add helm charts
This commit is contained in:
Ybehrooz
@@ -0,0 +1,30 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and (or .Values.postgresql.repmgrConfiguration .Values.postgresql.configuration .Values.postgresql.pgHbaConfiguration) (not .Values.postgresql.configurationCM) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-configuration" (include "postgresql-ha.postgresql" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{- if .Values.postgresql.repmgrConfiguration }}
|
||||
repmgr.conf: |-
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.repmgrConfiguration "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.configuration }}
|
||||
postgresql.conf: |-
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.configuration "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.pgHbaConfiguration }}
|
||||
pg_hba.conf: |-
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.pgHbaConfiguration "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,20 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.postgresql.extendedConf (not .Values.postgresql.extendedConfCM) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-extended-configuration" (include "postgresql-ha.postgresql" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
override.conf: |-
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.extendedConf "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,19 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.postgresql.initdbScripts (not .Values.postgresql.initdbScriptsCM) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-initdb-scripts" (include "postgresql-ha.postgresql" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.postgresql.initdbScripts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,47 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.service.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-metrics" (include "postgresql-ha.postgresql" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if .Values.metrics.serviceMonitor.selector }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.metrics.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.metrics.service.type }}
|
||||
{{- if (or (eq .Values.metrics.service.type "LoadBalancer") (eq .Values.metrics.service.type "NodePort")) }}
|
||||
externalTrafficPolicy: {{ .Values.metrics.service.externalTrafficPolicy | quote }}
|
||||
{{- end }}
|
||||
{{ if .Values.metrics.service.clusterIP }}
|
||||
clusterIP: {{ .Values.metrics.service.clusterIP }}
|
||||
{{ end }}
|
||||
{{ if eq .Values.metrics.service.type "LoadBalancer" }}
|
||||
loadBalancerSourceRanges: {{ .Values.metrics.service.loadBalancerSourceRanges }}
|
||||
{{ end }}
|
||||
{{- if (and (eq .Values.metrics.service.type "LoadBalancer") (not (empty .Values.metrics.service.loadBalancerIP))) }}
|
||||
loadBalancerIP: {{ .Values.metrics.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: metrics
|
||||
port: {{ .Values.metrics.service.ports.metrics }}
|
||||
targetPort: metrics
|
||||
{{- if (and (or (eq .Values.metrics.service.type "NodePort") (eq .Values.metrics.service.type "LoadBalancer")) (not (empty .Values.metrics.service.nodePorts.metrics))) }}
|
||||
nodePort: {{ .Values.metrics.service.nodePorts.metrics }}
|
||||
{{- else if eq .Values.metrics.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- end }}
|
||||
@@ -0,0 +1,80 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.postgresql.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.postgresql" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.postgresql.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
# Allow outbound connections to other cluster pods
|
||||
- ports:
|
||||
- port: {{ .Values.service.ports.postgresql }}
|
||||
- port: {{ .Values.postgresql.containerPorts.postgresql }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if .Values.postgresql.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.postgresql.containerPorts.postgresql }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- port: {{ .Values.metrics.containerPorts.http }}
|
||||
{{- end }}
|
||||
{{- if not .Values.postgresql.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "postgresql-ha.postgresql" . }}-client: "true"
|
||||
{{- if .Values.postgresql.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.postgresql.networkPolicy.ingressNSMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.networkPolicy.ingressNSPodMatchLabels }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.postgresql.networkPolicy.ingressNSPodMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,28 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.postgresql.pdb.create }}
|
||||
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.postgresql" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.postgresql.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.postgresql.pdb.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if or .Values.postgresql.pdb.maxUnavailable (not .Values.postgresql.pdb.minAvailable) }}
|
||||
maxUnavailable: {{ .Values.postgresql.pdb.maxUnavailable | default 1 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- end }}
|
||||
@@ -0,0 +1,159 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-scripts" (include "postgresql-ha.postgresql" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
pre-stop.sh: |-
|
||||
#!/bin/bash
|
||||
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
set -o nounset
|
||||
|
||||
# Debug section
|
||||
exec 3>&1
|
||||
exec 4>&2
|
||||
|
||||
# Process input parameters
|
||||
MIN_DELAY_AFTER_PG_STOP_SECONDS=$1
|
||||
|
||||
# Load Libraries
|
||||
. /opt/bitnami/scripts/libpostgresql.sh
|
||||
. /opt/bitnami/scripts/librepmgr.sh
|
||||
|
||||
# Load PostgreSQL & repmgr environment variables
|
||||
. /opt/bitnami/scripts/postgresql-env.sh
|
||||
|
||||
# Auxiliary functions
|
||||
is_new_primary_ready() {
|
||||
local -a current_primary_node
|
||||
readarray -t current_primary_node < <(repmgr_get_primary_node)
|
||||
local current_primary_host="${current_primary_node[0]}"
|
||||
|
||||
if [[ -n "$current_primary_host" ]] && [[ "$current_primary_host" != "$REPMGR_NODE_NETWORK_NAME" ]]; then
|
||||
info "New primary detected, leaving the cluster..."
|
||||
return 0
|
||||
fi
|
||||
|
||||
info "Waiting for a new primary to be available..."
|
||||
return 1
|
||||
}
|
||||
|
||||
export MODULE="pre-stop-hook"
|
||||
if ! is_boolean_yes "$BITNAMI_DEBUG"; then
|
||||
exec 1>/dev/null
|
||||
exec 2>/dev/null
|
||||
fi
|
||||
|
||||
postgresql_enable_nss_wrapper
|
||||
|
||||
# Prepare env vars for managing roles
|
||||
readarray -t primary_node < <(repmgr_get_upstream_node)
|
||||
primary_host="${primary_node[0]}"
|
||||
|
||||
# Stop postgresql for graceful exit.
|
||||
PG_STOP_INIT=$EPOCHSECONDS
|
||||
postgresql_stop
|
||||
|
||||
if [[ -z "$primary_host" ]] || [[ "$primary_host" = "$REPMGR_NODE_NETWORK_NAME" ]]; then
|
||||
info "Primary node need to wait for a new primary node before leaving the cluster"
|
||||
retry_while is_new_primary_ready 10 5
|
||||
else
|
||||
info "Standby node doesn't need to wait for a new primary switchover. Leaving the cluster"
