HTTP server.
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Name or number of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ scheme:
+ description: |-
+ Scheme to use for connecting to the host.
+ Defaults to HTTP.
+ type: string
+ required:
+ - port
+ type: object
+ initialDelaySeconds:
+ description: |-
+ Number of seconds after the container has started before liveness probes are initiated.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ format: int32
+ type: integer
+ periodSeconds:
+ description: |-
+ How often (in seconds) to perform the probe.
+ Default to 10 seconds. Minimum value is 1.
+ format: int32
+ type: integer
+ successThreshold:
+ description: |-
+ Minimum consecutive successes for the probe to be considered successful after having failed.
+ Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+ format: int32
+ type: integer
+ tcpSocket:
+ description: TCPSocket specifies a connection to a TCP port.
+ properties:
+ host:
+ description: 'Optional: Host name to connect to, defaults
+ to the pod IP.'
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Number or name of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ required:
+ - port
+ type: object
+ terminationGracePeriodSeconds:
+ description: |-
+ Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+ The grace period is the duration in seconds after the processes running in the pod are sent
+ a termination signal and the time when the processes are forcibly halted with a kill signal.
+ Set this value longer than the expected cleanup time for your process.
+ If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+ value overrides the value provided by the pod spec.
+ Value must be non-negative integer. The value zero indicates stop immediately via
+ the kill signal (no opportunity to shut down).
+ This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+ Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
+ format: int64
+ type: integer
+ timeoutSeconds:
+ description: |-
+ Number of seconds after which the probe times out.
+ Defaults to 1 second. Minimum value is 1.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ format: int32
+ type: integer
+ type: object
+ master_pod_move_timeout:
+ default: 20m
+ description: timeout for successful migration of master pods from
+ unschedulable node
+ type: string
+ node_readiness_label:
+ additionalProperties:
+ type: string
+ type: object
+ node_readiness_label_merge:
+ enum:
+ - AND
+ - OR
+ type: string
+ oauth_token_secret_name:
+ default: postgres-operator
+ description: namespaced name of the secret containing the OAuth2
+ token to pass to the teams API
+ properties:
+ name:
+ type: string
+ namespace:
+ type: string
+ required:
+ - name
+ type: object
+ pdb_master_label_selector:
+ default: true
+ type: boolean
+ pdb_name_format:
+ default: postgres-{cluster}-pdb
+ description: defines the template for PDB names
+ type: string
+ persistent_volume_claim_retention_policy:
+ additionalProperties:
+ type: string
+ type: object
+ pod_antiaffinity_preferred_during_scheduling:
+ type: boolean
+ pod_antiaffinity_topology_key:
+ default: kubernetes.io/hostname
+ type: string
+ pod_environment_configmap:
+ description: namespaced name of the ConfigMap with environment
+ variables to populate on every pod
+ properties:
+ name:
+ type: string
+ namespace:
+ type: string
+ required:
+ - name
+ type: object
+ pod_environment_secret:
+ type: string
+ pod_management_policy:
+ default: ordered_ready
+ enum:
+ - ordered_ready
+ - parallel
+ type: string
+ pod_priority_class_name:
+ type: string
+ pod_role_label:
+ default: spilo-role
+ type: string
+ pod_service_account_definition:
+ type: string
+ pod_service_account_name:
+ default: postgres-pod
+ type: string
+ pod_service_account_role_binding_definition:
+ type: string
+ pod_terminate_grace_period:
+ default: 5m
+ description: Postgres pods are terminated forcefully after this
+ timeout
+ type: string
+ secret_name_template:
+ default: '{username}.{cluster}.credentials.{tprkind}.{tprgroup}'
+ description: |-
+ template for database user secrets generated by the operator,
+ here username contains the namespace in the format namespace.username
+ if the user is in different namespace than cluster and cross namespace secrets
+ are enabled via `enable_cross_namespace_secret` flag in the configuration.
+ type: string
+ share_pgsocket_with_sidecars:
+ type: boolean
+ spilo_allow_privilege_escalation:
+ default: true
+ type: boolean
+ spilo_fsgroup:
+ format: int64
+ type: integer
+ spilo_privileged:
+ type: boolean
+ spilo_runasgroup:
+ format: int64
+ type: integer
+ spilo_runasuser:
+ format: int64
+ type: integer
+ storage_resize_mode:
+ default: pvc
+ enum:
+ - ebs
+ - mixed
+ - pvc
+ - "off"
+ type: string
+ toleration:
+ additionalProperties:
+ type: string
+ type: object
+ watched_namespace:
+ type: string
+ type: object
+ kubernetes_use_configmaps:
+ default: true
+ type: boolean
+ load_balancer:
+ description: LoadBalancerConfiguration defines the LB configuration
+ properties:
+ custom_service_annotations:
+ additionalProperties:
+ type: string
+ type: object
+ db_hosted_zone:
+ type: string
+ enable_master_load_balancer:
+ type: boolean
+ enable_master_node_port:
+ type: boolean
+ enable_master_pooler_load_balancer:
+ type: boolean
+ enable_master_pooler_node_port:
+ type: boolean
+ enable_replica_load_balancer:
+ type: boolean
+ enable_replica_node_port:
+ type: boolean
+ enable_replica_pooler_load_balancer:
+ type: boolean
+ enable_replica_pooler_node_port:
+ type: boolean
+ external_traffic_policy:
+ default: Cluster
+ enum:
+ - Cluster
+ - Local
+ type: string
+ master_dns_name_format:
+ default: '{cluster}.{namespace}.{hostedzone}'
+ description: defines the DNS name string template for the master
+ load balancer cluster
+ type: string
+ master_legacy_dns_name_format:
+ default: '{cluster}.{team}.{hostedzone}'
+ description: deprecated DNS template for master load balancer
+ using team name
+ type: string
+ replica_dns_name_format:
+ default: '{cluster}-repl.{namespace}.{hostedzone}'
+ description: defines the DNS name string template for the replica
+ load balancer cluster
+ type: string
+ replica_legacy_dns_name_format:
+ default: '{cluster}-repl.{team}.{hostedzone}'
+ description: deprecated DNS template for replica load balancer
+ using team name
+ type: string
+ type: object
+ logging_rest_api:
+ description: LoggingRESTAPIConfiguration defines Logging API conf
+ properties:
+ api_port:
+ default: 8080
+ type: integer
+ cluster_history_entries:
+ default: 1000
+ type: integer
+ ring_log_lines:
+ default: 100
+ type: integer
+ type: object
+ logical_backup:
+ description: OperatorLogicalBackupConfiguration defines configuration
+ for logical backup
+ properties:
+ logical_backup_azure_storage_account_key:
+ type: string
+ logical_backup_azure_storage_account_name:
+ type: string
+ logical_backup_azure_storage_container:
+ type: string
+ logical_backup_cpu_limit:
+ pattern: ^(\d+m|\d+(\.\d{1,3})?)$
+ type: string
+ logical_backup_cpu_request:
+ pattern: ^(\d+m|\d+(\.\d{1,3})?)$
+ type: string
+ logical_backup_cronjob_environment_secret:
+ type: string
+ logical_backup_docker_image:
+ default: ghcr.io/zalando/postgres-operator/logical-backup:v1.15.1
+ type: string
+ logical_backup_failed_jobs_history_limit:
+ default: 3
+ format: int32
+ minimum: 0
+ type: integer
+ logical_backup_google_application_credentials:
+ type: string
+ logical_backup_job_prefix:
+ default: logical-backup-
+ type: string
+ logical_backup_memory_limit:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ logical_backup_memory_request:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ logical_backup_provider:
+ default: s3
+ enum:
+ - az
+ - gcs
+ - s3
+ type: string
+ logical_backup_s3_access_key_id:
+ type: string
+ logical_backup_s3_bucket:
+ type: string
+ logical_backup_s3_bucket_prefix:
+ type: string
+ logical_backup_s3_endpoint:
+ type: string
+ logical_backup_s3_region:
+ type: string
+ logical_backup_s3_retention_time:
+ type: string
+ logical_backup_s3_secret_access_key:
+ type: string
+ logical_backup_s3_sse:
+ type: string
+ logical_backup_schedule:
+ default: 30 00 * * *
+ pattern: ^(\d+|\*)(/\d+)?(\s+(\d+|\*)(/\d+)?){4}$
+ type: string
+ logical_backup_successful_jobs_history_limit:
+ default: 3
+ format: int32
+ minimum: 0
+ type: integer
+ logical_backup_ttl_seconds_after_finished:
+ default: 86400
+ format: int32
+ minimum: 0
+ type: integer
+ type: object
+ maintenance_windows:
+ items:
+ pattern: ^\ *((Mon|Tue|Wed|Thu|Fri|Sat|Sun):(2[0-3]|[01]?\d):([0-5]?\d)|(2[0-3]|[01]?\d):([0-5]?\d))-((2[0-3]|[01]?\d):([0-5]?\d)|(2[0-3]|[01]?\d):([0-5]?\d))\
+ *$
+ type: string
+ type: array
+ major_version_upgrade:
+ description: MajorVersionUpgradeConfiguration defines how to execute
+ major version upgrades of Postgres.
+ properties:
+ major_version_upgrade_mode:
+ default: manual
+ enum:
+ - "off"
+ - manual
+ - full
+ type: string
+ major_version_upgrade_team_allow_list:
+ items:
+ type: string
+ type: array
+ minimal_major_version:
+ default: "14"
+ type: string
+ target_major_version:
+ default: "18"
+ type: string
+ type: object
+ max_instances:
+ default: -1
+ description: -1 = disabled
+ format: int32
+ minimum: -1
+ type: integer
+ min_instances:
+ default: -1
+ description: -1 = disabled
+ format: int32
+ minimum: -1
+ type: integer
+ patroni:
+ description: PatroniConfiguration defines configuration for Patroni
+ properties:
+ enable_patroni_failsafe_mode:
+ type: boolean
+ type: object
+ postgres_pod_resources:
+ description: PostgresPodResourcesDefaults defines the spec of default
+ resources
+ properties:
+ default_cpu_limit:
+ pattern: ^(\d+m|\d+(\.\d{1,3})?)$
+ type: string
+ default_cpu_request:
+ pattern: ^(\d+m|\d+(\.\d{1,3})?)$
+ type: string
+ default_memory_limit:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ default_memory_request:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ max_cpu_request:
+ pattern: ^(\d+m|\d+(\.\d{1,3})?)$
+ type: string
+ max_memory_request:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ min_cpu_limit:
+ pattern: ^(\d+m|\d+(\.\d{1,3})?)$
+ type: string
+ min_memory_limit:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ type: object
+ repair_period:
+ default: 5m
+ description: period between consecutive repair requests
+ type: string
+ resync_period:
+ default: 30m
+ description: period between consecutive sync requests
+ type: string
+ scalyr:
+ description: ScalyrConfiguration defines the configuration for ScalyrAPI
+ properties:
+ scalyr_api_key:
+ type: string
+ scalyr_cpu_limit:
+ default: "1"
+ pattern: ^(\d+m|\d+(\.\d{1,3})?)$
+ type: string
+ scalyr_cpu_request:
+ default: 100m
+ pattern: ^(\d+m|\d+(\.\d{1,3})?)$
+ type: string
+ scalyr_image:
+ type: string
+ scalyr_memory_limit:
+ default: 500Mi
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ scalyr_memory_request:
+ default: 50Mi
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ scalyr_server_url:
+ default: https://upload.eu.scalyr.com
+ type: string
+ type: object
+ set_memory_request_to_limit:
+ type: boolean
+ sidecar_docker_images:
+ additionalProperties:
+ type: string
+ type: object
+ sidecars:
+ type: object
+ x-kubernetes-preserve-unknown-fields: true
+ teams_api:
+ description: TeamsAPIConfiguration defines the configuration of TeamsAPI
+ properties:
+ enable_admin_role_for_users:
+ default: true
+ type: boolean
+ enable_postgres_team_crd:
+ default: true
+ type: boolean
+ enable_postgres_team_crd_superusers:
+ type: boolean
+ enable_team_member_deprecation:
+ type: boolean
+ enable_team_superuser:
+ type: boolean
+ enable_teams_api:
+ type: boolean
+ pam_configuration:
+ default: https://info.example.com/oauth2/tokeninfo?access_token=
+ uid realm=/employees
+ type: string
+ pam_role_name:
+ default: zalandos
+ type: string
+ postgres_superuser_teams:
+ items:
+ type: string
+ type: array
+ protected_role_names:
+ default:
+ - admin
+ - cron_admin
+ items:
+ type: string
+ type: array
+ role_deletion_suffix:
+ default: _deleted
+ type: string
+ team_admin_role:
+ default: admin
+ type: string
+ team_api_role_configuration:
+ additionalProperties:
+ type: string
+ default:
+ log_statement: all
+ type: object
+ teams_api_url:
+ default: https://teams.example.com/api/
+ type: string
+ type: object
+ timeouts:
+ description: OperatorTimeouts defines the timeout of ResourceCheck,
+ PodWait, ReadyWait
+ properties:
+ patroni_api_check_interval:
+ default: 1s
+ description: interval between consecutive attempts of operator
+ calling the Patroni API
+ type: string
+ patroni_api_check_timeout:
+ default: 5s
+ description: timeout when waiting for successful response from
+ Patroni API
+ type: string
+ pod_deletion_wait_timeout:
+ default: 10m
+ description: timeout when waiting for the Postgres pods to be
+ deleted
+ type: string
+ pod_label_wait_timeout:
+ default: 10m
+ description: timeout when waiting for pod role and cluster labels
+ type: string
+ ready_wait_interval:
+ default: 4s
+ description: interval between consecutive attempts waiting for
+ postgresql CRD to be created
+ type: string
+ ready_wait_timeout:
+ default: 30s
+ description: timeout for the complete postgres CRD creation
+ type: string
+ resource_check_interval:
+ default: 3s
+ description: interval to wait between consecutive attempts to
+ check for some K8s resources
+ type: string
+ resource_check_timeout:
+ default: 10m
+ description: timeout when waiting for the presence of a certain
+ K8s resource
+ type: string
+ type: object
+ users:
+ description: PostgresUsersConfiguration defines the system users of
+ Postgres.
+ properties:
+ additional_owner_roles:
+ items:
+ type: string
+ type: array
+ enable_password_rotation:
+ type: boolean
+ password_rotation_interval:
+ default: 90
+ format: int32
+ type: integer
+ password_rotation_user_retention:
+ default: 120
+ format: int32
+ type: integer
+ replication_username:
+ default: standby
+ type: string
+ super_username:
+ default: postgres
+ type: string
+ type: object
+ workers:
+ default: 8
+ format: int32
+ minimum: 1
+ type: integer
+ type: object
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ required:
+ - configuration
+ - metadata
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/manifests/acid.zalan.do_postgresteams.yaml b/manifests/acid.zalan.do_postgresteams.yaml
new file mode 100644
index 000000000..3bc7fcd1d
--- /dev/null
+++ b/manifests/acid.zalan.do_postgresteams.yaml
@@ -0,0 +1,84 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ app.kubernetes.io/name: postgres-operator
+ name: postgresteams.acid.zalan.do
+spec:
+ group: acid.zalan.do
+ names:
+ categories:
+ - all
+ kind: PostgresTeam
+ listKind: PostgresTeamList
+ plural: postgresteams
+ shortNames:
+ - pgteam
+ singular: postgresteam
+ scope: Namespaced
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: PostgresTeam defines Custom Resource Definition Object for team
+ management.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: PostgresTeamSpec defines the specification for the PostgresTeam
+ TPR.
+ properties:
+ additionalMembers:
+ additionalProperties:
+ description: List of users who will also be added to the Postgres
+ cluster.
+ items:
+ type: string
+ type: array
+ description: Map for teamId and associated additional users
+ type: object
+ additionalSuperuserTeams:
+ additionalProperties:
+ description: List of teams to become Postgres superusers
+ items:
+ type: string
+ type: array
+ description: Map for teamId and associated additional superuser teams
+ type: object
+ additionalTeams:
+ additionalProperties:
+ description: List of teams whose members will also be added to the
+ Postgres cluster.
+ items:
+ type: string
+ type: array
+ description: Map for teamId and associated additional teams
+ type: object
+ type: object
+ required:
+ - metadata
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/manifests/operatorconfiguration.crd.yaml b/manifests/operatorconfiguration.crd.yaml
index ebe4e7089..d90da0c50 100644
--- a/manifests/operatorconfiguration.crd.yaml
+++ b/manifests/operatorconfiguration.crd.yaml
@@ -942,6 +942,25 @@ spec:
super_username:
default: postgres
type: string
+ pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$'
+ connection_pooler_generate_config:
+ type: boolean
+ default: false
+ connection_pooler_command:
+ type: array
+ items:
+ type: string
+ connection_pooler_args:
+ type: array
+ items:
+ type: string
+ connection_pooler_auth_type:
+ type: string
+ default: "scram-sha-256"
+ connection_pooler_config_path:
+ type: string
+ default: "/etc/pgbouncer/pgbouncer.ini"
+ patroni:
type: object
workers:
default: 8
diff --git a/manifests/postgresql-operator-default-configuration.yaml b/manifests/postgresql-operator-default-configuration.yaml
index e25a7b339..f1168aa18 100644
--- a/manifests/postgresql-operator-default-configuration.yaml
+++ b/manifests/postgresql-operator-default-configuration.yaml
@@ -235,5 +235,11 @@ configuration:
connection_pooler_number_of_instances: 2
# connection_pooler_schema: "pooler"
# connection_pooler_user: "pooler"
+ connection_pooler_generate_config: false
+ # connection_pooler_command: []
+ # connection_pooler_args:
+ # - "/etc/pgbouncer/pgbouncer.ini"
+ connection_pooler_auth_type: "scram-sha-256"
+ connection_pooler_config_path: "/etc/pgbouncer/pgbouncer.ini"
patroni:
enable_patroni_failsafe_mode: false
diff --git a/manifests/postgresql.crd.yaml b/manifests/postgresql.crd.yaml
index 94db2d442..fd997841c 100644
--- a/manifests/postgresql.crd.yaml
+++ b/manifests/postgresql.crd.yaml
@@ -2134,9 +2134,6 @@ spec:
pattern: ^(\d+|\*)(/\d+)?(\s+(\d+|\*)(/\d+)?){4}$
type: string
maintenanceWindows:
- items:
- pattern: '^\ *((Mon|Tue|Wed|Thu|Fri|Sat|Sun):(2[0-3]|[01]?\d):([0-5]?\d)|(2[0-3]|[01]?\d):([0-5]?\d))-((2[0-3]|[01]?\d):([0-5]?\d)|(2[0-3]|[01]?\d):([0-5]?\d))\ *$'
- type: string
type: array
masterNodePort:
format: int32
@@ -2850,17 +2847,6 @@ spec:
format: int64
type: integer
standby:
- anyOf:
- - required:
- - s3_wal_path
- - required:
- - gs_wal_path
- - required:
- - standby_host
- not:
- required:
- - s3_wal_path
- - gs_wal_path
description: |-
StandbyDescription contains remote primary config and/or s3/gs wal path.
standby_host can be specified alone or together with either s3_wal_path OR gs_wal_path (mutually exclusive).
diff --git a/manifests/postgresql.crd.yaml-e b/manifests/postgresql.crd.yaml-e
new file mode 100644
index 000000000..f9536ae3e
--- /dev/null
+++ b/manifests/postgresql.crd.yaml-e
@@ -0,0 +1,4824 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ app.kubernetes.io/name: postgres-operator
+ name: postgresqls.acid.zalan.do
+spec:
+ group: acid.zalan.do
+ names:
+ categories:
+ - all
+ kind: postgresql
+ listKind: PostgresqlList
+ plural: postgresqls
+ shortNames:
+ - pg
+ singular: postgresql
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - description: Team responsible for Postgres cluster
+ jsonPath: .spec.teamId
+ name: Team
+ type: string
+ - description: PostgreSQL version
+ jsonPath: .spec.postgresql.version
+ name: Version
+ type: string
+ - description: Number of Pods per Postgres cluster
+ jsonPath: .spec.numberOfInstances
+ name: Pods
+ type: integer
+ - description: Size of the bound volume
+ jsonPath: .spec.volume.size
+ name: Volume
+ type: string
+ - description: Requested CPU for Postgres containers
+ jsonPath: .spec.resources.requests.cpu
+ name: CPU-Request
+ type: string
+ - description: Requested memory for Postgres containers
+ jsonPath: .spec.resources.requests.memory
+ name: Memory-Request
+ type: string
+ - description: Age of the PostgreSQL cluster
+ jsonPath: .metadata.creationTimestamp
+ name: Age
+ type: date
+ - description: Current sync status of postgresql resource
+ jsonPath: .status.PostgresClusterStatus
+ name: Status
+ type: string
+ name: v1
+ schema:
+ openAPIV3Schema:
+ description: Postgresql defines PostgreSQL Custom Resource Definition Object.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: PostgresSpec defines the specification for the PostgreSQL
+ TPR.
