+ 
-
+
+ 
-## Run your own production-grade PostgreSQL-as-a-Service on Kubernetes!
+## Run [Cloud Native PostgreSQL on Kubernetes](https://www.crunchydata.com/products/crunchy-postgresql-for-kubernetes/) with PGO: The [Postgres Operator](https://github.com/CrunchyData/postgres-operator) from [Crunchy Data](https://www.crunchydata.com/)!
Latest Release: {{< param operatorVersion >}}
-The [Crunchy PostgreSQL Operator](https://www.crunchydata.com/developers/download-postgres/containers/postgres-operator) automates and simplifies deploying and managing open source PostgreSQL clusters on Kubernetes and other Kubernetes-enabled Platforms by providing the essential features you need to keep your PostgreSQL clusters up and running, including:
+[PGO](https://www.crunchydata.com/developers/download-postgres/containers/postgres-operator),
+the [Postgres Operator](https://github.com/CrunchyData/postgres-operator)
+developed by [Crunchy Data](https://crunchydata.com/) and included in
+[Crunchy PostgreSQL for Kubernetes](https://www.crunchydata.com/products/crunchy-postgresql-for-kubernetes/),
+automates and simplifies deploying and managing open source PostgreSQL clusters
+on Kubernetes.
-#### PostgreSQL Cluster [Provisioning]({{< relref "/architecture/provisioning.md" >}})
+Whether you need to get a simple Postgres cluster up and running, need to deploy
+a high availability, fault tolerant cluster in production, or are running your
+own database-as-a-service, the PostgreSQL Operator provides the essential
+features you need to keep your cloud native Postgres clusters healthy, including:
+
+#### Postgres Cluster [Provisioning]({{< relref "/architecture/provisioning.md" >}})
[Create, Scale, & Delete PostgreSQL clusters with ease](/architecture/provisioning/), while fully customizing your Pods and PostgreSQL configuration!
@@ -30,7 +40,7 @@ Backups and restores leverage the open source [pgBackRest](https://www.pgbackres
#### TLS
-Secure communication between your applications and data servers by [enabling TLS for your PostgreSQL servers](/pgo-client/common-tasks/#enable-tls), including the ability to enforce that all of your connections to use TLS.
+Secure communication between your applications and data servers by [enabling TLS for your PostgreSQL servers](/pgo-client/common-tasks/#enable-tls), including the ability to enforce all of your connections to use TLS.
#### [Monitoring]({{< relref "/architecture/monitoring.md" >}})
@@ -72,16 +82,22 @@ Choose the type of backup (full, incremental, differential) and [how frequently
#### Multi-Namespace Support
-You can control how the PostgreSQL Operator leverages [Kubernetes Namespaces](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/) with several different deployment models:
+You can control how PGO, the Postgres Operator, leverages [Kubernetes Namespaces](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/) with several different deployment models:
-- Deploy the PostgreSQL Operator and all PostgreSQL clusters to the same namespace
-- Deploy the PostgreSQL Operator to one namespaces, and all PostgreSQL clusters to a different namespace
-- Deploy the PostgreSQL Operator to one namespace, and have your PostgreSQL clusters managed acrossed multiple namespaces
-- Dynamically add and remove namespaces managed by the PostgreSQL Operator using the `pgo create namespace` and `pgo delete namespace` commands
+- Deploy PGO and all PostgreSQL clusters to the same namespace
+- Deploy PGO to one namespaces, and all PostgreSQL clusters to a different
+namespace
+- Deploy PGO to one namespace, and have your PostgreSQL clusters managed across
+multiple namespaces
+- Dynamically add and remove namespaces managed by the PostgreSQL Operator using
+the `pgo` client to run `pgo create namespace` and `pgo delete namespace`
#### Full Customizability
-The Crunchy PostgreSQL Operator makes it easy to get your own PostgreSQL-as-a-Service up and running on Kubernetes-enabled platforms, but we know that there are further customizations that you can make. As such, the Crunchy PostgreSQL Operator allows you to further customize your deployments, including:
+The Postgres Operator (PGO) makes it easy to get Postgres up and running on
+Kubernetes-enabled platforms, but we know that there are further customizations
+that you can make. As such, PGO allows you to further customize your
+deployments, including:
- Selecting different storage classes for your primary, replica, and backup storage
- Select your own container resources class for each PostgreSQL cluster deployment; differentiate between resources applied for primary and replica clusters!
@@ -104,6 +120,7 @@ The Crunchy PostgreSQL Operator extends Kubernetes to provide a higher-level abs
- [PostgreSQL](https://www.postgresql.org)
- [PostgreSQL Contrib Modules](https://www.postgresql.org/docs/current/contrib.html)
- [PL/Python + PL/Python 3](https://www.postgresql.org/docs/current/plpython.html)
+ - [PL/Perl](https://www.postgresql.org/docs/current/plperl.html)
- [pgAudit](https://www.pgaudit.org/)
- [pgAudit Analyze](https://github.com/pgaudit/pgaudit_analyze)
- [pgnodemx](https://github.com/CrunchyData/pgnodemx)
@@ -139,24 +156,31 @@ For more information about which versions of the PostgreSQL Operator include whi
# Supported Platforms
-The Crunchy PostgreSQL Operator is tested on the following Platforms:
+PGO, the Postgres Operator, is Kubernetes-native and maintains backwards
+compatibility to Kubernetes 1.11 and is tested is tested against the following
+platforms:
- Kubernetes 1.13+
- OpenShift 3.11+
- Google Kubernetes Engine (GKE), including Anthos
- Amazon EKS
-- VMware Enterprise PKS 1.3+
+- Microsoft AKS
+- VMware Tanzu
-## Storage
+This list only includes the platforms that the Postgres Operator is specifically
+tested on as part of the release process: PGO works on other Kubernetes
+distributions as well.
-The Crunchy PostgreSQL Operator is tested with a variety of different types of Kubernetes storage and Storage Classes, including:
+## Storage
-- Rook
-- StorageOS
-- Google Compute Engine persistent volumes
-- NFS
-- HostPath
+PGO, the Postgres Operator, is tested with a variety of different types of
+Kubernetes storage and Storage Classes, as well as hostPath and NFS.
-and more. We have had reports of people using the PostgreSQL Operator with other [Storage Classes](https://kubernetes.io/docs/concepts/storage/storage-classes/) as well.
+We know there are a variety of different types of [Storage Classes](https://kubernetes.io/docs/concepts/storage/storage-classes/)
+available for Kubernetes and we do our best to test each one, but due to the
+breadth of this area we are unable to verify Postgres Operator functionality in
+each one. With that said, the PostgreSQL Operator is designed to be storage
+class agnostic and has been demonstrated to work with additional Storage
+Classes.
-We know there are a variety of different types of [Storage Classes](https://kubernetes.io/docs/concepts/storage/storage-classes/) available for Kubernetes and we do our best to test each one, but due to the breadth of this area we are unable to verify PostgreSQL Operator functionality in each one. With that said, the PostgreSQL Operator is designed to be storage class agnostic and has been demonstrated to work with additional Storage Classes. Storage is a rapidly evolving field in Kubernetes and we will continue to adapt the PostgreSQL Operator to modern Kubernetes storage standards.
+The PGO Postgres Operator project source code is available subject to the [Apache 2.0 license](https://raw.githubusercontent.com/CrunchyData/postgres-operator/master/LICENSE.md) with the PGO logo and branding assets covered by [our trademark guidelines](/logos/TRADEMARKS.md).
diff --git a/docs/content/advanced/crunchy-postgres-exporter.md b/docs/content/advanced/crunchy-postgres-exporter.md
index b9b2a3ba09..f864a22b5a 100644
--- a/docs/content/advanced/crunchy-postgres-exporter.md
+++ b/docs/content/advanced/crunchy-postgres-exporter.md
@@ -23,9 +23,9 @@ can be specified for the API to collect. For an example of a queries.yml file, s
The crunchy-postgres-exporter Docker image contains the following packages (versions vary depending on PostgreSQL version):
-* PostgreSQL ({{< param postgresVersion13 >}}, {{< param postgresVersion12 >}}, {{< param postgresVersion11 >}}, {{< param postgresVersion10 >}}, {{< param postgresVersion96 >}} and {{< param postgresVersion95 >}})
-* CentOS7 - publicly available
-* UBI7 - customers only
+* PostgreSQL ({{< param postgresVersion13 >}}, {{< param postgresVersion12 >}}, {{< param postgresVersion11 >}}, and {{< param postgresVersion10 >}}
+* CentOS 7, UBI 8 - publicly available
+* UBI 7, 8 - customers only
* [PostgreSQL Exporter](https://github.com/wrouesnel/postgres_exporter)
## Environment Variables
diff --git a/docs/content/architecture/disaster-recovery.md b/docs/content/architecture/disaster-recovery.md
index deee66dcc5..7833661e07 100644
--- a/docs/content/architecture/disaster-recovery.md
+++ b/docs/content/architecture/disaster-recovery.md
@@ -196,7 +196,7 @@ to re-enable autofail if you would like your PostgreSQL cluster to be
highly-available. You can re-enable autofail with this command:
```shell
-pgo update cluster hacluster --autofail=true
+pgo update cluster hacluster --enable-autofail
```
## Scheduling Backups
diff --git a/docs/content/architecture/high-availability/_index.md b/docs/content/architecture/high-availability/_index.md
index c5f05eaf96..aa1908f3a5 100644
--- a/docs/content/architecture/high-availability/_index.md
+++ b/docs/content/architecture/high-availability/_index.md
@@ -219,6 +219,30 @@ number of nodes are available to support this configuration, certain deployments
will fail, since it will not be possible for Kubernetes to successfully schedule
the pods for each deployment.
+It is possible to fine tune the pod anti-affinity rules further, specifically,
+set different affinity rules for the PostgreSQL, pgBackRest, and pgBouncer
+Deployments. These can be handled by the following flags on [`pgo create cluster`]({{< relref "pgo-client/reference/pgo_create_cluster.md">}}):
+
+- `--pod-anti-affinity`: Sets the pod anti-affinity rules for all the managed
+Deployments in the cluster (PostgreSQL, pgBackRest, pgBouncer)
+- `--pod-anti-affinity-pgbackrest`: Sets the pod anti-affinity rules for _only_
+the pgBackRest Deployment. This takes precedence over the value of
+`--pod-anti-affinity`.
+- `--pod-anti-affinity-pgbouncer`: Sets the pod anti-affinity rules for _only_
+the pgBouncer Deployment. This takes precedence over the value of
+`--pod-anti-affinity`.
+
+For example, to use `required` pod anti-affinity between PostgreSQL instances
+but use only `preferred` anti-affinity for pgBackRest and pgBouncer, you could
+use the following command:
+
+```
+pgo create cluster hippo --replicas=2 --pgbouncer \
+ --pod-anti-affinity=required \
+ --pod-anti-affinity=preferred \
+ --pod-anti-afinity=preferred
+```
+
## Synchronous Replication: Guarding Against Transactions Loss
Clusters managed by the Crunchy PostgreSQL Operator can be deployed with
diff --git a/docs/content/architecture/high-availability/multi-cluster-kubernetes.md b/docs/content/architecture/high-availability/multi-cluster-kubernetes.md
index c6043adba4..1a507bbfb9 100644
--- a/docs/content/architecture/high-availability/multi-cluster-kubernetes.md
+++ b/docs/content/architecture/high-availability/multi-cluster-kubernetes.md
@@ -93,6 +93,14 @@ that matches that of the active cluster it is replicating.
- `--pgbackrest-s3-endpoint`: The S3 endpoint to use
- `--pgbackrest-s3-region`: The S3 region to use
+If you do not want to set the user credentials, you can retrieve them at a later
+time by using the [`pgo show user`]({{< relref "/pgo-client/reference/pgo_show_user.md" >}})
+command with the `--show-system-accounts` flag, e.g.
+
+```
+pgo show user --show-system-accounts hippo
+```
+
With respect to the credentials, it should be noted that when the standby
cluster is being created within the same Kubernetes cluster AND it has access to
the Kubernetes Secret created for the active cluster, one can use the
@@ -182,6 +190,9 @@ pgo create cluster hippo-standby --standby --pgbouncer --replica-count=2 \
--password=opensourcehippo
```
+(If you are unsure of your credentials, you can use
+`pgo show user hippo --show-system-accounts` to retrieve them).
+
Note the use of the `--pgbackrest-repo-path` flag as it points to the name of
the pgBackRest repository that is used for the original `hippo` cluster.
@@ -208,14 +219,14 @@ command.
```
pgo show cluster hippo
-cluster : standby (crunchy-postgres-ha:{{< param centosBase >}}-{{< param postgresVersion >}}-{{< param operatorVersion >}})
+cluster : standby (crunchy-postgres-ha:{{< param ubiBase >}}-{{< param postgresVersion >}}-{{< param operatorVersion >}})
standby : true
```
## Promoting a Standby Cluster
There comes a time where a standby cluster needs to be promoted to an active
cluster. Promoting a standby cluster means that a PostgreSQL instance within
-it will become a priary and start accepting both reads and writes. This has the
+it will become a primary and start accepting both reads and writes. This has the
net effect of pushing WAL (transaction archives) to the pgBackRest repository,
so we need to take a few steps first to ensure we don't accidentally create a
split-brain scenario.
diff --git a/docs/content/architecture/namespace.md b/docs/content/architecture/namespace.md
index f6b4265723..1a551a8b91 100644
--- a/docs/content/architecture/namespace.md
+++ b/docs/content/architecture/namespace.md
@@ -34,8 +34,8 @@ settings.
Enables full dynamic namespace capabilities, in which the Operator can create, delete and update
any namespaces within a Kubernetes cluster. With `dynamic` mode enabled, the PostgreSQL Operator
-can respond to namespace events in a Kubernetes cluster, such as when a namespace is created, and
-take an appropriate action, such as adding the PostgreSQL Operator controllers for the newly
+can respond to namespace events in a Kubernetes cluster, such as when a namespace is created, and
+take an appropriate action, such as adding the PostgreSQL Operator controllers for the newly
created namespace.
The following defines the namespace permissions required for the `dynamic` mode to be enabled:
@@ -62,8 +62,8 @@ rules:
### `readonly`
-In `readonly` mode, the PostgreSQL Operator is still able to listen to namespace events within a
-Kubernetes cluster, but it can no longer modify (create, update, delete) namespaces. For example,
+In `readonly` mode, the PostgreSQL Operator is still able to listen to namespace events within a
+Kubernetes cluster, but it can no longer modify (create, update, delete) namespaces. For example,
if a Kubernetes administrator creates a namespace, the PostgreSQL Operator can respond and create
controllers for that namespace.
@@ -95,7 +95,7 @@ Operator is unable to dynamically respond to namespace events in the cluster, i
target namespaces are deleted or new target namespaces need to be added, the PostgreSQL Operator
will need to be re-deployed.
-Please note that it is important to redeploy the PostgreSQL Operator following the deletion of a
+Please note that it is important to redeploy the PostgreSQL Operator following the deletion of a
target namespace to ensure it no longer attempts to listen for events in that namespace.
The `disabled` mode is enabled the when the PostgreSQL Operator has not been assigned namespace
@@ -103,22 +103,22 @@ permissions.
## RBAC Reconciliation
-By default, the PostgreSQL Operator will attempt to reconcile RBAC resources (ServiceAccounts,
+By default, the PostgreSQL Operator will attempt to reconcile RBAC resources (ServiceAccounts,
Roles and RoleBindings) within each namespace configured for the PostgreSQL Operator installation.
This allows the PostgreSQL Operator to create, update and delete the various RBAC resources it
requires in order to properly create and manage PostgreSQL clusters within each targeted namespace
(this includes self-healing RBAC resources as needed if removed and/or misconfigured).
In order for RBAC reconciliation to function properly, the PostgreSQL Operator ServiceAccount must
-be assigned a certain set of permissions. While the PostgreSQL Operator is not concerned with
+be assigned a certain set of permissions. While the PostgreSQL Operator is not concerned with
exactly how it has been assigned the permissions required to reconcile RBAC in each target
-namespace, the various [installation methods]({{< relref "installation" >}}) supported by the
+namespace, the various [installation methods]({{< relref "installation" >}}) supported by the
PostgreSQL Operator install a recommended set permissions based on the specific Namespace Operating
Mode enabled (see section [Namespace Operating Modes]({{< relref "#namespace-operating-modes" >}})
above for more information regarding the various Namespace Operating Modes available).
-The following section defines the recommended set of permissions that should be assigned to the
-PostgreSQL Operator ServiceAccount in order to ensure proper RBAC reconciliation based on the
+The following section defines the recommended set of permissions that should be assigned to the
+PostgreSQL Operator ServiceAccount in order to ensure proper RBAC reconciliation based on the
specific Namespace Operating Mode enabled. Please note that each PostgreSQL Operator installation
method handles the initial configuration and setup of the permissions shown below based on the
Namespace Operating Mode configured during installation.
@@ -127,7 +127,7 @@ Namespace Operating Mode configured during installation.