|
||||
fi
|
||||
|
||||
# Make sure pre-stop hook waits at least 25 seconds after stop of PG to make sure Pgpool-II detects node is down.
|
||||
# default terminationGracePeriodSeconds=30 seconds
|
||||
PG_STOP_DURATION=$((EPOCHSECONDS - PG_STOP_INIT))
|
||||
if (( PG_STOP_DURATION < MIN_DELAY_AFTER_PG_STOP_SECONDS )); then
|
||||
WAIT_TO_PG_POOL_TIME=$((MIN_DELAY_AFTER_PG_STOP_SECONDS - PG_STOP_DURATION))
|
||||
info "Waiting additional $WAIT_TO_PG_POOL_TIME seconds for Pgpool-II to detect node is down"
|
||||
sleep $WAIT_TO_PG_POOL_TIME
|
||||
fi
|
||||
liveness-probe.sh: |-
|
||||
#!/bin/bash
|
||||
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
set -o nounset
|
||||
|
||||
# Load Libraries
|
||||
. /opt/bitnami/scripts/libpostgresql.sh
|
||||
. /opt/bitnami/scripts/librepmgr.sh
|
||||
|
||||
# Load PostgreSQL & repmgr environment variables
|
||||
. /opt/bitnami/scripts/postgresql-env.sh
|
||||
|
||||
# Check if PG is ready
|
||||
pg_isready_args=("-U" "postgres" "-p" "$POSTGRESQL_PORT_NUMBER" "-h" "127.0.0.1")
|
||||
is_boolean_yes "$POSTGRESQL_ENABLE_TLS" && pg_isready_args+=("-d" "sslcert=$POSTGRESQL_TLS_CERT_FILE sslkey=$POSTGRESQL_TLS_KEY_FILE")
|
||||
debug_execute pg_isready "${pg_isready_args[@]}"
|
||||
|
||||
# Check if repmgr has split-brain issues
|
||||
postgresql_enable_nss_wrapper
|
||||
repmgr_check_status
|
||||
readiness-probe.sh: |-
|
||||
#!/bin/bash
|
||||
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
set -o nounset
|
||||
|
||||
# Load Libraries
|
||||
. /opt/bitnami/scripts/libpostgresql.sh
|
||||
. /opt/bitnami/scripts/librepmgr.sh
|
||||
|
||||
# Load PostgreSQL & repmgr environment variables
|
||||
. /opt/bitnami/scripts/postgresql-env.sh
|
||||
|
||||
# We should not proceed if a standby clone is in progress
|
||||
if ps waux | grep "data standby clone" | grep -qv grep; then
|
||||
echo "standby clone in progress"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Then, let's check if PG is responding to queries
|
||||
{{- if .Values.postgresql.headlessWithNotReadyAddresses }}
|
||||
MIN_DELAY_AFTER_POD_READY_FIRST_TIME={{ add .Values.pgpool.livenessProbe.periodSeconds .Values.pgpool.livenessProbe.timeoutSeconds }}
|
||||
FIRST_READY_TS_FILE="/tmp/.first-ready.epoch"
|
||||
DELAY_SEMAPHORE="/tmp/.delay"
|
||||
{{- end }}
|
||||
if [[ $(PGPASSWORD="$POSTGRESQL_PASSWORD" psql -w -U "$POSTGRESQL_USERNAME" -d $POSTGRESQL_DATABASE -h 127.0.0.1 -p "$POSTGRESQL_PORT_NUMBER" -tA -c "SELECT 1" 2> /dev/null || true) = 1 ]]; then
|
||||
{{- if .Values.postgresql.headlessWithNotReadyAddresses }}
|
||||
# DB up, but initial readiness delay not applied
|
||||
if [[ ! -f "$DELAY_SEMAPHORE" ]] && [[ -f "$FIRST_READY_TS_FILE" ]]; then
|
||||
# calculate delay from the first readiness success
|
||||
FIRST_READY_TS=$(cat $FIRST_READY_TS_FILE)
|
||||
CURRENT_DELAY_SECONDS=$((EPOCHSECONDS - FIRST_READY_TS))
|
||||
# Wait for the minimal delay after the first readiness state
|
||||
if (( CURRENT_DELAY_SECONDS > MIN_DELAY_AFTER_POD_READY_FIRST_TIME )); then
|
||||
# mark delay as applied
|
||||
touch "$DELAY_APPLIED_FILE"
|
||||
else
|
||||
echo "minimal delay not met"
|
||||
exit 1
|
||||
fi
|
||||
# first ever readiness test success - store timestamp and report failure
|
||||
elif [[ ! -f "$DELAY_SEMAPHORE" ]]; then
|
||||
echo $EPOCHSECONDS > $FIRST_READY_TS_FILE
|
||||
exit 1
|
||||
fi
|
||||
{{- end }}
|
||||
# Finally, check if repmgr has split-brain issues
|
||||
postgresql_enable_nss_wrapper
|
||||
repmgr_check_status
|
||||
else
|
||||
echo "connection to database failed"
|
||||
exit 1
|
||||
fi
|
||||
@@ -0,0 +1,24 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if (include "postgresql-ha.postgresqlCreateSecret" .) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.postgresql" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" . ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" . ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- if not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres") }}
|
||||
postgres-password: {{ include "common.secrets.passwords.manage" (dict "secret" (include "postgresql-ha.postgresql" .) "key" "postgres-password" "providedValues" (list "global.postgresql.postgresPassword" "postgresql.postgresPassword") "length" 10 "context" .) }}
|
||||
{{- end }}
|
||||
password: {{ include "common.secrets.passwords.manage" (dict "secret" (include "postgresql-ha.postgresql" .) "key" "password" "providedValues" (list "global.postgresql.password" "postgresql.password") "length" 10 "context" .) }}
|
||||
repmgr-password: {{ include "common.secrets.passwords.manage" (dict "secret" (include "postgresql-ha.postgresql" .) "key" "repmgr-password" "providedValues" (list "global.postgresql.repmgrPassword" "postgresql.repmgrPassword") "length" 10 "context" .) }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,28 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-headless" (include "postgresql-ha.postgresql" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.commonAnnotations .Values.service.headless.annotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonAnnotations .Values.service.headless.annotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
publishNotReadyAddresses: {{ .Values.postgresql.headlessWithNotReadyAddresses }}
|
||||
ports:
|
||||
- name: {{ .Values.service.portName | quote }}
|
||||
port: {{ .Values.postgresql.containerPorts.postgresql }}
|
||||
targetPort: postgresql
|
||||
protocol: TCP
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
@@ -0,0 +1,29 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.witness.create }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-witness" (include "postgresql-ha.postgresql" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.commonAnnotations .Values.service.headless.annotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.serviceAnnotations .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
ports:
|
||||
- name: {{ .Values.service.portName | quote }}
|
||||
port: {{ .Values.postgresql.containerPorts.postgresql }}
|
||||
targetPort: postgresql
|
||||
protocol: TCP
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.witness.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: witness
|
||||
{{- end }}
|
||||
@@ -0,0 +1,31 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.postgresql" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.serviceLabels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if or .Values.postgresql.serviceAnnotations .Values.service.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.serviceAnnotations .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: {{ .Values.service.portName | quote }}
|
||||
port: {{ .Values.service.ports.postgresql }}
|
||||
targetPort: postgresql
|
||||
protocol: TCP
|
||||
{{- if .Values.service.extraPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
@@ -0,0 +1,49 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.postgresql" . }}
|
||||
namespace: {{ coalesce .Values.metrics.serviceMonitor.namespace (include "common.names.namespace" .) | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- if or .Values.commonAnnotations .Values.metrics.serviceMonitor.annotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.metrics.serviceMonitor.jobLabel }}
|
||||
jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }}
|
||||
{{- if .Values.metrics.serviceMonitor.selector }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
endpoints:
|
||||
- port: metrics
|
||||
{{- if .Values.metrics.serviceMonitor.interval }}
|
||||
interval: {{ .Values.metrics.serviceMonitor.interval }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.honorLabels }}
|
||||
honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.relabelings }}
|
||||
relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ include "common.names.namespace" . | quote }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,701 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ include "postgresql-ha.postgresql" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.labels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.postgresql.replicaCount }}
|
||||
podManagementPolicy: {{ .Values.postgresql.podManagementPolicy | quote }}
|
||||
serviceName: {{ printf "%s-headless" (include "postgresql-ha.postgresql" .) }}
|
||||
updateStrategy: {{- toYaml .Values.postgresql.updateStrategy | nindent 4 }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
template:
|
||||
metadata:
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