+ properties:
+ additionalVolumes:
+ items:
+ description: AdditionalVolume specs additional optional volumes
+ for statefulset
+ properties:
+ isSubPathExpr:
+ type: boolean
+ mountPath:
+ type: string
+ name:
+ type: string
+ subPath:
+ type: string
+ targetContainers:
+ items:
+ type: string
+ nullable: true
+ type: array
+ volumeSource:
+ type: object
+ x-kubernetes-preserve-unknown-fields: true
+ required:
+ - mountPath
+ - name
+ - volumeSource
+ type: object
+ type: array
+ allowedSourceRanges:
+ description: load balancers' source ranges are the same for master
+ and replica services
+ items:
+ pattern: ^((\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\.(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\.(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\.(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\/(\d|[1-2]\d|3[0-2])|(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9]))$
+ type: string
+ nullable: true
+ type: array
+ clone:
+ description: CloneDescription describes which cluster the new should
+ clone and up to which point in time
+ properties:
+ cluster:
+ type: string
+ s3_access_key_id:
+ type: string
+ s3_endpoint:
+ type: string
+ s3_force_path_style:
+ type: boolean
+ s3_secret_access_key:
+ type: string
+ s3_wal_path:
+ type: string
+ timestamp:
+ description: |-
+ The regexp matches the date-time format (RFC 3339 Section 5.6) that specifies a timezone as an offset relative to UTC
+ Example: 1996-12-19T16:39:57-08:00
+ Note: this field requires a timezone
+ pattern: ^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\.[0-9]+)?(([+-]([01][0-9]|2[0-3]):[0-5][0-9]))$
+ type: string
+ uid:
+ format: uuid
+ type: string
+ required:
+ - cluster
+ type: object
+ connectionPooler:
+ description: |-
+ ConnectionPooler Options for connection pooler
+
+ pgbouncer-large (with higher resources) or odyssey-small (with smaller
+ resources)
+ Type string `json:"type,omitempty"`
+
+ makes sense to expose. E.g. pool size (min/max boundaries), max client
+ connections etc.
+ properties:
+ dockerImage:
+ type: string
+ maxDBConnections:
+ format: int32
+ type: integer
+ mode:
+ enum:
+ - session
+ - transaction
+ type: string
+ numberOfInstances:
+ format: int32
+ minimum: 1
+ type: integer
+ resources:
+ description: Resources describes requests and limits for the cluster
+ resouces.
+ properties:
+ limits:
+ description: ResourceDescription describes CPU and memory
+ resources defined for a cluster.
+ properties:
+ cpu:
+ description: |-
+ Decimal natural followed by m, or decimal natural followed by
+ dot followed by up to three decimal digits.
+
+ This is because the Kubernetes CPU resource has millis as the
+ maximum precision. The actual values are checked in code
+ because the regular expression would be huge and horrible and
+ not very helpful in validation error messages; this one checks
+ only the format of the given number.
+
+ https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu
+
+ Note: the value specified here must not be zero or be lower
+ than the corresponding request.
+ pattern: ^(\d+m|\d+(\.\d{1,3})?)$
+ type: string
+ hugepages-1Gi:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ hugepages-2Mi:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ memory:
+ description: |-
+ You can express memory as a plain integer or as a fixed-point
+ integer using one of these suffixes: E, P, T, G, M, k. You can
+ also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki
+
+ https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory
+
+ Note: the value specified here must not be zero or be higher
+ than the corresponding limit.
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ type: object
+ requests:
+ description: ResourceDescription describes CPU and memory
+ resources defined for a cluster.
+ properties:
+ cpu:
+ description: |-
+ Decimal natural followed by m, or decimal natural followed by
+ dot followed by up to three decimal digits.
+
+ This is because the Kubernetes CPU resource has millis as the
+ maximum precision. The actual values are checked in code
+ because the regular expression would be huge and horrible and
+ not very helpful in validation error messages; this one checks
+ only the format of the given number.
+
+ https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu
+
+ Note: the value specified here must not be zero or be lower
+ than the corresponding request.
+ pattern: ^(\d+m|\d+(\.\d{1,3})?)$
+ type: string
+ hugepages-1Gi:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ hugepages-2Mi:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ memory:
+ description: |-
+ You can express memory as a plain integer or as a fixed-point
+ integer using one of these suffixes: E, P, T, G, M, k. You can
+ also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki
+
+ https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory
+
+ Note: the value specified here must not be zero or be higher
+ than the corresponding limit.
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ type: object
+ type: object
+ schema:
+ type: string
+ user:
+ type: string
+ type: object
+ databases:
+ additionalProperties:
+ type: string
+ description: |-
+ Note: usernames specified here as database owners must be declared
+ in the users key of the spec key.
+ type: object
+ dockerImage:
+ type: string
+ enableConnectionPooler:
+ type: boolean
+ enableLogicalBackup:
+ type: boolean
+ enableMasterLoadBalancer:
+ description: |-
+ vars that enable load balancers are pointers because it is important to know if any of them is omitted from the Postgres manifest
+ in that case the var evaluates to nil and the value is taken from the operator config
+ type: boolean
+ enableMasterNodePort:
+ description: |-
+ vars to enable and configure nodeport services
+ set ports to 0 or nil to let kubernetes decide which port to use
+ overrides loadbalancer configuration
+ type: boolean
+ enableMasterPoolerLoadBalancer:
+ type: boolean
+ enableMasterPoolerNodePort:
+ type: boolean
+ enableReplicaConnectionPooler:
+ type: boolean
+ enableReplicaLoadBalancer:
+ type: boolean
+ enableReplicaNodePort:
+ type: boolean
+ enableReplicaPoolerLoadBalancer:
+ type: boolean
+ enableReplicaPoolerNodePort:
+ type: boolean
+ enableShmVolume:
+ type: boolean
+ env:
+ items:
+ description: EnvVar represents an environment variable present in
+ a Container.
+ properties:
+ name:
+ description: |-
+ Name of the environment variable.
+ May consist of any printable ASCII characters except '='.
+ type: string
+ value:
+ description: |-
+ Variable references $(VAR_NAME) are expanded
+ using the previously defined environment variables in the container and
+ any service environment variables. If a variable cannot be resolved,
+ the reference in the input string will be unchanged. Double $$ are reduced
+ to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+ "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+ Escaped references will never be expanded, regardless of whether the variable
+ exists or not.
+ Defaults to "".
+ type: string
+ valueFrom:
+ description: Source for the environment variable's value. Cannot
+ be used if value is not empty.
+ properties:
+ configMapKeyRef:
+ description: Selects a key of a ConfigMap.
+ properties:
+ key:
+ description: The key to select.
+ type: string
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ optional:
+ description: Specify whether the ConfigMap or its key
+ must be defined
+ type: boolean
+ required:
+ - key
+ type: object
+ x-kubernetes-map-type: atomic
+ fieldRef:
+ description: |-
+ Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,
+ spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
+ properties:
+ apiVersion:
+ description: Version of the schema the FieldPath is
+ written in terms of, defaults to "v1".
+ type: string
+ fieldPath:
+ description: Path of the field to select in the specified
+ API version.
+ type: string
+ required:
+ - fieldPath
+ type: object
+ x-kubernetes-map-type: atomic
+ fileKeyRef:
+ description: |-
+ FileKeyRef selects a key of the env file.
+ Requires the EnvFiles feature gate to be enabled.
+ properties:
+ key:
+ description: |-
+ The key within the env file. An invalid key will prevent the pod from starting.
+ The keys defined within a source may consist of any printable ASCII characters except '='.
+ During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+ type: string
+ optional:
+ default: false
+ description: |-
+ Specify whether the file or its key must be defined. If the file or key
+ does not exist, then the env var is not published.
+ If optional is set to true and the specified key does not exist,
+ the environment variable will not be set in the Pod's containers.
+
+ If optional is set to false and the specified key does not exist,
+ an error will be returned during Pod creation.
+ type: boolean
+ path:
+ description: |-
+ The path within the volume from which to select the file.
+ Must be relative and may not contain the '..' path or start with '..'.
+ type: string
+ volumeName:
+ description: The name of the volume mount containing
+ the env file.
+ type: string
+ required:
+ - key
+ - path
+ - volumeName
+ type: object
+ x-kubernetes-map-type: atomic
+ resourceFieldRef:
+ description: |-
+ Selects a resource of the container: only resources limits and requests
+ (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
+ properties:
+ containerName:
+ description: 'Container name: required for volumes,
+ optional for env vars'
+ type: string
+ divisor:
+ anyOf:
+ - type: integer
+ - type: string
+ description: Specifies the output format of the exposed
+ resources, defaults to "1"
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ resource:
+ description: 'Required: resource to select'
+ type: string
+ required:
+ - resource
+ type: object
+ x-kubernetes-map-type: atomic
+ secretKeyRef:
+ description: Selects a key of a secret in the pod's namespace
+ properties:
+ key:
+ description: The key of the secret to select from. Must
+ be a valid secret key.
+ type: string
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ optional:
+ description: Specify whether the Secret or its key must
+ be defined
+ type: boolean
+ required:
+ - key
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ required:
+ - name
+ type: object
+ type: array
+ init_containers:
+ description: deprecated
+ items:
+ description: A single application container that you want to run
+ within a pod.
+ properties:
+ args:
+ description: |-
+ Arguments to the entrypoint.
+ The container image's CMD is used if this is not provided.
+ Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+ cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+ to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+ produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+ of whether the variable exists or not. Cannot be updated.
+ More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ command:
+ description: |-
+ Entrypoint array. Not executed within a shell.
+ The container image's ENTRYPOINT is used if this is not provided.
+ Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+ cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+ to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+ produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+ of whether the variable exists or not. Cannot be updated.
+ More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ env:
+ description: |-
+ List of environment variables to set in the container.
+ Cannot be updated.
+ items:
+ description: EnvVar represents an environment variable present
+ in a Container.
+ properties:
+ name:
+ description: |-
+ Name of the environment variable.
+ May consist of any printable ASCII characters except '='.
+ type: string
+ value:
+ description: |-
+ Variable references $(VAR_NAME) are expanded
+ using the previously defined environment variables in the container and
+ any service environment variables. If a variable cannot be resolved,
+ the reference in the input string will be unchanged. Double $$ are reduced
+ to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+ "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+ Escaped references will never be expanded, regardless of whether the variable
+ exists or not.
+ Defaults to "".
+ type: string
+ valueFrom:
+ description: Source for the environment variable's value.
+ Cannot be used if value is not empty.
+ properties:
+ configMapKeyRef:
+ description: Selects a key of a ConfigMap.
+ properties:
+ key:
+ description: The key to select.
+ type: string
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ optional:
+ description: Specify whether the ConfigMap or
+ its key must be defined
+ type: boolean
+ required:
+ - key
+ type: object
+ x-kubernetes-map-type: atomic
+ fieldRef:
+ description: |-
+ Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,
+ spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
+ properties:
+ apiVersion:
+ description: Version of the schema the FieldPath
+ is written in terms of, defaults to "v1".
+ type: string
+ fieldPath:
+ description: Path of the field to select in the
+ specified API version.
+ type: string
+ required:
+ - fieldPath
+ type: object
+ x-kubernetes-map-type: atomic
+ fileKeyRef:
+ description: |-
+ FileKeyRef selects a key of the env file.
+ Requires the EnvFiles feature gate to be enabled.
+ properties:
+ key:
+ description: |-
+ The key within the env file. An invalid key will prevent the pod from starting.
+ The keys defined within a source may consist of any printable ASCII characters except '='.
+ During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+ type: string
+ optional:
+ default: false
+ description: |-
+ Specify whether the file or its key must be defined. If the file or key
+ does not exist, then the env var is not published.
+ If optional is set to true and the specified key does not exist,
+ the environment variable will not be set in the Pod's containers.
+
+ If optional is set to false and the specified key does not exist,
+ an error will be returned during Pod creation.
+ type: boolean
+ path:
+ description: |-
+ The path within the volume from which to select the file.
+ Must be relative and may not contain the '..' path or start with '..'.
+ type: string
+ volumeName:
+ description: The name of the volume mount containing
+ the env file.
+ type: string
+ required:
+ - key
+ - path
+ - volumeName
+ type: object
+ x-kubernetes-map-type: atomic
+ resourceFieldRef:
+ description: |-
+ Selects a resource of the container: only resources limits and requests
+ (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
+ properties:
+ containerName:
+ description: 'Container name: required for volumes,
+ optional for env vars'
+ type: string
+ divisor:
+ anyOf:
+ - type: integer
+ - type: string
+ description: Specifies the output format of the
+ exposed resources, defaults to "1"
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ resource:
+ description: 'Required: resource to select'
+ type: string
+ required:
+ - resource
+ type: object
+ x-kubernetes-map-type: atomic
+ secretKeyRef:
+ description: Selects a key of a secret in the pod's
+ namespace
+ properties:
+ key:
+ description: The key of the secret to select from. Must
+ be a valid secret key.
+ type: string
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ optional:
+ description: Specify whether the Secret or its
+ key must be defined
+ type: boolean
+ required:
+ - key
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ required:
+ - name
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ envFrom:
+ description: |-
+ List of sources to populate environment variables in the container.
+ The keys defined within a source may consist of any printable ASCII characters except '='.
+ When a key exists in multiple
+ sources, the value associated with the last source will take precedence.
+ Values defined by an Env with a duplicate key will take precedence.
+ Cannot be updated.
+ items:
+ description: EnvFromSource represents the source of a set
+ of ConfigMaps or Secrets
+ properties:
+ configMapRef:
+ description: The ConfigMap to select from
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ optional:
+ description: Specify whether the ConfigMap must be
+ defined
+ type: boolean
+ type: object
+ x-kubernetes-map-type: atomic
+ prefix:
+ description: |-
+ Optional text to prepend to the name of each environment variable.
+ May consist of any printable ASCII characters except '='.
+ type: string
+ secretRef:
+ description: The Secret to select from
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ optional:
+ description: Specify whether the Secret must be defined
+ type: boolean
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ image:
+ description: |-
+ Container image name.
+ More info: https://kubernetes.io/docs/concepts/containers/images
+ This field is optional to allow higher level config management to default or override
+ container images in workload controllers like Deployments and StatefulSets.
+ type: string
+ imagePullPolicy:
+ description: |-
+ Image pull policy.
+ One of Always, Never, IfNotPresent.
+ Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+ Cannot be updated.
+ More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+ type: string
+ lifecycle:
+ description: |-
+ Actions that the management system should take in response to container lifecycle events.
+ Cannot be updated.
+ properties:
+ postStart:
+ description: |-
+ PostStart is called immediately after a container is created. If the handler fails,
+ the container is terminated and restarted according to its restart policy.
+ Other management of the container blocks until the hook completes.
+ More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
+ properties:
+ exec:
+ description: Exec specifies a command to execute in
+ the container.
+ properties:
+ command:
+ description: |-
+ Command is the command line to execute inside the container, the working directory for the
+ command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+ not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+ a shell, you need to explicitly call out to that shell.
+ Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ httpGet:
+ description: HTTPGet specifies an HTTP GET request to
+ perform.
+ properties:
+ host:
+ description: |-
+ Host name to connect to, defaults to the pod IP. You probably want to set
+ "Host" in httpHeaders instead.
+ type: string
+ httpHeaders:
+ description: Custom headers to set in the request.
+ HTTP allows repeated headers.
+ items:
+ description: HTTPHeader describes a custom header
+ to be used in HTTP probes
+ properties:
+ name:
+ description: |-
+ The header field name.
+ This will be canonicalized upon output, so case-variant names will be understood as the same header.
+ type: string
+ value:
+ description: The header field value
+ type: string
+ required:
+ - name
+ - value
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ path:
+ description: Path to access on the HTTP server.
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Name or number of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ scheme:
+ description: |-
+ Scheme to use for connecting to the host.
+ Defaults to HTTP.
+ type: string
+ required:
+ - port
+ type: object
+ sleep:
+ description: Sleep represents a duration that the container
+ should sleep.
+ properties:
+ seconds:
+ description: Seconds is the number of seconds to
+ sleep.
+ format: int64
+ type: integer
+ required:
+ - seconds
+ type: object
+ tcpSocket:
+ description: |-
+ Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept
+ for backward compatibility. There is no validation of this field and
+ lifecycle hooks will fail at runtime when it is specified.
+ properties:
+ host:
+ description: 'Optional: Host name to connect to,
+ defaults to the pod IP.'
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Number or name of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ required:
+ - port
+ type: object
+ type: object
+ preStop:
+ description: |-
+ PreStop is called immediately before a container is terminated due to an
+ API request or management event such as liveness/startup probe failure,
+ preemption, resource contention, etc. The handler is not called if the
+ container crashes or exits. The Pod's termination grace period countdown begins before the
+ PreStop hook is executed. Regardless of the outcome of the handler, the
+ container will eventually terminate within the Pod's termination grace
+ period (unless delayed by finalizers). Other management of the container blocks until the hook completes
+ or until the termination grace period is reached.
+ More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
+ properties:
+ exec:
+ description: Exec specifies a command to execute in
+ the container.
+ properties:
+ command:
+ description: |-
+ Command is the command line to execute inside the container, the working directory for the
+ command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+ not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+ a shell, you need to explicitly call out to that shell.
+ Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ httpGet:
+ description: HTTPGet specifies an HTTP GET request to
+ perform.
+ properties:
+ host:
+ description: |-
+ Host name to connect to, defaults to the pod IP. You probably want to set
+ "Host" in httpHeaders instead.
+ type: string
+ httpHeaders:
+ description: Custom headers to set in the request.
+ HTTP allows repeated headers.
+ items:
+ description: HTTPHeader describes a custom header
+ to be used in HTTP probes
+ properties:
+ name:
+ description: |-
+ The header field name.
+ This will be canonicalized upon output, so case-variant names will be understood as the same header.
+ type: string
+ value:
+ description: The header field value
+ type: string
+ required:
+ - name
+ - value
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ path:
+ description: Path to access on the HTTP server.
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Name or number of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ scheme:
+ description: |-
+ Scheme to use for connecting to the host.
+ Defaults to HTTP.
+ type: string
+ required:
+ - port
+ type: object
+ sleep:
+ description: Sleep represents a duration that the container
+ should sleep.
+ properties:
+ seconds:
+ description: Seconds is the number of seconds to
+ sleep.
+ format: int64
+ type: integer
+ required:
+ - seconds
+ type: object
+ tcpSocket:
+ description: |-
+ Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept
+ for backward compatibility. There is no validation of this field and
+ lifecycle hooks will fail at runtime when it is specified.
+ properties:
+ host:
+ description: 'Optional: Host name to connect to,
+ defaults to the pod IP.'
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Number or name of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ required:
+ - port
+ type: object
+ type: object
+ stopSignal:
+ description: |-
+ StopSignal defines which signal will be sent to a container when it is being stopped.
+ If not specified, the default is defined by the container runtime in use.
+ StopSignal can only be set for Pods with a non-empty .spec.os.name
+ type: string
+ type: object
+ livenessProbe:
+ description: |-
+ Periodic probe of container liveness.
+ Container will be restarted if the probe fails.
+ Cannot be updated.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ properties:
+ exec:
+ description: Exec specifies a command to execute in the
+ container.
+ properties:
+ command:
+ description: |-
+ Command is the command line to execute inside the container, the working directory for the
+ command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+ not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+ a shell, you need to explicitly call out to that shell.
+ Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ failureThreshold:
+ description: |-
+ Minimum consecutive failures for the probe to be considered failed after having succeeded.
+ Defaults to 3. Minimum value is 1.
+ format: int32
+ type: integer
+ grpc:
+ description: GRPC specifies a GRPC HealthCheckRequest.
+ properties:
+ port:
+ description: Port number of the gRPC service. Number
+ must be in the range 1 to 65535.
+ format: int32
+ type: integer
+ service:
+ default: ""
+ description: |-
+ Service is the name of the service to place in the gRPC HealthCheckRequest
+ (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+ If this is not specified, the default behavior is defined by gRPC.
+ type: string
+ required:
+ - port
+ type: object
+ httpGet:
+ description: HTTPGet specifies an HTTP GET request to perform.
+ properties:
+ host:
+ description: |-
+ Host name to connect to, defaults to the pod IP. You probably want to set
+ "Host" in httpHeaders instead.
+ type: string
+ httpHeaders:
+ description: Custom headers to set in the request. HTTP
+ allows repeated headers.
+ items:
+ description: HTTPHeader describes a custom header
+ to be used in HTTP probes
+ properties:
+ name:
+ description: |-
+ The header field name.
+ This will be canonicalized upon output, so case-variant names will be understood as the same header.
+ type: string
+ value:
+ description: The header field value
+ type: string
+ required:
+ - name
+ - value
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ path:
+ description: Path to access on the HTTP server.
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Name or number of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ scheme:
+ description: |-
+ Scheme to use for connecting to the host.
+ Defaults to HTTP.
+ type: string
+ required:
+ - port
+ type: object
+ initialDelaySeconds:
+ description: |-
+ Number of seconds after the container has started before liveness probes are initiated.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ format: int32
+ type: integer
+ periodSeconds:
+ description: |-
+ How often (in seconds) to perform the probe.
+ Default to 10 seconds. Minimum value is 1.
+ format: int32
+ type: integer
+ successThreshold:
+ description: |-
+ Minimum consecutive successes for the probe to be considered successful after having failed.
+ Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+ format: int32
+ type: integer
+ tcpSocket:
+ description: TCPSocket specifies a connection to a TCP port.
+ properties:
+ host:
+ description: 'Optional: Host name to connect to, defaults
+ to the pod IP.'