When using the `dynamic` Namespace Operating Mode, it is recommended that the PostgreSQL Operator
ServiceAccount be granted permissions to manage RBAC inside any namespace in the Kubernetes cluster
-via a ClusterRole. This allows for a fully-hands off approach to managing RBAC within each
+via a ClusterRole. This allows for a fully-hands off approach to managing RBAC within each
targeted namespace space. In other words, as namespaces are added and removed post-installation of
the PostgreSQL Operator (e.g. using `pgo create namespace` or `pgo delete namespace`), the Operator
is able to automatically reconcile RBAC in those namespaces without the need for any external
@@ -170,8 +170,6 @@ rules:
- endpoints
- pods
- pods/exec
- - pods/log
- - replicasets
- secrets
- services
- persistentvolumeclaims
@@ -184,10 +182,19 @@ rules:
- update
- delete
- deletecollection
+ - apiGroups:
+ - ''
+ resources:
+ - pods/log
+ verbs:
+ - get
+ - list
+ - watch
- apiGroups:
- apps
resources:
- deployments
+ - replicasets
verbs:
- get
- list
@@ -230,7 +237,7 @@ rules:
### `readonly` & `disabled` Namespace Operating Modes
-When using the `readonly` or `disabled` Namespace Operating Modes, it is recommended that the
+When using the `readonly` or `disabled` Namespace Operating Modes, it is recommended that the
PostgreSQL Operator ServiceAccount be granted permissions to manage RBAC inside of any configured
namespaces using local Roles within each targeted namespace. This means that as new namespaces
are added and removed post-installation of the PostgreSQL Operator, an administrator must manually
diff --git a/docs/content/contributing/developer-setup.md b/docs/content/contributing/developer-setup.md
index 113139e607..30413da4dd 100644
--- a/docs/content/contributing/developer-setup.md
+++ b/docs/content/contributing/developer-setup.md
@@ -24,7 +24,7 @@ Variable | Example | Description
`GOPATH` | $HOME/odev | Golang project directory
`PGOROOT` | $GOPATH/src/github.com/crunchydata/postgres-operator | Operator repository location
`PGO_CONF_DIR` | $PGOROOT/installers/ansible/roles/pgo-operator/files | Operator Config Template Directory
-`PGO_BASEOS` | {{< param centosBase >}} | Base OS for container images
+`PGO_BASEOS` | {{< param ubiBase >}} | Base OS for container images
`PGO_CMD` | kubectl | Cluster management tool executable
`PGO_IMAGE_PREFIX` | crunchydata | Container image prefix
`PGO_OPERATOR_NAMESPACE` | pgo | Kubernetes namespace for the operator
diff --git a/docs/content/custom-resources/_index.md b/docs/content/custom-resources/_index.md
index e27adfd3e6..58290f8acc 100644
--- a/docs/content/custom-resources/_index.md
+++ b/docs/content/custom-resources/_index.md
@@ -35,291 +35,219 @@ need to interface through the [`pgo` client]({{< relref "/pgo-client/_index.md"
The following sections will describe the functionality that is available today
when manipulating the PostgreSQL Operator Custom Resources directly.
-## PostgreSQL Operator Custom Resource Definitions
-
-There are several PostgreSQL Operator Custom Resource Definitions (CRDs) that
-are installed in order for the PostgreSQL Operator to successfully function:
-
-- `pgclusters.crunchydata.com`: Stores information required to manage a
-PostgreSQL cluster. This includes things like the cluster name, what storage and
-resource classes to use, which version of PostgreSQL to run, information about
-how to maintain a high-availability cluster, etc.
-- `pgreplicas.crunchydata.com`: Stores information required to manage the
-replicas within a PostgreSQL cluster. This includes things like the number of
-replicas, what storage and resource classes to use, special affinity rules, etc.
-- `pgtasks.crunchydata.com`: A general purpose CRD that accepts a type of task
-that is needed to run against a cluster (e.g. take a backup) and tracks the
-state of said task through its workflow.
-- `pgpolicies.crunchydata.com`: Stores a reference to a SQL file that can be
-executed against a PostgreSQL cluster. In the past, this was used to manage RLS
-policies on PostgreSQL clusters.
-
-Below takes an in depth look for what each attribute does in a Custom Resource
-Definition, and how they can be used in the creation and update workflow.
-
-### Glossary
-
-- `create`: if an attribute is listed as `create`, it means it can affect what
-happens when a new Custom Resource is created.
-- `update`: if an attribute is listed as `update`, it means it can affect the
-Custom Resource, and by extension the objects it manages, when the attribute is
-updated.
-
-### `pgclusters.crunchydata.com`
-
-The `pgclusters.crunchydata.com` Custom Resource Definition is the fundamental
-definition of a PostgreSQL cluster. Most attributes only affect the deployment
-of a PostgreSQL cluster at the time the PostgreSQL cluster is created. Some
-attributes can be modified during the lifetime of the PostgreSQL cluster and
-make changes, as described below.
-
-#### Specification (`Spec`)
-
-| Attribute | Action | Description |
-|-----------|--------|-------------|
-| Annotations | `create`, `update` | Specify Kubernetes [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/) that can be applied to the different deployments managed by the PostgreSQL Operator (PostgreSQL, pgBackRest, pgBouncer). For more information, please see the "Annotations Specification" below. |
-| BackrestConfig | `create` | Optional references to pgBackRest configuration files
-| BackrestLimits | `create`, `update` | Specify the container resource limits that the pgBackRest repository should use. Follows the [Kubernetes definitions of resource limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container). |
-| BackrestResources | `create`, `update` | Specify the container resource requests that the pgBackRest repository should use. Follows the [Kubernetes definitions of resource requests](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container). |
-| BackrestS3Bucket | `create` | An optional parameter that specifies a S3 bucket that pgBackRest should use. |
-| BackrestS3Endpoint | `create` | An optional parameter that specifies the S3 endpoint pgBackRest should use. |
-| BackrestS3Region | `create` | An optional parameter that specifies a cloud region that pgBackRest should use. |
-| BackrestS3URIStyle | `create` | An optional parameter that specifies if pgBackRest should use the `path` or `host` S3 URI style. |
-| BackrestS3VerifyTLS | `create` | An optional parameter that specifies if pgBackRest should verify the TLS endpoint. |
-| BackrestStorage | `create` | A specification that gives information about the storage attributes for the pgBackRest repository, which stores backups and archives, of the PostgreSQL cluster. For details, please see the `Storage Specification` section below. This is required. |
-| CCPImage | `create` | The name of the PostgreSQL container image to use, e.g. `crunchy-postgres-ha` or `crunchy-postgres-ha-gis`. |
-| CCPImagePrefix | `create` | If provided, the image prefix (or registry) of the PostgreSQL container image, e.g. `registry.developers.crunchydata.com/crunchydata`. The default is to use the image prefix set in the PostgreSQL Operator configuration. |
-| CCPImageTag | `create` | The tag of the PostgreSQL container image to use, e.g. `{{< param centosBase >}}-{{< param postgresVersion >}}-{{< param operatorVersion >}}`. |
-| CollectSecretName | `create` | An optional attribute unless `crunchy-postgres-exporter` is specified in the `UserLabels`; contains the name of a Kubernetes Secret that contains the credentials for a PostgreSQL user that is used for metrics collection, and is created when the PostgreSQL cluster is first bootstrapped. For more information, please see `User Secret Specification`.|
-| ClusterName | `create` | The name of the PostgreSQL cluster, e.g. `hippo`. This is used to group PostgreSQL instances (primary, replicas) together. |
-| CustomConfig | `create` | If specified, references a custom ConfigMap to use when bootstrapping a PostgreSQL cluster. For the shape of this file, please see the section on [Custom Configuration]({{< relref "/advanced/custom-configuration.md" >}}) |
-| Database | `create` | The name of a database that the PostgreSQL user can log into after the PostgreSQL cluster is created. |
-| ExporterLimits | `create`, `update` | Specify the container resource limits that the `crunchy-postgres-exporter` sidecar uses when it is deployed with a PostgreSQL instance. Follows the [Kubernetes definitions of resource limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container). |
-| ExporterPort | `create` | If the `"crunchy-postgres-exporter"` label is set in `UserLabels`, then this specifies the port that the metrics sidecar runs on (e.g. `9187`) |
-| ExporterResources | `create`, `update` | Specify the container resource requests that the `crunchy-postgres-exporter` sidecar uses when it is deployed with a PostgreSQL instance. Follows the [Kubernetes definitions of resource requests](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container). |
-| Limits | `create`, `update` | Specify the container resource limits that the PostgreSQL cluster should use. Follows the [Kubernetes definitions of resource limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container). |
-| Name | `create` | The name of the PostgreSQL instance that is the primary. On creation, this should be set to be the same as `ClusterName`. |
-| Namespace | `create` | The Kubernetes Namespace that the PostgreSQL cluster is deployed in. |
-| PGBadgerPort | `create` | If the `"crunchy-pgbadger"` label is set in `UserLabels`, then this specifies the port that the pgBadger sidecar runs on (e.g. `10000`) |
-| PGDataSource | `create` | Used to indicate if a PostgreSQL cluster should bootstrap its data from a pgBackRest repository. This uses the PostgreSQL Data Source Specification, described below. |
-| PGOImagePrefix | `create` | If provided, the image prefix (or registry) of any PostgreSQL Operator images that are used for jobs, e.g. `registry.developers.crunchydata.com/crunchydata`. The default is to use the image prefix set in the PostgreSQL Operator configuration. |
-| PgBouncer | `create`, `update` | If specified, defines the attributes to use for the pgBouncer connection pooling deployment that can be used in conjunction with this PostgreSQL cluster. Please see the specification defined below. |
-| PodAntiAffinity | `create` | A required section. Sets the [pod anti-affinity rules]({{< relref "/architecture/high-availability/_index.md#how-the-crunchy-postgresql-operator-uses-pod-anti-affinity" >}}) for the PostgreSQL cluster and associated deployments. Please see the `Pod Anti-Affinity Specification` section below. |
-| Policies | `create` | If provided, a comma-separated list referring to `pgpolicies.crunchydata.com.Spec.Name` that should be run once the PostgreSQL primary is first initialized. |
-| Port | `create` | The port that PostgreSQL will run on, e.g. `5432`. |
-| PrimaryStorage | `create` | A specification that gives information about the storage attributes for the primary instance in the PostgreSQL cluster. For details, please see the `Storage Specification` section below. This is required. |
-| RootSecretName | `create` | The name of a Kubernetes Secret that contains the credentials for a PostgreSQL _replication user_ that is created when the PostgreSQL cluster is first bootstrapped. For more information, please see `User Secret Specification`.|
-| ReplicaStorage | `create` | A specification that gives information about the storage attributes for any replicas in the PostgreSQL cluster. For details, please see the `Storage Specification` section below. This will likely be changed in the future based on the nature of the high-availability system, but presently it is still required that you set it. It is recommended you use similar settings to that of `PrimaryStorage`. |
-| Replicas | `create` | The number of replicas to create after a PostgreSQL primary is first initialized. This only works on create; to scale a cluster after it is initialized, please use the [`pgo scale`]({{< relref "/pgo-client/reference/pgo_scale.md" >}}) command. |
-| Resources | `create`, `update` | Specify the container resource requests that the PostgreSQL cluster should use. Follows the [Kubernetes definitions of resource requests](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container). |
-| RootSecretName | `create` | The name of a Kubernetes Secret that contains the credentials for a PostgreSQL superuser that is created when the PostgreSQL cluster is first bootstrapped. For more information, please see `User Secret Specification`.|
-| SyncReplication | `create` | If set to `true`, specifies the PostgreSQL cluster to use [synchronous replication]({{< relref "/architecture/high-availability/_index.md#how-the-crunchy-postgresql-operator-uses-pod-anti-affinity#synchronous-replication-guarding-against-transactions-loss" >}}).|
-| User | `create` | The name of the PostgreSQL user that is created when the PostgreSQL cluster is first created. |
-| UserLabels | `create` | A set of key-value string pairs that are used as a sort of "catch-all" for things that really should be modeled in the CRD. These values do get copied to the actually CR labels. If you want to set up metrics collection or pgBadger, you would specify `"crunchy-postgres-exporter": "true"` and `"crunchy-pgbadger": "true"` here, respectively. However, this structure does need to be set, so just follow whatever is in the example. |
-| UserSecretName | `create` | The name of a Kubernetes Secret that contains the credentials for a standard PostgreSQL user that is created when the PostgreSQL cluster is first bootstrapped. For more information, please see `User Secret Specification`.|
-| TablespaceMounts | `create`,`update` | Lists any tablespaces that are attached to the PostgreSQL cluster. Tablespaces can be added at a later time by updating the `TablespaceMounts` entry, but they cannot be removed. Stores a map of information, with the key being the name of the tablespace, and the value being a Storage Specification, defined below. |
-| TLS | `create` | Defines the attributes for enabling TLS for a PostgreSQL cluster. See TLS Specification below. |
-| TLSOnly | `create` | If set to true, requires client connections to use only TLS to connect to the PostgreSQL database. |
-| Standby | `create`, `update` | If set to true, indicates that the PostgreSQL cluster is a "standby" cluster, i.e. is in read-only mode entirely. Please see [Kubernetes Multi-Cluster Deployments]({{< relref "/architecture/high-availability/multi-cluster-kubernetes.md" >}}) for more information. |
-| Shutdown | `create`, `update` | If set to true, indicates that a PostgreSQL cluster should shutdown. If set to false, indicates that a PostgreSQL cluster should be up and running. |
-
-##### Storage Specification
-
-The storage specification is a spec that defines attributes about the storage to
-be used for a particular function of a PostgreSQL cluster (e.g. a primary
-instance or for the pgBackRest backup repository). The below describes each
-attribute and how it works.
-
-| Attribute | Action | Description |
-|-----------|--------|-------------|
-| AccessMode| `create` | The name of the Kubernetes Persistent Volume [Access Mode](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes) to use. |
-| MatchLabels | `create` | Only used with `StorageType` of `create`, used to match a particular subset of provisioned Persistent Volumes. |
-| Name | `create` | Only needed for `PrimaryStorage` in `pgclusters.crunchydata.com`.Used to identify the name of the PostgreSQL cluster. Should match `ClusterName`. |
-| Size | `create` | The size of the [Persistent Volume Claim](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims) (PVC). Must use a Kubernetes resource value, e.g. `20Gi`. |
-| StorageClass | `create` | The name of the Kubernetes [StorageClass](https://kubernetes.io/docs/concepts/storage/storage-classes/) to use. |
-| StorageType | `create` | Set to `create` if storage is provisioned (e.g. using `hostpath`). Set to `dynamic` if using a dynamic storage provisioner, e.g. via a `StorageClass`. |
-| SupplementalGroups | `create` | If provided, a comma-separated list of group IDs to use in case it is needed to interface with a particular storage system. Typically used with NFS or hostpath storage. |
-
-##### Pod Anti-Affinity Specification
-
-Sets the [pod anti-affinity]({{< relref "/architecture/high-availability/_index.md#how-the-crunchy-postgresql-operator-uses-pod-anti-affinity" >}})
-for the PostgreSQL cluster and associated deployments. Each attribute can
-contain one of the following values:
-
-- `required`
-- `preferred` (which is also the recommended default)
-- `disabled`
-
-For a detailed explanation for how this works. Please see the [high-availability]({{< relref "/architecture/high-availability/_index.md#how-the-crunchy-postgresql-operator-uses-pod-anti-affinity" >}})
-documentation.
-
-| Attribute | Action | Description |
-|-----------|--------|-------------|
-| Default | `create` | The default pod anti-affinity to use for all Pods managed in a given PostgreSQL cluster. |
-| PgBackRest | `create` | If set to a value that differs from `Default`, specifies the pod anti-affinity to use for just the pgBackRest repository. |
-| PgBouncer | `create` | If set to a value that differs from `Default`, specifies the pod anti-affinity to use for just the pgBouncer Pods. |
-
-##### PostgreSQL Data Source Specification
+## Custom Resource Workflows
-This specification is used when one wants to bootstrap the data in a PostgreSQL
-cluster from a pgBackRest repository. This can be a pgBackRest repository that
-is attached to an active PostgreSQL cluster or is kept around to be used for
-spawning new PostgreSQL clusters.
+### Create a PostgreSQL Cluster
-| Attribute | Action | Description |
-|-----------|--------|-------------|
-| RestoreFrom | `create` | The name of a PostgreSQL cluster, active or former, that will be used for bootstrapping the data of a new PostgreSQL cluster. |
-| RestoreOpts | `create` | Additional pgBackRest [restore options](https://pgbackrest.org/command.html#command-restore) that can be used as part of the bootstrapping operation, for example, point-in-time-recovery options. |
+The fundamental workflow for interfacing with a PostgreSQL Operator Custom
+Resource Definition is for creating a PostgreSQL cluster. However, this is also
+one of the most complicated workflows to go through, as there are several
+Kubernetes objects that need to be created prior to using this method. These
+include:
-##### TLS Specification
+- Secrets
+ - Information for setting up a pgBackRest repository
+ - PostgreSQL superuser bootstrap credentials
+ - PostgreSQL replication user bootstrap credentials
+ - PostgresQL standard user bootstrap credentials
-The TLS specification makes a reference to the various secrets that are required
-to enable TLS in a PostgreSQL cluster. For more information on how these secrets
-should be structured, please see [Enabling TLS in a PostgreSQL Cluster]({{< relref "/pgo-client/common-tasks.md#enable-tls" >}}).