annotations:
|
||||
{{- if and (or .Values.postgresql.repmgrConfiguration .Values.postgresql.configuration .Values.postgresql.pgHbaConfiguration) (not .Values.postgresql.configurationCM) }}
|
||||
checksum/configuration: {{ include (print $.Template.BasePath "/postgresql/configmap.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.podAnnotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.postgresql.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.annotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.annotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- include "postgresql-ha.image.pullSecrets" . | nindent 6 }}
|
||||
automountServiceAccountToken: {{ .Values.postgresql.automountServiceAccountToken }}
|
||||
{{- if .Values.postgresql.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.postgresql.podAffinityPreset "component" "postgresql" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.postgresql.podAntiAffinityPreset "component" "postgresql" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.postgresql.nodeAffinityPreset.type "key" .Values.postgresql.nodeAffinityPreset.key "values" .Values.postgresql.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.tolerations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.topologySpreadConstraints "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.priorityClassName }}
|
||||
priorityClassName: {{ .Values.postgresql.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.schedulerName }}
|
||||
schedulerName: {{ .Values.postgresql.schedulerName }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.postgresql.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.postgresql.podSecurityContext "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "postgresql-ha.serviceAccountName" . }}
|
||||
hostNetwork: {{ .Values.postgresql.hostNetwork }}
|
||||
hostIPC: {{ .Values.postgresql.hostIPC }}
|
||||
{{- if or .Values.postgresql.tls.enabled .Values.postgresql.initContainers .Values.postgresql.extraInitContainers (and .Values.volumePermissions.enabled (or (or (not (empty .Values.postgresql.extendedConf)) (not (empty .Values.postgresql.extendedConfCM))) .Values.persistence.enabled)) }}
|
||||
initContainers:
|
||||
{{- if .Values.postgresql.tls.enabled }}
|
||||
- name: init-chmod-tls
|
||||
image: {{ template "postgresql-ha.volumePermissions.image" . }}
|
||||
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
|
||||
command:
|
||||
- /bin/sh
|
||||
- -cx
|
||||
- |
|
||||
cp /tmp/certs/* /opt/bitnami/postgresql/certs/
|
||||
{{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }}
|
||||
chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/postgresql/certs/
|
||||
{{- else }}
|
||||
chown -R {{ .Values.postgresql.containerSecurityContext.runAsUser }}:{{ .Values.postgresql.podSecurityContext.fsGroup }} /opt/bitnami/postgresql/certs/
|
||||
{{- end }}
|
||||
chmod 600 {{ template "postgresql-ha.postgresql.tlsCertKey" . }}
|
||||
{{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" (omit .Values.volumePermissions.podSecurityContext "runAsUser") "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.podSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.volumePermissions.resources }}
|
||||
resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
|
||||
{{- else if ne .Values.volumePermissions.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: raw-certificates
|
||||
mountPath: /tmp/certs
|
||||
- name: postgresql-certificates
|
||||
mountPath: /opt/bitnami/postgresql/certs
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- end }}
|
||||
{{- if and .Values.volumePermissions.enabled (or (or (not (empty .Values.postgresql.extendedConf)) (not (empty .Values.postgresql.extendedConfCM))) .Values.persistence.enabled) }}
|
||||
- name: init-chmod-data
|
||||
image: {{ include "postgresql-ha.volumePermissions.image" . }}
|
||||
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
mkdir -p {{ .Values.persistence.mountPath }}/conf {{ .Values.persistence.mountPath }}/data {{ .Values.persistence.mountPath }}/lock
|
||||
chmod 700 {{ .Values.persistence.mountPath }}/conf {{ .Values.persistence.mountPath }}/data {{ .Values.persistence.mountPath }}/lock
|
||||
chown {{ .Values.postgresql.containerSecurityContext.runAsUser }}:{{ .Values.postgresql.podSecurityContext.fsGroup }} {{ .Values.persistence.mountPath }}
|
||||
find {{ .Values.persistence.mountPath }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | \
|
||||
xargs -r chown -R {{ .Values.postgresql.containerSecurityContext.runAsUser }}:{{ .Values.postgresql.podSecurityContext.fsGroup }}
|
||||
{{- if .Values.volumePermissions.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.podSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.volumePermissions.resources }}
|
||||
resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
|
||||
{{- else if ne .Values.volumePermissions.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: {{ .Values.persistence.mountPath }}
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- end }}
|
||||
{{- if or .Values.postgresql.initContainers .Values.postgresql.extraInitContainers }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" (coalesce .Values.postgresql.initContainers .Values.postgresql.extraInitContainers) "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: postgresql
|
||||
image: {{ include "postgresql-ha.postgresql.image" . }}
|
||||
imagePullPolicy: {{ .Values.postgresql.image.pullPolicy | quote }}
|
||||
{{- if .Values.postgresql.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.postgresql.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.postgresql.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /pre-stop.sh
|
||||
- {{ .Values.postgresql.preStopDelayAfterPgStopSeconds | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.postgresql.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.postgresql.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
# Auxiliary vars to populate environment variables
|
||||
{{- $postgresqlReplicaCount := int .Values.postgresql.replicaCount }}
|
||||
{{- $postgresqlFullname := include "postgresql-ha.postgresql" . }}
|
||||
{{- $postgresqlHeadlessServiceName := printf "%s-headless" (include "postgresql-ha.postgresql" .) }}
|
||||
{{- $clusterDomain:= .Values.clusterDomain }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" (or .Values.postgresql.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||
# PostgreSQL configuration
|
||||
- name: POSTGRESQL_VOLUME_DIR
|
||||
value: {{ .Values.persistence.mountPath | quote }}
|
||||
- name: PGDATA
|
||||
value: {{ printf "%s/%s" .Values.persistence.mountPath "data" | quote }}
|
||||
{{- if not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres") }}
|
||||
{{- if .Values.postgresql.usePasswordFiles }}
|
||||
- name: POSTGRES_POSTGRES_PASSWORD_FILE
|
||||
value: "/opt/bitnami/postgresql/secrets/postgres-password"
|
||||
{{- else }}
|
||||
- name: POSTGRES_POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "postgresql-ha.postgresqlSecretName" . }}
|
||||
key: postgres-password
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: POSTGRES_USER
|
||||
value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }}
|
||||
{{- if .Values.postgresql.usePasswordFiles }}
|
||||
- name: POSTGRES_PASSWORD_FILE
|
||||
value: "/opt/bitnami/postgresql/secrets/password"
|
||||
{{- else }}
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
{{- if (include "postgresql-ha.postgresqlCreateSecret" .) }}
|
||||
key: password
|
||||
{{- else }}
|
||||
{{- if ( index ( lookup "v1" "Secret" (include "common.names.namespace" .) (include "postgresql-ha.postgresqlSecretName" .) ) ".data.postgres-password" ) }}
|
||||
key: postgres-password
|
||||
{{- else }}
|
||||
key: password
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }}
|
||||
- name: POSTGRES_DB
|
||||
value: {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }}
|
||||
{{- end }}
|
||||
- name: POSTGRESQL_LOG_HOSTNAME
|
||||
value: {{ .Values.postgresql.audit.logHostname | quote }}
|
||||
- name: POSTGRESQL_LOG_CONNECTIONS
|
||||
value: {{ .Values.postgresql.audit.logConnections | quote }}
|
||||
- name: POSTGRESQL_LOG_DISCONNECTIONS
|
||||
value: {{ .Values.postgresql.audit.logDisconnections | quote }}
|
||||
{{- if .Values.postgresql.audit.logLinePrefix }}
|
||||
- name: POSTGRESQL_LOG_LINE_PREFIX
|
||||
value: {{ .Values.postgresql.audit.logLinePrefix | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.audit.logTimezone }}