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Number or name of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ required:
+ - port
+ type: object
+ terminationGracePeriodSeconds:
+ description: |-
+ Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+ The grace period is the duration in seconds after the processes running in the pod are sent
+ a termination signal and the time when the processes are forcibly halted with a kill signal.
+ Set this value longer than the expected cleanup time for your process.
+ If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+ value overrides the value provided by the pod spec.
+ Value must be non-negative integer. The value zero indicates stop immediately via
+ the kill signal (no opportunity to shut down).
+ This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+ Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
+ format: int64
+ type: integer
+ timeoutSeconds:
+ description: |-
+ Number of seconds after which the probe times out.
+ Defaults to 1 second. Minimum value is 1.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ format: int32
+ type: integer
+ type: object
+ name:
+ description: |-
+ Name of the container specified as a DNS_LABEL.
+ Each container in a pod must have a unique name (DNS_LABEL).
+ Cannot be updated.
+ type: string
+ ports:
+ description: |-
+ List of ports to expose from the container. Not specifying a port here
+ DOES NOT prevent that port from being exposed. Any port which is
+ listening on the default "0.0.0.0" address inside a container will be
+ accessible from the network.
+ Modifying this array with strategic merge patch may corrupt the data.
+ For more information See https://github.com/kubernetes/kubernetes/issues/108255.
+ Cannot be updated.
+ items:
+ description: ContainerPort represents a network port in a
+ single container.
+ properties:
+ containerPort:
+ description: |-
+ Number of port to expose on the pod's IP address.
+ This must be a valid port number, 0 < x < 65536.
+ format: int32
+ type: integer
+ hostIP:
+ description: What host IP to bind the external port to.
+ type: string
+ hostPort:
+ description: |-
+ Number of port to expose on the host.
+ If specified, this must be a valid port number, 0 < x < 65536.
+ If HostNetwork is specified, this must match ContainerPort.
+ Most containers do not need this.
+ format: int32
+ type: integer
+ name:
+ description: |-
+ If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
+ named port in a pod must have a unique name. Name for the port that can be
+ referred to by services.
+ type: string
+ protocol:
+ default: TCP
+ description: |-
+ Protocol for port. Must be UDP, TCP, or SCTP.
+ Defaults to "TCP".
+ type: string
+ required:
+ - containerPort
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - containerPort
+ - protocol
+ x-kubernetes-list-type: map
+ readinessProbe:
+ description: |-
+ Periodic probe of container service readiness.
+ Container will be removed from service endpoints if the probe fails.
+ Cannot be updated.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ properties:
+ exec:
+ description: Exec specifies a command to execute in the
+ container.
+ properties:
+ command:
+ description: |-
+ Command is the command line to execute inside the container, the working directory for the
+ command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+ not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+ a shell, you need to explicitly call out to that shell.
+ Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ failureThreshold:
+ description: |-
+ Minimum consecutive failures for the probe to be considered failed after having succeeded.
+ Defaults to 3. Minimum value is 1.
+ format: int32
+ type: integer
+ grpc:
+ description: GRPC specifies a GRPC HealthCheckRequest.
+ properties:
+ port:
+ description: Port number of the gRPC service. Number
+ must be in the range 1 to 65535.
+ format: int32
+ type: integer
+ service:
+ default: ""
+ description: |-
+ Service is the name of the service to place in the gRPC HealthCheckRequest
+ (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+ If this is not specified, the default behavior is defined by gRPC.
+ type: string
+ required:
+ - port
+ type: object
+ httpGet:
+ description: HTTPGet specifies an HTTP GET request to perform.
+ properties:
+ host:
+ description: |-
+ Host name to connect to, defaults to the pod IP. You probably want to set
+ "Host" in httpHeaders instead.
+ type: string
+ httpHeaders:
+ description: Custom headers to set in the request. HTTP
+ allows repeated headers.
+ items:
+ description: HTTPHeader describes a custom header
+ to be used in HTTP probes
+ properties:
+ name:
+ description: |-
+ The header field name.
+ This will be canonicalized upon output, so case-variant names will be understood as the same header.
+ type: string
+ value:
+ description: The header field value
+ type: string
+ required:
+ - name
+ - value
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ path:
+ description: Path to access on the HTTP server.
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Name or number of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ scheme:
+ description: |-
+ Scheme to use for connecting to the host.
+ Defaults to HTTP.
+ type: string
+ required:
+ - port
+ type: object
+ initialDelaySeconds:
+ description: |-
+ Number of seconds after the container has started before liveness probes are initiated.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ format: int32
+ type: integer
+ periodSeconds:
+ description: |-
+ How often (in seconds) to perform the probe.
+ Default to 10 seconds. Minimum value is 1.
+ format: int32
+ type: integer
+ successThreshold:
+ description: |-
+ Minimum consecutive successes for the probe to be considered successful after having failed.
+ Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+ format: int32
+ type: integer
+ tcpSocket:
+ description: TCPSocket specifies a connection to a TCP port.
+ properties:
+ host:
+ description: 'Optional: Host name to connect to, defaults
+ to the pod IP.'
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Number or name of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ required:
+ - port
+ type: object
+ terminationGracePeriodSeconds:
+ description: |-
+ Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+ The grace period is the duration in seconds after the processes running in the pod are sent
+ a termination signal and the time when the processes are forcibly halted with a kill signal.
+ Set this value longer than the expected cleanup time for your process.
+ If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+ value overrides the value provided by the pod spec.
+ Value must be non-negative integer. The value zero indicates stop immediately via
+ the kill signal (no opportunity to shut down).
+ This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+ Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
+ format: int64
+ type: integer
+ timeoutSeconds:
+ description: |-
+ Number of seconds after which the probe times out.
+ Defaults to 1 second. Minimum value is 1.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ format: int32
+ type: integer
+ type: object
+ resizePolicy:
+ description: |-
+ Resources resize policy for the container.
+ This field cannot be set on ephemeral containers.
+ items:
+ description: ContainerResizePolicy represents resource resize
+ policy for the container.
+ properties:
+ resourceName:
+ description: |-
+ Name of the resource to which this resource resize policy applies.
+ Supported values: cpu, memory.
+ type: string
+ restartPolicy:
+ description: |-
+ Restart policy to apply when specified resource is resized.
+ If not specified, it defaults to NotRequired.
+ type: string
+ required:
+ - resourceName
+ - restartPolicy
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ resources:
+ description: |-
+ Compute Resources required by this container.
+ Cannot be updated.
+ More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ properties:
+ claims:
+ description: |-
+ Claims lists the names of resources, defined in spec.resourceClaims,
+ that are used by this container.
+
+ This field depends on the
+ DynamicResourceAllocation feature gate.
+
+ This field is immutable. It can only be set for containers.
+ items:
+ description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+ properties:
+ name:
+ description: |-
+ Name must match the name of one entry in pod.spec.resourceClaims of
+ the Pod where this field is used. It makes that resource available
+ inside a container.
+ type: string
+ request:
+ description: |-
+ Request is the name chosen for a request in the referenced claim.
+ If empty, everything from the claim is made available, otherwise
+ only the result of this request.
+ type: string
+ required:
+ - name
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ limits:
+ additionalProperties:
+ anyOf:
+ - type: integer
+ - type: string
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ description: |-
+ Limits describes the maximum amount of compute resources allowed.
+ More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ type: object
+ requests:
+ additionalProperties:
+ anyOf:
+ - type: integer
+ - type: string
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ description: |-
+ Requests describes the minimum amount of compute resources required.
+ If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+ otherwise to an implementation-defined value. Requests cannot exceed Limits.
+ More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ type: object
+ type: object
+ restartPolicy:
+ description: |-
+ RestartPolicy defines the restart behavior of individual containers in a pod.
+ This overrides the pod-level restart policy. When this field is not specified,
+ the restart behavior is defined by the Pod's restart policy and the container type.
+ Additionally, setting the RestartPolicy as "Always" for the init container will
+ have the following effect:
+ this init container will be continually restarted on
+ exit until all regular containers have terminated. Once all regular
+ containers have completed, all init containers with restartPolicy "Always"
+ will be shut down. This lifecycle differs from normal init containers and
+ is often referred to as a "sidecar" container. Although this init
+ container still starts in the init container sequence, it does not wait
+ for the container to complete before proceeding to the next init
+ container. Instead, the next init container starts immediately after this
+ init container is started, or after any startupProbe has successfully
+ completed.
+ type: string
+ restartPolicyRules:
+ description: |-
+ Represents a list of rules to be checked to determine if the
+ container should be restarted on exit. The rules are evaluated in
+ order. Once a rule matches a container exit condition, the remaining
+ rules are ignored. If no rule matches the container exit condition,
+ the Container-level restart policy determines the whether the container
+ is restarted or not. Constraints on the rules:
+ - At most 20 rules are allowed.
+ - Rules can have the same action.
+ - Identical rules are not forbidden in validations.
+ When rules are specified, container MUST set RestartPolicy explicitly
+ even it if matches the Pod's RestartPolicy.
+ items:
+ description: ContainerRestartRule describes how a container
+ exit is handled.
+ properties:
+ action:
+ description: |-
+ Specifies the action taken on a container exit if the requirements
+ are satisfied. The only possible value is "Restart" to restart the
+ container.
+ type: string
+ exitCodes:
+ description: Represents the exit codes to check on container
+ exits.
+ properties:
+ operator:
+ description: |-
+ Represents the relationship between the container exit code(s) and the
+ specified values. Possible values are:
+ - In: the requirement is satisfied if the container exit code is in the
+ set of specified values.
+ - NotIn: the requirement is satisfied if the container exit code is
+ not in the set of specified values.
+ type: string
+ values:
+ description: |-
+ Specifies the set of values to check for container exit codes.
+ At most 255 elements are allowed.
+ items:
+ format: int32
+ type: integer
+ type: array
+ x-kubernetes-list-type: set
+ required:
+ - operator
+ type: object
+ required:
+ - action
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ securityContext:
+ description: |-
+ SecurityContext defines the security options the container should be run with.
+ If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
+ More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+ properties:
+ allowPrivilegeEscalation:
+ description: |-
+ AllowPrivilegeEscalation controls whether a process can gain more
+ privileges than its parent process. This bool directly controls if
+ the no_new_privs flag will be set on the container process.
+ AllowPrivilegeEscalation is true always when the container is:
+ 1) run as Privileged
+ 2) has CAP_SYS_ADMIN
+ Note that this field cannot be set when spec.os.name is windows.
+ type: boolean
+ appArmorProfile:
+ description: |-
+ appArmorProfile is the AppArmor options to use by this container. If set, this profile
+ overrides the pod's appArmorProfile.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ localhostProfile:
+ description: |-
+ localhostProfile indicates a profile loaded on the node that should be used.
+ The profile must be preconfigured on the node to work.
+ Must match the loaded name of the profile.
+ Must be set if and only if type is "Localhost".
+ type: string
+ type:
+ description: |-
+ type indicates which kind of AppArmor profile will be applied.
+ Valid options are:
+ Localhost - a profile pre-loaded on the node.
+ RuntimeDefault - the container runtime's default profile.
+ Unconfined - no AppArmor enforcement.
+ type: string
+ required:
+ - type
+ type: object
+ capabilities:
+ description: |-
+ The capabilities to add/drop when running containers.
+ Defaults to the default set of capabilities granted by the container runtime.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ add:
+ description: Added capabilities
+ items:
+ description: Capability represent POSIX capabilities
+ type
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ drop:
+ description: Removed capabilities
+ items:
+ description: Capability represent POSIX capabilities
+ type
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ privileged:
+ description: |-
+ Run container in privileged mode.
+ Processes in privileged containers are essentially equivalent to root on the host.
+ Defaults to false.
+ Note that this field cannot be set when spec.os.name is windows.
+ type: boolean
+ procMount:
+ description: |-
+ procMount denotes the type of proc mount to use for the containers.
+ The default value is Default which uses the container runtime defaults for
+ readonly paths and masked paths.
+ Note that this field cannot be set when spec.os.name is windows.
+ type: string
+ readOnlyRootFilesystem:
+ description: |-
+ Whether this container has a read-only root filesystem.
+ Default is false.
+ Note that this field cannot be set when spec.os.name is windows.
+ type: boolean
+ runAsGroup:
+ description: |-
+ The GID to run the entrypoint of the container process.
+ Uses runtime default if unset.
+ May also be set in PodSecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ runAsNonRoot:
+ description: |-
+ Indicates that the container must run as a non-root user.
+ If true, the Kubelet will validate the image at runtime to ensure that it
+ does not run as UID 0 (root) and fail to start the container if it does.
+ If unset or false, no such validation will be performed.
+ May also be set in PodSecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence.
+ type: boolean
+ runAsUser:
+ description: |-
+ The UID to run the entrypoint of the container process.
+ Defaults to user specified in image metadata if unspecified.
+ May also be set in PodSecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ seLinuxOptions:
+ description: |-
+ The SELinux context to be applied to the container.
+ If unspecified, the container runtime will allocate a random SELinux context for each
+ container. May also be set in PodSecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ level:
+ description: Level is SELinux level label that applies
+ to the container.
+ type: string
+ role:
+ description: Role is a SELinux role label that applies
+ to the container.
+ type: string
+ type:
+ description: Type is a SELinux type label that applies
+ to the container.
+ type: string
+ user:
+ description: User is a SELinux user label that applies
+ to the container.
+ type: string
+ type: object
+ seccompProfile:
+ description: |-
+ The seccomp options to use by this container. If seccomp options are
+ provided at both the pod & container level, the container options
+ override the pod options.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ localhostProfile:
+ description: |-
+ localhostProfile indicates a profile defined in a file on the node should be used.
+ The profile must be preconfigured on the node to work.
+ Must be a descending path, relative to the kubelet's configured seccomp profile location.
+ Must be set if type is "Localhost". Must NOT be set for any other type.
+ type: string
+ type:
+ description: |-
+ type indicates which kind of seccomp profile will be applied.
+ Valid options are:
+
+ Localhost - a profile defined in a file on the node should be used.
+ RuntimeDefault - the container runtime default profile should be used.
+ Unconfined - no profile should be applied.
+ type: string
+ required:
+ - type
+ type: object
+ windowsOptions:
+ description: |-
+ The Windows specific settings applied to all containers.
+ If unspecified, the options from the PodSecurityContext will be used.
+ If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+ Note that this field cannot be set when spec.os.name is linux.
+ properties:
+ gmsaCredentialSpec:
+ description: |-
+ GMSACredentialSpec is where the GMSA admission webhook
+ (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
+ GMSA credential spec named by the GMSACredentialSpecName field.
+ type: string
+ gmsaCredentialSpecName:
+ description: GMSACredentialSpecName is the name of the
+ GMSA credential spec to use.
+ type: string
+ hostProcess:
+ description: |-
+ HostProcess determines if a container should be run as a 'Host Process' container.
+ All of a Pod's containers must have the same effective HostProcess value
+ (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
+ In addition, if HostProcess is true then HostNetwork must also be set to true.
+ type: boolean
+ runAsUserName:
+ description: |-
+ The UserName in Windows to run the entrypoint of the container process.
+ Defaults to the user specified in image metadata if unspecified.
+ May also be set in PodSecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence.
+ type: string
+ type: object
+ type: object
+ startupProbe:
+ description: |-
+ StartupProbe indicates that the Pod has successfully initialized.
+ If specified, no other probes are executed until this completes successfully.
+ If this probe fails, the Pod will be restarted, just as if the livenessProbe failed.
+ This can be used to provide different probe parameters at the beginning of a Pod's lifecycle,
+ when it might take a long time to load data or warm a cache, than during steady-state operation.
+ This cannot be updated.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ properties:
+ exec:
+ description: Exec specifies a command to execute in the
+ container.
+ properties:
+ command:
+ description: |-
+ Command is the command line to execute inside the container, the working directory for the
+ command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+ not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+ a shell, you need to explicitly call out to that shell.
+ Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ failureThreshold:
+ description: |-
+ Minimum consecutive failures for the probe to be considered failed after having succeeded.
+ Defaults to 3. Minimum value is 1.
+ format: int32
+ type: integer
+ grpc:
+ description: GRPC specifies a GRPC HealthCheckRequest.
+ properties:
+ port:
+ description: Port number of the gRPC service. Number
+ must be in the range 1 to 65535.
+ format: int32
+ type: integer
+ service:
+ default: ""
+ description: |-
+ Service is the name of the service to place in the gRPC HealthCheckRequest
+ (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+ If this is not specified, the default behavior is defined by gRPC.
+ type: string
+ required:
+ - port
+ type: object
+ httpGet:
+ description: HTTPGet specifies an HTTP GET request to perform.
+ properties:
+ host:
+ description: |-
+ Host name to connect to, defaults to the pod IP. You probably want to set
+ "Host" in httpHeaders instead.
+ type: string
+ httpHeaders:
+ description: Custom headers to set in the request. HTTP
+ allows repeated headers.
+ items:
+ description: HTTPHeader describes a custom header
+ to be used in HTTP probes
+ properties:
+ name:
+ description: |-
+ The header field name.
+ This will be canonicalized upon output, so case-variant names will be understood as the same header.
+ type: string
+ value:
+ description: The header field value
+ type: string
+ required:
+ - name
+ - value
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ path:
+ description: Path to access on the HTTP server.
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Name or number of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ scheme:
+ description: |-
+ Scheme to use for connecting to the host.
+ Defaults to HTTP.
+ type: string
+ required:
+ - port
+ type: object
+ initialDelaySeconds:
+ description: |-
+ Number of seconds after the container has started before liveness probes are initiated.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ format: int32
+ type: integer
+ periodSeconds:
+ description: |-
+ How often (in seconds) to perform the probe.
+ Default to 10 seconds. Minimum value is 1.
+ format: int32
+ type: integer
+ successThreshold:
+ description: |-
+ Minimum consecutive successes for the probe to be considered successful after having failed.
+ Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+ format: int32
+ type: integer
+ tcpSocket:
+ description: TCPSocket specifies a connection to a TCP port.
+ properties:
+ host:
+ description: 'Optional: Host name to connect to, defaults
+ to the pod IP.'
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Number or name of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ required:
+ - port
+ type: object
+ terminationGracePeriodSeconds:
+ description: |-
+ Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+ The grace period is the duration in seconds after the processes running in the pod are sent
+ a termination signal and the time when the processes are forcibly halted with a kill signal.
+ Set this value longer than the expected cleanup time for your process.
+ If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+ value overrides the value provided by the pod spec.
+ Value must be non-negative integer. The value zero indicates stop immediately via
+ the kill signal (no opportunity to shut down).
+ This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+ Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
+ format: int64
+ type: integer
+ timeoutSeconds:
+ description: |-
+ Number of seconds after which the probe times out.
+ Defaults to 1 second. Minimum value is 1.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ format: int32
+ type: integer
+ type: object
+ stdin:
+ description: |-
+ Whether this container should allocate a buffer for stdin in the container runtime. If this
+ is not set, reads from stdin in the container will always result in EOF.
+ Default is false.
+ type: boolean
+ stdinOnce:
+ description: |-
+ Whether the container runtime should close the stdin channel after it has been opened by
+ a single attach. When stdin is true the stdin stream will remain open across multiple attach
+ sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the
+ first client attaches to stdin, and then remains open and accepts data until the client disconnects,
+ at which time stdin is closed and remains closed until the container is restarted. If this
+ flag is false, a container processes that reads from stdin will never receive an EOF.
+ Default is false
+ type: boolean
+ terminationMessagePath:
+ description: |-
+ Optional: Path at which the file to which the container's termination message
+ will be written is mounted into the container's filesystem.
+ Message written is intended to be brief final status, such as an assertion failure message.
+ Will be truncated by the node if greater than 4096 bytes. The total message length across
+ all containers will be limited to 12kb.
+ Defaults to /dev/termination-log.
+ Cannot be updated.
+ type: string
+ terminationMessagePolicy:
+ description: |-
+ Indicate how the termination message should be populated. File will use the contents of
+ terminationMessagePath to populate the container status message on both success and failure.
+ FallbackToLogsOnError will use the last chunk of container log output if the termination
+ message file is empty and the container exited with an error.
+ The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
+ Defaults to File.
+ Cannot be updated.
+ type: string
+ tty:
+ description: |-
+ Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.
+ Default is false.
+ type: boolean
+ volumeDevices:
+ description: volumeDevices is the list of block devices to be
+ used by the container.
+ items:
+ description: volumeDevice describes a mapping of a raw block
+ device within a container.
+ properties:
+ devicePath:
+ description: devicePath is the path inside of the container
+ that the device will be mapped to.
+ type: string
+ name:
+ description: name must match the name of a persistentVolumeClaim
+ in the pod
+ type: string
+ required:
+ - devicePath
+ - name
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - devicePath
+ x-kubernetes-list-type: map
+ volumeMounts:
+ description: |-
+ Pod volumes to mount into the container's filesystem.
+ Cannot be updated.
+ items:
+ description: VolumeMount describes a mounting of a Volume
+ within a container.
+ properties:
+ mountPath:
+ description: |-
+ Path within the container at which the volume should be mounted. Must
+ not contain ':'.
+ type: string
+ mountPropagation:
+ description: |-
+ mountPropagation determines how mounts are propagated from the host
+ to container and the other way around.