+Additionally, if you want to add some of the other sidecars, you may need to
+create additional secrets.
-| Attribute | Action | Description |
-|-----------|--------|-------------|
-| CASecret | `create` | A reference to the name of a Kubernetes Secret that specifies a certificate authority for the PostgreSQL cluster to trust. |
-| ReplicationTLSSecret | `create` | A reference to the name of a Kubernetes TLS Secret that contains a keypair for authenticating the replication user. Must be used with `CASecret` and `TLSSecret`. |
-| TLSSecret | `create` | A reference to the name of a Kubernetes TLS Secret that contains a keypair that is used for the PostgreSQL instance to identify itself and perform TLS communications with PostgreSQL clients. Must be used with `CASecret`. |
+The following guide goes through how to create a PostgreSQL cluster called
+`hippo` by creating a new custom resource.
-##### pgBouncer Specification
+#### Step 1: Creating the PostgreSQL User Secrets
-The pgBouncer specification defines how a pgBouncer deployment can be deployed
-alongside the PostgreSQL cluster. pgBouncer is a PostgreSQL connection pooler
-that can also help manage connection state, and is helpful to deploy alongside
-a PostgreSQL cluster to help with failover scenarios too.
+As mentioned above, there are a minimum of three PostgreSQL user accounts that
+you must create in order to bootstrap a PostgreSQL cluster. These are:
-| Attribute | Action | Description |
-|-----------|--------|-------------|
-| Limits | `create`, `update` | Specify the container resource limits that the pgBouncer Pods should use. Follows the [Kubernetes definitions of resource limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container). |
-| Replicas | `create`, `update` | The number of pgBouncer instances to deploy. Must be set to at least `1` to deploy pgBouncer. Setting to `0` removes an existing pgBouncer deployment for the PostgreSQL cluster. |
-| Resources | `create`, `update` | Specify the container resource requests that the pgBouncer Pods should use. Follows the [Kubernetes definitions of resource requests](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container). |
+- A PostgreSQL superuser
+- A replication user
+- A standard PostgreSQL user
-##### Annotations Specification
+The below code will help you set up these Secrets.
-The `pgcluster.crunchydata.com` specification contains a block that allows for
-custom [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-to be applied to the Deployments that are managed by the PostgreSQL Operator,
-including:
+```
+# this variable is the name of the cluster being created
+pgo_cluster_name=hippo
+# this variable is the namespace the cluster is being deployed into
+cluster_namespace=pgo
-- PostgreSQL
-- pgBackRest
-- pgBouncer
+# this is the superuser secret
+kubectl create secret generic -n "${cluster_namespace}" "${pgo_cluster_name}-postgres-secret" \
+ --from-literal=username=postgres \
+ --from-literal=password=Supersecurepassword*
-This also includes the option to apply Annotations globally across the three
-different deployment groups.
+# this is the replication user secret
+kubectl create secret generic -n "${cluster_namespace}" "${pgo_cluster_name}-primaryuser-secret" \
+ --from-literal=username=primaryuser \
+ --from-literal=password=Anothersecurepassword*
-| Attribute | Action | Description |
-|-----------|--------|-------------|
-| Backrest | `create`, `update` | Specify annotations that are only applied to the pgBackRest deployments |
-| Global | `create`, `update` | Specify annotations that are applied to the PostgreSQL, pgBackRest, and pgBouncer deployments |
-| PgBouncer | `create`, `update` | Specify annotations that are only applied to the pgBouncer deployments |
-| Postgres | `create`, `update` | Specify annotations that are only applied to the PostgreSQL deployments |
+# this is the standard user secret
+kubectl create secret generic -n "${cluster_namespace}" "${pgo_cluster_name}-hippo-secret" \
+ --from-literal=username=hippo \
+ --from-literal=password=Moresecurepassword*
-### `pgreplicas.crunchydata.com`
-The `pgreplicas.crunchydata.com` Custom Resource Definition contains information
-pertaning to the structure of PostgreSQL replicas associated within a PostgreSQL
-cluster. All of the attributes only affect the replica when it is created.
+kubectl label secrets -n "${cluster_namespace}" "${pgo_cluster_name}-postgres-secret" "pg-cluster=${pgo_cluster_name}"
+kubectl label secrets -n "${cluster_namespace}" "${pgo_cluster_name}-primaryuser-secret" "pg-cluster=${pgo_cluster_name}"
+kubectl label secrets -n "${cluster_namespace}" "${pgo_cluster_name}-hippo-secret" "pg-cluster=${pgo_cluster_name}"
+```
-#### Specification (`Spec`)
+#### Step 2: Create the PostgreSQL Cluster
-| Attribute | Action | Description |
-|-----------|--------|-------------|
-| ClusterName | `create` | The name of the PostgreSQL cluster, e.g. `hippo`. This is used to group PostgreSQL instances (primary, replicas) together. |
-| Name | `create` | The name of this PostgreSQL replica. It should be unique within a `ClusterName`. |
-| Namespace | `create` | The Kubernetes Namespace that the PostgreSQL cluster is deployed in. |
-| ReplicaStorage | `create` | A specification that gives information about the storage attributes for any replicas in the PostgreSQL cluster. For details, please see the `Storage Specification` section in the `pgclusters.crunchydata.com` description. This will likely be changed in the future based on the nature of the high-availability system, but presently it is still required that you set it. It is recommended you use similar settings to that of `PrimaryStorage`. |
-| UserLabels | `create` | A set of key-value string pairs that are used as a sort of "catch-all" for things that really should be modeled in the CRD. These values do get copied to the actually CR labels. If you want to set up metrics collection, you would specify `"crunchy-postgres-exporter": "true"` here. This also allows for node selector pinning using `NodeLabelKey` and `NodeLabelValue`. However, this structure does need to be set, so just follow whatever is in the example. |
+With the Secrets in place. It is now time to create the PostgreSQL cluster.
-## Custom Resource Workflows
+The below manifest references the Secrets created in the previous step to add a
+custom resource to the `pgclusters.crunchydata.com` custom resource definition.
-### Create a PostgreSQL Cluster
+**NOTE**: You will need to modify the storage sections to match your storage
+configuration.
-The fundamental workflow for interfacing with a PostgreSQL Operator Custom
-Resource Definition is for creating a PostgreSQL cluster. However, this is also
-one of the most complicated workflows to go through, as there are several
-Kubernetes objects that need to be created prior to using this method. These
-include:
+```
+# this variable is the name of the cluster being created
+export pgo_cluster_name=hippo
+# this variable is the namespace the cluster is being deployed into
+export cluster_namespace=pgo
-- Secrets
- - Information for setting up a pgBackRest repository
- - PostgreSQL superuser bootstrap credentials
- - PostgreSQL replication user bootstrap credentials
- - PostgresQL standard user bootstrap credentials
+cat <<-EOF > "${pgo_cluster_name}-pgcluster.yaml"
+apiVersion: crunchydata.com/v1
+kind: Pgcluster
+metadata:
+ annotations:
+ current-primary: ${pgo_cluster_name}
+ labels:
+ autofail: "true"
+ crunchy-pgbadger: "false"
+ crunchy-pgha-scope: ${pgo_cluster_name}
+ crunchy-postgres-exporter: "false"
+ deployment-name: ${pgo_cluster_name}
+ name: ${pgo_cluster_name}
+ pg-cluster: ${pgo_cluster_name}
+ pg-pod-anti-affinity: ""
+ pgo-backrest: "true"
+ pgo-version: {{< param operatorVersion >}}
+ pgouser: admin
+ name: ${pgo_cluster_name}
+ namespace: ${cluster_namespace}
+spec:
+ BackrestStorage:
+ accessmode: ReadWriteMany
+ matchLabels: ""
+ name: ""
+ size: 1G
+ storageclass: ""
+ storagetype: create
+ supplementalgroups: ""
+ PrimaryStorage:
+ accessmode: ReadWriteMany
+ matchLabels: ""
+ name: ${pgo_cluster_name}
+ size: 1G
+ storageclass: ""
+ storagetype: create
+ supplementalgroups: ""
+ ReplicaStorage:
+ accessmode: ReadWriteMany
+ matchLabels: ""
+ name: ""
+ size: 1G
+ storageclass: ""
+ storagetype: create
+ supplementalgroups: ""
+ annotations:
+ backrestLimits: {}
+ backrestRepoPath: ""
+ backrestResources:
+ memory: 48Mi
+ backrestS3Bucket: ""
+ backrestS3Endpoint: ""
+ backrestS3Region: ""
+ backrestS3URIStyle: ""
+ backrestS3VerifyTLS: ""
+ ccpimage: crunchy-postgres-ha
+ ccpimageprefix: registry.developers.crunchydata.com/crunchydata
+ ccpimagetag: {{< param ubiBase >}}-{{< param postgresVersion >}}-{{< param operatorVersion >}}
+ clustername: ${pgo_cluster_name}
+ customconfig: ""
+ database: ${pgo_cluster_name}
+ exporterport: "9187"
+ limits: {}
+ name: ${pgo_cluster_name}
+ namespace: ${cluster_namespace}
+ pgBouncer:
+ limits: {}
+ replicas: 0
+ pgDataSource:
+ restoreFrom: ""
+ restoreOpts: ""
+ pgbadgerport: "10000"
+ pgoimageprefix: registry.developers.crunchydata.com/crunchydata
+ podAntiAffinity:
+ default: preferred
+ pgBackRest: preferred
+ pgBouncer: preferred
+ policies: ""
+ port: "5432"
+ primarysecretname: ${pgo_cluster_name}-primaryuser-secret
+ replicas: "0"
+ rootsecretname: ${pgo_cluster_name}-postgres-secret
+ shutdown: false
+ standby: false
+ tablespaceMounts: {}
+ tls:
+ caSecret: ""
+ replicationTLSSecret: ""
+ tlsSecret: ""
+ tlsOnly: false
+ user: hippo
+ userlabels:
+ crunchy-postgres-exporter: "false"
+ pg-pod-anti-affinity: ""
+ pgo-version: {{< param operatorVersion >}}
+ usersecretname: ${pgo_cluster_name}-hippo-secret
+EOF
-Additionally, if you want to add some of the other sidecars, you may need to
-create additional secrets.
+kubectl apply -f "${pgo_cluster_name}-pgcluster.yaml"
+```
-The following guide goes through how to create a PostgreSQL cluster called
-`hippo` by creating a new custom resource.
+### Create a PostgreSQL Cluster With Backups in S3
-#### Step 1: Create the pgBackRest Secret
+A frequent use case is to create a PostgreSQL cluster with S3 or a S3-like
+storage system for storing backups. This requires adding a Secret that contains
+the S3 key and key secret for your account, and adding some additional
+information into the custom resource.
-pgBackRest is a fundamental part of a PostgreSQL deployment with the PostgreSQL
-Operator: not only is it a backup and archive repository, but it also helps with
-operations such as self-healing. A PostgreSQL instance a pgBackRest communicate
-using ssh, and as such, we need to generate a unique ssh keypair for
-communication for each PostgreSQL cluster we deploy.
+#### Step 1: Create the pgBackRest S3 Secrets
-In this example, we generate a ssh keypair using ED25519 keys, but if your
-environment requires it, you can also use RSA keys.
+As mentioned above, it is necessary to create a Secret containing the S3 key and
+key secret that will allow a user to create backups in S3.
-In your working directory, run the following commands:
+The below code will help you set up this Secret.
-
+```
# this variable is the name of the cluster being created
-export pgo_cluster_name=hippo
+pgo_cluster_name=hippo
# this variable is the namespace the cluster is being deployed into
-export cluster_namespace=pgo
-
-# generate a SSH public/private keypair for use by pgBackRest
-ssh-keygen -t ed25519 -N '' -f "${pgo_cluster_name}-key"
-
-# base64 encoded the keys for the generation of the Kubernetes secret, and place
-# them into variables temporarily
-public_key_temp=$(cat "${pgo_cluster_name}-key.pub" | base64)
-private_key_temp=$(cat "${pgo_cluster_name}-key" | base64)
-export pgbackrest_public_key="${public_key_temp//[$'\n']}" pgbackrest_private_key="${private_key_temp//[$'\n']}"
-
-# create the backrest-repo-config example file and substitute in the newly
-# created keys
-#
-# (Note: that the "config" / "sshd_config" entries contain configuration to
-# ensure that PostgreSQL instances are able to communicate with the pgBackRest
-# repository, which houses backups and archives, and vice versa. Most of the
-# settings follow the sshd defaults, with a few overrides. Edit at your own
-# discretion.)