|
||||
- name: POSTGRESQL_LOG_TIMEZONE
|
||||
value: {{ .Values.postgresql.audit.logTimezone | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.audit.pgAuditLog }}
|
||||
- name: POSTGRESQL_PGAUDIT_LOG
|
||||
value: {{ .Values.postgresql.audit.pgAuditLog | quote }}
|
||||
{{- end }}
|
||||
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
|
||||
value: {{ .Values.postgresql.audit.pgAuditLogCatalog | quote }}
|
||||
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
|
||||
value: {{ .Values.postgresql.audit.clientMinMessages | quote }}
|
||||
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
|
||||
value: {{ .Values.postgresql.sharedPreloadLibraries | quote }}
|
||||
{{- if .Values.postgresql.maxConnections }}
|
||||
- name: POSTGRESQL_MAX_CONNECTIONS
|
||||
value: {{ .Values.postgresql.maxConnections | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.usePgRewind }}
|
||||
- name: REPMGR_USE_PGREWIND
|
||||
value: {{ .Values.postgresql.usePgRewind | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.postgresConnectionLimit }}
|
||||
- name: POSTGRESQL_POSTGRES_CONNECTION_LIMIT
|
||||
value: {{ .Values.postgresql.postgresConnectionLimit | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.dbUserConnectionLimit }}
|
||||
- name: POSTGRESQL_USERNAME_CONNECTION_LIMIT
|
||||
value: {{ .Values.postgresql.dbUserConnectionLimit | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.tcpKeepalivesInterval }}
|
||||
- name: POSTGRESQL_TCP_KEEPALIVES_INTERVAL
|
||||
value: {{ .Values.postgresql.tcpKeepalivesInterval | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.tcpKeepalivesIdle }}
|
||||
- name: POSTGRESQL_TCP_KEEPALIVES_IDLE
|
||||
value: {{ .Values.postgresql.tcpKeepalivesIdle | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.tcpKeepalivesCount }}
|
||||
- name: POSTGRESQL_TCP_KEEPALIVES_COUNT
|
||||
value: {{ .Values.postgresql.tcpKeepalivesCount | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.statementTimeout }}
|
||||
- name: POSTGRESQL_STATEMENT_TIMEOUT
|
||||
value: {{ .Values.postgresql.statementTimeout | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.pghbaRemoveFilters }}
|
||||
- name: POSTGRESQL_PGHBA_REMOVE_FILTERS
|
||||
value: {{ .Values.postgresql.pghbaRemoveFilters | quote }}
|
||||
{{- end }}
|
||||
- name: POSTGRESQL_ENABLE_TLS
|
||||
value: {{ ternary "yes" "no" .Values.postgresql.tls.enabled | quote }}
|
||||
{{- if .Values.postgresql.tls.enabled }}
|
||||
- name: POSTGRESQL_TLS_PREFER_SERVER_CIPHERS
|
||||
value: {{ ternary "yes" "no" .Values.postgresql.tls.preferServerCiphers | quote }}
|
||||
- name: POSTGRESQL_TLS_CERT_FILE
|
||||
value: {{ template "postgresql-ha.postgresql.tlsCert" . }}
|
||||
- name: POSTGRESQL_TLS_KEY_FILE
|
||||
value: {{ template "postgresql-ha.postgresql.tlsCertKey" . }}
|
||||
{{- end }}
|
||||
- name: POSTGRESQL_PORT_NUMBER
|
||||
value: {{ .Values.postgresql.containerPorts.postgresql | quote }}
|
||||
# Repmgr configuration
|
||||
- name: REPMGR_PORT_NUMBER
|
||||
value: {{ .Values.postgresql.containerPorts.postgresql | quote }}
|
||||
- name: REPMGR_PRIMARY_PORT
|
||||
value: {{ .Values.postgresql.containerPorts.postgresql | quote }}
|
||||
- name: MY_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: REPMGR_UPGRADE_EXTENSION
|
||||
value: {{ ternary "yes" "no" .Values.postgresql.upgradeRepmgrExtension | quote }}
|
||||
- name: REPMGR_PGHBA_TRUST_ALL
|
||||
value: {{ ternary "yes" "no" .Values.postgresql.pgHbaTrustAll | quote }}
|
||||
- name: REPMGR_MOUNTED_CONF_DIR
|
||||
value: "/bitnami/repmgr/conf"
|
||||
- name: REPMGR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: REPMGR_PARTNER_NODES
|
||||
value: {{ range $e, $i := until $postgresqlReplicaCount }}{{ $postgresqlFullname }}-{{ $i }}.{{ $postgresqlHeadlessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }},{{ end }}
|
||||
- name: REPMGR_PRIMARY_HOST
|
||||
value: {{ printf "%s-0.%s.$(REPMGR_NAMESPACE).svc.%s" $postgresqlFullname $postgresqlHeadlessServiceName $clusterDomain | quote }}
|
||||
- name: REPMGR_NODE_NAME
|
||||
value: "$(MY_POD_NAME)"
|
||||
- name: REPMGR_NODE_NETWORK_NAME
|
||||
value: "$(MY_POD_NAME).{{ $postgresqlHeadlessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }}"
|
||||
- name: REPMGR_NODE_TYPE
|
||||
value: "data"
|
||||
- name: REPMGR_LOG_LEVEL
|
||||
value: {{ .Values.postgresql.repmgrLogLevel | quote }}
|
||||
- name: REPMGR_CONNECT_TIMEOUT
|
||||
value: {{ .Values.postgresql.repmgrConnectTimeout | quote }}
|
||||
- name: REPMGR_RECONNECT_ATTEMPTS
|
||||
value: {{ .Values.postgresql.repmgrReconnectAttempts | quote }}
|
||||
- name: REPMGR_RECONNECT_INTERVAL
|
||||
value: {{ .Values.postgresql.repmgrReconnectInterval | quote }}
|
||||
- name: REPMGR_USERNAME
|
||||
value: {{ (include "postgresql-ha.postgresqlRepmgrUsername" .) | quote }}
|
||||
{{- if .Values.postgresql.usePasswordFiles }}
|
||||
- name: REPMGR_PASSWORD_FILE
|
||||
value: "/opt/bitnami/postgresql/secrets/repmgr-password"
|
||||
{{- else }}
|
||||
- name: REPMGR_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
key: repmgr-password
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.repmgrUsePassfile }}
|
||||
- name: REPMGR_USE_PASSFILE
|
||||
value: {{ ternary "true" "false" .Values.postgresql.repmgrUsePassfile | quote }}
|
||||
- name: REPMGR_PASSFILE_PATH
|
||||
value: {{ default "/opt/bitnami/repmgr/conf/.pgpass" .Values.postgresql.repmgrPassfilePath }}
|
||||
{{- end }}
|
||||
{{- if (include "postgresql-ha.repmgrDatabase" .) }}
|
||||
- name: REPMGR_DATABASE
|
||||
value: {{ (include "postgresql-ha.repmgrDatabase" .) | quote }}
|
||||
{{- end }}
|
||||
- name: REPMGR_FENCE_OLD_PRIMARY
|
||||
value: {{ ternary "yes" "no" .Values.postgresql.repmgrFenceOldPrimary | quote }}
|
||||
{{- if .Values.postgresql.repmgrChildNodesCheckInterval }}
|
||||
- name: REPMGR_CHILD_NODES_CHECK_INTERVAL
|
||||
value: {{ .Values.postgresql.repmgrChildNodesCheckInterval | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.repmgrChildNodesConnectedMinCount }}
|
||||
- name: REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT
|
||||
value: {{ .Values.postgresql.repmgrChildNodesConnectedMinCount | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.repmgrChildNodesDisconnectTimeout }}
|
||||
- name: REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT
|
||||
value: {{ .Values.postgresql.repmgrChildNodesDisconnectTimeout | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.syncReplication }}
|
||||
- name: POSTGRESQL_NUM_SYNCHRONOUS_REPLICAS
|
||||
value: {{ sub (int .Values.postgresql.replicaCount) 1 | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.syncReplicationMode }}
|
||||
- name: POSTGRESQL_SYNCHRONOUS_REPLICAS_MODE
|
||||
value: {{ .Values.postgresql.syncReplicationMode | quote }}
|
||||
{{- end }}
|
||||
- name: POSTGRESQL_SR_CHECK
|
||||
value: "yes"
|
||||
- name: POSTGRESQL_SR_CHECK_USERNAME
|
||||
value: {{ (include "postgresql-ha.pgoolSrCheckUsername" .) | quote }}
|
||||
- name: POSTGRESQL_SR_CHECK_DATABASE
|
||||
value: {{ .Values.pgpool.srCheckDatabase | quote }}
|
||||
{{- if .Values.postgresql.usePasswordFiles }}
|
||||
- name: POSTGRESQL_SR_CHECK_PASSWORD_FILE
|
||||
value: "/opt/bitnami/postgresql/secrets/sr-check-password"
|
||||
{{- else }}
|
||||
- name: POSTGRESQL_SR_CHECK_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.pgpoolSecretName" . }}
|
||||
key: sr-check-password
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.postgresql.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
{{- if .Values.postgresql.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ .Values.postgresql.extraEnvVarsCM }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ .Values.postgresql.extraEnvVarsSecret }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: postgresql
|
||||
containerPort: {{ .Values.postgresql.containerPorts.postgresql }}
|
||||
protocol: TCP
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.postgresql.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.postgresql.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.postgresql.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
command:
|
||||
- /liveness-probe.sh
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.postgresql.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.postgresql.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
command:
|
||||
- /readiness-probe.sh