+ When not set, MountPropagationNone is used.
+ This field is beta in 1.10.
+ When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
+ (which defaults to None).
+ type: string
+ name:
+ description: This must match the Name of a Volume.
+ type: string
+ readOnly:
+ description: |-
+ Mounted read-only if true, read-write otherwise (false or unspecified).
+ Defaults to false.
+ type: boolean
+ recursiveReadOnly:
+ description: |-
+ RecursiveReadOnly specifies whether read-only mounts should be handled
+ recursively.
+
+ If ReadOnly is false, this field has no meaning and must be unspecified.
+
+ If ReadOnly is true, and this field is set to Disabled, the mount is not made
+ recursively read-only. If this field is set to IfPossible, the mount is made
+ recursively read-only, if it is supported by the container runtime. If this
+ field is set to Enabled, the mount is made recursively read-only if it is
+ supported by the container runtime, otherwise the pod will not be started and
+ an error will be generated to indicate the reason.
+
+ If this field is set to IfPossible or Enabled, MountPropagation must be set to
+ None (or be unspecified, which defaults to None).
+
+ If this field is not specified, it is treated as an equivalent of Disabled.
+ type: string
+ subPath:
+ description: |-
+ Path within the volume from which the container's volume should be mounted.
+ Defaults to "" (volume's root).
+ type: string
+ subPathExpr:
+ description: |-
+ Expanded path within the volume from which the container's volume should be mounted.
+ Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
+ Defaults to "" (volume's root).
+ SubPathExpr and SubPath are mutually exclusive.
+ type: string
+ required:
+ - mountPath
+ - name
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - mountPath
+ x-kubernetes-list-type: map
+ workingDir:
+ description: |-
+ Container's working directory.
+ If not specified, the container runtime's default will be used, which
+ might be configured in the container image.
+ Cannot be updated.
+ type: string
+ required:
+ - name
+ type: object
+ type: array
+ initContainers:
+ items:
+ description: A single application container that you want to run
+ within a pod.
+ properties:
+ args:
+ description: |-
+ Arguments to the entrypoint.
+ The container image's CMD is used if this is not provided.
+ Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+ cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+ to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+ produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+ of whether the variable exists or not. Cannot be updated.
+ More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ command:
+ description: |-
+ Entrypoint array. Not executed within a shell.
+ The container image's ENTRYPOINT is used if this is not provided.
+ Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+ cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+ to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+ produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+ of whether the variable exists or not. Cannot be updated.
+ More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ env:
+ description: |-
+ List of environment variables to set in the container.
+ Cannot be updated.
+ items:
+ description: EnvVar represents an environment variable present
+ in a Container.
+ properties:
+ name:
+ description: |-
+ Name of the environment variable.
+ May consist of any printable ASCII characters except '='.
+ type: string
+ value:
+ description: |-
+ Variable references $(VAR_NAME) are expanded
+ using the previously defined environment variables in the container and
+ any service environment variables. If a variable cannot be resolved,
+ the reference in the input string will be unchanged. Double $$ are reduced
+ to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+ "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+ Escaped references will never be expanded, regardless of whether the variable
+ exists or not.
+ Defaults to "".
+ type: string
+ valueFrom:
+ description: Source for the environment variable's value.
+ Cannot be used if value is not empty.
+ properties:
+ configMapKeyRef:
+ description: Selects a key of a ConfigMap.
+ properties:
+ key:
+ description: The key to select.
+ type: string
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ optional:
+ description: Specify whether the ConfigMap or
+ its key must be defined
+ type: boolean
+ required:
+ - key
+ type: object
+ x-kubernetes-map-type: atomic
+ fieldRef:
+ description: |-
+ Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,
+ spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
+ properties:
+ apiVersion:
+ description: Version of the schema the FieldPath
+ is written in terms of, defaults to "v1".
+ type: string
+ fieldPath:
+ description: Path of the field to select in the
+ specified API version.
+ type: string
+ required:
+ - fieldPath
+ type: object
+ x-kubernetes-map-type: atomic
+ fileKeyRef:
+ description: |-
+ FileKeyRef selects a key of the env file.
+ Requires the EnvFiles feature gate to be enabled.
+ properties:
+ key:
+ description: |-
+ The key within the env file. An invalid key will prevent the pod from starting.
+ The keys defined within a source may consist of any printable ASCII characters except '='.
+ During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+ type: string
+ optional:
+ default: false
+ description: |-
+ Specify whether the file or its key must be defined. If the file or key
+ does not exist, then the env var is not published.
+ If optional is set to true and the specified key does not exist,
+ the environment variable will not be set in the Pod's containers.
+
+ If optional is set to false and the specified key does not exist,
+ an error will be returned during Pod creation.
+ type: boolean
+ path:
+ description: |-
+ The path within the volume from which to select the file.
+ Must be relative and may not contain the '..' path or start with '..'.
+ type: string
+ volumeName:
+ description: The name of the volume mount containing
+ the env file.
+ type: string
+ required:
+ - key
+ - path
+ - volumeName
+ type: object
+ x-kubernetes-map-type: atomic
+ resourceFieldRef:
+ description: |-
+ Selects a resource of the container: only resources limits and requests
+ (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
+ properties:
+ containerName:
+ description: 'Container name: required for volumes,
+ optional for env vars'
+ type: string
+ divisor:
+ anyOf:
+ - type: integer
+ - type: string
+ description: Specifies the output format of the
+ exposed resources, defaults to "1"
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ resource:
+ description: 'Required: resource to select'
+ type: string
+ required:
+ - resource
+ type: object
+ x-kubernetes-map-type: atomic
+ secretKeyRef:
+ description: Selects a key of a secret in the pod's
+ namespace
+ properties:
+ key:
+ description: The key of the secret to select from. Must
+ be a valid secret key.
+ type: string
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ optional:
+ description: Specify whether the Secret or its
+ key must be defined
+ type: boolean
+ required:
+ - key
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ required:
+ - name
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ envFrom:
+ description: |-
+ List of sources to populate environment variables in the container.
+ The keys defined within a source may consist of any printable ASCII characters except '='.
+ When a key exists in multiple
+ sources, the value associated with the last source will take precedence.
+ Values defined by an Env with a duplicate key will take precedence.
+ Cannot be updated.
+ items:
+ description: EnvFromSource represents the source of a set
+ of ConfigMaps or Secrets
+ properties:
+ configMapRef:
+ description: The ConfigMap to select from
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ optional:
+ description: Specify whether the ConfigMap must be
+ defined
+ type: boolean
+ type: object
+ x-kubernetes-map-type: atomic
+ prefix:
+ description: |-
+ Optional text to prepend to the name of each environment variable.
+ May consist of any printable ASCII characters except '='.
+ type: string
+ secretRef:
+ description: The Secret to select from
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ optional:
+ description: Specify whether the Secret must be defined
+ type: boolean
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ image:
+ description: |-
+ Container image name.
+ More info: https://kubernetes.io/docs/concepts/containers/images
+ This field is optional to allow higher level config management to default or override
+ container images in workload controllers like Deployments and StatefulSets.
+ type: string
+ imagePullPolicy:
+ description: |-
+ Image pull policy.
+ One of Always, Never, IfNotPresent.
+ Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+ Cannot be updated.
+ More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+ type: string
+ lifecycle:
+ description: |-
+ Actions that the management system should take in response to container lifecycle events.
+ Cannot be updated.
+ properties:
+ postStart:
+ description: |-
+ PostStart is called immediately after a container is created. If the handler fails,
+ the container is terminated and restarted according to its restart policy.
+ Other management of the container blocks until the hook completes.
+ More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
+ properties:
+ exec:
+ description: Exec specifies a command to execute in
+ the container.
+ properties:
+ command:
+ description: |-
+ Command is the command line to execute inside the container, the working directory for the
+ command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+ not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+ a shell, you need to explicitly call out to that shell.
+ Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ httpGet:
+ description: HTTPGet specifies an HTTP GET request to
+ perform.
+ properties:
+ host:
+ description: |-
+ Host name to connect to, defaults to the pod IP. You probably want to set
+ "Host" in httpHeaders instead.
+ type: string
+ httpHeaders:
+ description: Custom headers to set in the request.
+ HTTP allows repeated headers.
+ items:
+ description: HTTPHeader describes a custom header
+ to be used in HTTP probes
+ properties:
+ name:
+ description: |-
+ The header field name.
+ This will be canonicalized upon output, so case-variant names will be understood as the same header.
+ type: string
+ value:
+ description: The header field value
+ type: string
+ required:
+ - name
+ - value
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ path:
+ description: Path to access on the HTTP server.
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Name or number of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ scheme:
+ description: |-
+ Scheme to use for connecting to the host.
+ Defaults to HTTP.
+ type: string
+ required:
+ - port
+ type: object
+ sleep:
+ description: Sleep represents a duration that the container
+ should sleep.
+ properties:
+ seconds:
+ description: Seconds is the number of seconds to
+ sleep.
+ format: int64
+ type: integer
+ required:
+ - seconds
+ type: object
+ tcpSocket:
+ description: |-
+ Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept
+ for backward compatibility. There is no validation of this field and
+ lifecycle hooks will fail at runtime when it is specified.
+ properties:
+ host:
+ description: 'Optional: Host name to connect to,
+ defaults to the pod IP.'
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Number or name of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ required:
+ - port
+ type: object
+ type: object
+ preStop:
+ description: |-
+ PreStop is called immediately before a container is terminated due to an
+ API request or management event such as liveness/startup probe failure,
+ preemption, resource contention, etc. The handler is not called if the
+ container crashes or exits. The Pod's termination grace period countdown begins before the
+ PreStop hook is executed. Regardless of the outcome of the handler, the
+ container will eventually terminate within the Pod's termination grace
+ period (unless delayed by finalizers). Other management of the container blocks until the hook completes
+ or until the termination grace period is reached.
+ More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
+ properties:
+ exec:
+ description: Exec specifies a command to execute in
+ the container.
+ properties:
+ command:
+ description: |-
+ Command is the command line to execute inside the container, the working directory for the
+ command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+ not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+ a shell, you need to explicitly call out to that shell.
+ Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ httpGet:
+ description: HTTPGet specifies an HTTP GET request to
+ perform.
+ properties:
+ host:
+ description: |-
+ Host name to connect to, defaults to the pod IP. You probably want to set
+ "Host" in httpHeaders instead.
+ type: string
+ httpHeaders:
+ description: Custom headers to set in the request.
+ HTTP allows repeated headers.
+ items:
+ description: HTTPHeader describes a custom header
+ to be used in HTTP probes
+ properties:
+ name:
+ description: |-
+ The header field name.
+ This will be canonicalized upon output, so case-variant names will be understood as the same header.
+ type: string
+ value:
+ description: The header field value
+ type: string
+ required:
+ - name
+ - value
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ path:
+ description: Path to access on the HTTP server.
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Name or number of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ scheme:
+ description: |-
+ Scheme to use for connecting to the host.
+ Defaults to HTTP.
+ type: string
+ required:
+ - port
+ type: object
+ sleep:
+ description: Sleep represents a duration that the container
+ should sleep.
+ properties:
+ seconds:
+ description: Seconds is the number of seconds to
+ sleep.
+ format: int64
+ type: integer
+ required:
+ - seconds
+ type: object
+ tcpSocket:
+ description: |-
+ Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept
+ for backward compatibility. There is no validation of this field and
+ lifecycle hooks will fail at runtime when it is specified.
+ properties:
+ host:
+ description: 'Optional: Host name to connect to,
+ defaults to the pod IP.'
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Number or name of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ required:
+ - port
+ type: object
+ type: object
+ stopSignal:
+ description: |-
+ StopSignal defines which signal will be sent to a container when it is being stopped.
+ If not specified, the default is defined by the container runtime in use.
+ StopSignal can only be set for Pods with a non-empty .spec.os.name
+ type: string
+ type: object
+ livenessProbe:
+ description: |-
+ Periodic probe of container liveness.
+ Container will be restarted if the probe fails.
+ Cannot be updated.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ properties:
+ exec:
+ description: Exec specifies a command to execute in the
+ container.
+ properties:
+ command:
+ description: |-
+ Command is the command line to execute inside the container, the working directory for the
+ command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+ not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+ a shell, you need to explicitly call out to that shell.
+ Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ failureThreshold:
+ description: |-
+ Minimum consecutive failures for the probe to be considered failed after having succeeded.
+ Defaults to 3. Minimum value is 1.
+ format: int32
+ type: integer
+ grpc:
+ description: GRPC specifies a GRPC HealthCheckRequest.
+ properties:
+ port:
+ description: Port number of the gRPC service. Number
+ must be in the range 1 to 65535.
+ format: int32
+ type: integer
+ service:
+ default: ""
+ description: |-
+ Service is the name of the service to place in the gRPC HealthCheckRequest
+ (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+ If this is not specified, the default behavior is defined by gRPC.
+ type: string
+ required:
+ - port
+ type: object
+ httpGet:
+ description: HTTPGet specifies an HTTP GET request to perform.
+ properties:
+ host:
+ description: |-
+ Host name to connect to, defaults to the pod IP. You probably want to set
+ "Host" in httpHeaders instead.
+ type: string
+ httpHeaders:
+ description: Custom headers to set in the request. HTTP
+ allows repeated headers.
+ items:
+ description: HTTPHeader describes a custom header
+ to be used in HTTP probes
+ properties:
+ name:
+ description: |-
+ The header field name.
+ This will be canonicalized upon output, so case-variant names will be understood as the same header.
+ type: string
+ value:
+ description: The header field value
+ type: string
+ required:
+ - name
+ - value
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ path:
+ description: Path to access on the HTTP server.
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Name or number of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ scheme:
+ description: |-
+ Scheme to use for connecting to the host.
+ Defaults to HTTP.
+ type: string
+ required:
+ - port
+ type: object
+ initialDelaySeconds:
+ description: |-
+ Number of seconds after the container has started before liveness probes are initiated.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ format: int32
+ type: integer
+ periodSeconds:
+ description: |-
+ How often (in seconds) to perform the probe.
+ Default to 10 seconds. Minimum value is 1.
+ format: int32
+ type: integer
+ successThreshold:
+ description: |-
+ Minimum consecutive successes for the probe to be considered successful after having failed.
+ Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+ format: int32
+ type: integer
+ tcpSocket:
+ description: TCPSocket specifies a connection to a TCP port.
+ properties:
+ host:
+ description: 'Optional: Host name to connect to, defaults
+ to the pod IP.'
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Number or name of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ required:
+ - port
+ type: object
+ terminationGracePeriodSeconds:
+ description: |-
+ Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+ The grace period is the duration in seconds after the processes running in the pod are sent
+ a termination signal and the time when the processes are forcibly halted with a kill signal.
+ Set this value longer than the expected cleanup time for your process.
+ If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+ value overrides the value provided by the pod spec.
+ Value must be non-negative integer. The value zero indicates stop immediately via
+ the kill signal (no opportunity to shut down).
+ This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+ Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
+ format: int64
+ type: integer
+ timeoutSeconds:
+ description: |-
+ Number of seconds after which the probe times out.
+ Defaults to 1 second. Minimum value is 1.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ format: int32
+ type: integer
+ type: object
+ name:
+ description: |-
+ Name of the container specified as a DNS_LABEL.
+ Each container in a pod must have a unique name (DNS_LABEL).
+ Cannot be updated.
+ type: string
+ ports:
+ description: |-
+ List of ports to expose from the container. Not specifying a port here
+ DOES NOT prevent that port from being exposed. Any port which is
+ listening on the default "0.0.0.0" address inside a container will be
+ accessible from the network.
+ Modifying this array with strategic merge patch may corrupt the data.
+ For more information See https://github.com/kubernetes/kubernetes/issues/108255.
+ Cannot be updated.
+ items:
+ description: ContainerPort represents a network port in a
+ single container.
+ properties:
+ containerPort:
+ description: |-
+ Number of port to expose on the pod's IP address.
+ This must be a valid port number, 0 < x < 65536.
+ format: int32
+ type: integer
+ hostIP:
+ description: What host IP to bind the external port to.
+ type: string
+ hostPort:
+ description: |-
+ Number of port to expose on the host.
+ If specified, this must be a valid port number, 0 < x < 65536.
+ If HostNetwork is specified, this must match ContainerPort.
+ Most containers do not need this.
+ format: int32
+ type: integer
+ name:
+ description: |-
+ If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
+ named port in a pod must have a unique name. Name for the port that can be
+ referred to by services.
+ type: string
+ protocol:
+ default: TCP
+ description: |-
+ Protocol for port. Must be UDP, TCP, or SCTP.
+ Defaults to "TCP".
+ type: string
+ required:
+ - containerPort
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - containerPort
+ - protocol
+ x-kubernetes-list-type: map
+ readinessProbe:
+ description: |-
+ Periodic probe of container service readiness.
+ Container will be removed from service endpoints if the probe fails.
+ Cannot be updated.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ properties:
+ exec:
+ description: Exec specifies a command to execute in the
+ container.
+ properties:
+ command:
+ description: |-
+ Command is the command line to execute inside the container, the working directory for the
+ command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+ not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+ a shell, you need to explicitly call out to that shell.
+ Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ failureThreshold:
+ description: |-
+ Minimum consecutive failures for the probe to be considered failed after having succeeded.
+ Defaults to 3. Minimum value is 1.
+ format: int32
+ type: integer
+ grpc:
+ description: GRPC specifies a GRPC HealthCheckRequest.
+ properties:
+ port:
+ description: Port number of the gRPC service. Number
+ must be in the range 1 to 65535.
+ format: int32
+ type: integer
+ service:
+ default: ""
+ description: |-
+ Service is the name of the service to place in the gRPC HealthCheckRequest
+ (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+ If this is not specified, the default behavior is defined by gRPC.
+ type: string
+ required:
+ - port
+ type: object
+ httpGet:
+ description: HTTPGet specifies an HTTP GET request to perform.
+ properties:
+ host:
+ description: |-
+ Host name to connect to, defaults to the pod IP. You probably want to set
+ "Host" in httpHeaders instead.
+ type: string
+ httpHeaders:
+ description: Custom headers to set in the request. HTTP
+ allows repeated headers.
+ items:
+ description: HTTPHeader describes a custom header
+ to be used in HTTP probes
+ properties:
+ name:
+ description: |-
+ The header field name.
+ This will be canonicalized upon output, so case-variant names will be understood as the same header.
+ type: string
+ value:
+ description: The header field value
+ type: string
+ required:
+ - name
+ - value
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ path:
+ description: Path to access on the HTTP server.
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Name or number of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ scheme:
+ description: |-
+ Scheme to use for connecting to the host.
+ Defaults to HTTP.
+ type: string
+ required:
+ - port
+ type: object
+ initialDelaySeconds:
+ description: |-
+ Number of seconds after the container has started before liveness probes are initiated.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ format: int32
+ type: integer
+ periodSeconds:
+ description: |-
+ How often (in seconds) to perform the probe.
+ Default to 10 seconds. Minimum value is 1.
+ format: int32
+ type: integer
+ successThreshold:
+ description: |-
+ Minimum consecutive successes for the probe to be considered successful after having failed.
+ Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+ format: int32
+ type: integer
+ tcpSocket:
+ description: TCPSocket specifies a connection to a TCP port.
+ properties:
+ host:
+ description: 'Optional: Host name to connect to, defaults
+ to the pod IP.'
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Number or name of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ required:
+ - port
+ type: object
+ terminationGracePeriodSeconds:
+ description: |-
+ Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+ The grace period is the duration in seconds after the processes running in the pod are sent
+ a termination signal and the time when the processes are forcibly halted with a kill signal.
+ Set this value longer than the expected cleanup time for your process.
+ If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+ value overrides the value provided by the pod spec.
+ Value must be non-negative integer. The value zero indicates stop immediately via
+ the kill signal (no opportunity to shut down).
+ This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+ Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
+ format: int64
+ type: integer
+ timeoutSeconds:
+ description: |-
+ Number of seconds after which the probe times out.
+ Defaults to 1 second. Minimum value is 1.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ format: int32
+ type: integer
+ type: object
+ resizePolicy:
+ description: |-
+ Resources resize policy for the container.
+ This field cannot be set on ephemeral containers.
+ items:
+ description: ContainerResizePolicy represents resource resize
+ policy for the container.
+ properties:
+ resourceName:
+ description: |-
+ Name of the resource to which this resource resize policy applies.
+ Supported values: cpu, memory.
+ type: string
+ restartPolicy:
+ description: |-
+ Restart policy to apply when specified resource is resized.
+ If not specified, it defaults to NotRequired.
+ type: string
+ required:
+ - resourceName
+ - restartPolicy
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ resources:
+ description: |-
+ Compute Resources required by this container.
+ Cannot be updated.
+ More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ properties:
+ claims:
+ description: |-
+ Claims lists the names of resources, defined in spec.resourceClaims,
+ that are used by this container.
+
+ This field depends on the
+ DynamicResourceAllocation feature gate.
+
+ This field is immutable. It can only be set for containers.
+ items:
+ description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+ properties:
+ name:
+ description: |-
+ Name must match the name of one entry in pod.spec.resourceClaims of
+ the Pod where this field is used. It makes that resource available
+ inside a container.
+ type: string
+ request:
+ description: |-
+ Request is the name chosen for a request in the referenced claim.
+ If empty, everything from the claim is made available, otherwise
+ only the result of this request.
