From 58817c3cab25290181ab8c26f3f07500375355bd Mon Sep 17 00:00:00 2001 From: Leo Sok Date: Fri, 10 Apr 2026 13:59:31 +0500 Subject: [PATCH] one pod postgres added --- postgresql-ha/Chart.lock | 6 - postgresql-ha/Chart.yaml | 42 - postgresql-ha/README.md | 1224 -------- postgresql-ha/charts/common/.helmignore | 24 - postgresql-ha/charts/common/Chart.yaml | 23 - postgresql-ha/charts/common/README.md | 235 -- .../charts/common/templates/_affinities.tpl | 139 - .../charts/common/templates/_capabilities.tpl | 221 -- .../common/templates/_compatibility.tpl | 38 - .../charts/common/templates/_errors.tpl | 28 - .../charts/common/templates/_images.tpl | 109 - .../charts/common/templates/_ingress.tpl | 73 - .../charts/common/templates/_labels.tpl | 46 - .../charts/common/templates/_names.tpl | 71 - .../charts/common/templates/_resources.tpl | 50 - .../charts/common/templates/_secrets.tpl | 182 -- .../charts/common/templates/_storage.tpl | 22 - .../charts/common/templates/_tplvalues.tpl | 38 - .../charts/common/templates/_utils.tpl | 77 - .../charts/common/templates/_warnings.tpl | 109 - .../templates/validations/_cassandra.tpl | 77 - .../common/templates/validations/_mariadb.tpl | 108 - .../common/templates/validations/_mongodb.tpl | 113 - .../common/templates/validations/_mysql.tpl | 108 - .../templates/validations/_postgresql.tpl | 134 - .../common/templates/validations/_redis.tpl | 81 - .../templates/validations/_validations.tpl | 51 - postgresql-ha/charts/common/values.yaml | 8 - postgresql-ha/templates/NOTES.txt | 109 - postgresql-ha/templates/_helpers.tpl | 736 ----- postgresql-ha/templates/pgpool/configmap.yaml | 22 - .../pgpool/custom-users-secrets.yaml | 23 - .../templates/pgpool/deployment.yaml | 449 --- .../pgpool/initdb-scripts-configmap.yaml | 21 - postgresql-ha/templates/pgpool/secrets.yaml | 22 - postgresql-ha/templates/pgpool/service.yaml | 54 - .../templates/postgresql/configmap.yaml | 30 - .../postgresql/hooks-scripts-configmap.yaml | 136 - .../templates/postgresql/metrics-service.yaml | 47 - postgresql-ha/templates/postgresql/pdb.yaml | 28 - .../templates/postgresql/secrets.yaml | 24 - .../postgresql/service-headless.yaml | 28 - .../templates/postgresql/service.yaml | 31 - .../templates/postgresql/statefulset.yaml | 678 ----- .../postgresql/witness-statefulset.yaml | 629 ---- postgresql-ha/values.yaml | 2292 --------------- {postgresql-ha => postgresql}/.helmignore | 0 postgresql/CHANGELOG.md | 2552 +++++++++++++++++ postgresql/Chart.lock | 6 + postgresql/Chart.yaml | 41 + postgresql/README.md | 1154 ++++++++ postgresql/templates/NOTES.txt | 123 + postgresql/templates/_helpers.tpl | 458 +++ .../templates/backup/cronjob.yaml | 103 +- .../templates/backup/networkpolicy.yaml | 32 + .../templates/backup/pvc.yaml | 6 +- .../templates/extra-list.yaml | 0 postgresql/templates/primary/configmap.yaml | 26 + .../primary}/extended-configmap.yaml | 8 +- .../primary/initialization-configmap.yaml | 8 +- .../templates/primary}/metrics-configmap.yaml | 2 +- .../templates/primary/metrics-svc.yaml | 26 +- .../templates/primary}/networkpolicy.yaml | 52 +- .../templates/primary/pdb.yaml | 27 +- .../primary/preinitialization-configmap.yaml | 17 + .../templates/primary}/servicemonitor.yaml | 29 +- postgresql/templates/primary/statefulset.yaml | 705 +++++ .../templates/primary/svc-headless.yaml | 31 + postgresql/templates/primary/svc.yaml | 58 + postgresql/templates/prometheusrule.yaml | 22 + .../templates/psp.yaml | 4 +- .../templates/read/extended-configmap.yaml | 20 + .../templates/read/metrics-configmap.yaml | 11 +- postgresql/templates/read/metrics-svc.yaml | 31 + .../templates/read}/networkpolicy.yaml | 46 +- .../templates/read}/pdb.yaml | 25 +- postgresql/templates/read/servicemonitor.yaml | 46 + postgresql/templates/read/statefulset.yaml | 588 ++++ postgresql/templates/read/svc-headless.yaml | 33 + postgresql/templates/read/svc.yaml | 60 + .../templates/role.yaml | 15 +- .../templates/rolebinding.yaml | 8 +- postgresql/templates/secrets.yaml | 120 + .../templates/serviceaccount.yaml | 6 +- .../templates/tls-secrets.yaml | 15 +- postgresql/templates/update-password/job.yaml | 235 ++ .../templates/update-password/new-secret.yaml | 32 + .../update-password/previous-secret.yaml | 32 + postgresql/values.schema.json | 156 + postgresql/values.yaml | 1970 +++++++++++++ 90 files changed, 8752 insertions(+), 8983 deletions(-) delete mode 100644 postgresql-ha/Chart.lock delete mode 100644 postgresql-ha/Chart.yaml delete mode 100644 postgresql-ha/README.md delete mode 100644 postgresql-ha/charts/common/.helmignore delete mode 100644 postgresql-ha/charts/common/Chart.yaml delete mode 100644 postgresql-ha/charts/common/README.md delete mode 100644 postgresql-ha/charts/common/templates/_affinities.tpl delete mode 100644 postgresql-ha/charts/common/templates/_capabilities.tpl delete mode 100644 postgresql-ha/charts/common/templates/_compatibility.tpl delete mode 100644 postgresql-ha/charts/common/templates/_errors.tpl delete mode 100644 postgresql-ha/charts/common/templates/_images.tpl delete mode 100644 postgresql-ha/charts/common/templates/_ingress.tpl delete mode 100644 postgresql-ha/charts/common/templates/_labels.tpl delete mode 100644 postgresql-ha/charts/common/templates/_names.tpl delete mode 100644 postgresql-ha/charts/common/templates/_resources.tpl delete mode 100644 postgresql-ha/charts/common/templates/_secrets.tpl delete mode 100644 postgresql-ha/charts/common/templates/_storage.tpl delete mode 100644 postgresql-ha/charts/common/templates/_tplvalues.tpl delete mode 100644 postgresql-ha/charts/common/templates/_utils.tpl delete mode 100644 postgresql-ha/charts/common/templates/_warnings.tpl delete mode 100644 postgresql-ha/charts/common/templates/validations/_cassandra.tpl delete mode 100644 postgresql-ha/charts/common/templates/validations/_mariadb.tpl delete mode 100644 postgresql-ha/charts/common/templates/validations/_mongodb.tpl delete mode 100644 postgresql-ha/charts/common/templates/validations/_mysql.tpl delete mode 100644 postgresql-ha/charts/common/templates/validations/_postgresql.tpl delete mode 100644 postgresql-ha/charts/common/templates/validations/_redis.tpl delete mode 100644 postgresql-ha/charts/common/templates/validations/_validations.tpl delete mode 100644 postgresql-ha/charts/common/values.yaml delete mode 100644 postgresql-ha/templates/NOTES.txt delete mode 100644 postgresql-ha/templates/_helpers.tpl delete mode 100644 postgresql-ha/templates/pgpool/configmap.yaml delete mode 100644 postgresql-ha/templates/pgpool/custom-users-secrets.yaml delete mode 100644 postgresql-ha/templates/pgpool/deployment.yaml delete mode 100644 postgresql-ha/templates/pgpool/initdb-scripts-configmap.yaml delete mode 100644 postgresql-ha/templates/pgpool/secrets.yaml delete mode 100644 postgresql-ha/templates/pgpool/service.yaml delete mode 100644 postgresql-ha/templates/postgresql/configmap.yaml delete mode 100644 postgresql-ha/templates/postgresql/hooks-scripts-configmap.yaml delete mode 100644 postgresql-ha/templates/postgresql/metrics-service.yaml delete mode 100644 postgresql-ha/templates/postgresql/pdb.yaml delete mode 100644 postgresql-ha/templates/postgresql/secrets.yaml delete mode 100644 postgresql-ha/templates/postgresql/service-headless.yaml delete mode 100644 postgresql-ha/templates/postgresql/service.yaml delete mode 100644 postgresql-ha/templates/postgresql/statefulset.yaml delete mode 100644 postgresql-ha/templates/postgresql/witness-statefulset.yaml delete mode 100644 postgresql-ha/values.yaml rename {postgresql-ha => postgresql}/.helmignore (100%) create mode 100644 postgresql/CHANGELOG.md create mode 100644 postgresql/Chart.lock create mode 100644 postgresql/Chart.yaml create mode 100644 postgresql/README.md create mode 100644 postgresql/templates/NOTES.txt create mode 100644 postgresql/templates/_helpers.tpl rename {postgresql-ha => postgresql}/templates/backup/cronjob.yaml (54%) create mode 100644 postgresql/templates/backup/networkpolicy.yaml rename {postgresql-ha => postgresql}/templates/backup/pvc.yaml (84%) rename {postgresql-ha => postgresql}/templates/extra-list.yaml (100%) create mode 100644 postgresql/templates/primary/configmap.yaml rename {postgresql-ha/templates/postgresql => postgresql/templates/primary}/extended-configmap.yaml (75%) rename postgresql-ha/templates/postgresql/initdb-scripts-configmap.yaml => postgresql/templates/primary/initialization-configmap.yaml (60%) rename {postgresql-ha/templates => postgresql/templates/primary}/metrics-configmap.yaml (89%) rename postgresql-ha/templates/postgresql/service-witness.yaml => postgresql/templates/primary/metrics-svc.yaml (50%) rename {postgresql-ha/templates/pgpool => postgresql/templates/primary}/networkpolicy.yaml (52%) rename postgresql-ha/templates/postgresql/witness-pdb.yaml => postgresql/templates/primary/pdb.yaml (50%) create mode 100644 postgresql/templates/primary/preinitialization-configmap.yaml rename {postgresql-ha/templates/postgresql => postgresql/templates/primary}/servicemonitor.yaml (70%) create mode 100644 postgresql/templates/primary/statefulset.yaml create mode 100644 postgresql/templates/primary/svc-headless.yaml create mode 100644 postgresql/templates/primary/svc.yaml create mode 100644 postgresql/templates/prometheusrule.yaml rename postgresql-ha/templates/podsecuritypolicy.yaml => postgresql/templates/psp.yaml (92%) create mode 100644 postgresql/templates/read/extended-configmap.yaml rename postgresql-ha/templates/ldap-secrets.yaml => postgresql/templates/read/metrics-configmap.yaml (62%) create mode 100644 postgresql/templates/read/metrics-svc.yaml rename {postgresql-ha/templates/postgresql => postgresql/templates/read}/networkpolicy.yaml (57%) rename {postgresql-ha/templates/pgpool => postgresql/templates/read}/pdb.yaml (53%) create mode 100644 postgresql/templates/read/servicemonitor.yaml create mode 100644 postgresql/templates/read/statefulset.yaml create mode 100644 postgresql/templates/read/svc-headless.yaml create mode 100644 postgresql/templates/read/svc.yaml rename {postgresql-ha => postgresql}/templates/role.yaml (74%) rename {postgresql-ha => postgresql}/templates/rolebinding.yaml (74%) create mode 100644 postgresql/templates/secrets.yaml rename {postgresql-ha => postgresql}/templates/serviceaccount.yaml (87%) rename {postgresql-ha => postgresql}/templates/tls-secrets.yaml (51%) create mode 100644 postgresql/templates/update-password/job.yaml create mode 100644 postgresql/templates/update-password/new-secret.yaml create mode 100644 postgresql/templates/update-password/previous-secret.yaml create mode 100644 postgresql/values.schema.json create mode 100644 postgresql/values.yaml diff --git a/postgresql-ha/Chart.lock b/postgresql-ha/Chart.lock deleted file mode 100644 index 7d12824..0000000 --- a/postgresql-ha/Chart.lock +++ /dev/null @@ -1,6 +0,0 @@ -dependencies: -- name: common - repository: oci://registry-1.docker.io/bitnamicharts - version: 2.19.3 -digest: sha256:de997835d9ce9a9deefc2d70d8c62b11aa1d1a76ece9e86a83736ab9f930bf4d -generated: "2024-05-20T18:36:28.694168074Z" diff --git a/postgresql-ha/Chart.yaml b/postgresql-ha/Chart.yaml deleted file mode 100644 index d064d50..0000000 --- a/postgresql-ha/Chart.yaml +++ /dev/null @@ -1,42 +0,0 @@ -annotations: - category: Database - images: | - - name: os-shell - image: docker.io/bitnami/os-shell:12-debian-12-r22 - - name: pgpool - image: docker.io/bitnami/pgpool:4.5.2-debian-12-r0 - - name: postgres-exporter - image: docker.io/bitnami/postgres-exporter:0.15.0-debian-12-r32 - - name: postgresql-repmgr - image: docker.io/bitnami/postgresql-repmgr:16.3.0-debian-12-r9 - licenses: Apache-2.0 -apiVersion: v2 -appVersion: 16.3.0 -dependencies: -- name: common - repository: oci://registry-1.docker.io/bitnamicharts - tags: - - bitnami-common - version: 2.x.x -description: This PostgreSQL cluster solution includes the PostgreSQL replication - manager, an open-source tool for managing replication and failover on PostgreSQL - clusters. -home: https://bitnami.com -icon: https://bitnami.com/assets/stacks/postgresql/img/postgresql-stack-220x234.png -keywords: -- postgresql -- repmgr -- pgpool -- postgres -- database -- sql -- replication -- cluster -- high availability -maintainers: -- name: Broadcom, Inc. All Rights Reserved. - url: https://github.com/bitnami/charts -name: postgresql-ha -sources: -- https://github.com/bitnami/charts/tree/main/bitnami/postgresql-ha -version: 14.2.0 diff --git a/postgresql-ha/README.md b/postgresql-ha/README.md deleted file mode 100644 index 8b9e844..0000000 --- a/postgresql-ha/README.md +++ /dev/null @@ -1,1224 +0,0 @@ - - -# Bitnami package for PostgreSQL HA - -This PostgreSQL cluster solution includes the PostgreSQL replication manager, an open-source tool for managing replication and failover on PostgreSQL clusters. - -[Overview of PostgreSQL HA](https://www.postgresql.org/) - -Trademarks: This software listing is packaged by Bitnami. The respective trademarks mentioned in the offering are owned by the respective companies, and use of them does not imply any affiliation or endorsement. - -## TL;DR - -```console -helm install my-release oci://registry-1.docker.io/bitnamicharts/postgresql-ha -``` - -Looking to use PostgreSQL HA in production? Try [VMware Tanzu Application Catalog](https://bitnami.com/enterprise), the enterprise edition of Bitnami Application Catalog. - -## Introduction - -This [Helm](https://github.com/kubernetes/helm) chart installs [PostgreSQL](https://www.postgresql.org/) with HA architecture in a Kubernetes cluster. Welcome to [contribute](https://github.com/bitnami/charts/blob/main/CONTRIBUTING.md) to Helm Chart for PostgreSQL HA. - -This Helm chart has been developed based on [bitnami/postgresql](https://github.com/bitnami/charts/tree/main/bitnami/postgresql) chart but including some changes to guarantee high availability such as: - -- A new deployment, service have been added to deploy [Pgpool-II](https://pgpool.net/mediawiki/index.php/Main_Page) to act as proxy for PostgreSQL backend. It helps to reduce connection overhead, acts as a load balancer for PostgreSQL, and ensures database node failover. -- Replacing `bitnami/postgresql` with `bitnami/postgresql-repmgr` which includes and configures [repmgr](https://repmgr.org/). Repmgr ensures standby nodes assume the primary role when the primary node is unhealthy. - -Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters. - -## Differences between the PostgreSQL-HA and PostgreSQL Helm charts - -There are two different ways to deploy a PostgreSQL cluster, using the PostgreSQL Helm chart or the PostgreSQL High Availability (HA) Helm chart. Both solutions provide a simply and reliable way to run PostgreSQL in a production environment. Keep reading to discover the differences between them and check which one better suits your needs. - -- Both the PostgreSQL HA and the PostgreSQL chart configures a cluster with a master-slave topology. The master node has writing permissions while replication is on the slaves nodes which have reading-only permissions. -- The PostgreSQL HA Helm chart deploys a cluster with three nodes by default, one for pgpool, and one master and one slave for PostgreSQL. The PostgreSQL chart configures a cluster with two nodes by default (one master and one slave). -- The PostgreSQL HA Helm chart uses pgpool to handle the connection to the nodes. pgpool is resposible to spread the queries among nodes. -- The PostgreSQL HA Helm chart includes a repmgr module that ensures high-availability thanks to automatic membership control. If the master is down, any of the slave nodes will be promoted as master to avoid data loss. - -The following diagram shows you the options you have for using Bitnami's PostgreSQL solutions in your deployments: - -![A diagram comparing a PostgreSQL solution versus a PostgreSQL HA with pgpool and repmgr](img/postgresql-ha-topology.png) - -## Prerequisites - -- Kubernetes 1.23+ -- Helm 3.8.0+ - -## Installing the Chart - -To install the chart with the release name `my-release`: - -```console -helm install my-release oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql-ha -``` - -> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. - -## Configuration and installation details - -### Resource