-cat <<-EOF > "${pgo_cluster_name}-backrest-repo-config.yaml"
-apiVersion: v1
-kind: Secret
-type: Opaque
-metadata:
- labels:
- pg-cluster: ${pgo_cluster_name}
- pgo-backrest-repo: "true"
- name: ${pgo_cluster_name}-backrest-repo-config
- namespace: ${cluster_namespace}
-data:
- authorized_keys: ${pgbackrest_public_key}
- id_ed25519: ${pgbackrest_private_key}
- ssh_host_ed25519_key: ${pgbackrest_private_key}
- config: SG9zdCAqClN0cmljdEhvc3RLZXlDaGVja2luZyBubwpJZGVudGl0eUZpbGUgL3RtcC9pZF9lZDI1NTE5ClBvcnQgMjAyMgpVc2VyIHBnYmFja3Jlc3QK
- sshd_config: IwkkT3BlbkJTRDogc3NoZF9jb25maWcsdiAxLjEwMCAyMDE2LzA4LzE1IDEyOjMyOjA0IG5hZGR5IEV4cCAkCgojIFRoaXMgaXMgdGhlIHNzaGQgc2VydmVyIHN5c3RlbS13aWRlIGNvbmZpZ3VyYXRpb24gZmlsZS4gIFNlZQojIHNzaGRfY29uZmlnKDUpIGZvciBtb3JlIGluZm9ybWF0aW9uLgoKIyBUaGlzIHNzaGQgd2FzIGNvbXBpbGVkIHdpdGggUEFUSD0vdXNyL2xvY2FsL2JpbjovdXNyL2JpbgoKIyBUaGUgc3RyYXRlZ3kgdXNlZCBmb3Igb3B0aW9ucyBpbiB0aGUgZGVmYXVsdCBzc2hkX2NvbmZpZyBzaGlwcGVkIHdpdGgKIyBPcGVuU1NIIGlzIHRvIHNwZWNpZnkgb3B0aW9ucyB3aXRoIHRoZWlyIGRlZmF1bHQgdmFsdWUgd2hlcmUKIyBwb3NzaWJsZSwgYnV0IGxlYXZlIHRoZW0gY29tbWVudGVkLiAgVW5jb21tZW50ZWQgb3B0aW9ucyBvdmVycmlkZSB0aGUKIyBkZWZhdWx0IHZhbHVlLgoKIyBJZiB5b3Ugd2FudCB0byBjaGFuZ2UgdGhlIHBvcnQgb24gYSBTRUxpbnV4IHN5c3RlbSwgeW91IGhhdmUgdG8gdGVsbAojIFNFTGludXggYWJvdXQgdGhpcyBjaGFuZ2UuCiMgc2VtYW5hZ2UgcG9ydCAtYSAtdCBzc2hfcG9ydF90IC1wIHRjcCAjUE9SVE5VTUJFUgojClBvcnQgMjAyMgojQWRkcmVzc0ZhbWlseSBhbnkKI0xpc3RlbkFkZHJlc3MgMC4wLjAuMAojTGlzdGVuQWRkcmVzcyA6OgoKSG9zdEtleSAvc3NoZC9zc2hfaG9zdF9lZDI1NTE5X2tleQoKIyBDaXBoZXJzIGFuZCBrZXlpbmcKI1Jla2V5TGltaXQgZGVmYXVsdCBub25lCgojIExvZ2dpbmcKI1N5c2xvZ0ZhY2lsaXR5IEFVVEgKU3lzbG9nRmFjaWxpdHkgQVVUSFBSSVYKI0xvZ0xldmVsIElORk8KCiMgQXV0aGVudGljYXRpb246CgojTG9naW5HcmFjZVRpbWUgMm0KUGVybWl0Um9vdExvZ2luIG5vClN0cmljdE1vZGVzIG5vCiNNYXhBdXRoVHJpZXMgNgojTWF4U2Vzc2lvbnMgMTAKClB1YmtleUF1dGhlbnRpY2F0aW9uIHllcwoKIyBUaGUgZGVmYXVsdCBpcyB0byBjaGVjayBib3RoIC5zc2gvYXV0aG9yaXplZF9rZXlzIGFuZCAuc3NoL2F1dGhvcml6ZWRfa2V5czIKIyBidXQgdGhpcyBpcyBvdmVycmlkZGVuIHNvIGluc3RhbGxhdGlvbnMgd2lsbCBvbmx5IGNoZWNrIC5zc2gvYXV0aG9yaXplZF9rZXlzCiNBdXRob3JpemVkS2V5c0ZpbGUJL3BnY29uZi9hdXRob3JpemVkX2tleXMKQXV0aG9yaXplZEtleXNGaWxlCS9zc2hkL2F1dGhvcml6ZWRfa2V5cwoKI0F1dGhvcml6ZWRQcmluY2lwYWxzRmlsZSBub25lCgojQXV0aG9yaXplZEtleXNDb21tYW5kIG5vbmUKI0F1dGhvcml6ZWRLZXlzQ29tbWFuZFVzZXIgbm9ib2R5CgojIEZvciB0aGlzIHRvIHdvcmsgeW91IHdpbGwgYWxzbyBuZWVkIGhvc3Qga2V5cyBpbiAvZXRjL3NzaC9zc2hfa25vd25faG9zdHMKI0hvc3RiYXNlZEF1dGhlbnRpY2F0aW9uIG5vCiMgQ2hhbmdlIHRvIHllcyBpZiB5b3UgZG9uJ3QgdHJ1c3Qgfi8uc3NoL2tub3duX2hvc3RzIGZvcgojIEhvc3RiYXNlZEF1dGhlbnRpY2F0aW9uCiNJZ25vcmVVc2VyS25vd25Ib3N0cyBubwojIERvbid0IHJlYWQgdGhlIHVzZXIncyB+Ly5yaG9zdHMgYW5kIH4vLnNob3N0cyBmaWxlcwojSWdub3JlUmhvc3RzIHllcwoKIyBUbyBkaXNhYmxlIHR1bm5lbGVkIGNsZWFyIHRleHQgcGFzc3dvcmRzLCBjaGFuZ2UgdG8gbm8gaGVyZSEKI1Bhc3N3b3JkQXV0aGVudGljYXRpb24geWVzCiNQZXJtaXRFbXB0eVBhc3N3b3JkcyBubwpQYXNzd29yZEF1dGhlbnRpY2F0aW9uIG5vCgojIENoYW5nZSB0byBubyB0byBkaXNhYmxlIHMva2V5IHBhc3N3b3JkcwpDaGFsbGVuZ2VSZXNwb25zZUF1dGhlbnRpY2F0aW9uIHllcwojQ2hhbGxlbmdlUmVzcG9uc2VBdXRoZW50aWNhdGlvbiBubwoKIyBLZXJiZXJvcyBvcHRpb25zCiNLZXJiZXJvc0F1dGhlbnRpY2F0aW9uIG5vCiNLZXJiZXJvc09yTG9jYWxQYXNzd2QgeWVzCiNLZXJiZXJvc1RpY2tldENsZWFudXAgeWVzCiNLZXJiZXJvc0dldEFGU1Rva2VuIG5vCiNLZXJiZXJvc1VzZUt1c2Vyb2sgeWVzCgojIEdTU0FQSSBvcHRpb25zCiNHU1NBUElBdXRoZW50aWNhdGlvbiB5ZXMKI0dTU0FQSUNsZWFudXBDcmVkZW50aWFscyBubwojR1NTQVBJU3RyaWN0QWNjZXB0b3JDaGVjayB5ZXMKI0dTU0FQSUtleUV4Y2hhbmdlIG5vCiNHU1NBUElFbmFibGVrNXVzZXJzIG5vCgojIFNldCB0aGlzIHRvICd5ZXMnIHRvIGVuYWJsZSBQQU0gYXV0aGVudGljYXRpb24sIGFjY291bnQgcHJvY2Vzc2luZywKIyBhbmQgc2Vzc2lvbiBwcm9jZXNzaW5nLiBJZiB0aGlzIGlzIGVuYWJsZWQsIFBBTSBhdXRoZW50aWNhdGlvbiB3aWxsCiMgYmUgYWxsb3dlZCB0aHJvdWdoIHRoZSBDaGFsbGVuZ2VSZXNwb25zZUF1dGhlbnRpY2F0aW9uIGFuZAojIFBhc3N3b3JkQXV0aGVudGljYXRpb24uICBEZXBlbmRpbmcgb24geW91ciBQQU0gY29uZmlndXJhdGlvbiwKIyBQQU0gYXV0aGVudGljYXRpb24gdmlhIENoYWxsZW5nZVJlc3BvbnNlQXV0aGVudGljYXRpb24gbWF5IGJ5cGFzcwojIHRoZSBzZXR0aW5nIG9mICJQZXJtaXRSb290TG9naW4gd2l0aG91dC1wYXNzd29yZCIuCiMgSWYgeW91IGp1c3Qgd2FudCB0aGUgUEFNIGFjY291bnQgYW5kIHNlc3Npb24gY2hlY2tzIHRvIHJ1biB3aXRob3V0CiMgUEFNIGF1dGhlbnRpY2F0aW9uLCB0aGVuIGVuYWJsZSB0aGlzIGJ1dCBzZXQgUGFzc3dvcmRBdXRoZW50aWNhdGlvbgojIGFuZCBDaGFsbGVuZ2VSZXNwb25zZUF1dGhlbnRpY2F0aW9uIHRvICdubycuCiMgV0FSTklORzogJ1VzZVBBTSBubycgaXMgbm90IHN1cHBvcnRlZCBpbiBSZWQgSGF0IEVudGVycHJpc2UgTGludXggYW5kIG1heSBjYXVzZSBzZXZlcmFsCiMgcHJvYmxlbXMuClVzZVBBTSB5ZXMKCiNBbGxvd0FnZW50Rm9yd2FyZGluZyB5ZXMKI0FsbG93VGNwRm9yd2FyZGluZyB5ZXMKI0dhdGV3YXlQb3J0cyBubwpYMTFGb3J3YXJkaW5nIHllcwojWDExRGlzcGxheU9mZnNldCAxMAojWDExVXNlTG9jYWxob3N0IHllcwojUGVybWl0VFRZIHllcwojUHJpbnRNb3RkIHllcwojUHJpbnRMYXN0TG9nIHllcwojVENQS2VlcEFsaXZlIHllcwojVXNlTG9naW4gbm8KI1Blcm1pdFVzZXJFbnZpcm9ubWVudCBubwojQ29tcHJlc3Npb24gZGVsYXllZAojQ2xpZW50QWxpdmVJbnRlcnZhbCAwCiNDbGllbnRBbGl2ZUNvdW50TWF4IDMKI1Nob3dQYXRjaExldmVsIG5vCiNVc2VETlMgeWVzCiNQaWRGaWxlIC92YXIvcnVuL3NzaGQucGlkCiNNYXhTdGFydHVwcyAxMDozMDoxMDAKI1Blcm1pdFR1bm5lbCBubwojQ2hyb290RGlyZWN0b3J5IG5vbmUKI1ZlcnNpb25BZGRlbmR1bSBub25lCgojIG5vIGRlZmF1bHQgYmFubmVyIHBhdGgKI0Jhbm5lciBub25lCgojIEFjY2VwdCBsb2NhbGUtcmVsYXRlZCBlbnZpcm9ubWVudCB2YXJpYWJsZXMKQWNjZXB0RW52IExBTkcgTENfQ1RZUEUgTENfTlVNRVJJQyBMQ19USU1FIExDX0NPTExBVEUgTENfTU9ORVRBUlkgTENfTUVTU0FHRVMKQWNjZXB0RW52IExDX1BBUEVSIExDX05BTUUgTENfQUREUkVTUyBMQ19URUxFUEhPTkUgTENfTUVBU1VSRU1FTlQKQWNjZXB0RW52IExDX0lERU5USUZJQ0FUSU9OIExDX0FMTCBMQU5HVUFHRQpBY2NlcHRFbnYgWE1PRElGSUVSUwoKIyBvdmVycmlkZSBkZWZhdWx0IG9mIG5vIHN1YnN5c3RlbXMKU3Vic3lzdGVtCXNmdHAJL3Vzci9saWJleGVjL29wZW5zc2gvc2Z0cC1zZXJ2ZXIKCiMgRXhhbXBsZSBvZiBvdmVycmlkaW5nIHNldHRpbmdzIG9uIGEgcGVyLXVzZXIgYmFzaXMKI01hdGNoIFVzZXIgYW5vbmN2cwojCVgxMUZvcndhcmRpbmcgbm8KIwlBbGxvd1RjcEZvcndhcmRpbmcgbm8KIwlQZXJtaXRUVFkgbm8KIwlGb3JjZUNvbW1hbmQgY3ZzIHNlcnZlcgo=
-EOF
+cluster_namespace=pgo
+# the following variables are your S3 key and key secret
+backrest_s3_key=yours3key
+backrest_s3_key_secret=yours3keysecret
-# remove the pgBackRest ssh keypair from the shell session
-unset pgbackrest_public_key pgbackrest_private_key
+kubectl -n "${cluster_namespace}" create secret generic "${pgo_cluster_name}-backrest-repo-config" \
+ --from-literal="aws-s3-key=${backrest_s3_key}" \
+ --from-literal="aws-s3-key-secret=${backrest_s3_key_secret}"
-# create the pgBackRest secret
-kubectl apply -f "${pgo_cluster_name}-backrest-repo-config.yaml"
-
+unset backrest_s3_key
+unset backrest_s3_key_secret
+```
#### Step 2: Creating the PostgreSQL User Secrets
-As mentioned above, there are a minimum of three PostgreSQL user accounts that
-you must create in order to bootstrap a PostgreSQL cluster. These are:
+Similar to the basic create cluster example, there are a minimum of three
+PostgreSQL user accounts that you must create in order to bootstrap a PostgreSQL
+cluster. These are:
- A PostgreSQL superuser
- A replication user
@@ -360,15 +288,18 @@ With the Secrets in place. It is now time to create the PostgreSQL cluster.
The below manifest references the Secrets created in the previous step to add a
custom resource to the `pgclusters.crunchydata.com` custom resource definition.
-
-**NOTE**: You will need to modify the storage sections to match your storage
-configuration.
+There are some additions in this example specifically for storing backups in S3.
```
# this variable is the name of the cluster being created
export pgo_cluster_name=hippo
# this variable is the namespace the cluster is being deployed into
export cluster_namespace=pgo
+# the following variables store the information for your S3 cluster. You may
+# need to adjust them for your actual settings
+export backrest_s3_bucket=your-bucket
+export backrest_s3_endpoint=s3.region-name.amazonaws.com
+export backrest_s3_region=region-name
cat <<-EOF > "${pgo_cluster_name}-pgcluster.yaml"
apiVersion: crunchydata.com/v1
@@ -378,6 +309,7 @@ metadata:
current-primary: ${pgo_cluster_name}
labels:
autofail: "true"
+ backrest-storage-type: "s3"
crunchy-pgbadger: "false"
crunchy-pgha-scope: ${pgo_cluster_name}
crunchy-postgres-exporter: "false"
@@ -397,7 +329,7 @@ spec:
name: ""
size: 1G
storageclass: ""
- storagetype: create
+ storagetype: dynamic
supplementalgroups: ""
PrimaryStorage:
accessmode: ReadWriteMany
@@ -405,7 +337,7 @@ spec:
name: ${pgo_cluster_name}
size: 1G
storageclass: ""
- storagetype: create
+ storagetype: dynamic
supplementalgroups: ""
ReplicaStorage:
accessmode: ReadWriteMany
@@ -413,21 +345,21 @@ spec:
name: ""
size: 1G
storageclass: ""
- storagetype: create
+ storagetype: dynamic
supplementalgroups: ""
annotations:
backrestLimits: {}
backrestRepoPath: ""
backrestResources:
memory: 48Mi
- backrestS3Bucket: ""
- backrestS3Endpoint: ""
- backrestS3Region: ""
+ backrestS3Bucket: ${backrest_s3_bucket}
+ backrestS3Endpoint: ${backrest_s3_endpoint}
+ backrestS3Region: ${backrest_s3_region}
backrestS3URIStyle: ""
backrestS3VerifyTLS: ""
ccpimage: crunchy-postgres-ha
ccpimageprefix: registry.developers.crunchydata.com/crunchydata
- ccpimagetag: {{< param centosBase >}}-{{< param postgresVersion >}}-{{< param operatorVersion >}}
+ ccpimagetag: {{< param ubiBase >}}-{{< param postgresVersion >}}-{{< param operatorVersion >}}
clustername: ${pgo_cluster_name}
customconfig: ""
database: ${pgo_cluster_name}
@@ -462,6 +394,7 @@ spec:
tlsOnly: false
user: hippo
userlabels:
+ backrest-storage-type: "s3"
crunchy-postgres-exporter: "false"
pg-pod-anti-affinity: ""
pgo-version: {{< param operatorVersion >}}
@@ -690,3 +623,201 @@ spec:
Save your edits, and in a short period of time, you should see these annotations
applied to the managed Deployments.
+
+## PostgreSQL Operator Custom Resource Definitions
+
+There are several PostgreSQL Operator Custom Resource Definitions (CRDs) that
+are installed in order for the PostgreSQL Operator to successfully function:
+
+- `pgclusters.crunchydata.com`: Stores information required to manage a
+PostgreSQL cluster. This includes things like the cluster name, what storage and
+resource classes to use, which version of PostgreSQL to run, information about
+how to maintain a high-availability cluster, etc.
+- `pgreplicas.crunchydata.com`: Stores information required to manage the
+replicas within a PostgreSQL cluster. This includes things like the number of
+replicas, what storage and resource classes to use, special affinity rules, etc.
+- `pgtasks.crunchydata.com`: A general purpose CRD that accepts a type of task
+that is needed to run against a cluster (e.g. take a backup) and tracks the
+state of said task through its workflow.
+- `pgpolicies.crunchydata.com`: Stores a reference to a SQL file that can be
+executed against a PostgreSQL cluster. In the past, this was used to manage RLS
+policies on PostgreSQL clusters.
+
+Below takes an in depth look for what each attribute does in a Custom Resource
+Definition, and how they can be used in the creation and update workflow.
+
+### Glossary
+
+- `create`: if an attribute is listed as `create`, it means it can affect what
+happens when a new Custom Resource is created.
+- `update`: if an attribute is listed as `update`, it means it can affect the
+Custom Resource, and by extension the objects it manages, when the attribute is
+updated.
+
+### `pgclusters.crunchydata.com`
+
+The `pgclusters.crunchydata.com` Custom Resource Definition is the fundamental
+definition of a PostgreSQL cluster. Most attributes only affect the deployment
+of a PostgreSQL cluster at the time the PostgreSQL cluster is created. Some
+attributes can be modified during the lifetime of the PostgreSQL cluster and
+make changes, as described below.