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.postgresql.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.postgresql.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- '{{ include "postgresql-ha.pgpassword" . }} psql -w -U {{ include "postgresql-ha.postgresqlUsername" . | quote }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} -h 127.0.0.1 -p {{ .Values.postgresql.containerPorts.postgresql }} -c "SELECT 1"'
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.resources }}
|
||||
resources: {{- toYaml .Values.postgresql.resources | nindent 12 }}
|
||||
{{- else if ne .Values.postgresql.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.postgresql.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/postgresql/conf
|
||||
subPath: app-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/postgresql/tmp
|
||||
subPath: app-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/conf
|
||||
subPath: repmgr-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/tmp
|
||||
subPath: repmgr-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/logs
|
||||
subPath: repmgr-logs-dir
|
||||
{{- if or .Values.postgresql.repmgrConfiguration .Values.postgresql.configuration .Values.postgresql.pgHbaConfiguration .Values.postgresql.configurationCM }}
|
||||
- name: postgresql-config
|
||||
mountPath: /bitnami/repmgr/conf
|
||||
{{- end }}
|
||||
{{- if or .Values.postgresql.extendedConf .Values.postgresql.extendedConfCM }}
|
||||
- name: postgresql-extended-config
|
||||
mountPath: /bitnami/postgresql/conf/conf.d/
|
||||
{{- end }}
|
||||
{{- if or .Values.postgresql.initdbScriptsCM .Values.postgresql.initdbScripts }}
|
||||
- name: custom-init-scripts
|
||||
mountPath: /docker-entrypoint-initdb.d/
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.initdbScriptsSecret }}
|
||||
- name: custom-init-scripts-secret
|
||||
mountPath: /docker-entrypoint-initdb.d/secret
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.usePasswordFiles }}
|
||||
{{- if not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres") }}
|
||||
- name: postgresql-creds
|
||||
mountPath: /opt/bitnami/postgresql/secrets/postgres-password
|
||||
subPath: postgres-password
|
||||
{{- end }}
|
||||
- name: postgresql-creds
|
||||
subPath: password
|
||||
mountPath: /opt/bitnami/postgresql/secrets/password
|
||||
- name: postgresql-creds
|
||||
subPath: repmgr-password
|
||||
mountPath: /opt/bitnami/postgresql/secrets/repmgr-password
|
||||
- name: pgpool-creds
|
||||
subPath: sr-check-password
|
||||
mountPath: /opt/bitnami/postgresql/secrets/sr-check-password
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.tls.enabled }}
|
||||
- name: postgresql-certificates
|
||||
mountPath: /opt/bitnami/postgresql/certs
|
||||
{{- end }}
|
||||
- name: data
|
||||
mountPath: {{ .Values.persistence.mountPath }}
|
||||
- name: scripts
|
||||
mountPath: /pre-stop.sh
|
||||
subPath: pre-stop.sh
|
||||
- name: scripts
|
||||
mountPath: /liveness-probe.sh
|
||||
subPath: liveness-probe.sh
|
||||
- name: scripts
|
||||
mountPath: /readiness-probe.sh
|
||||
subPath: readiness-probe.sh
|
||||
{{- if .Values.postgresql.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.postgresql.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- name: metrics
|
||||
image: {{ include "postgresql-ha.metrics.image" . }}
|
||||
imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }}
|
||||
{{- if .Values.metrics.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.metrics.podSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: PG_EXPORTER_WEB_LISTEN_ADDRESS
|
||||
value: :{{ .Values.metrics.containerPorts.http }}
|
||||
- name: DATA_SOURCE_URI
|
||||
value: {{ printf "127.0.0.1:%d/%s?sslmode=disable" (.Values.postgresql.containerPorts.postgresql | int64) (include "postgresql-ha.postgresqlDatabase" .) | quote }}
|
||||
{{- if .Values.postgresql.usePasswordFiles }}
|
||||
- name: DATA_SOURCE_PASS_FILE
|
||||
value: "/opt/bitnami/postgresql/secrets/password"
|
||||
{{- else }}
|
||||
- name: DATA_SOURCE_PASS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
key: password
|
||||
{{- end }}
|
||||
- name: DATA_SOURCE_USER
|
||||
value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }}
|
||||
{{- if .Values.metrics.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
{{- if .Values.metrics.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ .Values.metrics.extraEnvVarsCM }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ .Values.metrics.extraEnvVarsSecret }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: {{ .Values.metrics.containerPorts.http }}
|
||||
protocol: TCP
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.metrics.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.metrics.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
tcpSocket:
|
||||
port: metrics
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.metrics.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: metrics
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.metrics.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: metrics
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.resources }}
|
||||
resources: {{- toYaml .Values.metrics.resources | nindent 12 }}
|
||||
{{- else if ne .Values.metrics.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- if or .Values.postgresql.usePasswordFiles .Values.metrics.customMetrics }}
|
||||
{{- if .Values.postgresql.usePasswordFiles }}
|
||||
- name: postgresql-creds
|
||||
mountPath: /opt/bitnami/postgresql/secrets/
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.customMetrics }}
|
||||
- name: custom-metrics
|
||||
mountPath: /conf
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.customMetrics }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
args: ["--extend.query-path", "/conf/custom-metrics.yaml"]
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.sidecars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.postgresql.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if .Values.postgresql.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.postgresql.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.customMetrics }}
|
||||
- name: custom-metrics
|
||||
configMap:
|
||||
name: {{ include "postgresql.metricsCM" . }}
|
||||
{{- end }}
|
||||
- name: scripts
|
||||
configMap:
|
||||
name: {{ printf "%s-scripts" (include "postgresql-ha.postgresql" .) }}
|
||||
defaultMode: 0755
|
||||
{{- if or .Values.postgresql.repmgrConfiguration .Values.postgresql.configuration .Values.postgresql.pgHbaConfiguration .Values.postgresql.configurationCM }}
|
||||
- name: postgresql-config
|
||||
configMap:
|
||||
name: {{ include "postgresql-ha.postgresqlConfigurationCM" . }}
|
||||
{{- end }}
|
||||
{{- if or .Values.postgresql.extendedConf .Values.postgresql.extendedConfCM }}
|
||||
- name: postgresql-extended-config
|
||||
configMap:
|
||||
name: {{ template "postgresql-ha.postgresqlExtendedConfCM" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.initdbScriptsSecret }}
|
||||
- name: custom-init-scripts-secret
|
||||
secret:
|
||||
secretName: {{ template "postgresql-ha.postgresqlInitdbScriptsSecret" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.usePasswordFiles }}
|
||||
- name: postgresql-creds
|
||||
secret:
|
||||
secretName: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
- name: pgpool-creds
|
||||
secret:
|
||||
secretName: {{ include "postgresql-ha.pgpoolSecretName" . }}
|
||||
{{- end }}
|
||||
{{- if or .Values.postgresql.initdbScriptsCM .Values.postgresql.initdbScripts }}
|
||||
- name: custom-init-scripts
|
||||
configMap:
|
||||
name: {{ template "postgresql-ha.postgresqlInitdbScriptsCM" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.tls.enabled }}
|
||||
- name: raw-certificates
|
||||
secret:
|
||||
secretName: {{ required "A secret containing TLS certificates is required when TLS is enabled" (tpl .Values.postgresql.tls.certificatesSecret .) }}
|
||||
- name: postgresql-certificates
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if and .Values.persistence.enabled .Values.persistence.existingClaim }}
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
{{- with .Values.persistence.existingClaim }}
|
||||
claimName: {{ tpl . $ }}
|
||||
{{- end }}
|
||||
{{- else if not .Values.persistence.enabled }}
|
||||
- name: data
|
||||
emptyDir: {}
|
||||
{{- else if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
|
||||
{{- if .Values.persistentVolumeClaimRetentionPolicy.enabled }}
|
||||
persistentVolumeClaimRetentionPolicy:
|
||||
whenDeleted: {{ .Values.persistentVolumeClaimRetentionPolicy.whenDeleted }}
|