requests and limits - -Bitnami charts allow setting resource requests and limits for all containers inside the chart deployment. These are inside the `resources` value (check parameter table). Setting requests is essential for production workloads and these should be adapted to your specific use case. - -To make this process easier, the chart contains the `resourcesPreset` values, which automatically sets the `resources` section according to different presets. Check these presets in [the bitnami/common chart](https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15). However, in production workloads using `resourcePreset` is discouraged as it may not fully adapt to your specific needs. Find more information on container resource management in the [official Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/). - -### [Rolling VS Immutable tags](https://docs.vmware.com/en/VMware-Tanzu-Application-Catalog/services/tutorials/GUID-understand-rolling-tags-containers-index.html) - -It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. - -Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. - -### Use a different PostgreSQL version - -To modify the application version used in this chart, specify a different version of the image using the `image.tag` parameter and/or a different repository using the `image.repository` parameter. - -### Use a volume for /dev/shm - -When working with huge databeses, `/dev/shm` can run out of space. A way to fix this is to use the `postgresql.extraVolumes` and `postgresql.extraVolumeMounts` values. In the example below, we set an `emptyDir` volume with 512Mb: - -```yaml -postgresql: - extraVolumes: - - name: dshm - emptyDir: - medium: Memory - sizeLimit: 512Mi - extraVolumeMounts: - - name: dshm - mountPath: /dev/shm -``` - -### Configure the way how to expose PostgreSQL - -- **ClusterIP**: Exposes the service on a cluster-internal IP. Choosing this value makes the service only reachable from within the cluster. Set `service.type=ClusterIP` to choose this service type. -- **NodePort**: Exposes the service on each Node's IP at a static port (the NodePort). You will be able to contact the NodePort service, from outside the cluster, by requesting `NodeIP:NodePort`. Set `service.type=NodePort` to choose this service type. -- **LoadBalancer**: Exposes the service externally using a cloud provider's load balancer. Set `service.type=LoadBalancer` to choose this service type. - -### Adjust permissions of persistent volume mountpoint - -As the images run as non-root by default, it is necessary to adjust the ownership of the persistent volumes so that the containers can write data into it. - -By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. -As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. - -You can enable this initContainer by setting `volumePermissions.enabled` to `true`. - -### LDAP - -LDAP support can be enabled in the chart by specifying the `ldap.` parameters while creating a release. The following parameters should be configured to properly enable the LDAP support in the chart. - -- **ldap.enabled**: Enable LDAP support. Defaults to `false`. -- **ldap.uri**: LDAP URL beginning in the form `ldap[s]://:`. No defaults. -- **ldap.base**: LDAP base DN. No defaults. -- **ldap.binddn**: LDAP bind DN. No defaults. -- **ldap.bindpw**: LDAP bind password. No defaults. -- **ldap.bslookup**: LDAP base lookup. No defaults. -- **ldap.nss_initgroups_ignoreusers**: LDAP ignored users. `root,nslcd`. -- **ldap.scope**: LDAP search scope. No defaults. -- **ldap.tls_reqcert**: LDAP TLS check on server certificates. No defaults. - -For example: - -```text -ldap.enabled="true" -ldap.uri="ldap://my_ldap_server" -ldap.base="dc=example\,dc=org" -ldap.binddn="cn=admin\,dc=example\,dc=org" -ldap.bindpw="admin" -ldap.bslookup="ou=group-ok\,dc=example\,dc=org" -ldap.nss_initgroups_ignoreusers="root\,nslcd" -ldap.scope="sub" -ldap.tls_reqcert="demand" -``` - -Next, login to the PostgreSQL server using the `psql` client and add the PAM authenticated LDAP users. - -> Note: Parameters including commas must be escaped as shown in the above example. - -### Securing traffic using TLS - -The chart handles two main flows of traffic information: - -- Connections between end-clients and PgPool (sometimes referred to as *frontend* connections). -- Internal connections between PgPool and PostgreSQL nodes (sometimes referred to as *backend* connections). - -The Bitnami postgresql-ha chart allows configuring the securitization of both types of traffic using TLS. - -#### Encrypt traffic between clients and Pgpool (frontend) - -TLS for end-client connections can be enabled in the chart by specifying the `pgpool.tls.*` parameters when installing a release. Below you can find detailed information about these parameters: - -- `pgpool.tls.enabled`: Enable TLS support. Defaults to `false`. -- `pgpool.tls.certificatesSecret`: Name of an existing secret that contains the certificates. No defaults. -- `pgpool.tls.certFilename`: Certificate filename. No defaults. -- `pgpool.tls.certKeyFilename`: Certificate key filename. No defaults. - -For example: - -- First, create a secret with the certificates files. You will need to generate previously the certificate files: - - ```console - kubectl create secret generic pgpool-tls-secret --from-file=./cert.crt --from-file=./cert.key --from-file=./ca.crt - ``` - -> Note: Although certificate generation is out of the scope of this guide, bear in mind that PostgreSQL requires that server TLS certificates specify the actual DNS server name in the CN (Common Name) field. - -- Then, install the chart using the following parameters: - - ```console - pgpool.tls.enabled=true - pgpool.tls.certificatesSecret="pgpool-tls-secret" - pgpool.tls.certFilename="cert.crt" - pgpool.tls.certKeyFilename="cert.key" - ``` - -> Note: Certificates permissions: PgPool requires certain permissions on sensitive files (such as certificate keys) to start up. Due to an on-going [issue](https://github.com/kubernetes/kubernetes/issues/57923) regarding K8s permissions and the use of `containerSecurityContext.runAsUser`, an init container will adapt the permissions to ensure everything works as expected. - -##### Enable client certificate authentication - -When TLS is configured for *frontend* connections, the server can be configured to authenticate clients by verifying their provided TLS certificate is valid and trusted. Hence, the client will not be sent a password prompt. - -You can enable this authentication feature additionally specifying the following parameter: - -- `postgresql.tls.certCAFilename`: CA Certificate filename. No defaults. - - ```console - $ psql --host postgresql-ha-pgpool -d "dbname=XXXXX user=YYYYYY sslcert=client.crt sslkey=client.key sslmode=require" - psql (14.4) - SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off) - Type "help" for help. - - postgres=> - ``` - -Clients using this method to authenticate will be required to provide a certificate with the CN (Common Name) field matching the requested database user name. Please, refer to [the official documentation](https://www.postgresql.org/docs/current/auth-cert.html) for further information. - -> Note: As with traditional password-based authentication, database users must exist in both PgPool and PostgreSQL nodes and have the correct privileges to connect to a database. You may use the `postgresql.initdbScripts` and `pgpool.customUsers` properties to create them in advance. - -#### Encrypt traffic between Pgpool and PostgreSQL nodes (backend) - -TLS for backend connections can be enabled in the chart by specifying the `postgresql.tls.*` parameters while creating a release. Below you can find detailed information about these parameters: - -- `postgresql.tls.enabled`: Enable TLS support. Defaults to `false` -- `postgresql.tls.certificatesSecret`: Name of an existing secret that contains the certificates. No defaults. -- `postgresql.tls.certFilename`: Certificate filename. No defaults. -- `postgresql.tls.certKeyFilename`: Certificate key filename. No defaults. - -For example: - -- First, create a secret with the certificates files. You will need to generate previously the certificate files: - - ```console - kubectl create secret generic postgresql-tls-secret --from-file=./cert.crt --from-file=./cert.key --from-file=./ca.crt - ``` - -- Then, install the chart using the following parameters: - - ```console - postgresql.tls.enabled=true - postgresql.tls.certificatesSecret="postgresql-tls-secret" - postgresql.tls.certFilename="cert.crt" - postgresql.tls.certKeyFilename="cert.key" - ``` - -> Note: Certificates permissions: PostgreSQL requires certain permissions on sensitive files (such as certificate keys) to start up. Due to an on-going [issue](https://github.com/kubernetes/kubernetes/issues/57923) regarding K8s permissions and the use of `containerSecurityContext.runAsUser`, an init container will adapt the permissions to ensure everything works as expected. - -If you want to encrypt both *frontend* and *backend* traffics, you may use the same secret for Pgpool and PostgreSQL TLS configuration. - -### repmgr.conf / postgresql.conf / pg_hba.conf / pgpool.conf files as configMap - -This helm chart also supports to customize the whole configuration file. - -You can specify the Pgpool, PostgreSQL and Repmgr configuration using the `pgpool.configuration`, `postgresql.configuration`, `postgresql.pgHbaConfiguration`, and `postgresql.repmgrConfiguration` parameters. The corresponding files will be mounted as ConfigMap to the containers and it will be used for configuring Pgpool, Repmgr and the PostgreSQL server. - -In addition to this option, you can also set an external ConfigMap(s) with all the configuration files. This is done by setting the `postgresql.configurationCM` and `pgpool.configurationCM` parameters. Note that this will override the previous options. - -### Allow settings to be loaded from files other than the default `postgresql.conf` - -If you don't want to provide the whole PostgreSQL configuration file and only specify certain parameters, you can specify the extended configuration using the `postgresql.extendedConf` parameter. A file will be mounted as configMap to the containers adding/overwriting the default configuration using the `include_dir` directive that allows settings to be loaded from files other than the default `postgresql.conf`. - -In addition to this option, you can also set an external ConfigMap with all the extra configuration files. This is done by setting the `postgresql.extendedConfCM` parameter. Note that this will override the previous option. - -### Initialize a fresh instance - -The [Bitnami PostgreSQL with Repmgr](https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr) image allows you to use your custom scripts to initialize a fresh instance. You can specify custom scripts using the `initdbScripts` parameter as dict so they can be consumed as a ConfigMap. - -In addition to this option, you can also set an external ConfigMap with all the initialization scripts. This is done by setting the `initdbScriptsCM` parameter. Note that this will override the two previous options. If your initialization scripts contain sensitive information such as credentials or passwords, you can use the `initdbScriptsSecret` parameter. - -The above parameters (`initdbScripts`, `initdbScriptsCM`, and `initdbScriptsSecret`) are supported in both StatefulSet by prepending `postgresql` or `pgpool` to the parameter, depending on the use case (see above parameters table). - -The allowed extensions are `.sh`, `.sql` and `.sql.gz` in the **postgresql** container while only `.sh` in the case of the **pgpool** one. - -+info: and - -### Use of global variables - -In more complex scenarios, we may have the following tree of dependencies - -```text - +--------------+ - | | - +------------+ Chart 1 +-----------+ - | | | | - | --------+------+ | - | | | - | | | - | | | - | | | - v v v -+-------+------+ +--------+------+ +--------+------+ -| | | | | | -| PostgreSQL HA | | Sub-chart 1 | | Sub-chart 2 | -|---------------|--|-------------|--|-------------| -+--------------+ +---------------+ +---------------+ -``` - -The three charts below depend on the parent chart Chart 1. However, subcharts 1 and 2 may need to connect to PostgreSQL HA as well. In order to do so, subcharts 1 and 2 need to know the PostgreSQL HA credentials, so one option for deploying could be deploy Chart 1 with the following parameters: - -```text -postgresql.postgresqlPassword=testtest -subchart1.postgresql.postgresqlPassword=testtest -subchart2.postgresql.postgresqlPassword=testtest -postgresql.postgresqlDatabase=db1 -subchart1.postgresql.postgresqlDatabase=db1 -subchart2.postgresql.postgresqlDatabase=db1 -``` - -If the number of dependent sub-charts increases, installing the chart with parameters can become increasingly difficult. An alternative would be to set the credentials using global variables as follows: - -```text -global.postgresql.postgresqlPassword=testtest -global.postgresql.postgresqlDatabase=db1 -``` - -This way, the credentials will be available in all of the subcharts. - -### Setting Pod's affinity - -This chart allows you to set your custom affinity using the `XXX.affinity` paremeter(s). Find more information about Pod's affinity in the [kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity). - -As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/main/bitnami/common#affinities) chart. To do so, set the `XXX.podAffinityPreset`, `XXX.podAntiAffinityPreset`, or `XXX.nodeAffinityPreset` parameters. - -## Persistence - -The data is persisted by default using PVC templates in the PostgreSQL statefulset. You can disable the persistence setting the `persistence.enabled` parameter to `false`. -A default `StorageClass` is needed in the Kubernetes cluster to dynamically provision the volumes. Specify another StorageClass in the `persistence.storageClass` or set `persistence.existingClaim` if you have already existing persistent volumes to use. - -## Parameters - -### Global parameters - -| Name | Description | Value | -| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | -| `global.imageRegistry` | Global Docker image registry | `""` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | -| `global.storageClass` | Global StorageClass for Persistent Volume(s) | `""` | -| `global.postgresql.username` | PostgreSQL username (overrides `postgresql.username`) | `""` | -| `global.postgresql.password` | PostgreSQL password (overrides `postgresql.password`) | `""` | -| `global.postgresql.database` | PostgreSQL database (overrides `postgresql.database`) | `""` | -| `global.postgresql.repmgrUsername` | PostgreSQL repmgr username (overrides `postgresql.repmgrUsername`) | `""` | -| `global.postgresql.repmgrPassword` | PostgreSQL repmgr password (overrides `postgresql.repmgrpassword`) | `""` | -| `global.postgresql.repmgrDatabase` | PostgreSQL repmgr database (overrides `postgresql.repmgrDatabase`) | `""` | -| `global.postgresql.existingSecret` | Name of existing secret to use for PostgreSQL passwords (overrides `postgresql.existingSecret`) | `""` | -| `global.ldap.bindpw` | LDAP bind password (overrides `ldap.bindpw`) | `""` | -| `global.ldap.existingSecret` | Name of existing secret to use for LDAP passwords (overrides `ldap.existingSecret`) | `""` | -| `global.pgpool.adminUsername` | Pgpool Admin username (overrides `pgpool.adminUsername`) | `""` | -| `global.pgpool.adminPassword` | Pgpool Admin password (overrides `pgpool.adminPassword`) | `""` | -| `global.pgpool.existingSecret` | Pgpool existing secret | `""` | -| `global.compatibility.openshift.adaptSecurityContext` | Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) | `auto` | - -### Common parameters - -| Name | Description | Value | -| ------------------------ | --------------------------------------------------------------------------------------------------- | --------------- | -| `kubeVersion` | Override Kubernetes version | `""` | -| `nameOverride` | String to partially override common.names.fullname template (will maintain the release name) | `""` | -| `fullnameOverride` | String to fully override common.names.fullname template | `""` | -| `namespaceOverride` | String to fully override common.names.namespace | `""` | -| `commonLabels` | Common labels to add to all resources (sub-charts are not considered). Evaluated as a template | `{}` | -| `commonAnnotations` | Common annotations to add to all resources (sub-charts are not considered). Evaluated as a template | `{}` | -| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` | -| `extraDeploy` | Array of extra objects to deploy with the release (evaluated as a template) | `[]` | -| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | -| `diagnosticMode.command` | Command to override all containers in the deployment | `[]` | -| `diagnosticMode.args` | Args to override all containers in the deployment | `[]` | - -### PostgreSQL with Repmgr parameters - -| Name | Description | Value | -| -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- | -| `postgresql.image.registry` | PostgreSQL with Repmgr image registry | `REGISTRY_NAME` | -| `postgresql.image.repository` | PostgreSQL with Repmgr image repository | `REPOSITORY_NAME/postgresql-repmgr` | -| `postgresql.image.digest` | PostgreSQL image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | -| `postgresql.image.pullPolicy` | PostgreSQL with Repmgr image pull policy | `IfNotPresent` | -| `postgresql.