+
+#### Specification (`Spec`)
+
+| Attribute | Action | Description |
+|-----------|--------|-------------|
+| Annotations | `create`, `update` | Specify Kubernetes [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/) that can be applied to the different deployments managed by the PostgreSQL Operator (PostgreSQL, pgBackRest, pgBouncer). For more information, please see the "Annotations Specification" below. |
+| BackrestConfig | `create` | Optional references to pgBackRest configuration files
+| BackrestLimits | `create`, `update` | Specify the container resource limits that the pgBackRest repository should use. Follows the [Kubernetes definitions of resource limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container). |
+| BackrestResources | `create`, `update` | Specify the container resource requests that the pgBackRest repository should use. Follows the [Kubernetes definitions of resource requests](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container). |
+| BackrestS3Bucket | `create` | An optional parameter that specifies a S3 bucket that pgBackRest should use. |
+| BackrestS3Endpoint | `create` | An optional parameter that specifies the S3 endpoint pgBackRest should use. |
+| BackrestS3Region | `create` | An optional parameter that specifies a cloud region that pgBackRest should use. |
+| BackrestS3URIStyle | `create` | An optional parameter that specifies if pgBackRest should use the `path` or `host` S3 URI style. |
+| BackrestS3VerifyTLS | `create` | An optional parameter that specifies if pgBackRest should verify the TLS endpoint. |
+| BackrestStorage | `create` | A specification that gives information about the storage attributes for the pgBackRest repository, which stores backups and archives, of the PostgreSQL cluster. For details, please see the `Storage Specification` section below. This is required. |
+| CCPImage | `create` | The name of the PostgreSQL container image to use, e.g. `crunchy-postgres-ha` or `crunchy-postgres-ha-gis`. |
+| CCPImagePrefix | `create` | If provided, the image prefix (or registry) of the PostgreSQL container image, e.g. `registry.developers.crunchydata.com/crunchydata`. The default is to use the image prefix set in the PostgreSQL Operator configuration. |
+| CCPImageTag | `create` | The tag of the PostgreSQL container image to use, e.g. `{{< param ubiBase >}}-{{< param postgresVersion >}}-{{< param operatorVersion >}}`. |
+| CollectSecretName | `create` | An optional attribute unless `crunchy-postgres-exporter` is specified in the `UserLabels`; contains the name of a Kubernetes Secret that contains the credentials for a PostgreSQL user that is used for metrics collection, and is created when the PostgreSQL cluster is first bootstrapped. For more information, please see `User Secret Specification`.|
+| ClusterName | `create` | The name of the PostgreSQL cluster, e.g. `hippo`. This is used to group PostgreSQL instances (primary, replicas) together. |
+| CustomConfig | `create` | If specified, references a custom ConfigMap to use when bootstrapping a PostgreSQL cluster. For the shape of this file, please see the section on [Custom Configuration]({{< relref "/advanced/custom-configuration.md" >}}) |
+| Database | `create` | The name of a database that the PostgreSQL user can log into after the PostgreSQL cluster is created. |
+| ExporterLimits | `create`, `update` | Specify the container resource limits that the `crunchy-postgres-exporter` sidecar uses when it is deployed with a PostgreSQL instance. Follows the [Kubernetes definitions of resource limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container). |
+| ExporterPort | `create` | If the `"crunchy-postgres-exporter"` label is set in `UserLabels`, then this specifies the port that the metrics sidecar runs on (e.g. `9187`) |
+| ExporterResources | `create`, `update` | Specify the container resource requests that the `crunchy-postgres-exporter` sidecar uses when it is deployed with a PostgreSQL instance. Follows the [Kubernetes definitions of resource requests](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container). |
+| Limits | `create`, `update` | Specify the container resource limits that the PostgreSQL cluster should use. Follows the [Kubernetes definitions of resource limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container). |
+| Name | `create` | The name of the PostgreSQL instance that is the primary. On creation, this should be set to be the same as `ClusterName`. |
+| Namespace | `create` | The Kubernetes Namespace that the PostgreSQL cluster is deployed in. |
+| PGBadgerPort | `create` | If the `"crunchy-pgbadger"` label is set in `UserLabels`, then this specifies the port that the pgBadger sidecar runs on (e.g. `10000`) |
+| PGDataSource | `create` | Used to indicate if a PostgreSQL cluster should bootstrap its data from a pgBackRest repository. This uses the PostgreSQL Data Source Specification, described below. |
+| PGOImagePrefix | `create` | If provided, the image prefix (or registry) of any PostgreSQL Operator images that are used for jobs, e.g. `registry.developers.crunchydata.com/crunchydata`. The default is to use the image prefix set in the PostgreSQL Operator configuration. |
+| PgBouncer | `create`, `update` | If specified, defines the attributes to use for the pgBouncer connection pooling deployment that can be used in conjunction with this PostgreSQL cluster. Please see the specification defined below. |
+| PodAntiAffinity | `create` | A required section. Sets the [pod anti-affinity rules]({{< relref "/architecture/high-availability/_index.md#how-the-crunchy-postgresql-operator-uses-pod-anti-affinity" >}}) for the PostgreSQL cluster and associated deployments. Please see the `Pod Anti-Affinity Specification` section below. |
+| Policies | `create` | If provided, a comma-separated list referring to `pgpolicies.crunchydata.com.Spec.Name` that should be run once the PostgreSQL primary is first initialized. |
+| Port | `create` | The port that PostgreSQL will run on, e.g. `5432`. |
+| PrimaryStorage | `create` | A specification that gives information about the storage attributes for the primary instance in the PostgreSQL cluster. For details, please see the `Storage Specification` section below. This is required. |
+| RootSecretName | `create` | The name of a Kubernetes Secret that contains the credentials for a PostgreSQL _replication user_ that is created when the PostgreSQL cluster is first bootstrapped. For more information, please see `User Secret Specification`.|
+| ReplicaStorage | `create` | A specification that gives information about the storage attributes for any replicas in the PostgreSQL cluster. For details, please see the `Storage Specification` section below. This will likely be changed in the future based on the nature of the high-availability system, but presently it is still required that you set it. It is recommended you use similar settings to that of `PrimaryStorage`. |
+| Replicas | `create` | The number of replicas to create after a PostgreSQL primary is first initialized. This only works on create; to scale a cluster after it is initialized, please use the [`pgo scale`]({{< relref "/pgo-client/reference/pgo_scale.md" >}}) command. |
+| Resources | `create`, `update` | Specify the container resource requests that the PostgreSQL cluster should use. Follows the [Kubernetes definitions of resource requests](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container). |
+| RootSecretName | `create` | The name of a Kubernetes Secret that contains the credentials for a PostgreSQL superuser that is created when the PostgreSQL cluster is first bootstrapped. For more information, please see `User Secret Specification`.|
+| SyncReplication | `create` | If set to `true`, specifies the PostgreSQL cluster to use [synchronous replication]({{< relref "/architecture/high-availability/_index.md#how-the-crunchy-postgresql-operator-uses-pod-anti-affinity#synchronous-replication-guarding-against-transactions-loss" >}}).|
+| User | `create` | The name of the PostgreSQL user that is created when the PostgreSQL cluster is first created. |
+| UserLabels | `create` | A set of key-value string pairs that are used as a sort of "catch-all" for things that really should be modeled in the CRD. These values do get copied to the actually CR labels. If you want to set up metrics collection or pgBadger, you would specify `"crunchy-postgres-exporter": "true"` and `"crunchy-pgbadger": "true"` here, respectively. However, this structure does need to be set, so just follow whatever is in the example. |
+| UserSecretName | `create` | The name of a Kubernetes Secret that contains the credentials for a standard PostgreSQL user that is created when the PostgreSQL cluster is first bootstrapped. For more information, please see `User Secret Specification`.|
+| TablespaceMounts | `create`,`update` | Lists any tablespaces that are attached to the PostgreSQL cluster. Tablespaces can be added at a later time by updating the `TablespaceMounts` entry, but they cannot be removed. Stores a map of information, with the key being the name of the tablespace, and the value being a Storage Specification, defined below. |
+| TLS | `create` | Defines the attributes for enabling TLS for a PostgreSQL cluster. See TLS Specification below. |
+| TLSOnly | `create` | If set to true, requires client connections to use only TLS to connect to the PostgreSQL database. |
+| Standby | `create`, `update` | If set to true, indicates that the PostgreSQL cluster is a "standby" cluster, i.e. is in read-only mode entirely. Please see [Kubernetes Multi-Cluster Deployments]({{< relref "/architecture/high-availability/multi-cluster-kubernetes.md" >}}) for more information. |
+| Shutdown | `create`, `update` | If set to true, indicates that a PostgreSQL cluster should shutdown. If set to false, indicates that a PostgreSQL cluster should be up and running. |
+
+##### Storage Specification
+
+The storage specification is a spec that defines attributes about the storage to
+be used for a particular function of a PostgreSQL cluster (e.g. a primary
+instance or for the pgBackRest backup repository). The below describes each
+attribute and how it works.
+
+| Attribute | Action | Description |
+|-----------|--------|-------------|
+| AccessMode| `create` | The name of the Kubernetes Persistent Volume [Access Mode](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes) to use. |
+| MatchLabels | `create` | Only used with `StorageType` of `create`, used to match a particular subset of provisioned Persistent Volumes. |
+| Name | `create` | Only needed for `PrimaryStorage` in `pgclusters.crunchydata.com`.Used to identify the name of the PostgreSQL cluster. Should match `ClusterName`. |
+| Size | `create` | The size of the [Persistent Volume Claim](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims) (PVC). Must use a Kubernetes resource value, e.g. `20Gi`. |
+| StorageClass | `create` | The name of the Kubernetes [StorageClass](https://kubernetes.io/docs/concepts/storage/storage-classes/) to use. |
+| StorageType | `create` | Set to `create` if storage is provisioned (e.g. using `hostpath`). Set to `dynamic` if using a dynamic storage provisioner, e.g. via a `StorageClass`. |
+| SupplementalGroups | `create` | If provided, a comma-separated list of group IDs to use in case it is needed to interface with a particular storage system. Typically used with NFS or hostpath storage. |
+
+##### Pod Anti-Affinity Specification
+
+Sets the [pod anti-affinity]({{< relref "/architecture/high-availability/_index.md#how-the-crunchy-postgresql-operator-uses-pod-anti-affinity" >}})
+for the PostgreSQL cluster and associated deployments. Each attribute can
+contain one of the following values:
+
+- `required`
+- `preferred` (which is also the recommended default)
+- `disabled`
+
+For a detailed explanation for how this works. Please see the [high-availability]({{< relref "/architecture/high-availability/_index.md#how-the-crunchy-postgresql-operator-uses-pod-anti-affinity" >}})
+documentation.
+
+| Attribute | Action | Description |
+|-----------|--------|-------------|
+| Default | `create` | The default pod anti-affinity to use for all Pods managed in a given PostgreSQL cluster. |
+| PgBackRest | `create` | If set to a value that differs from `Default`, specifies the pod anti-affinity to use for just the pgBackRest repository. |
+| PgBouncer | `create` | If set to a value that differs from `Default`, specifies the pod anti-affinity to use for just the pgBouncer Pods. |
+
+##### PostgreSQL Data Source Specification
+
+This specification is used when one wants to bootstrap the data in a PostgreSQL
+cluster from a pgBackRest repository. This can be a pgBackRest repository that
+is attached to an active PostgreSQL cluster or is kept around to be used for
+spawning new PostgreSQL clusters.
+
+| Attribute | Action | Description |
+|-----------|--------|-------------|
+| RestoreFrom | `create` | The name of a PostgreSQL cluster, active or former, that will be used for bootstrapping the data of a new PostgreSQL cluster. |
+| RestoreOpts | `create` | Additional pgBackRest [restore options](https://pgbackrest.org/command.html#command-restore) that can be used as part of the bootstrapping operation, for example, point-in-time-recovery options. |
+
+##### TLS Specification
+
+The TLS specification makes a reference to the various secrets that are required
+to enable TLS in a PostgreSQL cluster. For more information on how these secrets
+should be structured, please see [Enabling TLS in a PostgreSQL Cluster]({{< relref "/pgo-client/common-tasks.md#enable-tls" >}}).
+
+| Attribute | Action | Description |
+|-----------|--------|-------------|
+| CASecret | `create` | A reference to the name of a Kubernetes Secret that specifies a certificate authority for the PostgreSQL cluster to trust. |
+| ReplicationTLSSecret | `create` | A reference to the name of a Kubernetes TLS Secret that contains a keypair for authenticating the replication user. Must be used with `CASecret` and `TLSSecret`. |
+| TLSSecret | `create` | A reference to the name of a Kubernetes TLS Secret that contains a keypair that is used for the PostgreSQL instance to identify itself and perform TLS communications with PostgreSQL clients. Must be used with `CASecret`. |
+
+##### pgBouncer Specification
+
+The pgBouncer specification defines how a pgBouncer deployment can be deployed
+alongside the PostgreSQL cluster. pgBouncer is a PostgreSQL connection pooler
+that can also help manage connection state, and is helpful to deploy alongside
+a PostgreSQL cluster to help with failover scenarios too.
+
+| Attribute | Action | Description |
+|-----------|--------|-------------|
+| Limits | `create`, `update` | Specify the container resource limits that the pgBouncer Pods should use. Follows the [Kubernetes definitions of resource limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container). |
+| Replicas | `create`, `update` | The number of pgBouncer instances to deploy. Must be set to at least `1` to deploy pgBouncer. Setting to `0` removes an existing pgBouncer deployment for the PostgreSQL cluster. |
+| Resources | `create`, `update` | Specify the container resource requests that the pgBouncer Pods should use. Follows the [Kubernetes definitions of resource requests](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container). |
+
+##### Annotations Specification
+
+The `pgcluster.crunchydata.com` specification contains a block that allows for
+custom [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
+to be applied to the Deployments that are managed by the PostgreSQL Operator,
+including:
+
+- PostgreSQL
+- pgBackRest
+- pgBouncer
+
+This also includes the option to apply Annotations globally across the three
+different deployment groups.
+
+| Attribute | Action | Description |
+|-----------|--------|-------------|
+| Backrest | `create`, `update` | Specify annotations that are only applied to the pgBackRest deployments |
+| Global | `create`, `update` | Specify annotations that are applied to the PostgreSQL, pgBackRest, and pgBouncer deployments |
+| PgBouncer | `create`, `update` | Specify annotations that are only applied to the pgBouncer deployments |
+| Postgres | `create`, `update` | Specify annotations that are only applied to the PostgreSQL deployments |
+
+### `pgreplicas.crunchydata.com`
+
+The `pgreplicas.crunchydata.com` Custom Resource Definition contains information
+pertaning to the structure of PostgreSQL replicas associated within a PostgreSQL
+cluster. All of the attributes only affect the replica when it is created.
+
+#### Specification (`Spec`)
+
+| Attribute | Action | Description |
+|-----------|--------|-------------|
+| ClusterName | `create` | The name of the PostgreSQL cluster, e.g. `hippo`. This is used to group PostgreSQL instances (primary, replicas) together. |
+| Name | `create` | The name of this PostgreSQL replica. It should be unique within a `ClusterName`. |
+| Namespace | `create` | The Kubernetes Namespace that the PostgreSQL cluster is deployed in. |
+| ReplicaStorage | `create` | A specification that gives information about the storage attributes for any replicas in the PostgreSQL cluster. For details, please see the `Storage Specification` section in the `pgclusters.crunchydata.com` description. This will likely be changed in the future based on the nature of the high-availability system, but presently it is still required that you set it. It is recommended you use similar settings to that of `PrimaryStorage`. |
+| UserLabels | `create` | A set of key-value string pairs that are used as a sort of "catch-all" for things that really should be modeled in the CRD. These values do get copied to the actually CR labels. If you want to set up metrics collection, you would specify `"crunchy-postgres-exporter": "true"` here. This also allows for node selector pinning using `NodeLabelKey` and `NodeLabelValue`. However, this structure does need to be set, so just follow whatever is in the example. |
diff --git a/docs/content/installation/_index.md b/docs/content/installation/_index.md
index 909561ce46..036a080a4e 100644
--- a/docs/content/installation/_index.md
+++ b/docs/content/installation/_index.md
@@ -5,10 +5,10 @@ draft: false
weight: 40
---
-There are several different ways to install and deploy the [PostgreSQL Operator](https://www.crunchydata.com/developers/download-postgres/containers/postgres-operator)
+There are several different ways to install and deploy the [PGO, the Postgres Operator](https://www.crunchydata.com/developers/download-postgres/containers/postgres-operator)
based upon your use case.
-For the vast majority of use cases, we recommend using the [PostgreSQL Operator Installer]({{< relref "/installation/postgres-operator.md" >}}),
+For the vast majority of use cases, we recommend using the [Postgres Operator Installer]({{< relref "/installation/postgres-operator.md" >}}),
which uses the `pgo-deployer` container to set up all of the objects required to
run the PostgreSQL Operator.
diff --git a/docs/content/installation/configuration.md b/docs/content/installation/configuration.md
index 1a09b4afaa..64ca97aaac 100644
--- a/docs/content/installation/configuration.md
+++ b/docs/content/installation/configuration.md
@@ -5,9 +5,9 @@ draft: false
weight: 40
---
-# PostgreSQL Operator Installer Configuration
+# PGO Installer Configuration
-When installing the PostgreSQL Operator you have many configuration options, these
+When installing PGO, the Postgres Operator you have many configuration options, these
options are listed in this section.