||||
whenScaled: {{ .Values.persistentVolumeClaimRetentionPolicy.whenScaled }}
|
||||
{{- end }}
|
||||
volumeClaimTemplates:
|
||||
- apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: data
|
||||
{{- if .Values.persistence.annotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.annotations "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.persistence.labels }}
|
||||
labels: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.labels "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- range .Values.persistence.accessModes }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size | quote }}
|
||||
{{- if .Values.persistence.selector }}
|
||||
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.selector "context" $) | nindent 10 }}
|
||||
{{- end -}}
|
||||
{{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.witness.pdb.create }}
|
||||
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ printf "%s-witness" (include "postgresql-ha.postgresql" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: witness
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.witness.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.witness.pdb.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if or .Values.witness.pdb.maxUnavailable (not .Values.witness.pdb.minAvailable) }}
|
||||
maxUnavailable: {{ .Values.witness.pdb.maxUnavailable | default 1 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: witness
|
||||
{{- end }}
|
||||
@@ -0,0 +1,631 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.witness.create }}
|
||||
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ printf "%s-witness" (include "postgresql-ha.postgresql" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.witness.labels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: witness
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.witness.replicaCount }}
|
||||
podManagementPolicy: Parallel
|
||||
serviceName: {{ printf "%s-witness" (include "postgresql-ha.postgresql" .) }}
|
||||
updateStrategy: {{- toYaml .Values.witness.updateStrategy | nindent 4 }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.witness.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: witness
|
||||
template:
|
||||
metadata:
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: witness
|
||||
{{- if or .Values.witness.podAnnotations (and .Values.metrics.enabled .Values.metrics.annotations) }}
|
||||
annotations:
|
||||
{{- if .Values.witness.podAnnotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.witness.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.annotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.annotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- include "postgresql-ha.image.pullSecrets" . | nindent 6 }}
|
||||
automountServiceAccountToken: {{ .Values.witness.automountServiceAccountToken }}
|
||||
{{- if .Values.witness.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.witness.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.witness.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.witness.podAffinityPreset "component" "postgresql" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.witness.podAntiAffinityPreset "component" "postgresql" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.witness.nodeAffinityPreset.type "key" .Values.witness.nodeAffinityPreset.key "values" .Values.witness.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.witness.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.witness.tolerations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.witness.topologySpreadConstraints "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.priorityClassName }}
|
||||
priorityClassName: {{ .Values.witness.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.schedulerName }}
|
||||
schedulerName: {{ .Values.witness.schedulerName }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.witness.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.witness.podSecurityContext "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "postgresql-ha.serviceAccountName" . }}
|
||||
hostNetwork: {{ .Values.witness.hostNetwork }}
|
||||
hostIPC: {{ .Values.witness.hostIPC }}
|
||||
initContainers:
|
||||
{{- if .Values.postgresql.tls.enabled }}
|
||||
- name: init-chmod-tls
|
||||
image: {{ template "postgresql-ha.volumePermissions.image" . }}
|
||||
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
|
||||
command:
|
||||
- /bin/sh
|
||||
- -cx
|
||||
- |
|
||||
cp /tmp/certs/* /opt/bitnami/postgresql/certs/
|
||||
{{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }}
|
||||
chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/postgresql/certs/
|
||||
{{- else }}
|
||||
chown -R {{ .Values.witness.containerSecurityContext.runAsUser }}:{{ .Values.witness.podSecurityContext.fsGroup }} /opt/bitnami/postgresql/certs/
|
||||
{{- end }}
|
||||
chmod 600 {{ template "postgresql-ha.postgresql.tlsCertKey" . }}
|
||||
{{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" (omit .Values.volumePermissions.podSecurityContext "runAsUser") "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.podSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: raw-certificates
|
||||
mountPath: /tmp/certs
|
||||
- name: postgresql-certificates
|
||||
mountPath: /opt/bitnami/postgresql/certs
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- end }}
|
||||
{{- if and .Values.volumePermissions.enabled (or (or (not (empty .Values.witness.extendedConf)) (not (empty .Values.witness.extendedConfCM))) .Values.persistence.enabled) }}
|
||||
- name: init-chmod-data
|
||||
image: {{ include "postgresql-ha.volumePermissions.image" . }}
|
||||
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
mkdir -p {{ .Values.persistence.mountPath }}/conf {{ .Values.persistence.mountPath }}/data {{ .Values.persistence.mountPath }}/lock
|
||||
chmod 700 {{ .Values.persistence.mountPath }}/conf {{ .Values.persistence.mountPath }}/data {{ .Values.persistence.mountPath }}/lock
|
||||
chown {{ .Values.witness.containerSecurityContext.runAsUser }}:{{ .Values.witness.podSecurityContext.fsGroup }} {{ .Values.persistence.mountPath }}
|
||||
find {{ .Values.persistence.mountPath }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | \
|
||||
xargs -r chown -R {{ .Values.witness.containerSecurityContext.runAsUser }}:{{ .Values.witness.podSecurityContext.fsGroup }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.podSecurityContext "context" $) | nindent 12 }}
|
||||
{{- if .Values.volumePermissions.resources }}
|
||||
resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
|
||||
{{- else if ne .Values.volumePermissions.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: {{ .Values.persistence.mountPath }}
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- end }}
|
||||
{{- if or .Values.witness.initContainers .Values.witness.extraInitContainers }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" (coalesce .Values.witness.initContainers .Values.witness.extraInitContainers) "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: postgresql
|
||||
image: {{ include "postgresql-ha.postgresql.image" . }}
|
||||
imagePullPolicy: {{ .Values.postgresql.image.pullPolicy | quote }}
|
||||
{{- if .Values.witness.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.witness.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.witness.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.witness.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /pre-stop.sh
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.witness.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.witness.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.witness.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.witness.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
# Auxiliary vars to populate environment variables
|
||||
{{- $postgresqlReplicaCount := int .Values.witness.replicaCount }}
|
||||
{{- $postgresqlFullname := include "postgresql-ha.postgresql" . }}
|
||||
{{- $postgresqlHeadlessServiceName := printf "%s-headless" (include "postgresql-ha.postgresql" .) }}
|
||||
{{- $postgresqlWitnessServiceName := printf "%s-witness" (include "postgresql-ha.postgresql" .) }}
|
||||
{{- $clusterDomain:= .Values.clusterDomain }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" (or .Values.postgresql.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||
# PostgreSQL configuration
|
||||
- name: POSTGRESQL_VOLUME_DIR
|
||||
value: {{ .Values.persistence.mountPath | quote }}
|
||||