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `postgresql.image.debug` | Specify if debug logs should be enabled | `false` | -| `postgresql.labels` | Labels to add to the StatefulSet. Evaluated as template | `{}` | -| `postgresql.podLabels` | Labels to add to the StatefulSet pods. Evaluated as template | `{}` | -| `postgresql.serviceAnnotations` | Provide any additional annotations for PostgreSQL service | `{}` | -| `postgresql.replicaCount` | Number of replicas to deploy. Use an odd number. Having 3 replicas is the minimum to get quorum when promoting a new primary. | `3` | -| `postgresql.updateStrategy.type` | Postgresql statefulset strategy type | `RollingUpdate` | -| `postgresql.containerPorts.postgresql` | PostgreSQL port | `5432` | -| `postgresql.automountServiceAccountToken` | Mount Service Account token in pod | `false` | -| `postgresql.hostAliases` | Deployment pod host aliases | `[]` | -| `postgresql.hostNetwork` | Specify if host network should be enabled for PostgreSQL pod | `false` | -| `postgresql.hostIPC` | Specify if host IPC should be enabled for PostgreSQL pod | `false` | -| `postgresql.podAnnotations` | Additional pod annotations | `{}` | -| `postgresql.podAffinityPreset` | PostgreSQL pod affinity preset. Ignored if `postgresql.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `postgresql.podAntiAffinityPreset` | PostgreSQL pod anti-affinity preset. Ignored if `postgresql.affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `postgresql.nodeAffinityPreset.type` | PostgreSQL node affinity preset type. Ignored if `postgresql.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `postgresql.nodeAffinityPreset.key` | PostgreSQL node label key to match Ignored if `postgresql.affinity` is set. | `""` | -| `postgresql.nodeAffinityPreset.values` | PostgreSQL node label values to match. Ignored if `postgresql.affinity` is set. | `[]` | -| `postgresql.affinity` | Affinity for PostgreSQL pods assignment | `{}` | -| `postgresql.nodeSelector` | Node labels for PostgreSQL pods assignment | `{}` | -| `postgresql.tolerations` | Tolerations for PostgreSQL pods assignment | `[]` | -| `postgresql.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `[]` | -| `postgresql.priorityClassName` | Pod priority class | `""` | -| `postgresql.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | -| `postgresql.terminationGracePeriodSeconds` | Seconds PostgreSQL pod needs to terminate gracefully | `""` | -| `postgresql.podSecurityContext.enabled` | Enable security context for PostgreSQL with Repmgr | `true` | -| `postgresql.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | -| `postgresql.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | -| `postgresql.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | -| `postgresql.podSecurityContext.fsGroup` | Group ID for the PostgreSQL with Repmgr filesystem | `1001` | -| `postgresql.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | -| `postgresql.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` | -| `postgresql.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | -| `postgresql.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | -| `postgresql.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | -| `postgresql.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | -| `postgresql.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | -| `postgresql.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | -| `postgresql.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | -| `postgresql.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | -| `postgresql.command` | Override default container command (useful when using custom images) | `[]` | -| `postgresql.args` | Override default container args (useful when using custom images) | `[]` | -| `postgresql.lifecycleHooks` | LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template | `{}` | -| `postgresql.extraEnvVars` | Array containing extra environment variables | `[]` | -| `postgresql.extraEnvVarsCM` | ConfigMap with extra environment variables | `""` | -| `postgresql.extraEnvVarsSecret` | Secret with extra environment variables | `""` | -| `postgresql.extraVolumes` | Extra volumes to add to the deployment | `[]` | -| `postgresql.extraVolumeMounts` | Extra volume mounts to add to the container. Normally used with `extraVolumes`. | `[]` | -| `postgresql.initContainers` | Extra init containers to add to the deployment | `[]` | -| `postgresql.sidecars` | Extra sidecar containers to add to the deployment | `[]` | -| `postgresql.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if postgresql.resources is set (postgresql.resources is recommended for production). | `micro` | -| `postgresql.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | -| `postgresql.podManagementPolicy` | sets the pod management policy | `Parallel` | -| `postgresql.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `postgresql.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | -| `postgresql.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `postgresql.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `postgresql.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | -| `postgresql.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `postgresql.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `postgresql.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | -| `postgresql.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `postgresql.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | -| `postgresql.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | -| `postgresql.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `postgresql.startupProbe.enabled` | Enable startupProbe | `false` | -| `postgresql.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | -| `postgresql.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | -| `postgresql.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | -| `postgresql.startupProbe.failureThreshold` | Failure threshold for startupProbe | `10` | -| `postgresql.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | -| `postgresql.customLivenessProbe` | Override default liveness probe | `{}` | -| `postgresql.customReadinessProbe` | Override default readiness probe | `{}` | -| `postgresql.customStartupProbe` | Override default startup probe | `{}` | -| `postgresql.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | -| `postgresql.networkPolicy.allowExternal` | Don't require server label for connections | `true` | -| `postgresql.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | -| `postgresql.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | -| `postgresql.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` | -| `postgresql.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` | -| `postgresql.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` | -| `postgresql.pdb.create` | Specifies whether to create a Pod disruption budget for PostgreSQL with Repmgr | `true` | -| `postgresql.pdb.minAvailable` | Minimum number / percentage of pods that should remain scheduled | `""` | -| `postgresql.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `postgresql.pdb.minAvailable` and `postgresql.pdb.maxUnavailable` are empty. | `""` | -| `postgresql.username` | PostgreSQL username | `postgres` | -| `postgresql.password` | PostgreSQL password | `""` | -| `postgresql.database` | PostgreSQL database | `""` | -| `postgresql.existingSecret` | PostgreSQL password using existing secret | `""` | -| `postgresql.postgresPassword` | PostgreSQL password for the `postgres` user when `username` is not `postgres` | `""` | -| `postgresql.usePasswordFile` | Set to `true` to mount PostgreSQL secret as a file instead of passing environment variable | `""` | -| `postgresql.repmgrUsePassfile` | Set to `true` to configure repmgrl to use `passfile` instead of `password` vars*:*:*:username:password" and use it to configure Repmgr instead of using password (Requires Postgresql 10+, otherwise ignored) | `""` | -| `postgresql.repmgrPassfilePath` | Custom path where `passfile` will be stored | `""` | -| `postgresql.upgradeRepmgrExtension` | Upgrade repmgr extension in the database | `false` | -| `postgresql.pgHbaTrustAll` | Configures PostgreSQL HBA to trust every user | `false` | -| `postgresql.syncReplication` | Make the replication synchronous. This will wait until the data is synchronized in all the replicas before other query can be run. This ensures the data availability at the expenses of speed. | `false` | -| `postgresql.syncReplicationMode` | This specifies the method to choose synchronous standbys from the listed servers. Valid values: empty, FIRST, ANY. | `""` | -| `postgresql.repmgrUsername` | PostgreSQL Repmgr username | `repmgr` | -| `postgresql.repmgrPassword` | PostgreSQL Repmgr password | `""` | -| `postgresql.repmgrDatabase` | PostgreSQL Repmgr database | `repmgr` | -| `postgresql.repmgrLogLevel` | Repmgr log level (DEBUG, INFO, NOTICE, WARNING, ERROR, ALERT, CRIT or EMERG) | `NOTICE` | -| `postgresql.repmgrConnectTimeout` | Repmgr backend connection timeout (in seconds) | `5` | -| `postgresql.repmgrReconnectAttempts` | Repmgr backend reconnection attempts | `2` | -| `postgresql.repmgrReconnectInterval` | Repmgr backend reconnection interval (in seconds) | `3` | -| `postgresql.repmgrFenceOldPrimary` | Set if fencing of old primary in multiple primary situation is desired | `false` | -| `postgresql.repmgrChildNodesCheckInterval` | Repmgr child nodes check interval (in seconds) | `5` | -| `postgresql.repmgrChildNodesConnectedMinCount` | Repmgr minimum number of connected child nodes before being considered as failed primary for fencing | `1` | -| `postgresql.repmgrChildNodesDisconnectTimeout` | Repmgr time before node will be fenced when insufficient child nodes are detected (in seconds) | `30` | -| `postgresql.usePgRewind` | Use pg_rewind for standby failover (experimental) | `false` | -| `postgresql.audit.logHostname` | Add client hostnames to the log file | `true` | -| `postgresql.audit.logConnections` | Add client log-in operations to the log file | `false` | -| `postgresql.audit.logDisconnections` | Add client log-outs operations to the log file | `false` | -| `postgresql.audit.pgAuditLog` | Add operations to log using the pgAudit extension | `""` | -| `postgresql.audit.pgAuditLogCatalog` | Log catalog using pgAudit | `off` | -| `postgresql.audit.clientMinMessages` | Message log level to share with the user | `error` | -| `postgresql.audit.logLinePrefix` | Template string for the log line prefix | `""` | -| `postgresql.audit.logTimezone` | Timezone for the log timestamps | `""` | -| `postgresql.sharedPreloadLibraries` | Shared preload libraries (comma-separated list) | `pgaudit, repmgr` | -| `postgresql.maxConnections` | Maximum total connections | `""` | -| `postgresql.postgresConnectionLimit` | Maximum connections for the postgres user | `""` | -| `postgresql.dbUserConnectionLimit` | Maximum connections for the created user | `""` | -| `postgresql.tcpKeepalivesInterval` | TCP keepalives interval | `""` | -| `postgresql.tcpKeepalivesIdle` | TCP keepalives idle | `""` | -| `postgresql.tcpKeepalivesCount` | TCP keepalives count | `""` | -| `postgresql.statementTimeout` | Statement timeout | `""` | -| `postgresql.pghbaRemoveFilters` | Comma-separated list of patterns to remove from the pg_hba.conf file | `""` | -| `postgresql.extraInitContainers` | Extra init containers | `[]` | -| `postgresql.repmgrConfiguration` | Repmgr configuration | `""` | -| `postgresql.configuration` | PostgreSQL configuration | `""` | -| `postgresql.pgHbaConfiguration` | PostgreSQL client authentication configuration | `""` | -| `postgresql.configurationCM` | Name of existing ConfigMap with configuration files | `""` | -| `postgresql.extendedConf` | Extended PostgreSQL configuration (appended to main or default configuration). Implies `volumePermissions.enabled`. | `""` | -| `postgresql.extendedConfCM` | ConfigMap with PostgreSQL extended configuration | `""` | -| `postgresql.initdbScripts` | Dictionary of initdb scripts | `{}` | -| `postgresql.initdbScriptsCM` | ConfigMap with scripts to be run at first boot | `""` | -| `postgresql.initdbScriptsSecret` | Secret with scripts to be run at first boot | `""` | -| `postgresql.tls.enabled` | Enable TLS traffic support for end-client connections | `false` | -| `postgresql.tls.preferServerCiphers` | Whether to use the server's TLS cipher preferences rather than the client's | `true` | -| `postgresql.tls.certificatesSecret` | Name of an existing secret that contains the certificates | `""` | -| `postgresql.tls.certFilename` | Certificate filename | `""` | -| `postgresql.tls.certKeyFilename` | Certificate key filename | `""` | -| `postgresql.preStopDelayAfterPgStopSeconds` | Minimal number of seconds preStop hook waits after postgres instance is stopped | `25` | -| `postgresql.headlessWithNotReadyAddresses` | set postgres headless service into publishNotReadyAddresses mode | `false` | -| `witness.create` | Create PostgreSQL witness nodes | `false` | -| `witness.labels` | Labels to add to the StatefulSet. Evaluated as template | `{}` | -| `witness.podLabels` | Labels to add to the StatefulSet pods. Evaluated as template | `{}` | -| `witness.replicaCount` | Number of replicas to deploy. | `1` | -| `witness.updateStrategy.type` | Postgresql statefulset strategy type | `RollingUpdate` | -| `witness.containerPorts.postgresql` | PostgreSQL witness port | `5432` | -| `witness.automountServiceAccountToken` | Mount Service Account token in pod | `false` | -| `witness.hostAliases` | Deployment pod host aliases | `[]` | -| `witness.hostNetwork` | Specify if host network should be enabled for PostgreSQL witness pod | `false` | -| `witness.hostIPC` | Specify if host IPC should be enabled for PostgreSQL witness pod | `false` | -| `witness.podAnnotations` | Additional pod annotations | `{}` | -| `witness.podAffinityPreset` | PostgreSQL witness pod affinity preset. Ignored if `witness.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `witness.podAntiAffinityPreset` | PostgreSQL witness pod anti-affinity preset. Ignored if `witness.affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `witness.nodeAffinityPreset.type` | PostgreSQL witness node affinity preset type. Ignored if `witness.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `witness.nodeAffinityPreset.key` | PostgreSQL witness node label key to match Ignored if `witness.affinity` is set. | `""` | -| `witness.nodeAffinityPreset.values` | PostgreSQL witness node label values to match. Ignored if `witness.affinity` is set. | `[]` | -| `witness.affinity` | Affinity for PostgreSQL witness pods assignment | `{}` | -| `witness.nodeSelector` | Node labels for PostgreSQL witness pods assignment | `{}` | -| `witness.tolerations` | Tolerations for PostgreSQL witness pods assignment | `[]` | -| `witness.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `[]` | -| `witness.priorityClassName` | Pod priority class | `""` | -| `witness.