## General Configuration
@@ -31,7 +31,7 @@ Operator.
| `ccp_image_prefix` | registry.developers.crunchydata.com/crunchydata | **Required** | Configures the image prefix used when creating containers from Crunchy Container Suite. |
| `ccp_image_pull_secret` | | | Name of a Secret containing credentials for container image registries. |
| `ccp_image_pull_secret_manifest` | | | Provide a path to the Secret manifest to be installed in each namespace. (optional) |
-| `ccp_image_tag` | {{< param centosBase >}}-{{< param postgresVersion >}}-{{< param operatorVersion >}} | **Required** | Configures the image tag (version) used when creating containers from Crunchy Container Suite. |
+| `ccp_image_tag` | {{< param ubiBase >}}-{{< param postgresVersion >}}-{{< param operatorVersion >}} | **Required** | Configures the image tag (version) used when creating containers from Crunchy Container Suite. |
| `create_rbac` | true | **Required** | Set to true if the installer should create the RBAC resources required to run the PostgreSQL Operator. |
| `crunchy_debug` | false | | Set to configure Operator to use debugging mode. Note: this can cause sensitive data such as passwords to appear in Operator logs. |
| `db_name` | | | Set to a value to configure the default database name on all newly created clusters. By default, the PostgreSQL Operator will set it to the name of the cluster that is being created. |
@@ -53,12 +53,12 @@ Operator.
| `namespace_mode` | dynamic | | Determines which namespace permissions are assigned to the PostgreSQL Operator using a ClusterRole. Options: `dynamic`, `readonly`, and `disabled` |
| `pgbadgerport` | 10000 | **Required** | Set to configure the default port used to connect to pgbadger. |
| `pgo_add_os_ca_store` | false | **Required** | When true, includes system default certificate authorities. |
-| `pgo_admin_password` | examplepassword | **Required** | Configures the pgo administrator password. |
+| `pgo_admin_password` | examplepassword | | Configures the pgo administrator password. When blank, a random password is generated. |
| `pgo_admin_perms` | * | **Required** | Sets the access control rules provided by the PostgreSQL Operator RBAC resources for the PostgreSQL Operator administrative account that is created by this installer. Defaults to allowing all of the permissions, which is represented with the * |
| `pgo_admin_role_name` | pgoadmin | **Required** | Sets the name of the PostgreSQL Operator role that is utilized for administrative operations performed by the PostgreSQL Operator. |
| `pgo_admin_username` | admin | **Required** | Configures the pgo administrator username. |
| `pgo_apiserver_port` | 8443 | | Set to configure the port used by the Crunchy PostgreSQL Operator apiserver. |
-| `pgo_apiserver_url` | https://postgres-operator | | Sets the `pgo_apiserver_url` for the `pgo-client` deployment. |
+| `pgo_apiserver_url` | https://postgres-operator | | Sets the `pgo_apiserver_url` for the `pgo-client` deployment. Note that the URL should **not** end in a `/`. |
| `pgo_client_cert_secret` | pgo.tls | | Sets the secret that the `pgo-client` will use when connecting to the PostgreSQL Operator. |
| `pgo_client_container_install` | false | | Run the `pgo-client` deployment with the PostgreSQL Operator. |
| `pgo_client_install` | true | | Enable to download the `pgo` client binary as part of the Ansible install |
@@ -69,7 +69,7 @@ Operator.
| `pgo_image_prefix` | registry.developers.crunchydata.com/crunchydata | **Required** | Configures the image prefix used when creating containers for the Crunchy PostgreSQL Operator (apiserver, operator, scheduler..etc). |
| `pgo_image_pull_secret` | | | Name of a Secret containing credentials for container image registries. |
| `pgo_image_pull_secret_manifest` | | | Provide a path to the Secret manifest to be installed in each namespace. (optional) |
-| `pgo_image_tag` | {{< param centosBase >}}-{{< param operatorVersion >}} | **Required** | Configures the image tag used when creating containers for the Crunchy PostgreSQL Operator (apiserver, operator, scheduler..etc) |
+| `pgo_image_tag` | {{< param ubiBase >}}-{{< param operatorVersion >}} | **Required** | Configures the image tag used when creating containers for the Crunchy PostgreSQL Operator (apiserver, operator, scheduler..etc) |
| `pgo_installation_name` | devtest | **Required** | The name of the PGO installation. |
| `pgo_noauth_routes` | | | Configures URL routes with mTLS and HTTP BasicAuth disabled. |
| `pgo_operator_namespace` | pgo | **Required** | Set to configure the namespace where Operator will be deployed. |
@@ -135,8 +135,8 @@ other storage classes in production deployments.
| Name | Default | Required | Description |
|------|---------|----------|-------------|
-| `backrest_storage` | hostpathstorage | **Required** | Set the value of the storage configuration to use for the pgbackrest shared repository deployment created when a user specifies pgbackrest to be enabled on a cluster. |
-| `backup_storage` | hostpathstorage | **Required** | Set the value of the storage configuration to use for backups, including the storage for pgbackrest repo volumes. |
+| `backrest_storage` | hostpathstorage | **Required** | Set the value of the storage configuration to use for the pgBackRest repository. |
+| `backup_storage` | hostpathstorage | **Required** | required, the value of the storage configuration to use for backups generated by `pg_dump`. |
| `primary_storage` | hostpathstorage | **Required** | Set to configure which storage definition to use when creating volumes used by PostgreSQL primaries on all newly created clusters. |
| `replica_storage` | hostpathstorage | **Required** | Set to configure which storage definition to use when creating volumes used by PostgreSQL replicas on all newly created clusters. |
| `wal_storage` | | | Set to configure which storage definition to use when creating volumes used for PostgreSQL Write-Ahead Log. |
diff --git a/docs/content/installation/metrics/metrics-configuration.md b/docs/content/installation/metrics/metrics-configuration.md
index 7d343480cf..d8a6bbf55f 100644
--- a/docs/content/installation/metrics/metrics-configuration.md
+++ b/docs/content/installation/metrics/metrics-configuration.md
@@ -25,7 +25,7 @@ These variables affect the general configuration of PostgreSQL Operator Monitori
| `create_rbac` | true | **Required** | Set to true if the installer should create the RBAC resources required to run the PostgreSQL Operator Monitoring infrastructure. |
| `db_port` | 5432 | **Required** | Set to configure the PostgreSQL port used by all PostgreSQL clusters. |
| `delete_metrics_namespace` | false | | Set to configure whether or not the metrics namespace (defined using variable `metrics_namespace`) is deleted when uninstalling the monitoring infrastructure. |
-| `disable_fsgroup` | false | | Set to `true` for deployments where you do not want to have the default PostgreSQL fsGroup (26) set. The typical usage is in OpenShift environments that have a `restricted` Security Context Constraints. |
+| `disable_fsgroup` | false | | Set to `true` for deployments where you do not want to have the default PostgreSQL fsGroup (26) set. The typical usage is in OpenShift environments that have a `restricted` Security Context Constraints. If you use the `anyuid` SCC, you would want to set this to `false`. The Postgres Operator will set this value appropriately by default, except for when using the `anyuid` SCC. |
| `grafana_admin_password` | admin | **Required** | Set to configure the login password for the Grafana administrator. |
| `grafana_admin_username` | admin | **Required** | Set to configure the login username for the Grafana administrator. |
| `grafana_install` | true | **Required** | Set to true to install Grafana to visualize metrics. |
@@ -108,7 +108,7 @@ and tag as needed to use the RedHat certified containers:
| `alertmanager_image_tag` | v0.21.0 | **Required** | Configures the image tag to use for the Alertmanager container. |
| `grafana_image_prefix` | grafana | **Required** | Configures the image prefix to use for the Grafana container.|
| `grafana_image_name` | grafana | **Required** | Configures the image name to use for the Grafana container. |
-| `grafana_image_tag` | 6.7.4 | **Required** | Configures the image tag to use for the Grafana container. |
+| `grafana_image_tag` | 6.7.5 | **Required** | Configures the image tag to use for the Grafana container. |
| `prometheus_image_prefix` | prom | **Required** | Configures the image prefix to use for the Prometheus container. |
| `prometheus_image_name` | promtheus | **Required** | Configures the image name to use for the Prometheus container. |
| `prometheus_image_tag` | v2.20.0 | **Required** | Configures the image tag to use for the Prometheus container. |
@@ -124,7 +124,7 @@ PostgreSQL Operator Monitoring infrastructure:
| Name | Default | Required | Description |
|------|---------|----------|-------------|
-| `pgo_image_prefix` | registry.developers.crunchydata.com/crunchydata | **Required** | Configures the image prefix used by the `pgo-deployer` container |
-| `pgo_image_tag` | {{< param centosBase >}}-{{< param operatorVersion >}} | **Required** | Configures the image tag used by the `pgo-deployer` container |
+| `pgo_image_prefix` | registry.developers.crunchydata.com/crunchydata | **Required** | Configures the image prefix used by the `pgo-deployer` container |
+| `pgo_image_tag` | {{< param ubiBase >}}-{{< param operatorVersion >}} | **Required** | Configures the image tag used by the `pgo-deployer` container |
-[k8s-service-type]: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
\ No newline at end of file
+[k8s-service-type]: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
diff --git a/docs/content/installation/metrics/other/ansible/_index.md b/docs/content/installation/metrics/other/ansible/_index.md
index cede0bb875..e48c6801dd 100644
--- a/docs/content/installation/metrics/other/ansible/_index.md
+++ b/docs/content/installation/metrics/other/ansible/_index.md
@@ -5,17 +5,17 @@ draft: false
weight: 10
---
-# Crunchy Data PostgreSQL Operator Monitoring Playbooks
+# PGO: Postgres Operator Monitoring Playbooks
-The Crunchy Data PostgreSQL Operator Monitoring Playbooks contain [Ansible](https://www.ansible.com/)
+PGO, the Postgres Operator from Crunchy Data, Monitoring Playbooks contain [Ansible](https://www.ansible.com/)
roles for installing and managing the [Crunchy Data PostgreSQL Operator Monitoring infrastructure]({{< relref "/installation/other/ansible/installing-operator.md" >}}).
## Features
The playbooks provided allow users to:
-* install PostgreSQL Operator Monitoring on Kubernetes and OpenShift
-* install PostgreSQL Operator from a Linux, Mac or Windows (Ubuntu subsystem) host
+* install PGO Monitoring on Kubernetes and OpenShift
+* install PGO from a Linux, Mac or Windows (Ubuntu subsystem) host
* support a variety of deployment models
## Resources
diff --git a/docs/content/installation/metrics/other/ansible/metrics-prerequisites.md b/docs/content/installation/metrics/other/ansible/metrics-prerequisites.md
index 1e9d31164d..116559ea30 100644
--- a/docs/content/installation/metrics/other/ansible/metrics-prerequisites.md
+++ b/docs/content/installation/metrics/other/ansible/metrics-prerequisites.md
@@ -62,7 +62,6 @@ if you are being using them for your environment. Both sets of variables cannot
be used at the same time. The unused variables should be left commented out or removed.
{{% /notice %}}
-
| Name | Default | Required | Description |
|-----------------------------------|-------------|----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `kubernetes_context` | | **Required**, if deploying to Kubernetes |When deploying to Kubernetes, set to configure the context name of the kubeconfig to be used for authentication. |
@@ -83,10 +82,15 @@ kubectl config current-context
## Configuring - `values.yaml`
The `values.yaml` file contains all of the configuration parameters
-for deploying the PostgreSQL Operator Monitoring infrastructure.
+for deploying the PostgreSQL Operator Monitoring infrastructure.
The [example file](https://github.com/CrunchyData/postgres-operator/blob/v{{< param operatorVersion >}}/installers/metrics/ansible/values.yaml)
contains defaults that should work in most Kubernetes environments, but it may
require some customization.
+Note that in OpenShift and CodeReady Containers you will need to set the
+`disable_fsgroup` to `true` attribute to `true` if you are using the
+`restricted` Security Context Constraint (SCC). If you are using the `anyuid`
+SCC, you will need to set `disable_fsgroup` to `false`.
+
For a detailed description of each configuration parameter, please read the
[PostgreSQL Operator Installer Metrics Configuration Reference](<{{< relref "/installation/metrics/metrics-configuration.md">}}>)
diff --git a/docs/content/installation/metrics/other/helm-metrics.md b/docs/content/installation/metrics/other/helm-metrics.md
index fb94918003..e09a1ae5c8 100644
--- a/docs/content/installation/metrics/other/helm-metrics.md
+++ b/docs/content/installation/metrics/other/helm-metrics.md
@@ -57,10 +57,15 @@ file will be used to populate the configuation options in the ConfigMap.
### Configuration - `values.yaml`
The `values.yaml` file contains all of the configuration parameters for deploying
-the PostgreSQL Operator Monitoring infrastructure.
+the PostgreSQL Operator Monitoring infrastructure.
The [values.yaml file](https://github.com/CrunchyData/postgres-operator/blob/master/installers/metrics/helm/values.yaml)
contains the defaults that should work in most Kubernetes environments, but it may require some customization.
+Note that in OpenShift and CodeReady Containers you will need to set the
+`disable_fsgroup` to `true` attribute to `true` if you are using the
+`restricted` Security Context Constraint (SCC). If you are using the `anyuid`
+SCC, you will need to set `disable_fsgroup` to `false`.
+
For a detailed description of each configuration parameter, please read the
[PostgreSQL Operator Monitoring Installer Configuration Reference](<{{< relref "/installation/metrics/metrics-configuration.md">}}>)
@@ -81,11 +86,11 @@ upgrade and uninstall the PostgreSQL Operator.
## Upgrade and Uninstall
-Once install has be completed using Helm, it will also be used to upgrade and
+Once install has be completed using Helm, it will also be used to upgrade and
uninstall your PostgreSQL Operator.
{{% notice tip %}}
-The `name` and `namespace` in the following sections should match the options
+The `name` and `namespace` in the following sections should match the options
provided at install.
{{% /notice %}}
@@ -111,7 +116,7 @@ helm uninstall
+
+### 3.3 And the unique visual styling of our website (the "Trade Dress").
+
+This Policy encompasses all Project trademarks and service marks, whether Word Marks, Logos or Trade Dress, which we collectively call the “Marks." We might not have registered some Marks, but this Policy covers our Marks regardless.
+
+## 4. Universal considerations for all uses
+
+Whenever you use a Mark, you must not mislead anyone, either directly or by omission, about what they are getting and from whom. The law reflects this requirement in two major ways described below: it prohibits creating a "likelihood of confusion," but allows for "nominative use."
+
+For example, you cannot say you are distributing PGO software when you're distributing a modified version of it, because you likely would confuse people, since they are not getting the same features and functionality they would get if they downloaded the software from us. You also cannot use our Logo on your website to suggest your website is an official website or we endorse your website.
+
+You can, though, say, for example, you like the PGO software, you are a PGO community participant, you are providing unmodified PGO software, or you wrote a book describing how to use the PGO software.
+
+This fundamental requirement - that it is always clear to people what they are getting and from whom - is reflected throughout this Policy. It should guide you if you are unsure about how you are using the Marks.
+
+In addition:
+
+You may not use the Marks in association with software use or distribution if you don’t comply with the license for the software.
+
+You may not use or register the Marks as part of your own trademark, service mark, domain name, company name, trade name, product name or service name.
+
+Trademark law does not allow you to use names or trademarks that are too similar to ours. You therefore may not use an obvious Mark variant or phonetic equivalent, foreign language equivalent, takeoff, or abbreviation for a similar or compatible product or service.
+
+You will not acquire rights in the Marks, and any goodwill you generate using the Marks inures solely to our benefit.
+## 5. Use for software
+
+See universal considerations for all uses, above, which also apply.
+
+### 5.1 Uses we consider non-infringing
+
+#### 5.1.1 Distributing unmodified source code or unmodified executable code we have compiled
+
+When you redistribute our unmodified software, you are not changing its quality or nature. Therefore, you may retain the Word Marks and Logos we have placed on the software, to identify your redistributed software whether you redistribute by optical media, memory stick or download of unmodified source and executable code. This only applies if you are redistributing official software from this Project that you have not changed. You can find the Logo files [here](/).
+
+#### 5.1.2 Distributing executable code you have compiled, or modified code
+
+You may use the Word Marks, but not the Logos, to describe the software’s origin, that is, that the code you are distributing is a modification of our software. You may say, for example, "this software is derived from the source code from the PGO Project."
+Of course, you can place your own trademarks or logos on software to which you have made substantive modifications, because by modifying the software, you have become the origin of the modified software.
+
+#### 5.1.3 Statements about compatibility, interoperability or derivation
+
+You may use the Word Marks, but not the Logos, to describe the relationship between your software and ours. You should use Our Mark after a verb or preposition that describes that relationship. So, you may say, for example, "Bob's plug-in for PGO," but may not say "Bob's PGO plug-in."
+
+#### 5.1.4 Using trademarks to show community affiliation
+
+This section discusses using our Marks for application themes, skins and personas. We discuss using our Marks on websites below.
+You may use the Word Marks and the Logos in themes, personas, or skins to show your Project support, provided the use is non-commercial and clearly decorative, as contrasted with a use that appears to be the branding for a website or application.
+
+### 5.2 Permitted uses
+
+#### 5.2.1 Distributing unmodified software
+
+You may use the Word Marks and Logos to distribute executable code if you make the code from official Project source code using the procedure for creating an executable found at [https://access.crunchydata.com/documentation/postgres-operator/latest/installation/](https://access.crunchydata.com/documentation/postgres-operator/latest/installation/).
+
+#### 5.3 Unpermitted uses we consider infringing
+
+We will likely consider it an infringement to use the Marks in software that combines our software with another software program. In addition to creating a single executable for both software programs, we would consider your software "combined" with ours if installing our software automatically installs yours. We would not consider your software "combined" with ours if it is on the same media but requires separate, independent action to install.
+
+## 6. Use for non-software goods and services
+
+See universal considerations for all uses, above, which also apply.
+
+### 6.1 Uses we consider non-infringing
+
+#### 6.1.1 Websites
+
+You may use the Word Marks and Logos on your webpage to show your Project support if:
+
+- Your own branding or naming is more prominent than any Project Marks;
+- The Logos hyperlink to the Project website: [https://github.com/CrunchyData/postgres-operator](https://github.com/CrunchyData/postgres-operator);
+- The site does not mislead customers into thinking your website, service, or product is our website, service, or product; and
+- The site clearly states the Project does not affiliate with or endorse you.
+
+#### 6.1.2 Publishing and presenting
+
+You can use the Word Marks in book and article titles, and the Logo in illustrations within a document, if the use does not suggest we published, endorse, or agree with your work.
+
+#### 6.1.3 Events
+
+You can use the Logo to promote the software and Project at events.
+
+### 6.2 Permitted uses
+
+#### 6.2.1 Meetups and user groups
+
+You can use the Word Marks as part of your meetup or user group name if:
+
+- The group’s main focus is the software;
+- Any software or services the group provides are without cost;
+- The group does not make a profit;
+- Any charge to attend meetings is only to cover the cost of the venue, food and drink.
+
+The universal considerations for all uses, above, still apply: specifically, you may not use or register the Marks as part of your own trademark, service mark, domain name, company name, trade name, product name or service name.
+
+### 6.3 Unpermitted uses we consider infringing
+
+We will likely consider it an infringement to use the Marks as part of a domain name or subdomain.
+We also would likely consider it an infringement to use the Marks on for-sale promotional goods.