+ type: string
+ required:
+ - name
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ limits:
+ additionalProperties:
+ anyOf:
+ - type: integer
+ - type: string
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ description: |-
+ Limits describes the maximum amount of compute resources allowed.
+ More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ type: object
+ requests:
+ additionalProperties:
+ anyOf:
+ - type: integer
+ - type: string
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ description: |-
+ Requests describes the minimum amount of compute resources required.
+ If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+ otherwise to an implementation-defined value. Requests cannot exceed Limits.
+ More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ type: object
+ type: object
+ restartPolicy:
+ description: |-
+ RestartPolicy defines the restart behavior of individual containers in a pod.
+ This overrides the pod-level restart policy. When this field is not specified,
+ the restart behavior is defined by the Pod's restart policy and the container type.
+ Additionally, setting the RestartPolicy as "Always" for the init container will
+ have the following effect:
+ this init container will be continually restarted on
+ exit until all regular containers have terminated. Once all regular
+ containers have completed, all init containers with restartPolicy "Always"
+ will be shut down. This lifecycle differs from normal init containers and
+ is often referred to as a "sidecar" container. Although this init
+ container still starts in the init container sequence, it does not wait
+ for the container to complete before proceeding to the next init
+ container. Instead, the next init container starts immediately after this
+ init container is started, or after any startupProbe has successfully
+ completed.
+ type: string
+ restartPolicyRules:
+ description: |-
+ Represents a list of rules to be checked to determine if the
+ container should be restarted on exit. The rules are evaluated in
+ order. Once a rule matches a container exit condition, the remaining
+ rules are ignored. If no rule matches the container exit condition,
+ the Container-level restart policy determines the whether the container
+ is restarted or not. Constraints on the rules:
+ - At most 20 rules are allowed.
+ - Rules can have the same action.
+ - Identical rules are not forbidden in validations.
+ When rules are specified, container MUST set RestartPolicy explicitly
+ even it if matches the Pod's RestartPolicy.
+ items:
+ description: ContainerRestartRule describes how a container
+ exit is handled.
+ properties:
+ action:
+ description: |-
+ Specifies the action taken on a container exit if the requirements
+ are satisfied. The only possible value is "Restart" to restart the
+ container.
+ type: string
+ exitCodes:
+ description: Represents the exit codes to check on container
+ exits.
+ properties:
+ operator:
+ description: |-
+ Represents the relationship between the container exit code(s) and the
+ specified values. Possible values are:
+ - In: the requirement is satisfied if the container exit code is in the
+ set of specified values.
+ - NotIn: the requirement is satisfied if the container exit code is
+ not in the set of specified values.
+ type: string
+ values:
+ description: |-
+ Specifies the set of values to check for container exit codes.
+ At most 255 elements are allowed.
+ items:
+ format: int32
+ type: integer
+ type: array
+ x-kubernetes-list-type: set
+ required:
+ - operator
+ type: object
+ required:
+ - action
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ securityContext:
+ description: |-
+ SecurityContext defines the security options the container should be run with.
+ If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
+ More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+ properties:
+ allowPrivilegeEscalation:
+ description: |-
+ AllowPrivilegeEscalation controls whether a process can gain more
+ privileges than its parent process. This bool directly controls if
+ the no_new_privs flag will be set on the container process.
+ AllowPrivilegeEscalation is true always when the container is:
+ 1) run as Privileged
+ 2) has CAP_SYS_ADMIN
+ Note that this field cannot be set when spec.os.name is windows.
+ type: boolean
+ appArmorProfile:
+ description: |-
+ appArmorProfile is the AppArmor options to use by this container. If set, this profile
+ overrides the pod's appArmorProfile.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ localhostProfile:
+ description: |-
+ localhostProfile indicates a profile loaded on the node that should be used.
+ The profile must be preconfigured on the node to work.
+ Must match the loaded name of the profile.
+ Must be set if and only if type is "Localhost".
+ type: string
+ type:
+ description: |-
+ type indicates which kind of AppArmor profile will be applied.
+ Valid options are:
+ Localhost - a profile pre-loaded on the node.
+ RuntimeDefault - the container runtime's default profile.
+ Unconfined - no AppArmor enforcement.
+ type: string
+ required:
+ - type
+ type: object
+ capabilities:
+ description: |-
+ The capabilities to add/drop when running containers.
+ Defaults to the default set of capabilities granted by the container runtime.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ add:
+ description: Added capabilities
+ items:
+ description: Capability represent POSIX capabilities
+ type
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ drop:
+ description: Removed capabilities
+ items:
+ description: Capability represent POSIX capabilities
+ type
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ privileged:
+ description: |-
+ Run container in privileged mode.
+ Processes in privileged containers are essentially equivalent to root on the host.
+ Defaults to false.
+ Note that this field cannot be set when spec.os.name is windows.
+ type: boolean
+ procMount:
+ description: |-
+ procMount denotes the type of proc mount to use for the containers.
+ The default value is Default which uses the container runtime defaults for
+ readonly paths and masked paths.
+ Note that this field cannot be set when spec.os.name is windows.
+ type: string
+ readOnlyRootFilesystem:
+ description: |-
+ Whether this container has a read-only root filesystem.
+ Default is false.
+ Note that this field cannot be set when spec.os.name is windows.
+ type: boolean
+ runAsGroup:
+ description: |-
+ The GID to run the entrypoint of the container process.
+ Uses runtime default if unset.
+ May also be set in PodSecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ runAsNonRoot:
+ description: |-
+ Indicates that the container must run as a non-root user.
+ If true, the Kubelet will validate the image at runtime to ensure that it
+ does not run as UID 0 (root) and fail to start the container if it does.
+ If unset or false, no such validation will be performed.
+ May also be set in PodSecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence.
+ type: boolean
+ runAsUser:
+ description: |-
+ The UID to run the entrypoint of the container process.
+ Defaults to user specified in image metadata if unspecified.
+ May also be set in PodSecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence.
+ Note that this field cannot be set when spec.os.name is windows.
+ format: int64
+ type: integer
+ seLinuxOptions:
+ description: |-
+ The SELinux context to be applied to the container.
+ If unspecified, the container runtime will allocate a random SELinux context for each
+ container. May also be set in PodSecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ level:
+ description: Level is SELinux level label that applies
+ to the container.
+ type: string
+ role:
+ description: Role is a SELinux role label that applies
+ to the container.
+ type: string
+ type:
+ description: Type is a SELinux type label that applies
+ to the container.
+ type: string
+ user:
+ description: User is a SELinux user label that applies
+ to the container.
+ type: string
+ type: object
+ seccompProfile:
+ description: |-
+ The seccomp options to use by this container. If seccomp options are
+ provided at both the pod & container level, the container options
+ override the pod options.
+ Note that this field cannot be set when spec.os.name is windows.
+ properties:
+ localhostProfile:
+ description: |-
+ localhostProfile indicates a profile defined in a file on the node should be used.
+ The profile must be preconfigured on the node to work.
+ Must be a descending path, relative to the kubelet's configured seccomp profile location.
+ Must be set if type is "Localhost". Must NOT be set for any other type.
+ type: string
+ type:
+ description: |-
+ type indicates which kind of seccomp profile will be applied.
+ Valid options are:
+
+ Localhost - a profile defined in a file on the node should be used.
+ RuntimeDefault - the container runtime default profile should be used.
+ Unconfined - no profile should be applied.
+ type: string
+ required:
+ - type
+ type: object
+ windowsOptions:
+ description: |-
+ The Windows specific settings applied to all containers.
+ If unspecified, the options from the PodSecurityContext will be used.
+ If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+ Note that this field cannot be set when spec.os.name is linux.
+ properties:
+ gmsaCredentialSpec:
+ description: |-
+ GMSACredentialSpec is where the GMSA admission webhook
+ (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
+ GMSA credential spec named by the GMSACredentialSpecName field.
+ type: string
+ gmsaCredentialSpecName:
+ description: GMSACredentialSpecName is the name of the
+ GMSA credential spec to use.
+ type: string
+ hostProcess:
+ description: |-
+ HostProcess determines if a container should be run as a 'Host Process' container.
+ All of a Pod's containers must have the same effective HostProcess value
+ (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
+ In addition, if HostProcess is true then HostNetwork must also be set to true.
+ type: boolean
+ runAsUserName:
+ description: |-
+ The UserName in Windows to run the entrypoint of the container process.
+ Defaults to the user specified in image metadata if unspecified.
+ May also be set in PodSecurityContext. If set in both SecurityContext and
+ PodSecurityContext, the value specified in SecurityContext takes precedence.
+ type: string
+ type: object
+ type: object
+ startupProbe:
+ description: |-
+ StartupProbe indicates that the Pod has successfully initialized.
+ If specified, no other probes are executed until this completes successfully.
+ If this probe fails, the Pod will be restarted, just as if the livenessProbe failed.
+ This can be used to provide different probe parameters at the beginning of a Pod's lifecycle,
+ when it might take a long time to load data or warm a cache, than during steady-state operation.
+ This cannot be updated.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ properties:
+ exec:
+ description: Exec specifies a command to execute in the
+ container.
+ properties:
+ command:
+ description: |-
+ Command is the command line to execute inside the container, the working directory for the
+ command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+ not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+ a shell, you need to explicitly call out to that shell.
+ Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ failureThreshold:
+ description: |-
+ Minimum consecutive failures for the probe to be considered failed after having succeeded.
+ Defaults to 3. Minimum value is 1.
+ format: int32
+ type: integer
+ grpc:
+ description: GRPC specifies a GRPC HealthCheckRequest.
+ properties:
+ port:
+ description: Port number of the gRPC service. Number
+ must be in the range 1 to 65535.
+ format: int32
+ type: integer
+ service:
+ default: ""
+ description: |-
+ Service is the name of the service to place in the gRPC HealthCheckRequest
+ (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+ If this is not specified, the default behavior is defined by gRPC.
+ type: string
+ required:
+ - port
+ type: object
+ httpGet:
+ description: HTTPGet specifies an HTTP GET request to perform.
+ properties:
+ host:
+ description: |-
+ Host name to connect to, defaults to the pod IP. You probably want to set
+ "Host" in httpHeaders instead.
+ type: string
+ httpHeaders:
+ description: Custom headers to set in the request. HTTP
+ allows repeated headers.
+ items:
+ description: HTTPHeader describes a custom header
+ to be used in HTTP probes
+ properties:
+ name:
+ description: |-
+ The header field name.
+ This will be canonicalized upon output, so case-variant names will be understood as the same header.
+ type: string
+ value:
+ description: The header field value
+ type: string
+ required:
+ - name
+ - value
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ path:
+ description: Path to access on the HTTP server.
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Name or number of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ scheme:
+ description: |-
+ Scheme to use for connecting to the host.
+ Defaults to HTTP.
+ type: string
+ required:
+ - port
+ type: object
+ initialDelaySeconds:
+ description: |-
+ Number of seconds after the container has started before liveness probes are initiated.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ format: int32
+ type: integer
+ periodSeconds:
+ description: |-
+ How often (in seconds) to perform the probe.
+ Default to 10 seconds. Minimum value is 1.
+ format: int32
+ type: integer
+ successThreshold:
+ description: |-
+ Minimum consecutive successes for the probe to be considered successful after having failed.
+ Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+ format: int32
+ type: integer
+ tcpSocket:
+ description: TCPSocket specifies a connection to a TCP port.
+ properties:
+ host:
+ description: 'Optional: Host name to connect to, defaults
+ to the pod IP.'
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Number or name of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ required:
+ - port
+ type: object
+ terminationGracePeriodSeconds:
+ description: |-
+ Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+ The grace period is the duration in seconds after the processes running in the pod are sent
+ a termination signal and the time when the processes are forcibly halted with a kill signal.
+ Set this value longer than the expected cleanup time for your process.
+ If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+ value overrides the value provided by the pod spec.
+ Value must be non-negative integer. The value zero indicates stop immediately via
+ the kill signal (no opportunity to shut down).
+ This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+ Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
+ format: int64
+ type: integer
+ timeoutSeconds:
+ description: |-
+ Number of seconds after which the probe times out.
+ Defaults to 1 second. Minimum value is 1.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ format: int32
+ type: integer
+ type: object
+ stdin:
+ description: |-
+ Whether this container should allocate a buffer for stdin in the container runtime. If this
+ is not set, reads from stdin in the container will always result in EOF.
+ Default is false.
+ type: boolean
+ stdinOnce:
+ description: |-
+ Whether the container runtime should close the stdin channel after it has been opened by
+ a single attach. When stdin is true the stdin stream will remain open across multiple attach
+ sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the
+ first client attaches to stdin, and then remains open and accepts data until the client disconnects,
+ at which time stdin is closed and remains closed until the container is restarted. If this
+ flag is false, a container processes that reads from stdin will never receive an EOF.
+ Default is false
+ type: boolean
+ terminationMessagePath:
+ description: |-
+ Optional: Path at which the file to which the container's termination message
+ will be written is mounted into the container's filesystem.
+ Message written is intended to be brief final status, such as an assertion failure message.
+ Will be truncated by the node if greater than 4096 bytes. The total message length across
+ all containers will be limited to 12kb.
+ Defaults to /dev/termination-log.
+ Cannot be updated.
+ type: string
+ terminationMessagePolicy:
+ description: |-
+ Indicate how the termination message should be populated. File will use the contents of
+ terminationMessagePath to populate the container status message on both success and failure.
+ FallbackToLogsOnError will use the last chunk of container log output if the termination
+ message file is empty and the container exited with an error.
+ The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
+ Defaults to File.
+ Cannot be updated.
+ type: string
+ tty:
+ description: |-
+ Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.
+ Default is false.
+ type: boolean
+ volumeDevices:
+ description: volumeDevices is the list of block devices to be
+ used by the container.
+ items:
+ description: volumeDevice describes a mapping of a raw block
+ device within a container.
+ properties:
+ devicePath:
+ description: devicePath is the path inside of the container
+ that the device will be mapped to.
+ type: string
+ name:
+ description: name must match the name of a persistentVolumeClaim
+ in the pod
+ type: string
+ required:
+ - devicePath
+ - name
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - devicePath
+ x-kubernetes-list-type: map
+ volumeMounts:
+ description: |-
+ Pod volumes to mount into the container's filesystem.
+ Cannot be updated.
+ items:
+ description: VolumeMount describes a mounting of a Volume
+ within a container.
+ properties:
+ mountPath:
+ description: |-
+ Path within the container at which the volume should be mounted. Must
+ not contain ':'.
+ type: string
+ mountPropagation:
+ description: |-
+ mountPropagation determines how mounts are propagated from the host
+ to container and the other way around.
+ When not set, MountPropagationNone is used.
+ This field is beta in 1.10.
+ When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
+ (which defaults to None).
+ type: string
+ name:
+ description: This must match the Name of a Volume.
+ type: string
+ readOnly:
+ description: |-
+ Mounted read-only if true, read-write otherwise (false or unspecified).
+ Defaults to false.
+ type: boolean
+ recursiveReadOnly:
+ description: |-
+ RecursiveReadOnly specifies whether read-only mounts should be handled
+ recursively.
+
+ If ReadOnly is false, this field has no meaning and must be unspecified.
+
+ If ReadOnly is true, and this field is set to Disabled, the mount is not made
+ recursively read-only. If this field is set to IfPossible, the mount is made
+ recursively read-only, if it is supported by the container runtime. If this
+ field is set to Enabled, the mount is made recursively read-only if it is
+ supported by the container runtime, otherwise the pod will not be started and
+ an error will be generated to indicate the reason.
+
+ If this field is set to IfPossible or Enabled, MountPropagation must be set to
+ None (or be unspecified, which defaults to None).
+
+ If this field is not specified, it is treated as an equivalent of Disabled.
+ type: string
+ subPath:
+ description: |-
+ Path within the volume from which the container's volume should be mounted.
+ Defaults to "" (volume's root).
+ type: string
+ subPathExpr:
+ description: |-
+ Expanded path within the volume from which the container's volume should be mounted.
+ Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
+ Defaults to "" (volume's root).
+ SubPathExpr and SubPath are mutually exclusive.
+ type: string
+ required:
+ - mountPath
+ - name
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - mountPath
+ x-kubernetes-list-type: map
+ workingDir:
+ description: |-
+ Container's working directory.
+ If not specified, the container runtime's default will be used, which
+ might be configured in the container image.
+ Cannot be updated.
+ type: string
+ required:
+ - name
+ type: object
+ type: array
+ livenessProbe:
+ description: |-
+ Probe describes a health check to be performed against a container to determine whether it is
+ alive or ready to receive traffic.
+ properties:
+ exec:
+ description: Exec specifies a command to execute in the container.
+ properties:
+ command:
+ description: |-
+ Command is the command line to execute inside the container, the working directory for the
+ command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+ not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+ a shell, you need to explicitly call out to that shell.
+ Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ failureThreshold:
+ description: |-
+ Minimum consecutive failures for the probe to be considered failed after having succeeded.
+ Defaults to 3. Minimum value is 1.
+ format: int32
+ type: integer
+ grpc:
+ description: GRPC specifies a GRPC HealthCheckRequest.
+ properties:
+ port:
+ description: Port number of the gRPC service. Number must
+ be in the range 1 to 65535.
+ format: int32
+ type: integer
+ service:
+ default: ""
+ description: |-
+ Service is the name of the service to place in the gRPC HealthCheckRequest
+ (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+ If this is not specified, the default behavior is defined by gRPC.
+ type: string
+ required:
+ - port
+ type: object
+ httpGet:
+ description: HTTPGet specifies an HTTP GET request to perform.
+ properties:
+ host:
+ description: |-
+ Host name to connect to, defaults to the pod IP. You probably want to set
+ "Host" in httpHeaders instead.
+ type: string
+ httpHeaders:
+ description: Custom headers to set in the request. HTTP allows
+ repeated headers.
+ items:
+ description: HTTPHeader describes a custom header to be
+ used in HTTP probes
+ properties:
+ name:
+ description: |-
+ The header field name.
+ This will be canonicalized upon output, so case-variant names will be understood as the same header.
+ type: string
+ value:
+ description: The header field value
+ type: string
+ required:
+ - name
+ - value
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ path:
+ description: Path to access on the HTTP server.
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Name or number of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ scheme:
+ description: |-
+ Scheme to use for connecting to the host.
+ Defaults to HTTP.
+ type: string
+ required:
+ - port
+ type: object
+ initialDelaySeconds:
+ description: |-
+ Number of seconds after the container has started before liveness probes are initiated.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ format: int32
+ type: integer
+ periodSeconds:
+ description: |-
+ How often (in seconds) to perform the probe.
+ Default to 10 seconds. Minimum value is 1.
+ format: int32
+ type: integer
+ successThreshold:
+ description: |-
+ Minimum consecutive successes for the probe to be considered successful after having failed.
+ Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
+ format: int32
+ type: integer
+ tcpSocket:
+ description: TCPSocket specifies a connection to a TCP port.
+ properties:
+ host:
+ description: 'Optional: Host name to connect to, defaults
+ to the pod IP.'
+ type: string
+ port:
+ anyOf:
+ - type: integer
+ - type: string
+ description: |-
+ Number or name of the port to access on the container.
+ Number must be in the range 1 to 65535.
+ Name must be an IANA_SVC_NAME.
+ x-kubernetes-int-or-string: true
+ required:
+ - port
+ type: object
+ terminationGracePeriodSeconds:
+ description: |-
+ Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+ The grace period is the duration in seconds after the processes running in the pod are sent
+ a termination signal and the time when the processes are forcibly halted with a kill signal.
+ Set this value longer than the expected cleanup time for your process.
+ If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+ value overrides the value provided by the pod spec.
+ Value must be non-negative integer. The value zero indicates stop immediately via
+ the kill signal (no opportunity to shut down).
+ This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+ Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
+ format: int64
+ type: integer
+ timeoutSeconds:
+ description: |-
+ Number of seconds after which the probe times out.
+ Defaults to 1 second. Minimum value is 1.
+ More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
+ format: int32
+ type: integer
+ type: object
+ logicalBackupRetention:
+ type: string
+ logicalBackupSchedule:
+ pattern: ^(\d+|\*)(/\d+)?(\s+(\d+|\*)(/\d+)?){4}$
+ type: string
+ maintenanceWindows:
+ type: array
+ masterNodePort:
+ format: int32
+ type: integer
+ masterPoolerNodePort:
+ format: int32
+ type: integer
+ masterServiceAnnotations:
+ additionalProperties:
+ type: string
+ description: MasterServiceAnnotations takes precedence over ServiceAnnotations
+ for master role if not empty
+ type: object
+ nodeAffinity:
+ description: Node affinity is a group of node affinity scheduling
+ rules.
+ properties:
+ preferredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ The scheduler will prefer to schedule pods to nodes that satisfy
+ the affinity expressions specified by this field, but it may choose
+ a node that violates one or more of the expressions. The node that is
+ most preferred is the one with the greatest sum of weights, i.e.
+ for each node that meets all of the scheduling requirements (resource
+ request, requiredDuringScheduling affinity expressions, etc.),
+ compute a sum by iterating through the elements of this field and adding
+ "weight" to the sum if the node matches the corresponding matchExpressions; the
+ node(s) with the highest sum are the most preferred.