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | -| `witness.terminationGracePeriodSeconds` | Seconds PostgreSQL witness pod needs to terminate gracefully | `""` | -| `witness.podSecurityContext.enabled` | Enable security context for PostgreSQL witness with Repmgr | `true` | -| `witness.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | -| `witness.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | -| `witness.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | -| `witness.podSecurityContext.fsGroup` | Group ID for the PostgreSQL witness with Repmgr filesystem | `1001` | -| `witness.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | -| `witness.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` | -| `witness.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | -| `witness.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | -| `witness.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | -| `witness.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | -| `witness.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | -| `witness.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | -| `witness.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | -| `witness.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | -| `witness.command` | Override default container command (useful when using custom images) | `[]` | -| `witness.args` | Override default container args (useful when using custom images) | `[]` | -| `witness.lifecycleHooks` | LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template | `{}` | -| `witness.extraEnvVars` | Array containing extra environment variables | `[]` | -| `witness.extraEnvVarsCM` | ConfigMap with extra environment variables | `""` | -| `witness.extraEnvVarsSecret` | Secret with extra environment variables | `""` | -| `witness.extraVolumes` | Extra volumes to add to the deployment | `[]` | -| `witness.extraVolumeMounts` | Extra volume mounts to add to the container. Normally used with `extraVolumes`. | `[]` | -| `witness.initContainers` | Extra init containers to add to the deployment | `[]` | -| `witness.sidecars` | Extra sidecar containers to add to the deployment | `[]` | -| `witness.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if witness.resources is set (witness.resources is recommended for production). | `micro` | -| `witness.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | -| `witness.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `witness.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | -| `witness.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `witness.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `witness.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | -| `witness.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `witness.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `witness.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | -| `witness.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `witness.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | -| `witness.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | -| `witness.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `witness.startupProbe.enabled` | Enable startupProbe | `false` | -| `witness.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | -| `witness.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | -| `witness.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | -| `witness.startupProbe.failureThreshold` | Failure threshold for startupProbe | `10` | -| `witness.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | -| `witness.customLivenessProbe` | Override default liveness probe | `{}` | -| `witness.customReadinessProbe` | Override default readiness probe | `{}` | -| `witness.customStartupProbe` | Override default startup probe | `{}` | -| `witness.pdb.create` | Specifies whether to create a Pod disruption budget for PostgreSQL witness with Repmgr | `true` | -| `witness.pdb.minAvailable` | Minimum number / percentage of pods that should remain scheduled | `""` | -| `witness.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `witness.pdb.minAvailable` and `witness.pdb.maxUnavailable` are empty. | `""` | -| `witness.upgradeRepmgrExtension` | Upgrade repmgr extension in the database | `false` | -| `witness.pgHbaTrustAll` | Configures PostgreSQL HBA to trust every user | `false` | -| `witness.repmgrLogLevel` | Repmgr log level (DEBUG, INFO, NOTICE, WARNING, ERROR, ALERT, CRIT or EMERG) | `NOTICE` | -| `witness.repmgrConnectTimeout` | Repmgr backend connection timeout (in seconds) | `5` | -| `witness.repmgrReconnectAttempts` | Repmgr backend reconnection attempts | `2` | -| `witness.repmgrReconnectInterval` | Repmgr backend reconnection interval (in seconds) | `3` | -| `witness.audit.logHostname` | Add client hostnames to the log file | `true` | -| `witness.audit.logConnections` | Add client log-in operations to the log file | `false` | -| `witness.audit.logDisconnections` | Add client log-outs operations to the log file | `false` | -| `witness.audit.pgAuditLog` | Add operations to log using the pgAudit extension | `""` | -| `witness.audit.pgAuditLogCatalog` | Log catalog using pgAudit | `off` | -| `witness.audit.clientMinMessages` | Message log level to share with the user | `error` | -| `witness.audit.logLinePrefix` | Template string for the log line prefix | `""` | -| `witness.audit.logTimezone` | Timezone for the log timestamps | `""` | -| `witness.maxConnections` | Maximum total connections | `""` | -| `witness.postgresConnectionLimit` | Maximum connections for the postgres user | `""` | -| `witness.dbUserConnectionLimit` | Maximum connections for the created user | `""` | -| `witness.tcpKeepalivesInterval` | TCP keepalives interval | `""` | -| `witness.tcpKeepalivesIdle` | TCP keepalives idle | `""` | -| `witness.tcpKeepalivesCount` | TCP keepalives count | `""` | -| `witness.statementTimeout` | Statement timeout | `""` | -| `witness.pghbaRemoveFilters` | Comma-separated list of patterns to remove from the pg_hba.conf file | `""` | -| `witness.extraInitContainers` | Extra init containers | `[]` | -| `witness.repmgrConfiguration` | Repmgr configuration | `""` | -| `witness.configuration` | PostgreSQL configuration | `""` | -| `witness.pgHbaConfiguration` | PostgreSQL client authentication configuration | `""` | -| `witness.configurationCM` | Name of existing ConfigMap with configuration files | `""` | -| `witness.extendedConf` | Extended PostgreSQL configuration (appended to main or default configuration). Implies `volumePermissions.enabled`. | `""` | -| `witness.extendedConfCM` | ConfigMap with PostgreSQL extended configuration | `""` | -| `witness.initdbScripts` | Dictionary of initdb scripts | `{}` | -| `witness.initdbScriptsCM` | ConfigMap with scripts to be run at first boot | `""` | -| `witness.initdbScriptsSecret` | Secret with scripts to be run at first boot | `""` | - -### Pgpool parameters - -| Name | Description | Value | -| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | -| `pgpool.image.registry` | Pgpool image registry | `REGISTRY_NAME` | -| `pgpool.image.repository` | Pgpool image repository | `REPOSITORY_NAME/pgpool` | -| `pgpool.image.digest` | Pgpool image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | -| `pgpool.image.pullPolicy` | Pgpool image pull policy | `IfNotPresent` | -| `pgpool.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `pgpool.image.debug` | Specify if debug logs should be enabled | `false` | -| `pgpool.customUsers.usernames` | Comma or semicolon separated list of additional users that will be performing connections to the database using pgpool. | `""` | -| `pgpool.customUsers.passwords` | Comma or semicolon separated list of the associated passwords for the users above. Must have the same number of elements as the usernames list. | `""` | -| `pgpool.automountServiceAccountToken` | Mount Service Account token in pod | `false` | -| `pgpool.hostAliases` | Deployment pod host aliases | `[]` | -| `pgpool.customUsersSecret` | Name of a secret containing the usernames and passwords of accounts that will be added to pgpool_passwd | `""` | -| `pgpool.existingSecret` | Pgpool admin password using existing secret | `""` | -| `pgpool.srCheckDatabase` | Name of the database to perform streaming replication checks | `postgres` | -| `pgpool.labels` | Labels to add to the Deployment. Evaluated as template | `{}` | -| `pgpool.podLabels` | Labels to add to the pods. Evaluated as template | `{}` | -| `pgpool.serviceLabels` | Labels to add to the service. Evaluated as template | `{}` | -| `pgpool.serviceAnnotations` | Provide any additional annotations for Pgpool service | `{}` | -| `pgpool.customLivenessProbe` | Override default liveness probe | `{}` | -| `pgpool.customReadinessProbe` | Override default readiness probe | `{}` | -| `pgpool.customStartupProbe` | Override default startup probe | `{}` | -| `pgpool.command` | Override default container command (useful when using custom images) | `[]` | -| `pgpool.args` | Override default container args (useful when using custom images) | `[]` | -| `pgpool.lifecycleHooks` | LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template | `{}` | -| `pgpool.extraEnvVars` | Array containing extra environment variables | `[]` | -| `pgpool.extraEnvVarsCM` | ConfigMap with extra environment variables | `""` | -| `pgpool.extraEnvVarsSecret` | Secret with extra environment variables | `""` | -| `pgpool.extraVolumes` | Extra volumes to add to the deployment | `[]` | -| `pgpool.extraVolumeMounts` | Extra volume mounts to add to the container. Normally used with `extraVolumes` | `[]` | -| `pgpool.initContainers` | Extra init containers to add to the deployment | `[]` | -| `pgpool.sidecars` | Extra sidecar containers to add to the deployment | `[]` | -| `pgpool.replicaCount` | The number of replicas to deploy | `1` | -| `pgpool.podAnnotations` | Additional pod annotations | `{}` | -| `pgpool.priorityClassName` | Pod priority class | `""` | -| `pgpool.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | -| `pgpool.terminationGracePeriodSeconds` | Seconds pgpool pod needs to terminate gracefully | `""` | -| `pgpool.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `[]` | -| `pgpool.podAffinityPreset` | Pgpool pod affinity preset. Ignored if `pgpool.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `pgpool.podAntiAffinityPreset` | Pgpool pod anti-affinity preset. Ignored if `pgpool.affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `pgpool.nodeAffinityPreset.type` | Pgpool node affinity preset type. Ignored if `pgpool.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `pgpool.nodeAffinityPreset.key` | Pgpool node label key to match Ignored if `pgpool.affinity` is set. | `""` | -| `pgpool.nodeAffinityPreset.values` | Pgpool node label values to match. Ignored if `pgpool.affinity` is set. | `[]` | -| `pgpool.affinity` | Affinity for Pgpool pods assignment | `{}` | -| `pgpool.nodeSelector` | Node labels for Pgpool pods assignment | `{}` | -| `pgpool.tolerations` | Tolerations for Pgpool pods assignment | `[]` | -| `pgpool.podSecurityContext.enabled` | Enable security context for Pgpool | `true` | -| `pgpool.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | -| `pgpool.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | -| `pgpool.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | -| `pgpool.podSecurityContext.fsGroup` | Group ID for the Pgpool filesystem | `1001` | -| `pgpool.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | -| `pgpool.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` | -| `pgpool.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | -| `pgpool.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | -| `pgpool.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | -| `pgpool.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | -| `pgpool.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | -| `pgpool.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | -| `pgpool.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | -| `pgpool.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | -| `pgpool.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if pgpool.resources is set (pgpool.resources is recommended for production). | `micro` | -| `pgpool.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | -| `pgpool.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `pgpool.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | -| `pgpool.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `pgpool.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `pgpool.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `5` | -| `pgpool.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `pgpool.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `pgpool.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | -| `pgpool.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | -| `pgpool.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | -| `pgpool.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `5` | -| `pgpool.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `pgpool.startupProbe.enabled` | Enable startupProbe | `false` | -| `pgpool.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | -| `pgpool.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | -| `pgpool.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | -| `pgpool.startupProbe.failureThreshold` | Failure threshold for startupProbe | `10` | -| `pgpool.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | -| `pgpool.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | -| `pgpool.networkPolicy.allowExternal` | Don't require server label for connections | `true` | -| `pgpool.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | -| `pgpool.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | -| `pgpool.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` | -| `pgpool.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` | -| `pgpool.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` | -| `pgpool.pdb.create` | Specifies whether a Pod disruption budget should be created for Pgpool pods | `true` | -| `pgpool.pdb.minAvailable` | Minimum number / percentage of pods that should remain scheduled | `""` | -| `pgpool.