- name: PGDATA
|
||||
value: {{ printf "%s/%s" .Values.persistence.mountPath "data" | quote }}
|
||||
{{- if not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres") }}
|
||||
{{- if .Values.postgresql.usePasswordFiles }}
|
||||
- name: POSTGRES_POSTGRES_PASSWORD_FILE
|
||||
value: "/opt/bitnami/postgresql/secrets/postgres-password"
|
||||
{{- else }}
|
||||
- name: POSTGRES_POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "postgresql-ha.postgresqlSecretName" . }}
|
||||
key: postgres-password
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: POSTGRES_USER
|
||||
value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }}
|
||||
{{- if .Values.postgresql.usePasswordFiles }}
|
||||
- name: POSTGRES_PASSWORD_FILE
|
||||
value: "/opt/bitnami/postgresql/secrets/password"
|
||||
{{- else }}
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
{{- if (include "postgresql-ha.postgresqlCreateSecret" .) }}
|
||||
key: password
|
||||
{{- else }}
|
||||
{{- if ( index ( lookup "v1" "Secret" (include "common.names.namespace" .) (include "postgresql-ha.postgresqlSecretName" .) ) ".data.postgres-password" ) }}
|
||||
key: postgres-password
|
||||
{{- else }}
|
||||
key: password
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }}
|
||||
- name: POSTGRES_DB
|
||||
value: {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }}
|
||||
{{- end }}
|
||||
- name: POSTGRESQL_LOG_HOSTNAME
|
||||
value: {{ .Values.witness.audit.logHostname | quote }}
|
||||
- name: POSTGRESQL_LOG_CONNECTIONS
|
||||
value: {{ .Values.witness.audit.logConnections | quote }}
|
||||
- name: POSTGRESQL_LOG_DISCONNECTIONS
|
||||
value: {{ .Values.witness.audit.logDisconnections | quote }}
|
||||
{{- if .Values.witness.audit.logLinePrefix }}
|
||||
- name: POSTGRESQL_LOG_LINE_PREFIX
|
||||
value: {{ .Values.witness.audit.logLinePrefix | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.audit.logTimezone }}
|
||||
- name: POSTGRESQL_LOG_TIMEZONE
|
||||
value: {{ .Values.witness.audit.logTimezone | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.audit.pgAuditLog }}
|
||||
- name: POSTGRESQL_PGAUDIT_LOG
|
||||
value: {{ .Values.witness.audit.pgAuditLog | quote }}
|
||||
{{- end }}
|
||||
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
|
||||
value: {{ .Values.witness.audit.pgAuditLogCatalog | quote }}
|
||||
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
|
||||
value: {{ .Values.witness.audit.clientMinMessages | quote }}
|
||||
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
|
||||
value: {{ .Values.postgresql.sharedPreloadLibraries | quote }}
|
||||
{{- if .Values.witness.maxConnections }}
|
||||
- name: POSTGRESQL_MAX_CONNECTIONS
|
||||
value: {{ .Values.witness.maxConnections | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.postgresConnectionLimit }}
|
||||
- name: POSTGRESQL_POSTGRES_CONNECTION_LIMIT
|
||||
value: {{ .Values.witness.postgresConnectionLimit | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.dbUserConnectionLimit }}
|
||||
- name: POSTGRESQL_USERNAME_CONNECTION_LIMIT
|
||||
value: {{ .Values.witness.dbUserConnectionLimit | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.tcpKeepalivesInterval }}
|
||||
- name: POSTGRESQL_TCP_KEEPALIVES_INTERVAL
|
||||
value: {{ .Values.witness.tcpKeepalivesInterval | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.tcpKeepalivesIdle }}
|
||||
- name: POSTGRESQL_TCP_KEEPALIVES_IDLE
|
||||
value: {{ .Values.witness.tcpKeepalivesIdle | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.tcpKeepalivesCount }}
|
||||
- name: POSTGRESQL_TCP_KEEPALIVES_COUNT
|
||||
value: {{ .Values.witness.tcpKeepalivesCount | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.statementTimeout }}
|
||||
- name: POSTGRESQL_STATEMENT_TIMEOUT
|
||||
value: {{ .Values.witness.statementTimeout | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.pghbaRemoveFilters }}
|
||||
- name: POSTGRESQL_PGHBA_REMOVE_FILTERS
|
||||
value: {{ .Values.witness.pghbaRemoveFilters | quote }}
|
||||
{{- end }}
|
||||
- name: POSTGRESQL_ENABLE_TLS
|
||||
value: {{ ternary "yes" "no" .Values.postgresql.tls.enabled | quote }}
|
||||
{{- if .Values.postgresql.tls.enabled }}
|
||||
- name: POSTGRESQL_TLS_PREFER_SERVER_CIPHERS
|
||||
value: {{ ternary "yes" "no" .Values.postgresql.tls.preferServerCiphers | quote }}
|
||||
- name: POSTGRESQL_TLS_CERT_FILE
|
||||
value: {{ template "postgresql-ha.postgresql.tlsCert" . }}
|
||||
- name: POSTGRESQL_TLS_KEY_FILE
|
||||
value: {{ template "postgresql-ha.postgresql.tlsCertKey" . }}
|
||||
{{- end }}
|
||||
- name: POSTGRESQL_PORT_NUMBER
|
||||
value: {{ .Values.witness.containerPorts.postgresql | quote }}
|
||||
# Repmgr configuration
|
||||
- name: REPMGR_PORT_NUMBER
|
||||
value: {{ .Values.witness.containerPorts.postgresql | quote }}
|
||||
- name: REPMGR_PRIMARY_PORT
|
||||
value: {{ .Values.witness.containerPorts.postgresql | quote }}
|
||||
- name: MY_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: REPMGR_UPGRADE_EXTENSION
|
||||
value: {{ ternary "yes" "no" .Values.witness.upgradeRepmgrExtension | quote }}
|
||||
- name: REPMGR_PGHBA_TRUST_ALL
|
||||
value: {{ ternary "yes" "no" .Values.witness.pgHbaTrustAll | quote }}
|
||||
- name: REPMGR_MOUNTED_CONF_DIR
|
||||
value: "/bitnami/repmgr/conf"
|
||||
- name: REPMGR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: REPMGR_PARTNER_NODES
|
||||
value: {{ range $e, $i := until $postgresqlReplicaCount }}{{ $postgresqlFullname }}-{{ $i }}.{{ $postgresqlHeadlessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }},{{ end }}
|
||||
- name: REPMGR_PRIMARY_HOST
|
||||
value: {{ printf "%s-0.%s.$(REPMGR_NAMESPACE).svc.%s" $postgresqlFullname $postgresqlHeadlessServiceName $clusterDomain | quote }}
|
||||
- name: REPMGR_NODE_NAME
|
||||
value: "$(MY_POD_NAME)"
|
||||
- name: REPMGR_NODE_NETWORK_NAME
|
||||
value: "$(MY_POD_NAME).{{ $postgresqlWitnessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }}"
|
||||
- name: REPMGR_NODE_TYPE
|
||||
value: "witness"
|
||||
- name: REPMGR_NODE_ID_START_SEED
|
||||
value: "2000"
|
||||
- name: REPMGR_LOG_LEVEL
|
||||
value: {{ .Values.witness.repmgrLogLevel | quote }}
|
||||
- name: REPMGR_CONNECT_TIMEOUT
|
||||
value: {{ .Values.witness.repmgrConnectTimeout | quote }}
|
||||
- name: REPMGR_RECONNECT_ATTEMPTS
|
||||
value: {{ .Values.witness.repmgrReconnectAttempts | quote }}
|
||||
- name: REPMGR_RECONNECT_INTERVAL
|
||||
value: {{ .Values.witness.repmgrReconnectInterval | quote }}
|
||||
- name: REPMGR_USERNAME
|
||||
value: {{ (include "postgresql-ha.postgresqlRepmgrUsername" .) | quote }}
|
||||
{{- if .Values.postgresql.usePasswordFiles }}
|
||||
- name: REPMGR_PASSWORD_FILE
|
||||
value: "/opt/bitnami/postgresql/secrets/repmgr-password"
|
||||
{{- else }}
|
||||
- name: REPMGR_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
key: repmgr-password
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.repmgrUsePassfile }}
|
||||
- name: REPMGR_USE_PASSFILE
|
||||
value: {{ ternary "true" "false" .Values.postgresql.repmgrUsePassfile | quote }}
|
||||
- name: REPMGR_PASSFILE_PATH
|
||||
value: {{ default "/opt/bitnami/repmgr/conf/.pgpass" .Values.postgresql.repmgrPassfilePath }}
|
||||
{{- end }}
|
||||
{{- if (include "postgresql-ha.repmgrDatabase" .) }}
|
||||
- name: REPMGR_DATABASE
|
||||
value: {{ (include "postgresql-ha.repmgrDatabase" .) | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.witness.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
{{- if .Values.witness.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ .Values.witness.extraEnvVarsCM }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ .Values.witness.extraEnvVarsSecret }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: postgresql
|
||||
containerPort: {{ .Values.witness.containerPorts.postgresql }}
|
||||
protocol: TCP
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.witness.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.witness.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.witness.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.witness.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
command:
|
||||
- pg_isready
|
||||
- -U
|
||||
- postgres
|
||||
- -h
|
||||
- "127.0.0.1"
|
||||
- -p
|
||||
- {{ .Values.witness.containerPorts.postgresql | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.witness.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.witness.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.witness.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- '{{ include "postgresql-ha.pgpassword" . }} psql -w -U {{ include "postgresql-ha.postgresqlUsername" . | quote }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} -h 127.0.0.1 -p {{ .Values.witness.containerPorts.postgresql }} -c "SELECT 1"'