+ items:
+ description: |-
+ An empty preferred scheduling term matches all objects with implicit weight 0
+ (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+ properties:
+ preference:
+ description: A node selector term, associated with the corresponding
+ weight.
+ properties:
+ matchExpressions:
+ description: A list of node selector requirements by
+ node's labels.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies
+ to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchFields:
+ description: A list of node selector requirements by
+ node's fields.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies
+ to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-map-type: atomic
+ weight:
+ description: Weight associated with matching the corresponding
+ nodeSelectorTerm, in the range 1-100.
+ format: int32
+ type: integer
+ required:
+ - preference
+ - weight
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ requiredDuringSchedulingIgnoredDuringExecution:
+ description: |-
+ If the affinity requirements specified by this field are not met at
+ scheduling time, the pod will not be scheduled onto the node.
+ If the affinity requirements specified by this field cease to be met
+ at some point during pod execution (e.g. due to an update), the system
+ may or may not try to eventually evict the pod from its node.
+ properties:
+ nodeSelectorTerms:
+ description: Required. A list of node selector terms. The
+ terms are ORed.
+ items:
+ description: |-
+ A null or empty node selector term matches no objects. The requirements of
+ them are ANDed.
+ The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+ properties:
+ matchExpressions:
+ description: A list of node selector requirements by
+ node's labels.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies
+ to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchFields:
+ description: A list of node selector requirements by
+ node's fields.
+ items:
+ description: |-
+ A node selector requirement is a selector that contains values, a key, and an operator
+ that relates the key and values.
+ properties:
+ key:
+ description: The label key that the selector applies
+ to.
+ type: string
+ operator:
+ description: |-
+ Represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+ type: string
+ values:
+ description: |-
+ An array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. If the operator is Gt or Lt, the values
+ array must have a single element, which will be interpreted as an integer.
+ This array is replaced during a strategic merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
+ x-kubernetes-map-type: atomic
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - nodeSelectorTerms
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ numberOfInstances:
+ format: int32
+ minimum: 0
+ type: integer
+ patroni:
+ description: Patroni contains Patroni-specific configuration
+ properties:
+ failsafe_mode:
+ type: boolean
+ initdb:
+ additionalProperties:
+ type: string
+ type: object
+ loop_wait:
+ format: int32
+ type: integer
+ maximum_lag_on_failover:
+ format: int64
+ type: integer
+ pg_hba:
+ items:
+ type: string
+ type: array
+ retry_timeout:
+ format: int32
+ type: integer
+ slots:
+ additionalProperties:
+ additionalProperties:
+ type: string
+ type: object
+ type: object
+ synchronous_mode:
+ type: boolean
+ synchronous_mode_strict:
+ type: boolean
+ synchronous_node_count:
+ format: int32
+ type: integer
+ ttl:
+ format: int32
+ type: integer
+ type: object
+ pod_priority_class_name:
+ description: deprecated
+ type: string
+ podAnnotations:
+ additionalProperties:
+ type: string
+ type: object
+ podPriorityClassName:
+ type: string
+ postgresql:
+ description: PostgresqlParam describes PostgreSQL version and pairs
+ of configuration parameter name - values.
+ properties:
+ parameters:
+ additionalProperties:
+ type: string
+ type: object
+ version:
+ enum:
+ - "14"
+ - "15"
+ - "16"
+ - "17"
+ - "18"
+ type: string
+ required:
+ - version
+ type: object
+ preparedDatabases:
+ additionalProperties:
+ description: PreparedDatabase describes elements to be bootstrapped
+ properties:
+ defaultUsers:
+ type: boolean
+ extensions:
+ additionalProperties:
+ type: string
+ type: object
+ schemas:
+ additionalProperties:
+ description: PreparedSchema describes elements to be bootstrapped
+ per schema
+ properties:
+ defaultRoles:
+ type: boolean
+ defaultUsers:
+ type: boolean
+ type: object
+ type: object
+ secretNamespace:
+ type: string
+ type: object
+ type: object
+ replicaLoadBalancer:
+ description: deprecated
+ type: boolean
+ replicaNodePort:
+ format: int32
+ type: integer
+ replicaPoolerNodePort:
+ format: int32
+ type: integer
+ replicaServiceAnnotations:
+ additionalProperties:
+ type: string
+ description: ReplicaServiceAnnotations takes precedence over ServiceAnnotations
+ for replica role if not empty
+ type: object
+ resources:
+ description: Resources describes requests and limits for the cluster
+ resouces.
+ properties:
+ limits:
+ description: ResourceDescription describes CPU and memory resources
+ defined for a cluster.
+ properties:
+ cpu:
+ description: |-
+ Decimal natural followed by m, or decimal natural followed by
+ dot followed by up to three decimal digits.
+
+ This is because the Kubernetes CPU resource has millis as the
+ maximum precision. The actual values are checked in code
+ because the regular expression would be huge and horrible and
+ not very helpful in validation error messages; this one checks
+ only the format of the given number.
+
+ https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu
+
+ Note: the value specified here must not be zero or be lower
+ than the corresponding request.
+ pattern: ^(\d+m|\d+(\.\d{1,3})?)$
+ type: string
+ hugepages-1Gi:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ hugepages-2Mi:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ memory:
+ description: |-
+ You can express memory as a plain integer or as a fixed-point
+ integer using one of these suffixes: E, P, T, G, M, k. You can
+ also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki
+
+ https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory
+
+ Note: the value specified here must not be zero or be higher
+ than the corresponding limit.
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ type: object
+ requests:
+ description: ResourceDescription describes CPU and memory resources
+ defined for a cluster.
+ properties:
+ cpu:
+ description: |-
+ Decimal natural followed by m, or decimal natural followed by
+ dot followed by up to three decimal digits.
+
+ This is because the Kubernetes CPU resource has millis as the
+ maximum precision. The actual values are checked in code
+ because the regular expression would be huge and horrible and
+ not very helpful in validation error messages; this one checks
+ only the format of the given number.
+
+ https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu
+
+ Note: the value specified here must not be zero or be lower
+ than the corresponding request.
+ pattern: ^(\d+m|\d+(\.\d{1,3})?)$
+ type: string
+ hugepages-1Gi:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ hugepages-2Mi:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ memory:
+ description: |-
+ You can express memory as a plain integer or as a fixed-point
+ integer using one of these suffixes: E, P, T, G, M, k. You can
+ also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki
+
+ https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory
+
+ Note: the value specified here must not be zero or be higher
+ than the corresponding limit.
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ type: object
+ type: object
+ schedulerName:
+ type: string
+ serviceAnnotations:
+ additionalProperties:
+ type: string
+ type: object
+ sidecars:
+ items:
+ description: Sidecar defines a container to be run in the same pod
+ as the Postgres container.
+ properties:
+ command:
+ items:
+ type: string
+ type: array
+ env:
+ items:
+ description: EnvVar represents an environment variable present
+ in a Container.
+ properties:
+ name:
+ description: |-
+ Name of the environment variable.
+ May consist of any printable ASCII characters except '='.
+ type: string
+ value:
+ description: |-
+ Variable references $(VAR_NAME) are expanded
+ using the previously defined environment variables in the container and
+ any service environment variables. If a variable cannot be resolved,
+ the reference in the input string will be unchanged. Double $$ are reduced
+ to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+ "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+ Escaped references will never be expanded, regardless of whether the variable
+ exists or not.
+ Defaults to "".
+ type: string
+ valueFrom:
+ description: Source for the environment variable's value.
+ Cannot be used if value is not empty.
+ properties:
+ configMapKeyRef:
+ description: Selects a key of a ConfigMap.
+ properties:
+ key:
+ description: The key to select.
+ type: string
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ optional:
+ description: Specify whether the ConfigMap or
+ its key must be defined
+ type: boolean
+ required:
+ - key
+ type: object
+ x-kubernetes-map-type: atomic
+ fieldRef:
+ description: |-
+ Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,
+ spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
+ properties:
+ apiVersion:
+ description: Version of the schema the FieldPath
+ is written in terms of, defaults to "v1".
+ type: string
+ fieldPath:
+ description: Path of the field to select in the
+ specified API version.
+ type: string
+ required:
+ - fieldPath
+ type: object
+ x-kubernetes-map-type: atomic
+ fileKeyRef:
+ description: |-
+ FileKeyRef selects a key of the env file.
+ Requires the EnvFiles feature gate to be enabled.
+ properties:
+ key:
+ description: |-
+ The key within the env file. An invalid key will prevent the pod from starting.
+ The keys defined within a source may consist of any printable ASCII characters except '='.
+ During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
+ type: string
+ optional:
+ default: false
+ description: |-
+ Specify whether the file or its key must be defined. If the file or key
+ does not exist, then the env var is not published.
+ If optional is set to true and the specified key does not exist,
+ the environment variable will not be set in the Pod's containers.
+
+ If optional is set to false and the specified key does not exist,
+ an error will be returned during Pod creation.
+ type: boolean
+ path:
+ description: |-
+ The path within the volume from which to select the file.
+ Must be relative and may not contain the '..' path or start with '..'.
+ type: string
+ volumeName:
+ description: The name of the volume mount containing
+ the env file.
+ type: string
+ required:
+ - key
+ - path
+ - volumeName
+ type: object
+ x-kubernetes-map-type: atomic
+ resourceFieldRef:
+ description: |-
+ Selects a resource of the container: only resources limits and requests
+ (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
+ properties:
+ containerName:
+ description: 'Container name: required for volumes,
+ optional for env vars'
+ type: string
+ divisor:
+ anyOf:
+ - type: integer
+ - type: string
+ description: Specifies the output format of the
+ exposed resources, defaults to "1"
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ resource:
+ description: 'Required: resource to select'
+ type: string
+ required:
+ - resource
+ type: object
+ x-kubernetes-map-type: atomic
+ secretKeyRef:
+ description: Selects a key of a secret in the pod's
+ namespace
+ properties:
+ key:
+ description: The key of the secret to select from. Must
+ be a valid secret key.
+ type: string
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ optional:
+ description: Specify whether the Secret or its
+ key must be defined
+ type: boolean
+ required:
+ - key
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ required:
+ - name
+ type: object
+ type: array
+ image:
+ type: string
+ name:
+ type: string
+ ports:
+ items:
+ description: ContainerPort represents a network port in a
+ single container.
+ properties:
+ containerPort:
+ description: |-
+ Number of port to expose on the pod's IP address.
+ This must be a valid port number, 0 < x < 65536.
+ format: int32
+ type: integer
+ hostIP:
+ description: What host IP to bind the external port to.
+ type: string
+ hostPort:
+ description: |-
+ Number of port to expose on the host.
+ If specified, this must be a valid port number, 0 < x < 65536.
+ If HostNetwork is specified, this must match ContainerPort.
+ Most containers do not need this.
+ format: int32
+ type: integer
+ name:
+ description: |-
+ If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
+ named port in a pod must have a unique name. Name for the port that can be
+ referred to by services.
+ type: string
+ protocol:
+ default: TCP
+ description: |-
+ Protocol for port. Must be UDP, TCP, or SCTP.
+ Defaults to "TCP".
+ type: string
+ required:
+ - containerPort
+ type: object
+ type: array
+ resources:
+ description: Resources describes requests and limits for the
+ cluster resouces.
+ properties:
+ limits:
+ description: ResourceDescription describes CPU and memory
+ resources defined for a cluster.
+ properties:
+ cpu:
+ description: |-
+ Decimal natural followed by m, or decimal natural followed by
+ dot followed by up to three decimal digits.
+
+ This is because the Kubernetes CPU resource has millis as the
+ maximum precision. The actual values are checked in code
+ because the regular expression would be huge and horrible and
+ not very helpful in validation error messages; this one checks
+ only the format of the given number.
+
+ https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu
+
+ Note: the value specified here must not be zero or be lower
+ than the corresponding request.
+ pattern: ^(\d+m|\d+(\.\d{1,3})?)$
+ type: string
+ hugepages-1Gi:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ hugepages-2Mi:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ memory:
+ description: |-
+ You can express memory as a plain integer or as a fixed-point
+ integer using one of these suffixes: E, P, T, G, M, k. You can
+ also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki
+
+ https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory
+
+ Note: the value specified here must not be zero or be higher
+ than the corresponding limit.
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ type: object
+ requests:
+ description: ResourceDescription describes CPU and memory
+ resources defined for a cluster.
+ properties:
+ cpu:
+ description: |-
+ Decimal natural followed by m, or decimal natural followed by
+ dot followed by up to three decimal digits.
+
+ This is because the Kubernetes CPU resource has millis as the
+ maximum precision. The actual values are checked in code
+ because the regular expression would be huge and horrible and
+ not very helpful in validation error messages; this one checks
+ only the format of the given number.
+
+ https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu
+
+ Note: the value specified here must not be zero or be lower
+ than the corresponding request.
+ pattern: ^(\d+m|\d+(\.\d{1,3})?)$
+ type: string
+ hugepages-1Gi:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ hugepages-2Mi:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ memory:
+ description: |-
+ You can express memory as a plain integer or as a fixed-point
+ integer using one of these suffixes: E, P, T, G, M, k. You can
+ also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki
+
+ https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory
+
+ Note: the value specified here must not be zero or be higher
+ than the corresponding limit.
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ type: object
+ type: object
+ type: object
+ type: array
+ spiloFSGroup:
+ format: int64
+ type: integer
+ spiloRunAsGroup:
+ format: int64
+ type: integer
+ spiloRunAsUser:
+ format: int64
+ type: integer
+ standby:
+ description: |-
+ StandbyDescription contains remote primary config and/or s3/gs wal path.
+ standby_host can be specified alone or together with either s3_wal_path OR gs_wal_path (mutually exclusive).
+ At least one field must be specified. s3_wal_path and gs_wal_path are mutually exclusive.
+ properties:
+ gs_wal_path:
+ type: string
+ s3_wal_path:
+ type: string
+ standby_host:
+ type: string
+ standby_port:
+ type: string
+ standby_primary_slot_name:
+ type: string
+ type: object
+ streams:
+ items:
+ description: Stream defines properties for creating FabricEventStream
+ resources
+ properties:
+ applicationId:
+ type: string
+ batchSize:
+ format: int32
+ type: integer
+ cpu:
+ pattern: ^(\d+m|\d+(\.\d{1,3})?)$
+ type: string
+ database:
+ type: string
+ enableRecovery:
+ type: boolean
+ filter:
+ additionalProperties:
+ type: string
+ type: object
+ memory:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ tables:
+ additionalProperties:
+ description: StreamTable defines properties of outbox tables
+ for FabricEventStreams
+ properties:
+ eventType:
+ type: string
+ idColumn:
+ type: string
+ ignoreRecovery:
+ type: boolean
+ payloadColumn:
+ type: string
+ recoveryEventType:
+ type: string
+ required:
+ - eventType
+ type: object
+ type: object
+ required:
+ - applicationId
+ - database
+ - tables
+ type: object
+ type: array
+ teamId:
+ type: string
+ tls:
+ description: TLSDescription specs TLS properties
+ properties:
+ caFile:
+ type: string
+ caSecretName:
+ type: string
+ certificateFile:
+ type: string
+ privateKeyFile:
+ type: string
+ secretName:
+ type: string
+ required:
+ - secretName
+ type: object
+ tolerations:
+ items:
+ description: |-
+ The pod this Toleration is attached to tolerates any taint that matches
+ the triple using the matching operator .
+ properties:
+ effect:
+ description: |-
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+ When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+ type: string
+ key:
+ description: |-
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+ If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+ type: string
+ operator:
+ description: |-
+ Operator represents a key's relationship to the value.
+ Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
+ Exists is equivalent to wildcard for value, so that a pod can
+ tolerate all taints of a particular category.
+ Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
+ type: string
+ tolerationSeconds:
+ description: |-
+ TolerationSeconds represents the period of time the toleration (which must be
+ of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+ it is not set, which means tolerate the taint forever (do not evict). Zero and
+ negative values will be treated as 0 (evict immediately) by the system.
+ format: int64
+ type: integer
+ value:
+ description: |-
+ Value is the taint value the toleration matches to.
+ If the operator is Exists, the value should be empty, otherwise just a regular string.
+ type: string
+ type: object
+ type: array
+ topologySpreadConstraints:
+ items:
+ description: TopologySpreadConstraint specifies how to spread matching
+ pods among the given topology.
+ properties:
+ labelSelector:
+ description: |-
+ LabelSelector is used to find matching pods.
+ Pods that match this label selector are counted to determine the number of pods
+ in their corresponding topology domain.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector
+ requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector
+ applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ matchLabelKeys:
+ description: |-
+ MatchLabelKeys is a set of pod label keys to select the pods over which
+ spreading will be calculated. The keys are used to lookup values from the
+ incoming pod labels, those key-value labels are ANDed with labelSelector
+ to select the group of existing pods over which spreading will be calculated
+ for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
+ MatchLabelKeys cannot be set when LabelSelector isn't set.
+ Keys that don't exist in the incoming pod labels will
+ be ignored. A null or empty list means only match against labelSelector.
+
+ This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ maxSkew:
+ description: |-
+ MaxSkew describes the degree to which pods may be unevenly distributed.
+ When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference
+ between the number of matching pods in the target topology and the global minimum.
+ The global minimum is the minimum number of matching pods in an eligible domain
+ or zero if the number of eligible domains is less than MinDomains.
+ For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same
+ labelSelector spread as 2/2/1:
+ In this case, the global minimum is 1.
+ | zone1 | zone2 | zone3 |
+ | P P | P P | P |
+ - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2;
+ scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2)
+ violate MaxSkew(1).
+ - if MaxSkew is 2, incoming pod can be scheduled onto any zone.
+ When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence
+ to topologies that satisfy it.
+ It's a required field. Default value is 1 and 0 is not allowed.
+ format: int32
+ type: integer
+ minDomains:
+ description: |-
+ MinDomains indicates a minimum number of eligible domains.
+ When the number of eligible domains with matching topology keys is less than minDomains,
+ Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed.
+ And when the number of eligible domains with matching topology keys equals or greater than minDomains,
+ this value has no effect on scheduling.
+ As a result, when the number of eligible domains is less than minDomains,
+ scheduler won't schedule more than maxSkew Pods to those domains.
+ If value is nil, the constraint behaves as if MinDomains is equal to 1.
+ Valid values are integers greater than 0.
+ When value is not nil, WhenUnsatisfiable must be DoNotSchedule.
+
+ For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same
+ labelSelector spread as 2/2/2:
+ | zone1 | zone2 | zone3 |
+ | P P | P P | P P |
+ The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0.
+ In this situation, new pod with the same labelSelector cannot be scheduled,
+ because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones,
+ it will violate MaxSkew.
+ format: int32
+ type: integer
+ nodeAffinityPolicy:
+ description: |-
+ NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector
+ when calculating pod topology spread skew. Options are:
+ - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.
+ - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
+
+ If this value is nil, the behavior is equivalent to the Honor policy.
+ type: string
+ nodeTaintsPolicy:
+ description: |-
+ NodeTaintsPolicy indicates how we will treat node taints when calculating
+ pod topology spread skew. Options are:
+ - Honor: nodes without taints, along with tainted nodes for which the incoming pod
+ has a toleration, are included.
+ - Ignore: node taints are ignored. All nodes are included.
+
+ If this value is nil, the behavior is equivalent to the Ignore policy.
+ type: string
+ topologyKey:
+ description: |-
+ TopologyKey is the key of node labels. Nodes that have a label with this key
+ and identical values are considered to be in the same topology.
+ We consider each as a "bucket", and try to put balanced number
+ of pods into each bucket.
+ We define a domain as a particular instance of a topology.
+ Also, we define an eligible domain as a domain whose nodes meet the requirements of
+ nodeAffinityPolicy and nodeTaintsPolicy.
+ e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology.
+ And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology.
+ It's a required field.
+ type: string
+ whenUnsatisfiable:
+ description: |-
+ WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy
+ the spread constraint.
+ - DoNotSchedule (default) tells the scheduler not to schedule it.
+ - ScheduleAnyway tells the scheduler to schedule the pod in any location,
+ but giving higher precedence to topologies that would help reduce the
+ skew.
+ A constraint is considered "Unsatisfiable" for an incoming pod
+ if and only if every possible node assignment for that pod would violate
+ "MaxSkew" on some topology.
+ For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same
+ labelSelector spread as 3/1/1:
+ | zone1 | zone2 | zone3 |
+ | P P P | P | P |
+ If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled
+ to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies
+ MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler
+ won't make it *more* imbalanced.
+ It's a required field.