+
+## 7 General Information
+
+### 7.1 Trademark legends
+
+If you are using our Marks in a way described in the sections entitled "Permitted uses," put the following notice at the foot of the page where you have used the Mark (or, if in a book, on the credits page), on packaging or labeling, and on advertising or marketing materials: "The PGO Project is a trademark of Crunchy Data Solutions, Inc., used with permission."
+
+### 7.2 What to do when you see abuse
+
+If you are aware of a confusing use or misuse of the Marks, we would appreciate you bringing it to our attention. Please contact us at [trademarks@crunchydata.com](mailto:trademarks@crunchydata.com) so we can investigate it further.
+
+### 7.3 Where to get further information
+
+If you have questions, wish to speak about using our Marks in ways the Policy doesn’t address, or see abuse of our Marks, please send an email to [trademarks@crunchydata.com](mailto:trademarks@crunchydata.com).
+
+We based these guidelines on the Model Trademark Guidelines, available at [http://www.modeltrademarkguidelines.org](http://www.modeltrademarkguidelines.org), used under a Creative Commons Attribution 3.0 Unported license: [https://creativecommons.org/licenses/by/3.0/deed.en_US](https://creativecommons.org/licenses/by/3.0/deed.en_US).
diff --git a/docs/static/logos/pgo.png b/docs/static/logos/pgo.png
new file mode 100644
index 0000000000..9d38c8f859
Binary files /dev/null and b/docs/static/logos/pgo.png differ
diff --git a/docs/static/logos/pgo.svg b/docs/static/logos/pgo.svg
new file mode 100644
index 0000000000..d72f9d7810
--- /dev/null
+++ b/docs/static/logos/pgo.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/examples/create-by-resource/fromcrd.json b/examples/create-by-resource/fromcrd.json
index 987ec53d55..b044941521 100644
--- a/examples/create-by-resource/fromcrd.json
+++ b/examples/create-by-resource/fromcrd.json
@@ -16,7 +16,7 @@
"pg-cluster": "fromcrd",
"pg-pod-anti-affinity": "",
"pgo-backrest": "true",
- "pgo-version": "4.5.0",
+ "pgo-version": "4.5.7",
"pgouser": "pgoadmin",
"primary": "true"
},
@@ -62,7 +62,7 @@
},
"backrestResources": {},
"ccpimage": "crunchy-postgres-ha",
- "ccpimagetag": "centos7-12.4-4.5.0",
+ "ccpimagetag": "ubi8-12.11-4.5.7",
"clustername": "fromcrd",
"customconfig": "",
"database": "userdb",
@@ -95,7 +95,7 @@
"userlabels": {
"crunchy-postgres-exporter": "false",
"pg-pod-anti-affinity": "",
- "pgo-version": "4.5.0",
+ "pgo-version": "4.5.7",
"pgouser": "pgoadmin",
"pgo-backrest": "true"
},
diff --git a/examples/create-by-resource/run.sh b/examples/create-by-resource/run.sh
index 1cdefdda77..271154f8f9 100755
--- a/examples/create-by-resource/run.sh
+++ b/examples/create-by-resource/run.sh
@@ -1,6 +1,6 @@
#!/bin/bash
-# Copyright 2019 - 2020 Crunchy Data Solutions, Inc.
+# Copyright 2019 - 2022 Crunchy Data Solutions, Inc.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
@@ -18,6 +18,8 @@
#########
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+# PGO_CMD should either be "kubectl" or "oc" -- defaulting to kubectl
+PGO_CMD=${PGO_CMD:-kubectl}
# A namespace that exists in NAMESPACE env var - see examples/envs.sh
export NS=pgouser1
@@ -41,49 +43,10 @@ rm $DIR/fromcrd-key $DIR/fromcrd-key.pub
# EXAMPLE RUN #
###############
-# generate a SSH public/private keypair for use by pgBackRest
-ssh-keygen -t ed25519 -N '' -f $DIR/fromcrd-key
-
-# base64 encoded the keys for the generation of the Kube secret, and place
-# them into variables temporarily
-PUBLIC_KEY_TEMP=$(cat $DIR/fromcrd-key.pub | base64)
-PRIVATE_KEY_TEMP=$(cat $DIR/fromcrd-key | base64)
-
-export PUBLIC_KEY="${PUBLIC_KEY_TEMP//[$'\n']}"
-export PRIVATE_KEY="${PRIVATE_KEY_TEMP//[$'\n']}"
-
-unset PUBLIC_KEY_TEMP
-unset PRIVATE_KEY_TEMP
-
-# create the backrest-repo-config example file and substitute in the newly
-# created keys
-cat <<-EOF > $DIR/backrest-repo-config.yaml
-apiVersion: v1
-data:
- authorized_keys: ${PUBLIC_KEY}
- id_ed25519: ${PRIVATE_KEY}
- ssh_host_ed25519_key: ${PRIVATE_KEY}
- config: SG9zdCAqClN0cmljdEhvc3RLZXlDaGVja2luZyBubwpJZGVudGl0eUZpbGUgL3RtcC9pZF9lZDI1NTE5ClBvcnQgMjAyMgpVc2VyIHBnYmFja3Jlc3QK
- sshd_config: IwkkT3BlbkJTRDogc3NoZF9jb25maWcsdiAxLjEwMCAyMDE2LzA4LzE1IDEyOjMyOjA0IG5hZGR5IEV4cCAkCgojIFRoaXMgaXMgdGhlIHNzaGQgc2VydmVyIHN5c3RlbS13aWRlIGNvbmZpZ3VyYXRpb24gZmlsZS4gIFNlZQojIHNzaGRfY29uZmlnKDUpIGZvciBtb3JlIGluZm9ybWF0aW9uLgoKIyBUaGlzIHNzaGQgd2FzIGNvbXBpbGVkIHdpdGggUEFUSD0vdXNyL2xvY2FsL2JpbjovdXNyL2JpbgoKIyBUaGUgc3RyYXRlZ3kgdXNlZCBmb3Igb3B0aW9ucyBpbiB0aGUgZGVmYXVsdCBzc2hkX2NvbmZpZyBzaGlwcGVkIHdpdGgKIyBPcGVuU1NIIGlzIHRvIHNwZWNpZnkgb3B0aW9ucyB3aXRoIHRoZWlyIGRlZmF1bHQgdmFsdWUgd2hlcmUKIyBwb3NzaWJsZSwgYnV0IGxlYXZlIHRoZW0gY29tbWVudGVkLiAgVW5jb21tZW50ZWQgb3B0aW9ucyBvdmVycmlkZSB0aGUKIyBkZWZhdWx0IHZhbHVlLgoKIyBJZiB5b3Ugd2FudCB0byBjaGFuZ2UgdGhlIHBvcnQgb24gYSBTRUxpbnV4IHN5c3RlbSwgeW91IGhhdmUgdG8gdGVsbAojIFNFTGludXggYWJvdXQgdGhpcyBjaGFuZ2UuCiMgc2VtYW5hZ2UgcG9ydCAtYSAtdCBzc2hfcG9ydF90IC1wIHRjcCAjUE9SVE5VTUJFUgojClBvcnQgMjAyMgojQWRkcmVzc0ZhbWlseSBhbnkKI0xpc3RlbkFkZHJlc3MgMC4wLjAuMAojTGlzdGVuQWRkcmVzcyA6OgoKSG9zdEtleSAvc3NoZC9zc2hfaG9zdF9lZDI1NTE5X2tleQoKIyBDaXBoZXJzIGFuZCBrZXlpbmcKI1Jla2V5TGltaXQgZGVmYXVsdCBub25lCgojIExvZ2dpbmcKI1N5c2xvZ0ZhY2lsaXR5IEFVVEgKU3lzbG9nRmFjaWxpdHkgQVVUSFBSSVYKI0xvZ0xldmVsIElORk8KCiMgQXV0aGVudGljYXRpb246CgojTG9naW5HcmFjZVRpbWUgMm0KUGVybWl0Um9vdExvZ2luIG5vClN0cmljdE1vZGVzIG5vCiNNYXhBdXRoVHJpZXMgNgojTWF4U2Vzc2lvbnMgMTAKClB1YmtleUF1dGhlbnRpY2F0aW9uIHllcwoKIyBUaGUgZGVmYXVsdCBpcyB0byBjaGVjayBib3RoIC5zc2gvYXV0aG9yaXplZF9rZXlzIGFuZCAuc3NoL2F1dGhvcml6ZWRfa2V5czIKIyBidXQgdGhpcyBpcyBvdmVycmlkZGVuIHNvIGluc3RhbGxhdGlvbnMgd2lsbCBvbmx5IGNoZWNrIC5zc2gvYXV0aG9yaXplZF9rZXlzCkF1dGhvcml6ZWRLZXlzRmlsZQkvc3NoZC9hdXRob3JpemVkX2tleXMKCiNBdXRob3JpemVkUHJpbmNpcGFsc0ZpbGUgbm9uZQoKI0F1dGhvcml6ZWRLZXlzQ29tbWFuZCBub25lCiNBdXRob3JpemVkS2V5c0NvbW1hbmRVc2VyIG5vYm9keQoKIyBGb3IgdGhpcyB0byB3b3JrIHlvdSB3aWxsIGFsc28gbmVlZCBob3N0IGtleXMgaW4gL2V0Yy9zc2gvc3NoX2tub3duX2hvc3RzCiNIb3N0YmFzZWRBdXRoZW50aWNhdGlvbiBubwojIENoYW5nZSB0byB5ZXMgaWYgeW91IGRvbid0IHRydXN0IH4vLnNzaC9rbm93bl9ob3N0cyBmb3IKIyBIb3N0YmFzZWRBdXRoZW50aWNhdGlvbgojSWdub3JlVXNlcktub3duSG9zdHMgbm8KIyBEb24ndCByZWFkIHRoZSB1c2VyJ3Mgfi8ucmhvc3RzIGFuZCB+Ly5zaG9zdHMgZmlsZXMKI0lnbm9yZVJob3N0cyB5ZXMKCiMgVG8gZGlzYWJsZSB0dW5uZWxlZCBjbGVhciB0ZXh0IHBhc3N3b3JkcywgY2hhbmdlIHRvIG5vIGhlcmUhCiNQYXNzd29yZEF1dGhlbnRpY2F0aW9uIHllcwojUGVybWl0RW1wdHlQYXNzd29yZHMgbm8KUGFzc3dvcmRBdXRoZW50aWNhdGlvbiBubwoKIyBDaGFuZ2UgdG8gbm8gdG8gZGlzYWJsZSBzL2tleSBwYXNzd29yZHMKQ2hhbGxlbmdlUmVzcG9uc2VBdXRoZW50aWNhdGlvbiB5ZXMKI0NoYWxsZW5nZVJlc3BvbnNlQXV0aGVudGljYXRpb24gbm8KCiMgS2VyYmVyb3Mgb3B0aW9ucwojS2VyYmVyb3NBdXRoZW50aWNhdGlvbiBubwojS2VyYmVyb3NPckxvY2FsUGFzc3dkIHllcwojS2VyYmVyb3NUaWNrZXRDbGVhbnVwIHllcwojS2VyYmVyb3NHZXRBRlNUb2tlbiBubwojS2VyYmVyb3NVc2VLdXNlcm9rIHllcwoKIyBHU1NBUEkgb3B0aW9ucwojR1NTQVBJQXV0aGVudGljYXRpb24geWVzCiNHU1NBUElDbGVhbnVwQ3JlZGVudGlhbHMgbm8KI0dTU0FQSVN0cmljdEFjY2VwdG9yQ2hlY2sgeWVzCiNHU1NBUElLZXlFeGNoYW5nZSBubwojR1NTQVBJRW5hYmxlazV1c2VycyBubwoKIyBTZXQgdGhpcyB0byAneWVzJyB0byBlbmFibGUgUEFNIGF1dGhlbnRpY2F0aW9uLCBhY2NvdW50IHByb2Nlc3NpbmcsCiMgYW5kIHNlc3Npb24gcHJvY2Vzc2luZy4gSWYgdGhpcyBpcyBlbmFibGVkLCBQQU0gYXV0aGVudGljYXRpb24gd2lsbAojIGJlIGFsbG93ZWQgdGhyb3VnaCB0aGUgQ2hhbGxlbmdlUmVzcG9uc2VBdXRoZW50aWNhdGlvbiBhbmQKIyBQYXNzd29yZEF1dGhlbnRpY2F0aW9uLiAgRGVwZW5kaW5nIG9uIHlvdXIgUEFNIGNvbmZpZ3VyYXRpb24sCiMgUEFNIGF1dGhlbnRpY2F0aW9uIHZpYSBDaGFsbGVuZ2VSZXNwb25zZUF1dGhlbnRpY2F0aW9uIG1heSBieXBhc3MKIyB0aGUgc2V0dGluZyBvZiAiUGVybWl0Um9vdExvZ2luIHdpdGhvdXQtcGFzc3dvcmQiLgojIElmIHlvdSBqdXN0IHdhbnQgdGhlIFBBTSBhY2NvdW50IGFuZCBzZXNzaW9uIGNoZWNrcyB0byBydW4gd2l0aG91dAojIFBBTSBhdXRoZW50aWNhdGlvbiwgdGhlbiBlbmFibGUgdGhpcyBidXQgc2V0IFBhc3N3b3JkQXV0aGVudGljYXRpb24KIyBhbmQgQ2hhbGxlbmdlUmVzcG9uc2VBdXRoZW50aWNhdGlvbiB0byAnbm8nLgojIFdBUk5JTkc6ICdVc2VQQU0gbm8nIGlzIG5vdCBzdXBwb3J0ZWQgaW4gUmVkIEhhdCBFbnRlcnByaXNlIExpbnV4IGFuZCBtYXkgY2F1c2Ugc2V2ZXJhbAojIHByb2JsZW1zLgpVc2VQQU0geWVzIAoKI0FsbG93QWdlbnRGb3J3YXJkaW5nIHllcwojQWxsb3dUY3BGb3J3YXJkaW5nIHllcwojR2F0ZXdheVBvcnRzIG5vClgxMUZvcndhcmRpbmcgeWVzCiNYMTFEaXNwbGF5T2Zmc2V0IDEwCiNYMTFVc2VMb2NhbGhvc3QgeWVzCiNQZXJtaXRUVFkgeWVzCiNQcmludE1vdGQgeWVzCiNQcmludExhc3RMb2cgeWVzCiNUQ1BLZWVwQWxpdmUgeWVzCiNVc2VMb2dpbiBubwpVc2VQcml2aWxlZ2VTZXBhcmF0aW9uIG5vCiNQZXJtaXRVc2VyRW52aXJvbm1lbnQgbm8KI0NvbXByZXNzaW9uIGRlbGF5ZWQKI0NsaWVudEFsaXZlSW50ZXJ2YWwgMAojQ2xpZW50QWxpdmVDb3VudE1heCAzCiNTaG93UGF0Y2hMZXZlbCBubwojVXNlRE5TIHllcwojUGlkRmlsZSAvdmFyL3J1bi9zc2hkLnBpZAojTWF4U3RhcnR1cHMgMTA6MzA6MTAwCiNQZXJtaXRUdW5uZWwgbm8KI0Nocm9vdERpcmVjdG9yeSBub25lCiNWZXJzaW9uQWRkZW5kdW0gbm9uZQoKIyBubyBkZWZhdWx0IGJhbm5lciBwYXRoCiNCYW5uZXIgbm9uZQoKIyBBY2NlcHQgbG9jYWxlLXJlbGF0ZWQgZW52aXJvbm1lbnQgdmFyaWFibGVzCkFjY2VwdEVudiBMQU5HIExDX0NUWVBFIExDX05VTUVSSUMgTENfVElNRSBMQ19DT0xMQVRFIExDX01PTkVUQVJZIExDX01FU1NBR0VTCkFjY2VwdEVudiBMQ19QQVBFUiBMQ19OQU1FIExDX0FERFJFU1MgTENfVEVMRVBIT05FIExDX01FQVNVUkVNRU5UCkFjY2VwdEVudiBMQ19JREVOVElGSUNBVElPTiBMQ19BTEwgTEFOR1VBR0UKQWNjZXB0RW52IFhNT0RJRklFUlMKCiMgb3ZlcnJpZGUgZGVmYXVsdCBvZiBubyBzdWJzeXN0ZW1zClN1YnN5c3RlbQlzZnRwCS91c3IvbGliZXhlYy9vcGVuc3NoL3NmdHAtc2VydmVyCgojIEV4YW1wbGUgb2Ygb3ZlcnJpZGluZyBzZXR0aW5ncyBvbiBhIHBlci11c2VyIGJhc2lzCiNNYXRjaCBVc2VyIGFub25jdnMKIwlYMTFGb3J3YXJkaW5nIG5vCiMJQWxsb3dUY3BGb3J3YXJkaW5nIG5vCiMJUGVybWl0VFRZIG5vCiMJRm9yY2VDb21tYW5kIGN2cyBzZXJ2ZXI=
-kind: Secret
-metadata:
- labels:
- pg-cluster: fromcrd
- pgo-backrest-repo: "true"
- name: fromcrd-backrest-repo-config
- namespace: ${NS}
-type: Opaque
-EOF
-
-# unset the *_KEY environmental variables
-unset PUBLIC_KEY
-unset PRIVATE_KEY
-
# create the required postgres credentials for the fromcrd cluster
$PGO_CMD -n $NS create -f $DIR/postgres-secret.yaml
$PGO_CMD -n $NS create -f $DIR/primaryuser-secret.yaml
$PGO_CMD -n $NS create -f $DIR/testuser-secret.yaml
-$PGO_CMD -n $NS create -f $DIR/backrest-repo-config.yaml
# create the pgcluster CRD for the fromcrd cluster
$PGO_CMD -n $NS create -f $DIR/fromcrd.json
diff --git a/examples/custom-config/create.sh b/examples/custom-config/create.sh
index b0599f1b37..519ab0433e 100755
--- a/examples/custom-config/create.sh
+++ b/examples/custom-config/create.sh
@@ -1,6 +1,6 @@
#!/bin/bash
-# Copyright 2018 - 2020 Crunchy Data Solutions, Inc.