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `pgpool.pdb.minAvailable` and `pgpool.pdb.maxUnavailable` are empty. | `""` | -| `pgpool.updateStrategy` | Strategy used to replace old Pods by new ones | `{}` | -| `pgpool.containerPorts.postgresql` | Pgpool port | `5432` | -| `pgpool.minReadySeconds` | How many seconds a pod needs to be ready before killing the next, during update | `""` | -| `pgpool.adminUsername` | Pgpool Admin username | `admin` | -| `pgpool.adminPassword` | Pgpool Admin password | `""` | -| `pgpool.usePasswordFile` | Set to `true` to mount pgpool secret as a file instead of passing environment variable | `""` | -| `pgpool.authenticationMethod` | Pgpool authentication method. Use 'md5' for PSQL < 14. | `scram-sha-256` | -| `pgpool.logConnections` | Log all client connections (PGPOOL_ENABLE_LOG_CONNECTIONS) | `false` | -| `pgpool.logHostname` | Log the client hostname instead of IP address (PGPOOL_ENABLE_LOG_HOSTNAME) | `true` | -| `pgpool.logPerNodeStatement` | Log every SQL statement for each DB node separately (PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT) | `false` | -| `pgpool.logLinePrefix` | Format of the log entry lines (PGPOOL_LOG_LINE_PREFIX) | `""` | -| `pgpool.clientMinMessages` | Log level for clients | `error` | -| `pgpool.numInitChildren` | The number of preforked Pgpool-II server processes. It is also the concurrent | `""` | -| `pgpool.reservedConnections` | Number of reserved connections. When zero, excess connection block. When non-zero, excess connections are refused with an error message. | `1` | -| `pgpool.maxPool` | The maximum number of cached connections in each child process (PGPOOL_MAX_POOL) | `""` | -| `pgpool.childMaxConnections` | The maximum number of client connections in each child process (PGPOOL_CHILD_MAX_CONNECTIONS) | `""` | -| `pgpool.childLifeTime` | The time in seconds to terminate a Pgpool-II child process if it remains idle (PGPOOL_CHILD_LIFE_TIME) | `""` | -| `pgpool.clientIdleLimit` | The time in seconds to disconnect a client if it remains idle since the last query (PGPOOL_CLIENT_IDLE_LIMIT) | `""` | -| `pgpool.connectionLifeTime` | The time in seconds to terminate the cached connections to the PostgreSQL backend (PGPOOL_CONNECTION_LIFE_TIME) | `""` | -| `pgpool.useLoadBalancing` | Use Pgpool Load-Balancing | `true` | -| `pgpool.disableLoadBalancingOnWrite` | LoadBalancer on write actions behavior | `transaction` | -| `pgpool.configuration` | Pgpool configuration | `""` | -| `pgpool.configurationCM` | ConfigMap with Pgpool configuration | `""` | -| `pgpool.initdbScripts` | Dictionary of initdb scripts | `{}` | -| `pgpool.initdbScriptsCM` | ConfigMap with scripts to be run every time Pgpool container is initialized | `""` | -| `pgpool.initdbScriptsSecret` | Secret with scripts to be run every time Pgpool container is initialized | `""` | -| `pgpool.tls.enabled` | Enable TLS traffic support for end-client connections | `false` | -| `pgpool.tls.autoGenerated` | Create self-signed TLS certificates. Currently only supports PEM certificates | `false` | -| `pgpool.tls.preferServerCiphers` | Whether to use the server's TLS cipher preferences rather than the client's | `true` | -| `pgpool.tls.certificatesSecret` | Name of an existing secret that contains the certificates | `""` | -| `pgpool.tls.certFilename` | Certificate filename | `""` | -| `pgpool.tls.certKeyFilename` | Certificate key filename | `""` | -| `pgpool.tls.certCAFilename` | CA Certificate filename | `""` | - -### LDAP parameters - -| Name | Description | Value | -| ------------------------------- | ------------------------------------------------------------ | ------------ | -| `ldap.enabled` | Enable LDAP support | `false` | -| `ldap.existingSecret` | Name of existing secret to use for LDAP passwords | `""` | -| `ldap.uri` | LDAP URL beginning in the form `ldap[s]://:` | `""` | -| `ldap.basedn` | LDAP base DN | `""` | -| `ldap.binddn` | LDAP bind DN | `""` | -| `ldap.bindpw` | LDAP bind password | `""` | -| `ldap.bslookup` | LDAP base lookup | `""` | -| `ldap.scope` | LDAP search scope | `""` | -| `ldap.tlsReqcert` | LDAP TLS check on server certificates | `""` | -| `ldap.nssInitgroupsIgnoreusers` | LDAP ignored users | `root,nslcd` | - -### Other Parameters - -| Name | Description | Value | -| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ------- | -| `rbac.create` | Create Role and RoleBinding (required for PSP to work) | `false` | -| `rbac.rules` | Custom RBAC rules to set | `[]` | -| `serviceAccount.create` | Enable creation of ServiceAccount for Airflow pods | `true` | -| `serviceAccount.name` | The name of the ServiceAccount to use. | `""` | -| `serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` | -| `serviceAccount.automountServiceAccountToken` | Allows auto mount of ServiceAccountToken on the serviceAccount created | `false` | -| `psp.create` | Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later | `false` | - -### Metrics parameters - -| Name | Description | Value | -| ------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- | -| `metrics.enabled` | Enable PostgreSQL Prometheus exporter | `false` | -| `metrics.image.registry` | PostgreSQL Prometheus exporter image registry | `REGISTRY_NAME` | -| `metrics.image.repository` | PostgreSQL Prometheus exporter image repository | `REPOSITORY_NAME/postgres-exporter` | -| `metrics.image.digest` | PostgreSQL Prometheus exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | -| `metrics.image.pullPolicy` | PostgreSQL Prometheus exporter image pull policy | `IfNotPresent` | -| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `metrics.image.debug` | Specify if debug logs should be enabled | `false` | -| `metrics.podSecurityContext.enabled` | Enable security context for PostgreSQL Prometheus exporter | `true` | -| `metrics.podSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` | -| `metrics.podSecurityContext.runAsUser` | User ID for the PostgreSQL Prometheus exporter container | `1001` | -| `metrics.podSecurityContext.runAsGroup` | Group ID for the PostgreSQL Prometheus exporter container | `1001` | -| `metrics.podSecurityContext.runAsNonRoot` | Set PostgreSQL Prometheus exporter container's Security Context runAsNonRoot | `true` | -| `metrics.podSecurityContext.seccompProfile.type` | Set PostgreSQL Prometheus exporter container's Security Context seccompProfile | `RuntimeDefault` | -| `metrics.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production). | `nano` | -| `metrics.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | -| `metrics.containerPorts.http` | Prometheus metrics exporter port | `9187` | -| `metrics.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `metrics.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | -| `metrics.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `metrics.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `metrics.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | -| `metrics.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `metrics.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `metrics.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | -| `metrics.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `metrics.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | -| `metrics.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | -| `metrics.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `metrics.startupProbe.enabled` | Enable startupProbe | `false` | -| `metrics.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | -| `metrics.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | -| `metrics.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | -| `metrics.startupProbe.failureThreshold` | Failure threshold for startupProbe | `10` | -| `metrics.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | -| `metrics.customLivenessProbe` | Override default liveness probe | `{}` | -| `metrics.customReadinessProbe` | Override default readiness probe | `{}` | -| `metrics.customStartupProbe` | Override default startup probe | `{}` | -| `metrics.service.enabled` | PostgreSQL Prometheus exporter metrics service enabled | `true` | -| `metrics.service.type` | PostgreSQL Prometheus exporter metrics service type | `ClusterIP` | -| `metrics.service.ports.metrics` | PostgreSQL Prometheus exporter metrics service port | `9187` | -| `metrics.service.nodePorts.metrics` | PostgreSQL Prometheus exporter Node Port | `""` | -| `metrics.service.clusterIP` | PostgreSQL Prometheus exporter metrics service Cluster IP | `""` | -| `metrics.service.loadBalancerIP` | PostgreSQL Prometheus exporter service Load Balancer IP | `""` | -| `metrics.service.loadBalancerSourceRanges` | PostgreSQL Prometheus exporter service Load Balancer sources | `[]` | -| `metrics.service.externalTrafficPolicy` | PostgreSQL Prometheus exporter service external traffic policy | `Cluster` | -| `metrics.annotations` | Annotations for PostgreSQL Prometheus exporter service | `{}` | -| `metrics.customMetrics` | Additional custom metrics | `{}` | -| `metrics.extraEnvVars` | Array containing extra environment variables | `[]` | -| `metrics.extraEnvVarsCM` | ConfigMap with extra environment variables | `""` | -| `metrics.extraEnvVarsSecret` | Secret with extra environment variables | `""` | -| `metrics.serviceMonitor.enabled` | if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`) | `false` | -| `metrics.serviceMonitor.namespace` | Optional namespace which Prometheus is running in | `""` | -| `metrics.serviceMonitor.interval` | How frequently to scrape metrics (use by default, falling back to Prometheus' default) | `""` | -| `metrics.serviceMonitor.scrapeTimeout` | Service monitor scrape timeout | `""` | -| `metrics.serviceMonitor.annotations` | Additional annotations for the ServiceMonitor | `{}` | -| `metrics.serviceMonitor.labels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | `{}` | -| `metrics.serviceMonitor.selector` | Defaults to what's used if you follow CoreOS Prometheus Install Instructions () | `{}` | -| `metrics.serviceMonitor.relabelings` | ServiceMonitor relabelings. Value is evaluated as a template | `[]` | -| `metrics.serviceMonitor.metricRelabelings` | ServiceMonitor metricRelabelings. Value is evaluated as a template | `[]` | -| `metrics.serviceMonitor.honorLabels` | Specify honorLabels parameter to add the scrape endpoint | `false` | -| `metrics.serviceMonitor.jobLabel` | The name of the label on the target service to use as the job name in prometheus. | `""` | - -### Volume permissions parameters - -| Name | Description | Value | -| ---------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | -| `volumePermissions.enabled` | Enable init container to adapt volume permissions | `false` | -| `volumePermissions.image.registry` | Init container volume-permissions image registry | `REGISTRY_NAME` | -| `volumePermissions.image.repository` | Init container volume-permissions image repository | `REPOSITORY_NAME/os-shell` | -| `volumePermissions.image.digest` | Init container volume-permissions image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | -| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` | -| `volumePermissions.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `volumePermissions.podSecurityContext.enabled` | Whether to enable security context for the volume-permissions init container | `true` | -| `volumePermissions.podSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` | -| `volumePermissions.podSecurityContext.runAsUser` | Init container volume-permissions User ID | `0` | -| `volumePermissions.podSecurityContext.runAsGroup` | Group ID for the init container volume-permissions container | `0` | -| `volumePermissions.podSecurityContext.runAsNonRoot` | Set Security Context runAsNonRoot for the init container volume-permissions container | `false` | -| `volumePermissions.podSecurityContext.seccompProfile.type` | Set Security Context seccompProfile for the init container volume-permissions container | `RuntimeDefault` | -| `volumePermissions.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` | -| `volumePermissions.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | - -### Persistence parameters - -| Name | Description | Value | -| -------------------------------------------------- | --------------------------------------------------------------------------------------- | --------------------- | -| `persistence.enabled` | Enable data persistence | `true` | -| `persistence.existingClaim` | A manually managed Persistent Volume and Claim | `""` | -| `persistence.storageClass` | Persistent Volume Storage Class | `""` | -| `persistence.mountPath` | The path the volume will be mounted at, useful when using different PostgreSQL images. | `/bitnami/postgresql` | -| `persistence.accessModes` | List of access modes of data volume | `["ReadWriteOnce"]` | -| `persistence.size` | Persistent Volume Claim size | `8Gi` | -| `persistence.annotations` | Persistent Volume Claim annotations | `{}` | -| `persistence.labels` | Persistent Volume Claim labels | `{}` | -| `persistence.selector` | Selector to match an existing Persistent Volume (this value is evaluated as a template) | `{}` | -| `persistentVolumeClaimRetentionPolicy.enabled` | Enable Persistent volume retention policy for postgresql Statefulset | `false` | -| `persistentVolumeClaimRetentionPolicy.whenScaled` | Volume retention behavior when the replica count of the StatefulSet is reduced | `Retain` | -| `persistentVolumeClaimRetentionPolicy.whenDeleted` | Volume retention behavior that applies when the StatefulSet is deleted | `Retain` | - -### Traffic Exposure parameters - -| Name | Description | Value | -| ---------------------------------- | -------------------------------------------------------------------------- | ------------ | -| `service.type` | Kubernetes service type (`ClusterIP`, `NodePort` or `LoadBalancer`) | `ClusterIP` | -| `service.ports.postgresql` | PostgreSQL port | `5432` | -| `service.portName` | PostgreSQL service port name | `postgresql` | -| `service.nodePorts.postgresql` | Kubernetes service nodePort | `""` | -| `service.loadBalancerIP` | Load balancer IP if service type is `LoadBalancer` | `""` | -| `service.loadBalancerSourceRanges` | Addresses that are allowed when service is LoadBalancer | `[]` | -| `service.clusterIP` | Set the Cluster IP to use | `""` | -| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | -| `service.extraPorts` | Extra ports to expose (normally used with the `sidecar` value) | `[]` | -| `service.sessionAffinity` | Control where client requests go, to the same pod or round-robin | `None` | -| `service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | -| `service.annotations` | Provide any additional annotations both for PostgreSQL and Pgpool services | `{}` | -| `service.serviceLabels` | Labels for PostgreSQL service | `{}` | -| `service.headless.annotations` | Annotations for the headless service. | `{}` | - -### Backup parameters - -| Name | Description | Value | -| ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| `backup.enabled` | Enable the logical dump of the database "regularly" | `false` | -| `backup.cronjob.schedule` | Set the cronjob parameter schedule | `@daily` | -| `backup.cronjob.timeZone` | Set the cronjob parameter timeZone | `""` | -| `backup.cronjob.concurrencyPolicy` | Set the cronjob parameter concurrencyPolicy | `Allow` | -| `backup.cronjob.failedJobsHistoryLimit` | Set the cronjob parameter failedJobsHistoryLimit | `1` | -| `backup.cronjob.successfulJobsHistoryLimit` | Set the cronjob parameter successfulJobsHistoryLimit | `3` | -| `backup.cronjob.startingDeadlineSeconds` | Set the cronjob parameter startingDeadlineSeconds | `""` | -| `backup.cronjob.ttlSecondsAfterFinished` | Set the cronjob parameter ttlSecondsAfterFinished | `""` | -| `backup.cronjob.restartPolicy` | Set the cronjob parameter restartPolicy | `OnFailure` | -| `backup.cronjob.podSecurityContext.enabled` | Enable PodSecurityContext for CronJob/Backup | `true` | -| `backup.cronjob.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | -| `backup.cronjob.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | -| `backup.cronjob.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | -| `backup.cronjob.podSecurityContext.fsGroup` | Group ID for the CronJob | `1001` | -| `backup.cronjob.containerSecurityContext.enabled` | Enable container security context | `true` | -| `backup.cronjob.