+ type: string
+ required:
+ - maxSkew
+ - topologyKey
+ - whenUnsatisfiable
+ type: object
+ type: array
+ useLoadBalancer:
+ description: |-
+ deprecated load balancer settings maintained for backward compatibility
+ see "Load balancers" operator docs
+ type: boolean
+ users:
+ additionalProperties:
+ description: UserFlags defines flags (such as superuser, nologin)
+ that could be assigned to individual users
+ items:
+ enum:
+ - bypassrls
+ - BYPASSRLS
+ - nobypassrls
+ - NOBYPASSRLS
+ - createdb
+ - CREATEDB
+ - nocreatedb
+ - NOCREATEDB
+ - createrole
+ - CREATEROLE
+ - nocreaterole
+ - NOCREATEROLE
+ - inherit
+ - INHERIT
+ - noinherit
+ - NOINHERIT
+ - login
+ - LOGIN
+ - nologin
+ - NOLOGIN
+ - replication
+ - REPLICATION
+ - noreplication
+ - NOREPLICATION
+ - superuser
+ - SUPERUSER
+ - nosuperuser
+ - NOSUPERUSER
+ type: string
+ type: array
+ type: object
+ usersIgnoringSecretRotation:
+ items:
+ type: string
+ nullable: true
+ type: array
+ usersWithInPlaceSecretRotation:
+ items:
+ type: string
+ nullable: true
+ type: array
+ usersWithSecretRotation:
+ items:
+ type: string
+ nullable: true
+ type: array
+ volume:
+ description: Volume describes a single volume in the manifest.
+ properties:
+ iops:
+ format: int64
+ type: integer
+ isSubPathExpr:
+ type: boolean
+ selector:
+ description: |-
+ A label selector is a label query over a set of resources. The result of matchLabels and
+ matchExpressions are ANDed. An empty label selector matches all objects. A null
+ label selector matches no objects.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector
+ requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector
+ applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ size:
+ pattern: ^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$
+ type: string
+ storageClass:
+ type: string
+ subPath:
+ type: string
+ throughput:
+ format: int64
+ type: integer
+ type:
+ type: string
+ required:
+ - size
+ type: object
+ required:
+ - numberOfInstances
+ - postgresql
+ - teamId
+ - volume
+ type: object
+ status:
+ description: PostgresStatus contains status of the PostgreSQL cluster
+ (running, creation failed etc.)
+ properties:
+ PostgresClusterStatus:
+ type: string
+ required:
+ - PostgresClusterStatus
+ type: object
+ required:
+ - metadata
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
diff --git a/mkdocs.yml b/mkdocs.yml
index b8e8c3e04..93c743375 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -8,6 +8,7 @@ nav:
- Postgres Operator UI: 'operator-ui.md'
- Admin guide: 'administrator.md'
- User guide: 'user.md'
+ - PgBouncer generated config: 'pgbouncer-generated-config.md'
- Developer guide: 'developer.md'
- Reference:
- Config parameters: 'reference/operator_parameters.md'
diff --git a/pkg/apis/acid.zalan.do/v1/operator_configuration_type.go b/pkg/apis/acid.zalan.do/v1/operator_configuration_type.go
index 046dd0761..9686e0f75 100644
--- a/pkg/apis/acid.zalan.do/v1/operator_configuration_type.go
+++ b/pkg/apis/acid.zalan.do/v1/operator_configuration_type.go
@@ -347,6 +347,15 @@ type ConnectionPoolerConfiguration struct {
DefaultCPULimit string `json:"connection_pooler_default_cpu_limit,omitempty"`
// +kubebuilder:validation:Pattern=`^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$`
DefaultMemoryLimit string `json:"connection_pooler_default_memory_limit,omitempty"`
+ // +kubebuilder:default=false
+ GenerateConfig *bool `json:"connection_pooler_generate_config,omitempty"`
+ Command []string `json:"connection_pooler_command,omitempty"`
+ // +kubebuilder:default={"/etc/pgbouncer/pgbouncer.ini"}
+ Args []string `json:"connection_pooler_args,omitempty"`
+ // +kubebuilder:default="scram-sha-256"
+ AuthType string `json:"connection_pooler_auth_type,omitempty"`
+ // +kubebuilder:default="/etc/pgbouncer/pgbouncer.ini"
+ ConfigPath string `json:"connection_pooler_config_path,omitempty"`
}
// OperatorLogicalBackupConfiguration defines configuration for logical backup
diff --git a/pkg/apis/acid.zalan.do/v1/zz_generated.deepcopy.go b/pkg/apis/acid.zalan.do/v1/zz_generated.deepcopy.go
index 4601cf668..f5ef05ec5 100644
--- a/pkg/apis/acid.zalan.do/v1/zz_generated.deepcopy.go
+++ b/pkg/apis/acid.zalan.do/v1/zz_generated.deepcopy.go
@@ -142,6 +142,21 @@ func (in *ConnectionPoolerConfiguration) DeepCopyInto(out *ConnectionPoolerConfi
*out = new(int32)
**out = **in
}
+ if in.GenerateConfig != nil {
+ in, out := &in.GenerateConfig, &out.GenerateConfig
+ *out = new(bool)
+ **out = **in
+ }
+ if in.Command != nil {
+ in, out := &in.Command, &out.Command
+ *out = make([]string, len(*in))
+ copy(*out, *in)
+ }
+ if in.Args != nil {
+ in, out := &in.Args, &out.Args
+ *out = make([]string, len(*in))
+ copy(*out, *in)
+ }
return
}
diff --git a/pkg/cluster/connection_pooler.go b/pkg/cluster/connection_pooler.go
index 61cd9b041..a84ad74bd 100644
--- a/pkg/cluster/connection_pooler.go
+++ b/pkg/cluster/connection_pooler.go
@@ -34,6 +34,7 @@ type ConnectionPoolerObjects struct {
AuthSecret *v1.Secret
Deployment *appsv1.Deployment
Service *v1.Service
+ ConfigMap *v1.ConfigMap
Name string
ClusterName string
Namespace string
@@ -200,6 +201,52 @@ func (c *Cluster) generateConnectionPoolerAuthSecret(connectionPooler *Connectio
}
}
+type connectionPoolerSizes struct {
+ maxDBConn int32
+ defaultSize int32
+ minSize int32
+ reserveSize int32
+ maxClientConn int32
+}
+
+// connectionPoolerSizes computes the pgBouncer pool sizing from the cluster
+// spec and operator config. Shared by getConnectionPoolerEnvVars (stock image,
+// via env vars) and generatePgBouncerIni (generated config).
+func (c *Cluster) connectionPoolerSizes() connectionPoolerSizes {
+ spec := &c.Spec
+ connectionPoolerSpec := spec.ConnectionPooler
+ if connectionPoolerSpec == nil {
+ connectionPoolerSpec = &acidv1.ConnectionPooler{}
+ }
+
+ numberOfInstances := connectionPoolerSpec.NumberOfInstances
+ if numberOfInstances == nil {
+ numberOfInstances = util.CoalesceInt32(
+ c.OpConfig.ConnectionPooler.NumberOfInstances,
+ k8sutil.Int32ToPointer(1))
+ }
+
+ effectiveMaxDBConn := util.CoalesceInt32(
+ connectionPoolerSpec.MaxDBConnections,
+ c.OpConfig.ConnectionPooler.MaxDBConnections)
+ if effectiveMaxDBConn == nil {
+ effectiveMaxDBConn = k8sutil.Int32ToPointer(
+ constants.ConnectionPoolerMaxDBConnections)
+ }
+
+ maxDBConn := *effectiveMaxDBConn / *numberOfInstances
+ defaultSize := maxDBConn / 2
+ minSize := defaultSize / 2
+
+ return connectionPoolerSizes{
+ maxDBConn: maxDBConn,
+ defaultSize: defaultSize,
+ minSize: minSize,
+ reserveSize: minSize,
+ maxClientConn: constants.ConnectionPoolerMaxClientConnections,
+ }
+}
+
// Generate pool size related environment variables.
//
// MAX_DB_CONN would specify the global maximum for connections to a target
@@ -220,7 +267,6 @@ func (c *Cluster) generateConnectionPoolerAuthSecret(connectionPooler *Connectio
// have to wait for spinning up a new connections.
//
// RESERVE_SIZE is how many additional connections to allow for a pooler.
-
func (c *Cluster) getConnectionPoolerEnvVars() []v1.EnvVar {
spec := &c.Spec
connectionPoolerSpec := spec.ConnectionPooler
@@ -231,27 +277,7 @@ func (c *Cluster) getConnectionPoolerEnvVars() []v1.EnvVar {
connectionPoolerSpec.Mode,
c.OpConfig.ConnectionPooler.Mode)
- numberOfInstances := connectionPoolerSpec.NumberOfInstances
- if numberOfInstances == nil {
- numberOfInstances = util.CoalesceInt32(
- c.OpConfig.ConnectionPooler.NumberOfInstances,
- k8sutil.Int32ToPointer(1))
- }
-
- effectiveMaxDBConn := util.CoalesceInt32(
- connectionPoolerSpec.MaxDBConnections,
- c.OpConfig.ConnectionPooler.MaxDBConnections)
-
- if effectiveMaxDBConn == nil {
- effectiveMaxDBConn = k8sutil.Int32ToPointer(
- constants.ConnectionPoolerMaxDBConnections)
- }
-
- maxDBConn := *effectiveMaxDBConn / *numberOfInstances
-
- defaultSize := maxDBConn / 2
- minSize := defaultSize / 2
- reserveSize := minSize
+ sizes := c.connectionPoolerSizes()
return []v1.EnvVar{
{
@@ -264,23 +290,23 @@ func (c *Cluster) getConnectionPoolerEnvVars() []v1.EnvVar {
},
{
Name: "CONNECTION_POOLER_DEFAULT_SIZE",
- Value: fmt.Sprint(defaultSize),
+ Value: fmt.Sprint(sizes.defaultSize),
},
{
Name: "CONNECTION_POOLER_MIN_SIZE",
- Value: fmt.Sprint(minSize),
+ Value: fmt.Sprint(sizes.minSize),
},
{
Name: "CONNECTION_POOLER_RESERVE_SIZE",
- Value: fmt.Sprint(reserveSize),
+ Value: fmt.Sprint(sizes.reserveSize),
},
{
Name: "CONNECTION_POOLER_MAX_CLIENT_CONN",
- Value: fmt.Sprint(constants.ConnectionPoolerMaxClientConnections),
+ Value: fmt.Sprint(sizes.maxClientConn),
},
{
Name: "CONNECTION_POOLER_MAX_DB_CONN",
- Value: fmt.Sprint(maxDBConn),
+ Value: fmt.Sprint(sizes.maxDBConn),
},
}
}
@@ -441,6 +467,33 @@ func (c *Cluster) generateConnectionPoolerPodTemplate(role PostgresRole) (
}
}
+ // When enabled, mount an operator-generated pgbouncer.ini and override the
+ // container command/args (e.g. for images like the Chainguard FIPS pgbouncer
+ // whose entrypoint is the bare binary with no config-rendering wrapper).
+ if c.OpConfig.ConnectionPooler.GenerateConfig {
+ configVolumeName := c.connectionPoolerConfigMapName(role)
+ poolerVolumes = append(poolerVolumes, v1.Volume{
+ Name: configVolumeName,
+ VolumeSource: v1.VolumeSource{
+ ConfigMap: &v1.ConfigMapVolumeSource{
+ LocalObjectReference: v1.LocalObjectReference{
+ Name: configVolumeName,
+ },
+ },
+ },
+ })
+ volumeMounts = append(volumeMounts, v1.VolumeMount{
+ Name: configVolumeName,
+ MountPath: c.OpConfig.ConnectionPooler.ConfigPath,
+ SubPath: pgBouncerConfigFileName,
+ ReadOnly: true,
+ })
+ if len(c.OpConfig.ConnectionPooler.Command) > 0 {
+ poolerContainer.Command = c.OpConfig.ConnectionPooler.Command
+ }
+ poolerContainer.Args = c.OpConfig.ConnectionPooler.Args
+ }
+
poolerContainer.Env = envVars
poolerContainer.VolumeMounts = volumeMounts
tolerationsSpec := tolerations(&spec.Tolerations, c.OpConfig.PodToleration)
@@ -458,11 +511,16 @@ func (c *Cluster) generateConnectionPoolerPodTemplate(role PostgresRole) (
securityContext.FSGroup = effectiveFSGroup
}
+ podAnnotations, err := c.connectionPoolerPodAnnotations(role)
+ if err != nil {
+ return nil, err
+ }
+
podTemplate := &v1.PodTemplateSpec{
ObjectMeta: metav1.ObjectMeta{
Labels: c.connectionPoolerLabels(role, true).MatchLabels,
Namespace: c.Namespace,
- Annotations: c.annotationsSet(c.generatePodAnnotations(spec)),
+ Annotations: podAnnotations,
},
Spec: v1.PodSpec{
TerminationGracePeriodSeconds: &gracePeriod,
@@ -750,9 +808,28 @@ func (c *Cluster) deleteConnectionPooler(role PostgresRole) (err error) {
c.logger.Infof("connection pooler auth secret %s has been deleted for role %s", authSecret.Name, role)
}
+ // Repeat the same for the generated config map
+ configMap := c.ConnectionPooler[role].ConfigMap
+ if configMap == nil {
+ c.logger.Debug("no connection pooler config map object to delete")
+ } else {
+ err = c.KubeClient.
+ ConfigMaps(c.Namespace).
+ Delete(context.TODO(), configMap.Name, options)
+
+ if k8sutil.ResourceNotFound(err) {
+ c.logger.Debugf("connection pooler config map %s for role %s has already been deleted", configMap.Name, role)
+ } else if err != nil {
+ return fmt.Errorf("could not delete connection pooler config map: %v", err)
+ }
+
+ c.logger.Infof("connection pooler config map %s has been deleted for role %s", configMap.Name, role)
+ }
+
c.ConnectionPooler[role].AuthSecret = nil
c.ConnectionPooler[role].Deployment = nil
c.ConnectionPooler[role].Service = nil
+ c.ConnectionPooler[role].ConfigMap = nil
return nil
}
@@ -776,6 +853,40 @@ func (c *Cluster) deleteConnectionPoolerSecret() (err error) {
return nil
}
+// syncConnectionPoolerConfigMap reconciles the operator-generated pgbouncer
+// config map for the given role: create if missing, update on drift.
+func (c *Cluster) syncConnectionPoolerConfigMap(role PostgresRole) error {
+ desired, err := c.generateConnectionPoolerConfigMap(role)
+ if err != nil {
+ return fmt.Errorf("could not generate connection pooler config map: %v", err)
+ }
+
+ existing, err := c.KubeClient.ConfigMaps(c.Namespace).Get(context.TODO(), desired.Name, metav1.GetOptions{})
+ if k8sutil.ResourceNotFound(err) {
+ created, cErr := c.KubeClient.ConfigMaps(c.Namespace).Create(context.TODO(), desired, metav1.CreateOptions{})
+ if cErr != nil {
+ return fmt.Errorf("could not create connection pooler config map: %v", cErr)
+ }
+ c.ConnectionPooler[role].ConfigMap = created
+ return nil
+ } else if err != nil {
+ return fmt.Errorf("could not get connection pooler config map: %v", err)
+ }
+
+ if !reflect.DeepEqual(existing.Data, desired.Data) {
+ desired.ResourceVersion = existing.ResourceVersion
+ updated, uErr := c.KubeClient.ConfigMaps(c.Namespace).Update(context.TODO(), desired, metav1.UpdateOptions{})
+ if uErr != nil {
+ return fmt.Errorf("could not update connection pooler config map: %v", uErr)
+ }
+ c.ConnectionPooler[role].ConfigMap = updated
+ return nil
+ }
+
+ c.ConnectionPooler[role].ConfigMap = existing
+ return nil
+}
+
// Perform actual patching of a connection pooler deployment, assuming that all
// the check were already done before.
func updateConnectionPoolerDeployment(KubeClient k8sutil.KubernetesClient, newDeployment *appsv1.Deployment, doUpdate bool) (*appsv1.Deployment, error) {
@@ -1123,6 +1234,14 @@ func (c *Cluster) syncConnectionPoolerWorker(oldSpec, newSpec *acidv1.Postgresql
c.ConnectionPooler[role].AuthSecret = authSecret
}
+ // reconcile the generated pgbouncer config map before the deployment so the
+ // mounted config exists when pods start
+ if c.OpConfig.ConnectionPooler.GenerateConfig {
+ if cmErr := c.syncConnectionPoolerConfigMap(role); cmErr != nil {
+ return NoSync, cmErr
+ }
+ }
+
// next the pooler deployment
deployment, err = c.KubeClient.
Deployments(c.Namespace).
@@ -1183,7 +1302,10 @@ func (c *Cluster) syncConnectionPoolerWorker(oldSpec, newSpec *acidv1.Postgresql
syncReason = append(syncReason, specReason...)
}
- newPodAnnotations := c.annotationsSet(c.generatePodAnnotations(&c.Spec))
+ newPodAnnotations, annErr := c.connectionPoolerPodAnnotations(role)
+ if annErr != nil {
+ return nil, fmt.Errorf("could not generate pod annotations for connection pooler: %v", annErr)
+ }
deletedPodAnnotations := []string{}
if changed, reason := c.compareAnnotations(deployment.Spec.Template.Annotations, newPodAnnotations, &deletedPodAnnotations); changed {
specSync = true
diff --git a/pkg/cluster/connection_pooler_test.go b/pkg/cluster/connection_pooler_test.go
index 1b41cbb02..d6fb81e9d 100644
--- a/pkg/cluster/connection_pooler_test.go
+++ b/pkg/cluster/connection_pooler_test.go
@@ -31,6 +31,7 @@ func newFakeK8sPoolerTestClient() (k8sutil.KubernetesClient, *fake.Clientset) {
DeploymentsGetter: clientSet.AppsV1(),
ServicesGetter: clientSet.CoreV1(),
SecretsGetter: clientSet.CoreV1(),
+ ConfigMapsGetter: clientSet.CoreV1(),
}, clientSet
}
@@ -1155,6 +1156,34 @@ func TestConnectionPoolerServiceSpec(t *testing.T) {
}
}
+func TestConnectionPoolerSizes(t *testing.T) {
+ maxDB := int32(60)
+ instances := int32(2)
+ cluster := New(
+ Config{OpConfig: config.Config{
+ ConnectionPooler: config.ConnectionPooler{
+ MaxDBConnections: &maxDB,
+ NumberOfInstances: &instances,
+ },
+ }},
+ k8sutil.NewMockKubernetesClient(), acidv1.Postgresql{}, logger, eventRecorder)
+ cluster.Spec = acidv1.PostgresSpec{ConnectionPooler: &acidv1.ConnectionPooler{}}
+
+ sizes := cluster.connectionPoolerSizes()
+ if sizes.maxDBConn != 30 {
+ t.Errorf("expected maxDBConn 30, got %d", sizes.maxDBConn)
+ }
+ if sizes.defaultSize != 15 {
+ t.Errorf("expected defaultSize 15, got %d", sizes.defaultSize)
+ }
+ if sizes.reserveSize != 7 {
+ t.Errorf("expected reserveSize 7, got %d", sizes.reserveSize)
+ }
+ if sizes.minSize != 7 {
+ t.Errorf("expected minSize 7, got %d", sizes.minSize)
+ }
+}
+
func TestConnectionPoolerServiceType(t *testing.T) {
testName := "Test connection pooler service type selection"
diff --git a/pkg/cluster/pgbouncer_config.go b/pkg/cluster/pgbouncer_config.go
new file mode 100644
index 000000000..bfcac2dcd
--- /dev/null
+++ b/pkg/cluster/pgbouncer_config.go
@@ -0,0 +1,192 @@
+package cluster
+
+import (
+ "bytes"
+ "crypto/sha256"
+ "fmt"
+ "sort"
+ "strings"
+ "text/template"
+
+ acidv1 "github.com/zalando/postgres-operator/pkg/apis/acid.zalan.do/v1"
+ "github.com/zalando/postgres-operator/pkg/util"
+ v1 "k8s.io/api/core/v1"
+ metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const (
+ pgBouncerConfigFileName = "pgbouncer.ini"
+ poolerConfigChecksumAnnotation = "acid.zalan.do/pgbouncer-config-checksum"
+)
+
+// FIPS-friendly pgbouncer.ini. Differs from the stock Zalando image template:
+// no logfile/pidfile (distroless logs to stdout), auth_type is configurable,
+// and TLS cert lines are emitted only when spec.TLS is set (the FIPS image does
+// not run the openssl cert-generation step that the Zalando entrypoint does).
+const pgBouncerConfigTemplateText = `# Generated by postgres-operator. Do not edit.
+[databases]
+* = host={{ .DBHost }} port={{ .DBPort }} auth_user={{ .User }}
+postgres = host={{ .DBHost }} port={{ .DBPort }} auth_user={{ .User }}
+
+[pgbouncer]
+pool_mode = {{ .Mode }}
+listen_port = {{ .ListenPort }}
+listen_addr = *
+admin_users = {{ .User }}
+{{- if .StatsUsers }}
+stats_users = {{ .StatsUsers }}
+{{- end }}
+auth_dbname = postgres
+auth_file = /etc/pgbouncer/userlist.txt
+auth_query = SELECT * FROM {{ .Schema }}.user_lookup($1)
+auth_type = {{ .AuthType }}
+server_tls_sslmode = require
+{{- if .TLS }}
+{{- if .TLSCAFile }}
+server_tls_ca_file = {{ .TLSCAFile }}
+{{- end }}
+client_tls_sslmode = require
+client_tls_key_file = {{ .TLSKeyFile }}
+client_tls_cert_file = {{ .TLSCertFile }}
+{{- end }}
+log_connections = 0
+log_disconnections = 0
+max_prepared_statements = 200
+default_pool_size = {{ .DefaultPoolSize }}
+reserve_pool_size = {{ .ReservePoolSize }}
+max_client_conn = {{ .MaxClientConn }}
+max_db_connections = {{ .MaxDBConnections }}
+idle_transaction_timeout = 600
+server_login_retry = 5
+ignore_startup_parameters = extra_float_digits,options
+`
+
+var pgBouncerConfigTemplate = template.Must(
+ template.New(pgBouncerConfigFileName).Parse(pgBouncerConfigTemplateText))
+
+type pgBouncerConfigParams struct {
+ DBHost string
+ DBPort int32
+ ListenPort int32
+ User string
+ Schema string
+ Mode string
+ AuthType string
+ StatsUsers string
+ DefaultPoolSize int32
+ ReservePoolSize int32
+ MaxClientConn int32
+ MaxDBConnections int32
+ TLS bool
+ TLSCAFile string
+ TLSKeyFile string
+ TLSCertFile string
+}
+
+// generatePgBouncerIni renders the pgbouncer.ini for the given role from the
+// cluster spec and operator config.