|
||||
{{- end }}
|
||||
{{- if .Values.witness.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.witness.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.witness.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.witness.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- '{{ include "postgresql-ha.pgpassword" . }} psql -w -U {{ include "postgresql-ha.postgresqlUsername" . | quote }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} -h 127.0.0.1 -p {{ .Values.witness.containerPorts.postgresql }} -c "SELECT 1"'
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.resources }}
|
||||
resources: {{- toYaml .Values.witness.resources | nindent 12 }}
|
||||
{{- else if ne .Values.witness.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.witness.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/postgresql/conf
|
||||
subPath: app-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/postgresql/tmp
|
||||
subPath: app-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/conf
|
||||
subPath: repmgr-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/tmp
|
||||
subPath: repmgr-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/logs
|
||||
subPath: repmgr-logs-dir
|
||||
{{- if or .Values.witness.repmgrConfiguration .Values.witness.configuration .Values.witness.pgHbaConfiguration .Values.witness.configurationCM }}
|
||||
- name: postgresql-config
|
||||
mountPath: /bitnami/repmgr/conf
|
||||
{{- end }}
|
||||
{{- if or .Values.witness.extendedConf .Values.witness.extendedConfCM }}
|
||||
- name: postgresql-extended-config
|
||||
mountPath: /bitnami/postgresql/conf/conf.d/
|
||||
{{- end }}
|
||||
{{- if or .Values.witness.initdbScriptsCM .Values.witness.initdbScripts }}
|
||||
- name: custom-init-scripts
|
||||
mountPath: /docker-entrypoint-initdb.d/
|
||||
{{- end }}
|
||||
{{- if .Values.witness.initdbScriptsSecret }}
|
||||
- name: custom-init-scripts-secret
|
||||
mountPath: /docker-entrypoint-initdb.d/secret
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.usePasswordFiles }}
|
||||
- name: password
|
||||
mountPath: /opt/bitnami/postgresql/secrets/
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.tls.enabled }}
|
||||
- name: postgresql-certificates
|
||||
mountPath: /opt/bitnami/postgresql/certs
|
||||
{{- end }}
|
||||
- name: data
|
||||
mountPath: {{ .Values.persistence.mountPath }}
|
||||
- name: scripts
|
||||
mountPath: /pre-stop.sh
|
||||
subPath: pre-stop.sh
|
||||
{{- if .Values.witness.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.witness.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- name: metrics
|
||||
image: {{ include "postgresql-ha.metrics.image" . }}
|
||||
imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }}
|
||||
{{- if .Values.metrics.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.metrics.podSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: PG_EXPORTER_WEB_LISTEN_ADDRESS
|
||||
value: :{{ .Values.metrics.containerPorts.http }}
|
||||
- name: DATA_SOURCE_URI
|
||||
value: {{ printf "127.0.0.1:%d/%s?sslmode=disable" (.Values.witness.containerPorts.postgresql | int64) (include "postgresql-ha.postgresqlDatabase" .) | quote }}
|
||||
{{- if .Values.postgresql.usePasswordFiles }}
|
||||
- name: DATA_SOURCE_PASS_FILE
|
||||
value: "/opt/bitnami/postgresql/secrets/password"
|
||||
{{- else }}
|
||||
- name: DATA_SOURCE_PASS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
key: password
|
||||
{{- end }}
|
||||
- name: DATA_SOURCE_USER
|
||||
value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }}
|
||||
{{- if .Values.metrics.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
{{- if .Values.metrics.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ .Values.metrics.extraEnvVarsCM }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ .Values.metrics.extraEnvVarsSecret }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: {{ .Values.metrics.containerPorts.http }}
|
||||
protocol: TCP
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.metrics.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.metrics.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
tcpSocket:
|
||||
port: metrics
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.metrics.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: metrics
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.metrics.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
httpGet:
|
||||
path: /
|
||||
port: metrics
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.resources }}
|
||||
resources: {{- toYaml .Values.metrics.resources | nindent 12 }}
|
||||
{{- else if ne .Values.metrics.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
{{- if .Values.postgresql.usePasswordFiles }}
|
||||
- name: password
|
||||
mountPath: /opt/bitnami/postgresql/secrets/
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.customMetrics }}
|
||||
- name: custom-metrics
|
||||
mountPath: /conf
|
||||
readOnly: true
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
args: ["--extend.query-path", "/conf/custom-metrics.yaml"]
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.sidecars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.witness.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if .Values.witness.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.witness.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.customMetrics }}
|
||||
- name: custom-metrics
|
||||
configMap:
|
||||
name: {{ include "postgresql.metricsCM" . }}
|
||||
{{- end }}
|
||||
- name: scripts
|
||||
configMap:
|
||||
name: {{ printf "%s-scripts" (include "postgresql-ha.postgresql" .) }}
|
||||
defaultMode: 0755
|
||||
{{- if or .Values.witness.repmgrConfiguration .Values.witness.configuration .Values.witness.pgHbaConfiguration .Values.witness.configurationCM }}
|
||||
- name: postgresql-config
|
||||
configMap:
|
||||
name: {{ include "postgresql-ha.postgresqlConfigurationCM" . }}
|
||||
{{- end }}
|
||||
{{- if or .Values.witness.extendedConf .Values.witness.extendedConfCM }}
|
||||
- name: postgresql-extended-config
|
||||
configMap:
|
||||
name: {{ template "postgresql-ha.postgresqlExtendedConfCM" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.witness.initdbScriptsSecret }}
|
||||
- name: custom-init-scripts-secret
|
||||
secret:
|
||||
secretName: {{ template "postgresql-ha.postgresqlInitdbScriptsSecret" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.usePasswordFiles }}
|
||||
- name: password
|
||||
secret:
|
||||
secretName: {{ include "postgresql-ha.postgresqlSecretName" . }}
|
||||
{{- end }}
|
||||
{{- if or .Values.witness.initdbScriptsCM .Values.witness.initdbScripts }}
|
||||
- name: custom-init-scripts
|
||||
configMap:
|
||||
name: {{ template "postgresql-ha.postgresqlInitdbScriptsCM" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.tls.enabled }}
|
||||
- name: raw-certificates
|
||||
secret:
|
||||
secretName: {{ required "A secret containing TLS certificates is required when TLS is enabled" (tpl .Values.postgresql.tls.certificatesSecret .) }}
|
||||
- name: postgresql-certificates
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if and .Values.persistence.enabled .Values.persistence.existingClaim }}
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
{{- with .Values.persistence.existingClaim }}
|
||||
claimName: {{ tpl . $ }}
|
||||
{{- end }}
|
||||
{{- else if not .Values.persistence.enabled }}
|
||||
- name: data
|
||||
emptyDir: {}
|
||||
{{- else if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
|
||||
volumeClaimTemplates:
|
||||
- apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: data
|
||||
{{- if .Values.persistence.annotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.annotations "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.persistence.labels }}
|
||||
labels: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.labels "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- range .Values.persistence.accessModes }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size | quote }}
|
||||
{{- if .Values.persistence.selector }}
|
||||
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.selector "context" $) | nindent 10 }}
|
||||
{{- end -}}
|
||||
{{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user