+# Copyright 2018 - 2022 Crunchy Data Solutions, Inc.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
@@ -28,11 +28,8 @@ function echo_info() {
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-#Error if PGO_CMD not set
-if [[ -z ${PGO_CMD} ]]
-then
- echo_err "PGO_CMD is not set."
-fi
+# PGO_CMD should either be "kubectl" or "oc" -- defaulting to kubectl
+PGO_CMD=${PGO_CMD:-kubectl}
#Error is PGO_NAMESPACE not set
if [[ -z ${PGO_NAMESPACE} ]]
diff --git a/examples/custom-config/setup.sql b/examples/custom-config/setup.sql
index 206005eb8a..ca7510ff93 100644
--- a/examples/custom-config/setup.sql
+++ b/examples/custom-config/setup.sql
@@ -1,5 +1,5 @@
/*
- * Copyright 2017 - 2020 Crunchy Data Solutions, Inc.
+ * Copyright 2017 - 2022 Crunchy Data Solutions, Inc.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
diff --git a/examples/envs.sh b/examples/envs.sh
index 86bde3cde3..d30bb67261 100644
--- a/examples/envs.sh
+++ b/examples/envs.sh
@@ -22,8 +22,8 @@ export PGO_CONF_DIR=$PGOROOT/installers/ansible/roles/pgo-operator/files
# the version of the Operator you run is set by these vars
export PGO_IMAGE_PREFIX=registry.developers.crunchydata.com/crunchydata
-export PGO_BASEOS=centos7
-export PGO_VERSION=4.5.0
+export PGO_BASEOS=ubi8
+export PGO_VERSION=4.5.7
export PGO_IMAGE_TAG=$PGO_BASEOS-$PGO_VERSION
# for setting the pgo apiserver port, disabling TLS or not verifying TLS
diff --git a/examples/helm/README.md b/examples/helm/README.md
new file mode 100644
index 0000000000..6936a6ea86
--- /dev/null
+++ b/examples/helm/README.md
@@ -0,0 +1,79 @@
+# create-cluster
+
+This is a working example of how to create a cluster via the crd workflow
+using a [Helm](https://helm.sh/) chart.
+
+## Prerequisites
+
+### Postgres Operator
+
+This example assumes you have the Crunchy PostgreSQL Operator installed
+in a namespace called `pgo`.
+
+### Helm
+
+Helm will also need to be installed for this example to run
+
+## Documentation
+
+Please see the documentation for more guidance using custom resources:
+
+https://access.crunchydata.com/documentation/postgres-operator/latest/custom-resources/
+
+## Setup
+
+If you are running Postgres Operator 4.5.3 or later, you can skip the below
+step.
+
+### Before 4.5.3
+
+```
+cd postgres-operator/examples/helm/create-cluster
+
+mkdir certs
+cd certs
+
+# this variable is the name of the cluster being created
+export pgo_cluster_name=hippo
+
+# generate a SSH public/private keypair for use by pgBackRest
+ssh-keygen -t ed25519 -N '' -f "${pgo_cluster_name}-key"
+```
+
+## Running the Example
+
+For this example we will deploy the cluster into the `pgo` namespace where the
+Postgres Operator is installed and running.
+
+Return to the `create-cluster` directory:
+
+```
+cd postgres-operator/examples/helm/create-cluster
+```
+
+The following commands will allow you to execute a dry run first with debug
+if you want to verify everything is set correctly. Then after everything looks
+good run the install command with out the flags:
+
+```
+helm install --dry-run --debug postgres-operator-create-cluster . -n pgo
+helm install postgres-operator-create-cluster . -n pgo
+```
+
+## Verify
+
+Now you can your Hippo cluster has deployed into the pgo namespace by running
+these few commands:
+
+```
+kubectl get all -n pgo
+
+pgo test hippo -n pgo
+
+pgo show cluster hippo -n pgo
+```
+
+## NOTE
+
+As of operator version 4.5.0 when using helm uninstall you will have to manually
+clean up some left over artifacts after running the uninstall.
diff --git a/examples/helm/create-cluster/.helmignore b/examples/helm/create-cluster/.helmignore
new file mode 100644
index 0000000000..0e8a0eb36f
--- /dev/null
+++ b/examples/helm/create-cluster/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/examples/helm/create-cluster/Chart.yaml b/examples/helm/create-cluster/Chart.yaml
new file mode 100644
index 0000000000..5857415edb
--- /dev/null
+++ b/examples/helm/create-cluster/Chart.yaml
@@ -0,0 +1,23 @@
+apiVersion: v2
+name: crunchycrdcluster
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+appVersion: 1.16.0
diff --git a/examples/helm/create-cluster/templates/NOTES.txt b/examples/helm/create-cluster/templates/NOTES.txt
new file mode 100644
index 0000000000..542443a66e
--- /dev/null
+++ b/examples/helm/create-cluster/templates/NOTES.txt
@@ -0,0 +1,34 @@
+Thank you deploying a crunchy postgreSQL cluster v{{ .Chart.AppVersion }}!
+
+ ((((((((((((((((((((((
+ (((((((((((((%%%%%%%(((((((((((((((
+ (((((((((((%%% %%%%((((((((((((
+ (((((((((((%%( (((( ( %%%(((((((((((
+ (((((((((((((%% (( ,(( %%%(((((((((((
+ (((((((((((((((%% *%%/ %%%%%%%((((((((((
+ (((((((((((((((((((%%(( %%%%%%%%%%#(((((%%%%%%%%%%#((((((((((((
+ ((((((((((((((((((%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%((((((((((((((
+ *((((((((((((((((((((%%%%%% /%%%%%%%%%%%%%%%%%%%((((((((((((((((
+ (((((((((((((((((((((((%%%/ .%, %%%((((((((((((((((((,
+ ((((((((((((((((((((((% %#(((((((((((((((((
+(((((((((((((((%%%%%% #%(((((((((((((((((
+((((((((((((((%% %%(((((((((((((((,
+((((((((((((%%%#% % %%(((((((((((((((
+((((((((((((%. % % #((((((((((((((
+(((((((((((%% % %%* %(((((((((((((
+#(###(###(#%% %%% %% %%% #%%#(###(###(#
+###########%%%%% /%%%%%%%%%%%%% %% %%%%% ,%%#######
+###############%% %%%%%% %%% %%%%%%%% %%#####
+ ################%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %% %%##
+ ################%% %%%%%%%%%%%%%%%%% %%%% %
+ ##############%# %% (%%%%%%% %%%%%%
+ #############% %%%%% %%%%%%%%%%%
+ ###########% %%%%%%%%%%% %%%%%%%%%
+ #########%% %% %%%%%%%%%%%%%%%#
+ ########%% %% %%%%%%%%%
+ ######%% %% %%%%%%
+ ####%%% %%%%% %
+ %% %%%%
+
+More information about the custom resource workflow the docs can be found here:
+https://access.crunchydata.com/documentation/postgres-operator/latest/custom-resources/
diff --git a/examples/helm/create-cluster/templates/_helpers.tpl b/examples/helm/create-cluster/templates/_helpers.tpl
new file mode 100644
index 0000000000..8ebe4c4d53
--- /dev/null
+++ b/examples/helm/create-cluster/templates/_helpers.tpl
@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "crunchycrdcluster.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "crunchycrdcluster.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "crunchycrdcluster.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "crunchycrdcluster.labels" -}}
+helm.sh/chart: {{ include "crunchycrdcluster.chart" . }}
+{{ include "crunchycrdcluster.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "crunchycrdcluster.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "crunchycrdcluster.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "crunchycrdcluster.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "crunchycrdcluster.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
diff --git a/examples/helm/create-cluster/templates/hippo-secret.yaml b/examples/helm/create-cluster/templates/hippo-secret.yaml
new file mode 100644
index 0000000000..8e922196e1
--- /dev/null
+++ b/examples/helm/create-cluster/templates/hippo-secret.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+data:
+ password: {{ .Values.hipposecretpassword | b64enc }}
+ username: {{ .Values.hipposecretuser | b64enc }}
+kind: Secret
+metadata:
+ labels:
+ pg-cluster: {{ .Values.pgclustername }}
+ vendor: crunchydata
+ name: {{ .Values.pgclustername }}-hippo-secret
+ namespace: {{ .Values.namespace }}
+type: Opaque
diff --git a/examples/helm/create-cluster/templates/pgcluster.yaml b/examples/helm/create-cluster/templates/pgcluster.yaml
new file mode 100644
index 0000000000..2b29f4ce97
--- /dev/null
+++ b/examples/helm/create-cluster/templates/pgcluster.yaml
@@ -0,0 +1,95 @@
+apiVersion: crunchydata.com/v1
+kind: Pgcluster
+metadata:
+ annotations:
+ current-primary: {{ .Values.pgclustername }}
+ labels:
+ autofail: "true"
+ crunchy-pgbadger: "false"
+ crunchy-pgha-scope: {{ .Values.pgclustername }}
+ crunchy-postgres-exporter: "false"
+ deployment-name: {{ .Values.pgclustername }}
+ name: {{ .Values.pgclustername }}
+ pg-cluster: {{ .Values.pgclustername }}
+ pg-pod-anti-affinity: ""
+ pgo-backrest: "true"
+ pgo-version: 4.5.7
+ pgouser: admin
+ name: {{ .Values.pgclustername }}
+ namespace: {{ .Values.namespace }}
+spec:
+ BackrestStorage:
+ accessmode: ReadWriteOnce
+ matchLabels: ""
+ name: ""
+ size: 3G
+ storageclass: ""
+ storagetype: dynamic
+ supplementalgroups: ""
+ PrimaryStorage:
+ accessmode: ReadWriteOnce
+ matchLabels: ""
+ name: {{ .Values.pgclustername }}
+ size: 3G
+ storageclass: ""
+ storagetype: dynamic
+ supplementalgroups: ""
+ ReplicaStorage:
+ accessmode: ReadWriteOnce
+ matchLabels: ""
+ name: ""
+ size: 3G
+ storageclass: ""
+ storagetype: dynamic
+ supplementalgroups: ""
+ annotations:
+ backrestLimits: {}
+ backrestRepoPath: ""
+ backrestResources:
+ memory: 48Mi
+ backrestS3Bucket: ""
+ backrestS3Endpoint: ""
+ backrestS3Region: ""
+ backrestS3URIStyle: ""
+ backrestS3VerifyTLS: ""
+ ccpimage: {{ .Values.ccpimage }}
+ ccpimageprefix: {{ .Values.ccpimageprefix }}
+ ccpimagetag: {{ .Values.ccpimagetag }}
+ clustername: {{ .Values.pgclustername }}
+ customconfig: ""
+ database: {{ .Values.pgclustername }}
+ exporterport: "9187"
+ limits: {}
+ name: {{ .Values.pgclustername }}
+ namespace: {{ .Values.namespace }}
+ pgBouncer:
+ limits: {}
+ replicas: 0
+ pgDataSource:
+ restoreFrom: ""
+ restoreOpts: ""
+ pgbadgerport: "10000"
+ pgoimageprefix: {{ .Values.pgoimageprefix }}
+ podAntiAffinity:
+ default: preferred
+ pgBackRest: preferred
+ pgBouncer: preferred
+ policies: ""
+ port: "5432"
+ primarysecretname: {{ .Values.pgclustername }}-primaryuser-secret
+ replicas: "0"
+ rootsecretname: {{ .Values.pgclustername }}-postgres-secret
+ shutdown: false
+ standby: false
+ tablespaceMounts: {}
+ tls:
+ caSecret: ""
+ replicationTLSSecret: ""
+ tlsSecret: ""
+ tlsOnly: false
+ user: hippo
+ userlabels:
+ crunchy-postgres-exporter: "false"
+ pg-pod-anti-affinity: ""
+ pgo-version: {{ .Values.pgoversion }}
+ usersecretname: {{ .Values.pgclustername }}-hippo-secret
diff --git a/examples/helm/create-cluster/templates/postgres-secret.yaml b/examples/helm/create-cluster/templates/postgres-secret.yaml
new file mode 100644
index 0000000000..914da77e1c
--- /dev/null
+++ b/examples/helm/create-cluster/templates/postgres-secret.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+data:
+ password: {{ .Values.postgressecretpassword | b64enc }}
+ username: {{ .Values.postgressecretuser | b64enc }}
+kind: Secret
+metadata:
+ labels:
+ pg-cluster: {{ .Values.pgclustername }}
+ vendor: crunchydata
+ name: {{ .Values.pgclustername }}-postgres-secret
+ namespace: {{ .Values.namespace }}
+type: Opaque
\ No newline at end of file
diff --git a/examples/helm/create-cluster/templates/primaryuser-secret.yaml b/examples/helm/create-cluster/templates/primaryuser-secret.yaml
new file mode 100644
index 0000000000..f4471b8fd2
--- /dev/null
+++ b/examples/helm/create-cluster/templates/primaryuser-secret.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+data:
+ password: {{ .Values.primaryusersecretpassword | b64enc }}
+ username: {{ .Values.primaryusersecretuser | b64enc }}
+kind: Secret
+metadata:
+ labels:
+ pg-cluster: {{ .Values.pgclustername }}
+ vendor: crunchydata
+ name: {{ .Values.pgclustername }}-primaryuser-secret
+ namespace: {{ .Values.namespace }}
+type: Opaque
\ No newline at end of file
diff --git a/examples/helm/create-cluster/values.yaml b/examples/helm/create-cluster/values.yaml
new file mode 100644
index 0000000000..b6a8d32648
--- /dev/null
+++ b/examples/helm/create-cluster/values.yaml
@@ -0,0 +1,17 @@
+# Default values for pg_deployment in SDX.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+# The values is for the namespace and the postgresql cluster name
+ccpimage: crunchy-postgres-ha
+ccpimageprefix: registry.developers.crunchydata.com/crunchydata
+ccpimagetag: ubi8-12.11-4.5.7
+namespace: pgo
+pgclustername: hippo
+pgoimageprefix: registry.developers.crunchydata.com/crunchydata
+pgoversion: 4.5.7
+hipposecretuser: "hippo"
+hipposecretpassword: "Supersecurepassword*"
+postgressecretuser: "postgres"
+postgressecretpassword: "Anothersecurepassword*"
+primaryusersecretuser: "primaryuser"
+primaryusersecretpassword: "Moresecurepassword*"
\ No newline at end of file
diff --git a/hack/boilerplate.go.txt b/hack/boilerplate.go.txt
index 8aabc9a12b..22523257ce 100644
--- a/hack/boilerplate.go.txt
+++ b/hack/boilerplate.go.txt
@@ -1,5 +1,5 @@
/*
-Copyright 2020 Crunchy Data Solutions, Inc.
+Copyright 2020 - 2022 Crunchy Data Solutions, Inc.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
diff --git a/hack/config_sync.sh b/hack/config_sync.sh
index cab45b023b..b7a7b95b95 100755
--- a/hack/config_sync.sh
+++ b/hack/config_sync.sh
@@ -1,6 +1,6 @@
#!/bin/bash
-# Copyright 2020 Crunchy Data Solutions, Inc.
+# Copyright 2020 - 2022 Crunchy Data Solutions, Inc.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh
index c9795398ae..f010b87f3a 100755
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -1,6 +1,6 @@
#!/usr/bin/env bash
-# Copyright 2020 Crunchy Data Solutions, Inc.
+# Copyright 2020 - 2022 Crunchy Data Solutions, Inc.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
diff --git a/hack/verify-codegen.sh b/hack/verify-codegen.sh
index c096654ca9..4c359a10bf 100755
--- a/hack/verify-codegen.sh
+++ b/hack/verify-codegen.sh
@@ -1,6 +1,6 @@
#!/usr/bin/env bash
-# Copyright 2020 Crunchy Data Solutions, Inc.
+# Copyright 2020 - 2022 Crunchy Data Solutions, Inc.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
diff --git a/installers/ansible/README.md b/installers/ansible/README.md
index a9f0babd16..d6edeb160d 100644
--- a/installers/ansible/README.md
+++ b/installers/ansible/README.md
@@ -1,15 +1,15 @@
-# Crunchy Data PostgreSQL Operator Playbook
+# PGO: Postgres Operator Playbook
- 
+ 
- 
+ 