+func (c *Cluster) generatePgBouncerIni(role PostgresRole) (string, error) {
+ spec := &c.Spec
+ connectionPoolerSpec := spec.ConnectionPooler
+ if connectionPoolerSpec == nil {
+ connectionPoolerSpec = &acidv1.ConnectionPooler{}
+ }
+
+ sizes := c.connectionPoolerSizes()
+
+ infraRolesList := make([]string, 0)
+ for infraRoleName := range c.InfrastructureRoles {
+ infraRolesList = append(infraRolesList, infraRoleName)
+ }
+ sort.Strings(infraRolesList) // deterministic output for stable checksums
+
+ params := pgBouncerConfigParams{
+ DBHost: c.serviceAddress(role),
+ DBPort: c.servicePort(role),
+ ListenPort: pgPort,
+ User: util.Coalesce(connectionPoolerSpec.User, c.OpConfig.ConnectionPooler.User),
+ Schema: util.Coalesce(connectionPoolerSpec.Schema, c.OpConfig.ConnectionPooler.Schema),
+ Mode: util.Coalesce(connectionPoolerSpec.Mode, c.OpConfig.ConnectionPooler.Mode),
+ AuthType: c.OpConfig.ConnectionPooler.AuthType,
+ StatsUsers: strings.Join(infraRolesList, ","),
+ DefaultPoolSize: sizes.defaultSize,
+ ReservePoolSize: sizes.reserveSize,
+ MaxClientConn: sizes.maxClientConn,
+ MaxDBConnections: sizes.maxDBConn,
+ }
+
+ if spec.TLS != nil && spec.TLS.SecretName != "" {
+ mountPath := "/tls"
+ params.TLS = true
+ params.TLSCertFile = ensurePath(spec.TLS.CertificateFile, mountPath, "tls.crt")
+ params.TLSKeyFile = ensurePath(spec.TLS.PrivateKeyFile, mountPath, "tls.key")
+ if spec.TLS.CAFile != "" {
+ mountPathCA := mountPath
+ if spec.TLS.CASecretName != "" {
+ mountPathCA = mountPath + "ca"
+ }
+ params.TLSCAFile = ensurePath(spec.TLS.CAFile, mountPathCA, "")
+ }
+ }
+
+ var buf bytes.Buffer
+ if err := pgBouncerConfigTemplate.Execute(&buf, params); err != nil {
+ return "", fmt.Errorf("could not render pgbouncer config: %v", err)
+ }
+ return buf.String(), nil
+}
+
+// connectionPoolerConfigChecksum returns the sha256 of the rendered config,
+// used as a pod annotation so config changes roll the pooler pods.
+func (c *Cluster) connectionPoolerConfigChecksum(role PostgresRole) (string, error) {
+ ini, err := c.generatePgBouncerIni(role)
+ if err != nil {
+ return "", err
+ }
+ sum := sha256.Sum256([]byte(ini))
+ return fmt.Sprintf("%x", sum), nil
+}
+
+// connectionPoolerConfigMapName returns the name of the operator-generated
+// pgbouncer config map for the given role.
+func (c *Cluster) connectionPoolerConfigMapName(role PostgresRole) string {
+ return fmt.Sprintf("%s-config", c.connectionPoolerName(role))
+}
+
+// generateConnectionPoolerConfigMap builds the operator-owned ConfigMap holding
+// the rendered pgbouncer.ini for the given role.
+func (c *Cluster) generateConnectionPoolerConfigMap(role PostgresRole) (*v1.ConfigMap, error) {
+ ini, err := c.generatePgBouncerIni(role)
+ if err != nil {
+ return nil, err
+ }
+ return &v1.ConfigMap{
+ ObjectMeta: metav1.ObjectMeta{
+ Name: c.connectionPoolerConfigMapName(role),
+ Namespace: c.Namespace,
+ Labels: c.connectionPoolerLabels(role, true).MatchLabels,
+ Annotations: c.annotationsSet(nil),
+ OwnerReferences: c.ownerReferences(),
+ },
+ Data: map[string]string{
+ pgBouncerConfigFileName: ini,
+ },
+ }, nil
+}
+
+// connectionPoolerPodAnnotations returns the pooler pod annotations, adding the
+// config checksum when generated config is enabled so config changes roll pods.
+func (c *Cluster) connectionPoolerPodAnnotations(role PostgresRole) (map[string]string, error) {
+ annotations := c.annotationsSet(c.generatePodAnnotations(&c.Spec))
+ if c.OpConfig.ConnectionPooler.GenerateConfig {
+ checksum, err := c.connectionPoolerConfigChecksum(role)
+ if err != nil {
+ return nil, err
+ }
+ if annotations == nil {
+ annotations = map[string]string{}
+ }
+ annotations[poolerConfigChecksumAnnotation] = checksum
+ }
+ return annotations, nil
+}
diff --git a/pkg/cluster/pgbouncer_config_test.go b/pkg/cluster/pgbouncer_config_test.go
new file mode 100644
index 000000000..ac724db0d
--- /dev/null
+++ b/pkg/cluster/pgbouncer_config_test.go
@@ -0,0 +1,245 @@
+package cluster
+
+import (
+ "context"
+ "strings"
+ "testing"
+
+ acidv1 "github.com/zalando/postgres-operator/pkg/apis/acid.zalan.do/v1"
+ "github.com/zalando/postgres-operator/pkg/util"
+ "github.com/zalando/postgres-operator/pkg/util/config"
+ "github.com/zalando/postgres-operator/pkg/util/k8sutil"
+ v1 "k8s.io/api/core/v1"
+ metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func newGenerateConfigCluster() *Cluster {
+ maxDB := int32(60)
+ instances := int32(2)
+ cluster := New(
+ Config{OpConfig: config.Config{
+ ConnectionPooler: config.ConnectionPooler{
+ User: "pooler",
+ Schema: "pooler",
+ Mode: "transaction",
+ MaxDBConnections: &maxDB,
+ NumberOfInstances: &instances,
+ GenerateConfig: true,
+ AuthType: "scram-sha-256",
+ ConfigPath: "/etc/pgbouncer/pgbouncer.ini",
+ Args: []string{"/etc/pgbouncer/pgbouncer.ini"},
+ },
+ Resources: config.Resources{
+ EnableOwnerReferences: util.True(),
+ },
+ }},
+ k8sutil.NewMockKubernetesClient(), acidv1.Postgresql{}, logger, eventRecorder)
+ cluster.Name = "acid-test"
+ cluster.Namespace = "default"
+ cluster.Spec = acidv1.PostgresSpec{ConnectionPooler: &acidv1.ConnectionPooler{}}
+ return cluster
+}
+
+func TestGeneratePgBouncerIni(t *testing.T) {
+ cluster := newGenerateConfigCluster()
+
+ ini, err := cluster.generatePgBouncerIni(Master)
+ if err != nil {
+ t.Fatalf("unexpected error: %v", err)
+ }
+
+ for _, want := range []string{
+ "[databases]",
+ "[pgbouncer]",
+ "pool_mode = transaction",
+ "auth_type = scram-sha-256",
+ "auth_file = /etc/pgbouncer/userlist.txt",
+ "auth_query = SELECT * FROM pooler.user_lookup($1)",
+ "server_tls_sslmode = require",
+ "default_pool_size = 15",
+ "max_db_connections = 30",
+ } {
+ if !strings.Contains(ini, want) {
+ t.Errorf("rendered ini missing %q\n---\n%s", want, ini)
+ }
+ }
+
+ if strings.Contains(ini, "client_tls_cert_file") {
+ t.Errorf("did not expect client_tls_cert_file without spec.TLS\n%s", ini)
+ }
+}
+
+func TestGeneratePgBouncerIniWithTLS(t *testing.T) {
+ cluster := newGenerateConfigCluster()
+ cluster.Spec.TLS = &acidv1.TLSDescription{SecretName: "pg-tls"}
+
+ ini, err := cluster.generatePgBouncerIni(Master)
+ if err != nil {
+ t.Fatalf("unexpected error: %v", err)
+ }
+ for _, want := range []string{
+ "client_tls_sslmode = require",
+ "client_tls_key_file = /tls/tls.key",
+ "client_tls_cert_file = /tls/tls.crt",
+ } {
+ if !strings.Contains(ini, want) {
+ t.Errorf("rendered ini missing %q\n---\n%s", want, ini)
+ }
+ }
+}
+
+func TestConnectionPoolerConfigChecksumStability(t *testing.T) {
+ cluster := newGenerateConfigCluster()
+
+ sum1, err := cluster.connectionPoolerConfigChecksum(Master)
+ if err != nil {
+ t.Fatalf("unexpected error: %v", err)
+ }
+ sum2, err := cluster.connectionPoolerConfigChecksum(Master)
+ if err != nil {
+ t.Fatalf("unexpected error: %v", err)
+ }
+ if sum1 != sum2 {
+ t.Errorf("checksum not stable: %q != %q", sum1, sum2)
+ }
+
+ cluster.OpConfig.ConnectionPooler.AuthType = "md5"
+ sum3, err := cluster.connectionPoolerConfigChecksum(Master)
+ if err != nil {
+ t.Fatalf("unexpected error: %v", err)
+ }
+ if sum1 == sum3 {
+ t.Errorf("checksum should change when config changes")
+ }
+}
+
+func TestGenerateConnectionPoolerConfigMap(t *testing.T) {
+ cluster := newGenerateConfigCluster()
+
+ cm, err := cluster.generateConnectionPoolerConfigMap(Master)
+ if err != nil {
+ t.Fatalf("unexpected error: %v", err)
+ }
+ if cm.Name != cluster.connectionPoolerName(Master)+"-config" {
+ t.Errorf("unexpected config map name %q", cm.Name)
+ }
+ if _, ok := cm.Data["pgbouncer.ini"]; !ok {
+ t.Errorf("config map missing pgbouncer.ini key, got %#v", cm.Data)
+ }
+ if len(cm.OwnerReferences) == 0 {
+ t.Errorf("config map should have owner references")
+ }
+}
+
+func findVolumeMount(mounts []v1.VolumeMount, path string) *v1.VolumeMount {
+ for i := range mounts {
+ if mounts[i].MountPath == path {
+ return &mounts[i]
+ }
+ }
+ return nil
+}
+
+func TestPoolerPodTemplateGeneratedConfigOn(t *testing.T) {
+ cluster := newGenerateConfigCluster()
+
+ tmpl, err := cluster.generateConnectionPoolerPodTemplate(Master)
+ if err != nil {
+ t.Fatalf("unexpected error: %v", err)
+ }
+ container := tmpl.Spec.Containers[0]
+
+ mount := findVolumeMount(container.VolumeMounts, "/etc/pgbouncer/pgbouncer.ini")
+ if mount == nil {
+ t.Fatalf("expected a volume mount at /etc/pgbouncer/pgbouncer.ini")
+ }
+ if mount.SubPath != "pgbouncer.ini" {
+ t.Errorf("expected subPath pgbouncer.ini, got %q", mount.SubPath)
+ }
+ if len(container.Args) != 1 || container.Args[0] != "/etc/pgbouncer/pgbouncer.ini" {
+ t.Errorf("expected args [/etc/pgbouncer/pgbouncer.ini], got %#v", container.Args)
+ }
+ if _, ok := tmpl.Annotations[poolerConfigChecksumAnnotation]; !ok {
+ t.Errorf("expected checksum annotation on pod template")
+ }
+}
+
+func TestPoolerPodTemplateGeneratedConfigOff(t *testing.T) {
+ cluster := newGenerateConfigCluster()
+ cluster.OpConfig.ConnectionPooler.GenerateConfig = false
+
+ tmpl, err := cluster.generateConnectionPoolerPodTemplate(Master)
+ if err != nil {
+ t.Fatalf("unexpected error: %v", err)
+ }
+ container := tmpl.Spec.Containers[0]
+
+ if findVolumeMount(container.VolumeMounts, "/etc/pgbouncer/pgbouncer.ini") != nil {
+ t.Errorf("did not expect config mount when GenerateConfig is off")
+ }
+ if len(container.Args) != 0 {
+ t.Errorf("did not expect args when GenerateConfig is off, got %#v", container.Args)
+ }
+ if _, ok := tmpl.Annotations[poolerConfigChecksumAnnotation]; ok {
+ t.Errorf("did not expect checksum annotation when GenerateConfig is off")
+ }
+}
+
+func TestSyncConnectionPoolerConfigMap(t *testing.T) {
+ client, _ := newFakeK8sPoolerTestClient()
+ maxDB := int32(60)
+ instances := int32(2)
+ pg := acidv1.Postgresql{
+ ObjectMeta: metav1.ObjectMeta{Name: "acid-test", Namespace: "default"},
+ Spec: acidv1.PostgresSpec{
+ EnableConnectionPooler: boolToPointer(true),
+ ConnectionPooler: &acidv1.ConnectionPooler{},
+ },
+ }
+ cluster := New(
+ Config{OpConfig: config.Config{
+ ConnectionPooler: config.ConnectionPooler{
+ User: "pooler", Schema: "pooler", Mode: "transaction",
+ MaxDBConnections: &maxDB, NumberOfInstances: &instances,
+ GenerateConfig: true, AuthType: "scram-sha-256",
+ ConfigPath: "/etc/pgbouncer/pgbouncer.ini",
+ Args: []string{"/etc/pgbouncer/pgbouncer.ini"},
+ },
+ }},
+ client, pg, logger, eventRecorder)
+ cluster.Name = "acid-test"
+ cluster.Namespace = "default"
+ cluster.Spec = pg.Spec
+ cluster.ConnectionPooler = map[PostgresRole]*ConnectionPoolerObjects{
+ Master: {Name: cluster.connectionPoolerName(Master), Namespace: "default", Role: Master},
+ }
+
+ if err := cluster.syncConnectionPoolerConfigMap(Master); err != nil {
+ t.Fatalf("unexpected error: %v", err)
+ }
+ name := cluster.connectionPoolerName(Master) + "-config"
+ cm, err := client.ConfigMaps("default").Get(context.TODO(), name, metav1.GetOptions{})
+ if err != nil {
+ t.Fatalf("config map not created: %v", err)
+ }
+ if _, ok := cm.Data["pgbouncer.ini"]; !ok {
+ t.Errorf("config map missing pgbouncer.ini")
+ }
+
+ if err := cluster.syncConnectionPoolerConfigMap(Master); err != nil {
+ t.Fatalf("unexpected error on resync: %v", err)
+ }
+
+ // drift -> update branch: change a config input that alters the rendered ini
+ cluster.OpConfig.ConnectionPooler.AuthType = "md5"
+ if err := cluster.syncConnectionPoolerConfigMap(Master); err != nil {
+ t.Fatalf("unexpected error on drift resync: %v", err)
+ }
+ cm, err = client.ConfigMaps("default").Get(context.TODO(), name, metav1.GetOptions{})
+ if err != nil {
+ t.Fatalf("config map not found after update: %v", err)
+ }
+ if !strings.Contains(cm.Data["pgbouncer.ini"], "auth_type = md5") {
+ t.Errorf("expected updated config map to contain auth_type = md5, got:\n%s", cm.Data["pgbouncer.ini"])
+ }
+}
diff --git a/pkg/controller/operator_config.go b/pkg/controller/operator_config.go
index 667384e30..d46950dcc 100644
--- a/pkg/controller/operator_config.go
+++ b/pkg/controller/operator_config.go
@@ -287,5 +287,18 @@ func (c *Controller) importConfigurationFromCRD(fromCRD *acidv1.OperatorConfigur
fromCRD.ConnectionPooler.MaxDBConnections,
k8sutil.Int32ToPointer(constants.ConnectionPoolerMaxDBConnections))
+ if fromCRD.ConnectionPooler.GenerateConfig != nil {
+ result.ConnectionPooler.GenerateConfig = *fromCRD.ConnectionPooler.GenerateConfig
+ }
+ // Command is nil when not configured (keeps the image entrypoint)
+ result.ConnectionPooler.Command = fromCRD.ConnectionPooler.Command
+ result.ConnectionPooler.Args = util.CoalesceStrArr(
+ fromCRD.ConnectionPooler.Args,
+ []string{"/etc/pgbouncer/pgbouncer.ini"})
+ result.ConnectionPooler.AuthType = util.Coalesce(
+ fromCRD.ConnectionPooler.AuthType, "scram-sha-256")
+ result.ConnectionPooler.ConfigPath = util.Coalesce(
+ fromCRD.ConnectionPooler.ConfigPath, "/etc/pgbouncer/pgbouncer.ini")
+
return result
}
diff --git a/pkg/util/config/config.go b/pkg/util/config/config.go
index 95324a747..6d1ee2373 100644
--- a/pkg/util/config/config.go
+++ b/pkg/util/config/config.go
@@ -165,6 +165,12 @@ type ConnectionPooler struct {
ConnectionPoolerDefaultMemoryRequest string `name:"connection_pooler_default_memory_request"`
ConnectionPoolerDefaultCPULimit string `name:"connection_pooler_default_cpu_limit"`
ConnectionPoolerDefaultMemoryLimit string `name:"connection_pooler_default_memory_limit"`
+ GenerateConfig bool `name:"connection_pooler_generate_config" default:"false"`
+ // Command is nil when not configured (keeps the image entrypoint).
+ Command []string `name:"connection_pooler_command"`
+ Args []string `name:"connection_pooler_args" default:"/etc/pgbouncer/pgbouncer.ini"`
+ AuthType string `name:"connection_pooler_auth_type" default:"scram-sha-256"`
+ ConfigPath string `name:"connection_pooler_config_path" default:"/etc/pgbouncer/pgbouncer.ini"`
}
// Config describes operator config
diff --git a/pkg/util/config/config_test.go b/pkg/util/config/config_test.go
index 6373fdc9a..7b4605fef 100644
--- a/pkg/util/config/config_test.go
+++ b/pkg/util/config/config_test.go
@@ -6,6 +6,8 @@ import (
"reflect"
"strings"
"testing"
+
+ "github.com/stretchr/testify/assert"
)
func TestMain(m *testing.M) {
@@ -43,10 +45,6 @@ func int32Ptr(i int32) *int32 {
return &i
}
-func boolPtr(b bool) *bool {
- return &b
-}
-
var validateTests = []struct {
description string
cfg Config
@@ -335,3 +333,27 @@ func TestNewFromMap(t *testing.T) {
})
}
}
+
+func TestConnectionPoolerGenerateConfigDefaults(t *testing.T) {
+ cfg := NewFromMap(map[string]string{})
+
+ assert.Equal(t, false, cfg.ConnectionPooler.GenerateConfig, "expected GenerateConfig default false")
+ assert.Equal(t, "scram-sha-256", cfg.ConnectionPooler.AuthType, "expected AuthType scram-sha-256")
+ assert.Equal(t, "/etc/pgbouncer/pgbouncer.ini", cfg.ConnectionPooler.ConfigPath, "expected ConfigPath /etc/pgbouncer/pgbouncer.ini")
+ assert.Equal(t, []string{"/etc/pgbouncer/pgbouncer.ini"}, cfg.ConnectionPooler.Args, "expected Args [/etc/pgbouncer/pgbouncer.ini]")
+
+ cfg2 := NewFromMap(map[string]string{
+ "connection_pooler_generate_config": "true",
+ "connection_pooler_auth_type": "md5",
+ "connection_pooler_args": "/custom/pgbouncer.ini",
+ "connection_pooler_config_path": "/custom/pgbouncer.ini",
+ "connection_pooler_command": "/usr/bin/pgbouncer",
+ })
+ if !cfg2.ConnectionPooler.GenerateConfig {
+ assert.Equal(t, true, cfg2.ConnectionPooler.GenerateConfig, "expected GenerateConfig true")
+ }
+ assert.Equal(t, "md5", cfg2.ConnectionPooler.AuthType, "expected AuthType md5")
+ assert.Equal(t, []string{"/custom/pgbouncer.ini"}, cfg2.ConnectionPooler.Args, "expected Args [/custom/pgbouncer.ini]")
+ assert.Equal(t, "/custom/pgbouncer.ini", cfg2.ConnectionPooler.ConfigPath, "expected ConfigPath /custom/pgbouncer.ini")
+ assert.Equal(t, []string{"/usr/bin/pgbouncer"}, cfg2.ConnectionPooler.Command, "expected Command [/usr/bin/pgbouncer]")
+}