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` | -| `backup.cronjob.containerSecurityContext.runAsUser` | User ID for the backup container | `1001` | -| `backup.cronjob.containerSecurityContext.runAsGroup` | Group ID for the backup container | `1001` | -| `backup.cronjob.containerSecurityContext.runAsNonRoot` | Set backup container's Security Context runAsNonRoot | `true` | -| `backup.cronjob.containerSecurityContext.readOnlyRootFilesystem` | Is the container itself readonly | `true` | -| `backup.cronjob.containerSecurityContext.allowPrivilegeEscalation` | Is it possible to escalate backup pod(s) privileges | `false` | -| `backup.cronjob.containerSecurityContext.seccompProfile.type` | Set backup container's Security Context seccompProfile type | `RuntimeDefault` | -| `backup.cronjob.containerSecurityContext.capabilities.drop` | Set backup container's Security Context capabilities to drop | `["ALL"]` | -| `backup.cronjob.command` | Set backup container's command to run | `["/bin/sh","-c","pg_dumpall --clean --if-exists --load-via-partition-root --quote-all-identifiers --no-password --file=${PGDUMP_DIR}/pg_dumpall-$(date '+%Y-%m-%d-%H-%M').pgdump"]` | -| `backup.cronjob.labels` | Set the cronjob labels | `{}` | -| `backup.cronjob.annotations` | Set the cronjob annotations | `{}` | -| `backup.cronjob.nodeSelector` | Node labels for PostgreSQL backup CronJob pod assignment | `{}` | -| `backup.cronjob.tolerations` | Tolerations for PostgreSQL backup CronJob pod assignment | `[]` | -| `backup.cronjob.storage.existingClaim` | Provide an existing `PersistentVolumeClaim` (only when `architecture=standalone`) | `""` | -| `backup.cronjob.storage.resourcePolicy` | Setting it to "keep" to avoid removing PVCs during a helm delete operation. Leaving it empty will delete PVCs after the chart deleted | `""` | -| `backup.cronjob.storage.storageClass` | PVC Storage Class for the backup data volume | `""` | -| `backup.cronjob.storage.accessModes` | PV Access Mode | `["ReadWriteOnce"]` | -| `backup.cronjob.storage.size` | PVC Storage Request for the backup data volume | `8Gi` | -| `backup.cronjob.storage.annotations` | PVC annotations | `{}` | -| `backup.cronjob.storage.mountPath` | Path to mount the volume at | `/backup/pgdump` | -| `backup.cronjob.storage.subPath` | Subdirectory of the volume to mount at | `""` | -| `backup.cronjob.storage.volumeClaimTemplates.selector` | A label query over volumes to consider for binding (e.g. when using local volumes) | `{}` | - -Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, - -```console -helm install my-release \ - --set postgresql.password=password \ - oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql-ha -``` - -> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. - -The above command sets the password for user `postgres` to `password`. - -> NOTE: Once this chart is deployed, it is not possible to change the application's access credentials, such as usernames or passwords, using Helm. To change these application credentials after deployment, delete any persistent volumes (PVs) used by the chart and re-deploy it, or use the application's built-in administrative tools if available. - -Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example, - -```console -helm install my-release \ - -f values.yaml \ - bitnami/postgresql-ha -``` - -## Troubleshooting - -Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). - -## Upgrading - -It's necessary to specify the existing passwords while performing a upgrade to ensure the secrets are not updated with invalid randomly generated passwords. Remember to specify the existing values of the `postgresql.password` and `postgresql.repmgrPassword` parameters when upgrading the chart: - -```console -helm upgrade my-release oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql-ha \ - --set postgresql.password=[POSTGRES_PASSWORD] \ - --set postgresql.repmgrPassword=[REPMGR_PASSWORD] -``` - -> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. -> Note: you need to substitute the placeholders *[POSTGRES_PASSWORD]*, and *[REPMGR_PASSWORD]* with the values obtained from instructions in the installation notes. -> Note: As general rule, it is always wise to do a backup before the upgrading procedures. - -### To 14.0.0 - -This major bump changes the following security defaults: - -- `runAsGroup` is changed from `0` to `1001` -- `readOnlyRootFilesystem` is set to `true` -- `resourcesPreset` is changed from `none` to the minimum size working in our test suites (NOTE: `resourcesPreset` is not meant for production usage, but `resources` adapted to your use case). -- `global.compatibility.openshift.adaptSecurityContext` is changed from `disabled` to `auto`. - -This could potentially break any customization or init scripts used in your deployment. If this is the case, change the default values to the previous ones. - -### To 13.0.0 - -This major version adapts the NetworkPolicy objects to the most recent Bitnami standards. Now there is a separate object for `pgpool` and for `postgresql`, being located in their corresponding sections. It is also enabled by default in other to comply with the best security standards. - -Check the parameter section for the new value structure. - -### To 12.0.0 - -This major version updates the PostgreSQL container image version used from 15 to 16, the new stable version. There are no major changes in the chart, but we recommend checking the [PostgreSQL 16 release notes](https://www.postgresql.org/docs/current/release-16.html) before upgrading. - -> Note: Due to an error in our release process, the latest version in the previous major branch (11.9.8) already uses 16 by default, see [PR#19590](https://github.com/bitnami/charts/pull/19590) - -### To 10.0.0 - -This major version changes the default PostgreSQL image from 14.x to 15.x. Follow the [official instructions](https://www.postgresql.org/docs/15/upgrading.html) to upgrade to 15.x. - -### To 9.0.0 - -This chart major version updates the PostgreSQL image's version to the latest major, `v14`, as well as standarizes the templates and values. These changes can be sumarised in the following: - -- Image parameters that used `imageNameImage` are now under `imageName.image` -- `containerPort` parameters are now found by `containerPorts.xxxx` -- `service.port` parameters are now found by `service.ports.xxxx` -- `imageName.securityContext` parameters are now under `imageName.podSecurityContext` -- `serviceAccount.enabled` parameter has been renamed to `serviceAccount.create` -- `postgresql.updateStrategyType` parameter has been renamed to `postgresql.updateStrategy.type` -- Added the `pgpool.authenticationMethod` parameter. Use "md5" for older PSQL versions and the default value of "scram-sha-256" when using PSQL > v14. - -> Note: Keep in mind you will find an error such as the one below when upgrading since the new chart major version also bumps the application version. To workaround this issue you need to upgrade the database, please refer to the [official PostgreSQL documentation](https://www.postgresql.org/docs/current/upgrading.html) for more information about this. - -```log -postgresql-repmgr 14:41:21.00 INFO ==> Setting up streaming replication slave... -postgresql-repmgr 14:41:21.04 INFO ==> Starting PostgreSQL in background... -waiting for server to start....2022-04-12 14:41:21.069 GMT [220] FATAL: database files are incompatible with server -2022-04-12 14:41:21.069 GMT [220] DETAIL: The data directory was initialized by PostgreSQL version 11, which is not compatible with this version 14.2. -pg_ctl: could not start server -``` - -### To 8.0.0 - -A new major version of repmgr (5.3) was included. To upgrade to this major version, it's necessary to upgrade the repmgr extension installed on the database. To do so, follow the steps below: - -- Reduce your PostgreSQL setup to one replica (primary node) and upgrade to `8.0.0`, enabling the repmgr extension upgrade: - -```console -helm upgrade my-release --version 8.0.0 oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql-ha \ - --set postgresql.password=[POSTGRESQL_PASSWORD] \ - --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ - --set postgresql.replicaCount=1 \ - --set postgresql.upgradeRepmgrExtension=true -``` - -> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. - -- Scale your PostgreSQL setup to the original number of replicas: - -```console -helm upgrade my-release --version 8.0.0 oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql-ha \ - --set postgresql.password=[POSTGRESQL_PASSWORD] \ - --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ - --set postgresql.replicaCount=[NUMBER_OF_REPLICAS] -``` - -> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. -> Note: you need to substitute the placeholders *[POSTGRESQL_PASSWORD]*, and *[REPMGR_PASSWORD]* with the values obtained from instructions in the installation notes. - -### To 6.4.0 - -Support for adding custom configuration files or initialization scripts by placing them under the "files" directory in the working directory was removed. This functionality was very confusing for users since they do not usually clone the repo nor they fetch the charts to their working directories. -As an alternative to this feature, users can still use the equivalent parameters available in the `values.yaml` to load their custom configuration & scripts. - -### To 6.0.0 - -[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. - -#### What changes were introduced in this major version? - -- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. -- Move dependency information from the *requirements.yaml* to the *Chart.yaml* -- After running `helm dependency update`, a *Chart.lock* file is generated containing the same structure used in the previous *requirements.lock* -- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts - -#### Considerations when upgrading to this version - -- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues -- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore -- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 - -#### Useful links - -- -- -- - -### To 5.2.0 - -A new version of repmgr (5.2.0) was included. To upgrade to this version, it's necessary to upgrade the repmgr extension installed on the database. To do so, follow the steps below: - -- Reduce your PostgreSQL setup to one replica (primary node) and upgrade to `5.2.0`, enabling the repmgr extension upgrade: - -```console -helm upgrade my-release --version 5.2.0 oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql-ha \ - --set postgresql.password=[POSTGRESQL_PASSWORD] \ - --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ - --set postgresql.replicaCount=1 \ - --set postgresql.upgradeRepmgrExtension=true -``` - -> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. - -- Scale your PostgreSQL setup to the original number of replicas: - -```console -helm upgrade my-release --version 5.2.0 oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql-ha \ - --set postgresql.password=[POSTGRESQL_PASSWORD] \ - --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ - --set postgresql.replicaCount=[NUMBER_OF_REPLICAS] -``` - -> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. -> Note: you need to substitute the placeholders *[POSTGRESQL_PASSWORD]*, and *[REPMGR_PASSWORD]* with the values obtained from instructions in the installation notes (`helm get notes RELEASE_NAME`). - -### To 5.0.0 - -This release uses parallel deployment for the postgresql statefullset. This should fix the issues related to not being able to restart the cluster under some contions where the master node is not longer node `-0`. -This version is next major version to v3.x.y - -- To upgrade to this version you will need to delete the deployment, keep the PVCs and launch a new deployment keeping the deployment name. - -```console -$ # e.g. Previous deployment v3.9.1 -helm install my-release \ - --set postgresql.password=[POSTGRESQL_PASSWORD] \ - --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ - oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql-ha --version 3.9.1 - -$ # Update repository information -helm repo update - -$ # upgrade to v5.0.0 -helm delete my-release -helm install my-release \ - --set postgresql.password=[POSTGRESQL_PASSWORD] \ - --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ - oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql-ha --version 5.0.0 -``` - -> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. - -### To 4.0.x - -Due to an error handling the version numbers these versions are actually part of the 3.x versions and not a new major version. - -### To 3.0.0 - -A new major version of repmgr (5.1.0) was included. To upgrade to this major version, it's necessary to upgrade the repmgr extension installed on the database. To do so, follow the steps below: - -- Reduce your PostgreSQL setup to one replica (primary node) and upgrade to `3.0.0`, enabling the repmgr extension upgrade: - -```console -helm upgrade my-release --version 3.0.0 oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql-ha \ - --set postgresql.password=[POSTGRESQL_PASSWORD] \ - --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ - --set postgresql.replicaCount=1 \ - --set postgresql.upgradeRepmgrExtension=true -``` - -> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. - -- Scale your PostgreSQL setup to the original number of replicas: - -```console -helm upgrade my-release --version 3.0.0 oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql-ha \ - --set postgresql.password=[POSTGRESQL_PASSWORD] \ - --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ - --set postgresql.replicaCount=[NUMBER_OF_REPLICAS] -``` - -> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. -> Note: you need to substitute the placeholders *[POSTGRESQL_PASSWORD]*, and *[REPMGR_PASSWORD]* with the values obtained from instructions in the installation notes. - -### To 2.0.0 - -The [Bitnami Pgpool](https://github.com/bitnami/containers/tree/main/bitnami/pgpool) image was migrated to a "non-root" user approach. Previously the container ran as the `root` user and the Pgpool daemon was started as the `pgpool` user. From now on, both the container and the Pgpool daemon run as user `1001`. You can revert this behavior by setting the parameters `pgpool.containerSecurityContext.runAsUser`, and `pgpool.securityContext.fsGroup` to `0`. - -Consequences: - -- No backwards compatibility issues are expected since all the data is at PostgreSQL pods, and Pgpool uses a deployment without persistence. Therefore, upgrades should work smoothly from `1.x.x` versions. -- Environment variables related to LDAP configuration were renamed removing the `PGPOOL_` prefix. For instance, to indicate the LDAP URI to use, you must set `LDAP_URI` instead of `PGPOOL_LDAP_URI` - -### To 1.0.0 - -A new major version of repmgr (5.0.0) was included. To upgrade to this major version, it's necessary to upgrade the repmgr extension installed on the database. To do so, follow the steps below: - -- Reduce your PostgreSQL setup to one replica (primary node) and upgrade to `1.0.0`, enabling the repmgr extension upgrade: - -```console -helm upgrade my-release --version 1.0.0 oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql-ha \ - --set postgresql.password=[POSTGRESQL_PASSWORD] \ - --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ - --set postgresql.replicaCount=1 \ - --set postgresql.upgradeRepmgrExtension=true -``` - -> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. - -- Scale your PostgreSQL setup to the original number of replicas: - -```console -helm upgrade my-release --version 1.0.0 oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql-ha \ - --set postgresql.password=[POSTGRESQL_PASSWORD] \ - --set postgresql.repmgrPassword=[REPMGR_PASSWORD] \ - --set postgresql.replicaCount=[NUMBER_OF_REPLICAS] -``` - -> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. -> Note: you need to substitute the placeholders *[POSTGRESQL_PASSWORD]*, and *[REPMGR_PASSWORD]* with the values obtained from instructions in the installation notes. - -### To 0.4.0 - -In this version, the chart will use PostgreSQL-Repmgr container images with the Postgis extension included. The version used in Postgresql version 10, 11 and 12 is Postgis 2.5, and in Postgresql 9.6 is Postgis 2.3. Postgis has been compiled with the following dependencies: - -- protobuf -- protobuf-c -- json-c -- geos -- proj -- gdal - -## Bitnami Kubernetes Documentation - -Bitnami Kubernetes documentation is available at [https://docs.bitnami.com/](https://docs.bitnami.com/). You can find there the following resources: - -- [Documentation for PostgreSQL HA Helm chart](https://github.com/bitnami/charts/tree/main/bitnami/postgresql-ha) -- [Get Started with Kubernetes guides](https://docs.bitnami.com/kubernetes/) -- [Kubernetes FAQs](https://docs.bitnami.com/kubernetes/faq/) -- [Kubernetes Developer guides](https://docs.vmware.com/en/VMware-Tanzu-Application-Catalog/services/tutorials/GUID-index.html) - -## License - -Copyright © 2024 Broadcom. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. \ No newline at end of file diff --git a/postgresql-ha/charts/common/.helmignore b/postgresql-ha/charts/common/.helmignore deleted file mode 100644 index 7c7c21d..0000000 --- a/postgresql-ha/charts/common/.helmignore +++ /dev/null @@ -1,24 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ -# img folder -img/ diff --git a/postgresql-ha/charts/common/Chart.yaml b/postgresql-ha/charts/common/Chart.yaml deleted file mode 100644 index bffd8df..0000000 --- a/postgresql-ha/charts/common/Chart.yaml +++ /dev/null @@ -1,23 +0,0 @@ -annotations: - category: Infrastructure - licenses: Apache-2.0 -apiVersion: v2 -appVersion: 2.19.3 -description: A Library Helm Chart for grouping common logic between bitnami charts. - This chart is not deployable by itself. -home: https://bitnami.com -icon: https://bitnami.com/downloads/logos/bitnami-mark.png -keywords: -- common -- helper -- template -- function -- bitnami -maintainers: -- name: Broadcom, Inc. All Rights Reserved. - url: https://github.com/bitnami/charts -name: common -sources: -- https://github.com/bitnami/charts -type: library -version: 2.19.3 diff --git a/postgresql-ha/charts/common/README.md b/postgresql-ha/charts/common/README.md deleted file mode 100644 index 82d78a3..0000000 --- a/postgresql-ha/charts/common/README.md +++ /dev/null @@ -1,235 +0,0 @@ -# Bitnami Common Library Chart - -A [Helm Library Chart](https://helm.sh/docs/topics/library_charts/#helm) for grouping common logic between Bitnami charts. - -## TL;DR - -```yaml -dependencies: - - name: common - version: 2.x.x - repository: oci://registry-1.docker.io/bitnamicharts -``` - -```console -helm dependency update -``` - -```yaml -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "common.names.fullname" . }} -data: - myvalue: "Hello World" -``` - -Looking to use our applications in production? Try [VMware Tanzu Application Catalog](https://bitnami.com/enterprise), the enterprise edition of Bitnami Application Catalog. - -## Introduction - -This chart provides a common template helpers which can be used to develop new charts using [Helm](https://helm.sh) package manager. - -Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters. - -## Prerequisites - -- Kubernetes 1.23+ -- Helm 3.8.0+ - -## Parameters - -## Special input schemas - -### ImageRoot - -```yaml -registry: - type: string - description: Docker registry where the image is located - example: docker.io - -repository: - type: string - description: Repository and image name - example: bitnami/nginx - -tag: - type: string - description: image tag - example: 1.16.1-debian-10-r63 - -pullPolicy: - type: string - description: Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - -pullSecrets: - type: array - items: - type: string - description: Optionally specify an array of imagePullSecrets (evaluated as templates). - -debug: - type: boolean - description: Set to true if you would like to see extra information on logs - example: false - -## An instance would be: -# registry: docker.io -# repository: bitnami/nginx -# tag: 1.16.1-debian-10-r63 -# pullPolicy: IfNotPresent -# debug: false -``` - -### Persistence - -```yaml -enabled: - type: boolean - description: Whether enable persistence. - example: true - -storageClass: - type: string - description: Ghost data Persistent Volume Storage Class, If set to "-", storageClassName: "" which disables dynamic provisioning. - example: "-" - -accessMode: - type: string - description: Access mode for the Persistent Volume Storage. - example: ReadWriteOnce - -size: - type: string - description: Size the Persistent Volume Storage. - example: 8Gi - -path: - type: string - description: Path to be persisted. - example: /bitnami - -## An instance would be: -# enabled: true -# storageClass: "-" -# accessMode: ReadWriteOnce -# size: 8Gi -# path: /bitnami -``` - -### ExistingSecret - -```yaml -name: - type: string - description: Name of the existing secret. - example: mySecret -keyMapping: - description: Mapping between the expected key name and the name of the key in the existing secret. - type: object - -## An instance would be: -# name: mySecret -# keyMapping: -# password: myPasswordKey -``` - -#### Example of use - -When we store sensitive data for a deployment in a secret, some times we want to give to users the possibility of using theirs existing secrets. - -```yaml -# templates/secret.yaml ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "common.names.fullname" . }} - labels: - app: {{ include "common.names.fullname" . }} -type: Opaque -data: - password: {{ .Values.password | b64enc | quote }} - -# templates/dpl.yaml ---- -... - env: - - name: PASSWORD - valueFrom: - secretKeyRef: - name: {{ include "common.secrets.name" (dict "existingSecret" .Values.existingSecret "context" $) }} - key: {{ include "common.secrets.key" (dict "existingSecret" .Values.existingSecret "key" "password") }} -... - -# values.yaml ---- -name: mySecret -keyMapping: - password: myPasswordKey -``` - -### ValidateValue - -#### NOTES.txt - -```console -{{- $validateValueConf00 := (dict "valueKey" "path.to.value00" "secret" "secretName" "field" "password-00") -}} -{{- $validateValueConf01 := (dict "valueKey" "path.to.value01" "secret" "secretName" "field" "password-01") -}} - -{{ include "common.validations.values.multiple.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} -``` - -If we force those values to be empty we will see some alerts - -```console -helm install test mychart --set path.to.value00="",path.to.value01="" - 'path.to.value00' must not be empty, please add '--set path.to.value00=$PASSWORD_00' to the command. To get the current value: - - export PASSWORD_00=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-00}" | base64 -d) - - 'path.to.value01' must not be empty, please add '--set path.to.value01=$PASSWORD_01' to the command. To get the current value: - - export PASSWORD_01=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-01}" | base64 -d) -``` - -## Upgrading - -### To 1.0.0 - -[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. - -#### What changes were introduced in this major version? - -- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. -- Use `type: library`. [Here](https://v3.helm.sh/docs/faq/#library-chart-support) you can find more information. -- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts - -#### Considerations when upgrading to this version - -- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues -- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore -- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 - -#### Useful links - -- -- -- - -## License - -Copyright © 2024 Broadcom. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. diff --git a/postgresql-ha/charts/common/templates/_affinities.tpl b/postgresql-ha/charts/common/templates/_affinities.tpl deleted file mode 100644 index c2d2907..0000000 --- a/postgresql-ha/charts/common/templates/_affinities.tpl +++ /dev/null @@ -1,139 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} - -{{/* -Return a soft nodeAffinity definition -{{ include "common.affinities.nodes.soft" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}} -*/}} -{{- define "common.affinities.nodes.soft" -}} -preferredDuringSchedulingIgnoredDuringExecution: - - preference: - matchExpressions: - - key: {{ .key }} - operator: In - values: - {{- range .values }} - - {{ . | quote }} - {{- end }} - weight: 1 -{{- end -}} - -{{/* -Return a hard nodeAffinity definition -{{ include "common.affinities.nodes.hard" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}} -*/}} -{{- define "common.affinities.nodes.hard" -}} -requiredDuringSchedulingIgnoredDuringExecution: - nodeSelectorTerms: - - matchExpressions: - - key: {{ .key }} - operator: In - values: - {{- range .values }} - - {{ . | quote }} - {{- end }} -{{- end -}} - -{{/* -Return a nodeAffinity definition -{{ include "common.affinities.nodes" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}} -*/}} -{{- define "common.affinities.nodes" -}} - {{- if eq .type "soft" }} - {{- include "common.affinities.nodes.soft" . -}} - {{- else if eq .type "hard" }} - {{- include "common.affinities.nodes.hard" . -}} - {{- end -}} -{{- end -}} - -{{/* -Return a topologyKey definition -{{ include "common.affinities.topologyKey" (dict "topologyKey" "BAR") -}} -*/}} -{{- define "common.affinities.topologyKey" -}} -{{ .topologyKey | default "kubernetes.io/hostname" -}} -{{- end -}} - -{{/* -Return a soft podAffinity/podAntiAffinity definition -{{ include "common.affinities.pods.soft" (dict "component" "FOO" "customLabels" .Values.podLabels "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "extraPodAffinityTerms" .Values.extraPodAffinityTerms "context" $) -}} -*/}} -{{- define "common.affinities.pods.soft" -}} -{{- $component := default "" .component -}} -{{- $customLabels := default (dict) .customLabels -}} -{{- $extraMatchLabels := default (dict) .extraMatchLabels -}} -{{- $extraPodAffinityTerms := default (list) .extraPodAffinityTerms -}} -preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" .context )) | nindent 10 }} - {{- if not (empty $component) }} - {{ printf "app.kubernetes.io/component: %s" $component }} - {{- end }} - {{- range $key, $value := $extraMatchLabels }} - {{ $key }}: {{ $value | quote }} - {{- end }} - topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }} - weight: 1 - {{- range $extraPodAffinityTerms }} - - podAffinityTerm: - labelSelector: - matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" $.context )) | nindent 10 }} - {{- if not (empty $component) }} - {{ printf "app.kubernetes.io/component: %s" $component }} - {{- end }} - {{- range $key, $value := .extraMatchLabels }} - {{ $key }}: {{ $value | quote }} - {{- end }} - topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }} - weight: {{ .weight | default 1 -}} - {{- end -}} -{{- end -}} - -{{/* -Return a hard podAffinity/podAntiAffinity definition -{{ include "common.affinities.pods.hard" (dict "component" "FOO" "customLabels" .Values.podLabels "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "extraPodAffinityTerms" .Values.extraPodAffinityTerms "context" $) -}} -*/}} -{{- define "common.affinities.pods.hard" -}} -{{- $component := default "" .component -}} -{{- $customLabels := default (dict) .customLabels -}} -{{- $extraMatchLabels := default (dict) .extraMatchLabels -}} -{{- $extraPodAffinityTerms := default (list) .extraPodAffinityTerms -}} -requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" .context )) | nindent 8 }} - {{- if not (empty $component) }} - {{ printf "app.kubernetes.io/component: %s" $component }} - {{- end }} - {{- range $key, $value := $extraMatchLabels }} - {{ $key }}: {{ $value | quote }} - {{- end }} - topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }} - {{- range $extraPodAffinityTerms }} - - labelSelector: - matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" $.context )) | nindent 8 }} - {{- if not (empty $component) }} - {{ printf "app.kubernetes.io/component: %s" $component }} - {{- end }} - {{- range $key, $value := .extraMatchLabels }} - {{ $key }}: {{ $value | quote }} - {{- end }} - topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }} - {{- end -}} -{{- end -}} - -{{/* -Return a podAffinity/podAntiAffinity definition -{{ include "common.affinities.pods" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}} -*/}} -{{- define "common.affinities.pods" -}} - {{- if eq .type "soft" }} - {{- include "common.affinities.pods.soft" . -}} - {{- else if eq .type "hard" }} - {{- include "common.affinities.pods.hard" . -}} - {{- end -}} -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/_capabilities.tpl b/postgresql-ha/charts/common/templates/_capabilities.tpl deleted file mode 100644 index 002a517..0000000 --- a/postgresql-ha/charts/common/templates/_capabilities.tpl +++ /dev/null @@ -1,221 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} - -{{/* -Return the target Kubernetes version -*/}} -{{- define "common.capabilities.kubeVersion" -}} -{{- default (default .Capabilities.KubeVersion.Version .Values.kubeVersion) ((.Values.global).kubeVersion) -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for poddisruptionbudget. -*/}} -{{- define "common.capabilities.policy.apiVersion" -}} -{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "policy/v1beta1" -}} -{{- else -}} -{{- print "policy/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for networkpolicy. -*/}} -{{- define "common.capabilities.networkPolicy.apiVersion" -}} -{{- if semverCompare "<1.7-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "extensions/v1beta1" -}} -{{- else -}} -{{- print "networking.k8s.io/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for cronjob. -*/}} -{{- define "common.capabilities.cronjob.apiVersion" -}} -{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "batch/v1beta1" -}} -{{- else -}} -{{- print "batch/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for daemonset. -*/}} -{{- define "common.capabilities.daemonset.apiVersion" -}} -{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "extensions/v1beta1" -}} -{{- else -}} -{{- print "apps/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for deployment. -*/}} -{{- define "common.capabilities.deployment.apiVersion" -}} -{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "extensions/v1beta1" -}} -{{- else -}} -{{- print "apps/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for statefulset. -*/}} -{{- define "common.capabilities.statefulset.apiVersion" -}} -{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "apps/v1beta1" -}} -{{- else -}} -{{- print "apps/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for ingress. -*/}} -{{- define "common.capabilities.ingress.apiVersion" -}} -{{- if .Values.ingress -}} -{{- if .Values.ingress.apiVersion -}} -{{- .Values.ingress.apiVersion -}} -{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "extensions/v1beta1" -}} -{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "networking.k8s.io/v1beta1" -}} -{{- else -}} -{{- print "networking.k8s.io/v1" -}} -{{- end }} -{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "extensions/v1beta1" -}} -{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "networking.k8s.io/v1beta1" -}} -{{- else -}} -{{- print "networking.k8s.io/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for RBAC resources. -*/}} -{{- define "common.capabilities.rbac.apiVersion" -}} -{{- if semverCompare "<1.17-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "rbac.authorization.k8s.io/v1beta1" -}} -{{- else -}} -{{- print "rbac.authorization.k8s.io/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for CRDs. -*/}} -{{- define "common.capabilities.crd.apiVersion" -}} -{{- if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "apiextensions.k8s.io/v1beta1" -}} -{{- else -}} -{{- print "apiextensions.k8s.io/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for APIService. -*/}} -{{- define "common.capabilities.apiService.apiVersion" -}} -{{- if semverCompare "<1.10-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "apiregistration.k8s.io/v1beta1" -}} -{{- else -}} -{{- print "apiregistration.k8s.io/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for Horizontal Pod Autoscaler. -*/}} -{{- define "common.capabilities.hpa.apiVersion" -}} -{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .context) -}} -{{- if .beta2 -}} -{{- print "autoscaling/v2beta2" -}} -{{- else -}} -{{- print "autoscaling/v2beta1" -}} -{{- end -}} -{{- else -}} -{{- print "autoscaling/v2" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for Vertical Pod Autoscaler. -*/}} -{{- define "common.capabilities.vpa.apiVersion" -}} -{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .context) -}} -{{- if .beta2 -}} -{{- print "autoscaling/v2beta2" -}} -{{- else -}} -{{- print "autoscaling/v2beta1" -}} -{{- end -}} -{{- else -}} -{{- print "autoscaling/v2" -}} -{{- end -}} -{{- end -}} - -{{/* -Returns true if PodSecurityPolicy is supported -*/}} -{{- define "common.capabilities.psp.supported" -}} -{{- if semverCompare "<1.25-0" (include "common.capabilities.kubeVersion" .) -}} - {{- true -}} -{{- end -}} -{{- end -}} - -{{/* -Returns true if AdmissionConfiguration is supported -*/}} -{{- define "common.capabilities.admissionConfiguration.supported" -}} -{{- if semverCompare ">=1.23-0" (include "common.capabilities.kubeVersion" .) -}} - {{- true -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for AdmissionConfiguration. -*/}} -{{- define "common.capabilities.admissionConfiguration.apiVersion" -}} -{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "apiserver.config.k8s.io/v1alpha1" -}} -{{- else if semverCompare "<1.25-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "apiserver.config.k8s.io/v1beta1" -}} -{{- else -}} -{{- print "apiserver.config.k8s.io/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for PodSecurityConfiguration. -*/}} -{{- define "common.capabilities.podSecurityConfiguration.apiVersion" -}} -{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "pod-security.admission.config.k8s.io/v1alpha1" -}} -{{- else if semverCompare "<1.25-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "pod-security.admission.config.k8s.io/v1beta1" -}} -{{- else -}} -{{- print "pod-security.admission.config.k8s.io/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Returns true if the used Helm version is 3.3+. -A way to check the used Helm version was not introduced until version 3.3.0 with .Capabilities.HelmVersion, which contains an additional "{}}" structure. -This check is introduced as a regexMatch instead of {{ if .Capabilities.HelmVersion }} because checking for the key HelmVersion in <3.3 results in a "interface not found" error. -**To be removed when the catalog's minimun Helm version is 3.3** -*/}} -{{- define "common.capabilities.supportsHelmVersion" -}} -{{- if regexMatch "{(v[0-9])*[^}]*}}$" (.Capabilities | toString ) }} - {{- true -}} -{{- end -}} -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/_compatibility.tpl b/postgresql-ha/charts/common/templates/_compatibility.tpl deleted file mode 100644 index 538b3a3..0000000 --- a/postgresql-ha/charts/common/templates/_compatibility.tpl +++ /dev/null @@ -1,38 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} - -{{/* -Return true if the detected platform is Openshift -Usage: -{{- include "common.compatibility.isOpenshift" . -}} -*/}} -{{- define "common.compatibility.isOpenshift" -}} -{{- if .Capabilities.APIVersions.Has "security.openshift.io/v1" -}} -{{- true -}} -{{- end -}} -{{- end -}} - -{{/* -Render a compatible securityContext depending on the platform. By default it is maintained as it is. In other platforms like Openshift we remove default user/group values that do not work out of the box with the restricted-v1 SCC -Usage: -{{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) -}} -*/}} -{{- define "common.compatibility.renderSecurityContext" -}} -{{- $adaptedContext := .secContext -}} - -{{- if (((.context.Values.global).compatibility).openshift) -}} - {{- if or (eq .context.Values.global.compatibility.openshift.adaptSecurityContext "force") (and (eq .context.Values.global.compatibility.openshift.adaptSecurityContext "auto") (include "common.compatibility.isOpenshift" .context)) -}} - {{/* Remove incompatible user/group values that do not work in Openshift out of the box */}} - {{- $adaptedContext = omit $adaptedContext "fsGroup" "runAsUser" "runAsGroup" -}} - {{- if not .secContext.seLinuxOptions -}} - {{/* If it is an empty object, we remove it from the resulting context because it causes validation issues */}} - {{- $adaptedContext = omit $adaptedContext "seLinuxOptions" -}} - {{- end -}} - {{- end -}} -{{- end -}} -{{- omit $adaptedContext "enabled" | toYaml -}} -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/_errors.tpl b/postgresql-ha/charts/common/templates/_errors.tpl deleted file mode 100644 index e965365..0000000 --- a/postgresql-ha/charts/common/templates/_errors.tpl +++ /dev/null @@ -1,28 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} -{{/* -Through error when upgrading using empty passwords values that must not be empty. - -Usage: -{{- $validationError00 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password00" "secret" "secretName" "field" "password-00") -}} -{{- $validationError01 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password01" "secret" "secretName" "field" "password-01") -}} -{{ include "common.errors.upgrade.passwords.empty" (dict "validationErrors" (list $validationError00 $validationError01) "context" $) }} - -Required password params: - - validationErrors - String - Required. List of validation strings to be return, if it is empty it won't throw error. - - context - Context - Required. Parent context. -*/}} -{{- define "common.errors.upgrade.passwords.empty" -}} - {{- $validationErrors := join "" .validationErrors -}} - {{- if and $validationErrors .context.Release.IsUpgrade -}} - {{- $errorString := "\nPASSWORDS ERROR: You must provide your current passwords when upgrading the release." -}} - {{- $errorString = print $errorString "\n Note that even after reinstallation, old credentials may be needed as they may be kept in persistent volume claims." -}} - {{- $errorString = print $errorString "\n Further information can be obtained at https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues/#credential-errors-while-upgrading-chart-releases" -}} - {{- $errorString = print $errorString "\n%s" -}} - {{- printf $errorString $validationErrors | fail -}} - {{- end -}} -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/_images.tpl b/postgresql-ha/charts/common/templates/_images.tpl deleted file mode 100644 index 67df923..0000000 --- a/postgresql-ha/charts/common/templates/_images.tpl +++ /dev/null @@ -1,109 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} -{{/* -Return the proper image name -{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" .Values.global ) }} -*/}} -{{- define "common.images.image" -}} -{{- $registryName := default .imageRoot.registry ((.global).imageRegistry) -}} -{{- $repositoryName := .imageRoot.repository -}} -{{- $separator := ":" -}} -{{- $termination := .imageRoot.tag | toString -}} - -{{- if .imageRoot.digest }} - {{- $separator = "@" -}} - {{- $termination = .imageRoot.digest | toString -}} -{{- end -}} -{{- if $registryName }} - {{- printf "%s/%s%s%s" $registryName $repositoryName $separator $termination -}} -{{- else -}} - {{- printf "%s%s%s" $repositoryName $separator $termination -}} -{{- end -}} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead) -{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }} -*/}} -{{- define "common.images.pullSecrets" -}} - {{- $pullSecrets := list }} - - {{- range ((.global).imagePullSecrets) -}} - {{- if kindIs "map" . -}} - {{- $pullSecrets = append $pullSecrets .name -}} - {{- else -}} - {{- $pullSecrets = append $pullSecrets . -}} - {{- end }} - {{- end -}} - - {{- range .images -}} - {{- range .pullSecrets -}} - {{- if kindIs "map" . -}} - {{- $pullSecrets = append $pullSecrets .name -}} - {{- else -}} - {{- $pullSecrets = append $pullSecrets . -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if (not (empty $pullSecrets)) }} -imagePullSecrets: - {{- range $pullSecrets | uniq }} - - name: {{ . }} - {{- end }} - {{- end }} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names evaluating values as templates -{{ include "common.images.renderPullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $) }} -*/}} -{{- define "common.images.renderPullSecrets" -}} - {{- $pullSecrets := list }} - {{- $context := .context }} - - {{- range (($context.Values.global).imagePullSecrets) -}} - {{- if kindIs "map" . -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" $context)) -}} - {{- else -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}} - {{- end -}} - {{- end -}} - - {{- range .images -}} - {{- range .pullSecrets -}} - {{- if kindIs "map" . -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" $context)) -}} - {{- else -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if (not (empty $pullSecrets)) }} -imagePullSecrets: - {{- range $pullSecrets | uniq }} - - name: {{ . }} - {{- end }} - {{- end }} -{{- end -}} - -{{/* -Return the proper image version (ingores image revision/prerelease info & fallbacks to chart appVersion) -{{ include "common.images.version" ( dict "imageRoot" .Values.path.to.the.image "chart" .Chart ) }} -*/}} -{{- define "common.images.version" -}} -{{- $imageTag := .imageRoot.tag | toString -}} -{{/* regexp from https://github.com/Masterminds/semver/blob/23f51de38a0866c5ef0bfc42b3f735c73107b700/version.go#L41-L44 */}} -{{- if regexMatch `^([0-9]+)(\.[0-9]+)?(\.[0-9]+)?(-([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?(\+([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?$` $imageTag -}} - {{- $version := semver $imageTag -}} - {{- printf "%d.%d.%d" $version.Major $version.Minor $version.Patch -}} -{{- else -}} - {{- print .chart.AppVersion -}} -{{- end -}} -{{- end -}} - diff --git a/postgresql-ha/charts/common/templates/_ingress.tpl b/postgresql-ha/charts/common/templates/_ingress.tpl deleted file mode 100644 index 7d2b879..0000000 --- a/postgresql-ha/charts/common/templates/_ingress.tpl +++ /dev/null @@ -1,73 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} - -{{/* -Generate backend entry that is compatible with all Kubernetes API versions. - -Usage: -{{ include "common.ingress.backend" (dict "serviceName" "backendName" "servicePort" "backendPort" "context" $) }} - -Params: - - serviceName - String. Name of an existing service backend - - servicePort - String/Int. Port name (or number) of the service. It will be translated to different yaml depending if it is a string or an integer. - - context - Dict - Required. The context for the template evaluation. -*/}} -{{- define "common.ingress.backend" -}} -{{- $apiVersion := (include "common.capabilities.ingress.apiVersion" .context) -}} -{{- if or (eq $apiVersion "extensions/v1beta1") (eq $apiVersion "networking.k8s.io/v1beta1") -}} -serviceName: {{ .serviceName }} -servicePort: {{ .servicePort }} -{{- else -}} -service: - name: {{ .serviceName }} - port: - {{- if typeIs "string" .servicePort }} - name: {{ .servicePort }} - {{- else if or (typeIs "int" .servicePort) (typeIs "float64" .servicePort) }} - number: {{ .servicePort | int }} - {{- end }} -{{- end -}} -{{- end -}} - -{{/* -Print "true" if the API pathType field is supported -Usage: -{{ include "common.ingress.supportsPathType" . }} -*/}} -{{- define "common.ingress.supportsPathType" -}} -{{- if (semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .)) -}} -{{- print "false" -}} -{{- else -}} -{{- print "true" -}} -{{- end -}} -{{- end -}} - -{{/* -Returns true if the ingressClassname field is supported -Usage: -{{ include "common.ingress.supportsIngressClassname" . }} -*/}} -{{- define "common.ingress.supportsIngressClassname" -}} -{{- if semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "false" -}} -{{- else -}} -{{- print "true" -}} -{{- end -}} -{{- end -}} - -{{/* -Return true if cert-manager required annotations for TLS signed -certificates are set in the Ingress annotations -Ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations -Usage: -{{ include "common.ingress.certManagerRequest" ( dict "annotations" .Values.path.to.the.ingress.annotations ) }} -*/}} -{{- define "common.ingress.certManagerRequest" -}} -{{ if or (hasKey .annotations "cert-manager.io/cluster-issuer") (hasKey .annotations "cert-manager.io/issuer") (hasKey .annotations "kubernetes.io/tls-acme") }} - {{- true -}} -{{- end -}} -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/_labels.tpl b/postgresql-ha/charts/common/templates/_labels.tpl deleted file mode 100644 index 0a0cc54..0000000 --- a/postgresql-ha/charts/common/templates/_labels.tpl +++ /dev/null @@ -1,46 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} - -{{/* -Kubernetes standard labels -{{ include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" $) -}} -*/}} -{{- define "common.labels.standard" -}} -{{- if and (hasKey . "customLabels") (hasKey . "context") -}} -{{- $default := dict "app.kubernetes.io/name" (include "common.names.name" .context) "helm.sh/chart" (include "common.names.chart" .context) "app.kubernetes.io/instance" .context.Release.Name "app.kubernetes.io/managed-by" .context.Release.Service -}} -{{- with .context.Chart.AppVersion -}} -{{- $_ := set $default "app.kubernetes.io/version" . -}} -{{- end -}} -{{ template "common.tplvalues.merge" (dict "values" (list .customLabels $default) "context" .context) }} -{{- else -}} -app.kubernetes.io/name: {{ include "common.names.name" . }} -helm.sh/chart: {{ include "common.names.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- with .Chart.AppVersion }} -app.kubernetes.io/version: {{ . | quote }} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Labels used on immutable fields such as deploy.spec.selector.matchLabels or svc.spec.selector -{{ include "common.labels.matchLabels" (dict "customLabels" .Values.podLabels "context" $) -}} - -We don't want to loop over custom labels appending them to the selector -since it's very likely that it will break deployments, services, etc. -However, it's important to overwrite the standard labels if the user -overwrote them on metadata.labels fields. -*/}} -{{- define "common.labels.matchLabels" -}} -{{- if and (hasKey . "customLabels") (hasKey . "context") -}} -{{ merge (pick (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) "app.kubernetes.io/name" "app.kubernetes.io/instance") (dict "app.kubernetes.io/name" (include "common.names.name" .context) "app.kubernetes.io/instance" .context.Release.Name ) | toYaml }} -{{- else -}} -app.kubernetes.io/name: {{ include "common.names.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end -}} -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/_names.tpl b/postgresql-ha/charts/common/templates/_names.tpl deleted file mode 100644 index ba83956..0000000 --- a/postgresql-ha/charts/common/templates/_names.tpl +++ /dev/null @@ -1,71 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "common.names.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "common.names.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "common.names.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create a default fully qualified dependency name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -Usage: -{{ include "common.names.dependency.fullname" (dict "chartName" "dependency-chart-name" "chartValues" .Values.dependency-chart "context" $) }} -*/}} -{{- define "common.names.dependency.fullname" -}} -{{- if .chartValues.fullnameOverride -}} -{{- .chartValues.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .chartName .chartValues.nameOverride -}} -{{- if contains $name .context.Release.Name -}} -{{- .context.Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .context.Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Allow the release namespace to be overridden for multi-namespace deployments in combined charts. -*/}} -{{- define "common.names.namespace" -}} -{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a fully qualified app name adding the installation's namespace. -*/}} -{{- define "common.names.fullname.namespace" -}} -{{- printf "%s-%s" (include "common.names.fullname" .) (include "common.names.namespace" .) | trunc 63 | trimSuffix "-" -}} -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/_resources.tpl b/postgresql-ha/charts/common/templates/_resources.tpl deleted file mode 100644 index a4f53c2..0000000 --- a/postgresql-ha/charts/common/templates/_resources.tpl +++ /dev/null @@ -1,50 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} - -{{/* -Return a resource request/limit object based on a given preset. -These presets are for basic testing and not meant to be used in production -{{ include "common.resources.preset" (dict "type" "nano") -}} -*/}} -{{- define "common.resources.preset" -}} -{{/* The limits are the requests increased by 50% (except ephemeral-storage and xlarge/2xlarge sizes)*/}} -{{- $presets := dict - "nano" (dict - "requests" (dict "cpu" "100m" "memory" "128Mi" "ephemeral-storage" "50Mi") - "limits" (dict "cpu" "150m" "memory" "192Mi" "ephemeral-storage" "1024Mi") - ) - "micro" (dict - "requests" (dict "cpu" "250m" "memory" "256Mi" "ephemeral-storage" "50Mi") - "limits" (dict "cpu" "375m" "memory" "384Mi" "ephemeral-storage" "1024Mi") - ) - "small" (dict - "requests" (dict "cpu" "500m" "memory" "512Mi" "ephemeral-storage" "50Mi") - "limits" (dict "cpu" "750m" "memory" "768Mi" "ephemeral-storage" "1024Mi") - ) - "medium" (dict - "requests" (dict "cpu" "500m" "memory" "1024Mi" "ephemeral-storage" "50Mi") - "limits" (dict "cpu" "750m" "memory" "1536Mi" "ephemeral-storage" "1024Mi") - ) - "large" (dict - "requests" (dict "cpu" "1.0" "memory" "2048Mi" "ephemeral-storage" "50Mi") - "limits" (dict "cpu" "1.5" "memory" "3072Mi" "ephemeral-storage" "1024Mi") - ) - "xlarge" (dict - "requests" (dict "cpu" "1.5" "memory" "4096Mi" "ephemeral-storage" "50Mi") - "limits" (dict "cpu" "3.0" "memory" "6144Mi" "ephemeral-storage" "1024Mi") - ) - "2xlarge" (dict - "requests" (dict "cpu" "1.5" "memory" "4096Mi" "ephemeral-storage" "50Mi") - "limits" (dict "cpu" "6.0" "memory" "12288Mi" "ephemeral-storage" "1024Mi") - ) - }} -{{- if hasKey $presets .type -}} -{{- index $presets .type | toYaml -}} -{{- else -}} -{{- printf "ERROR: Preset key '%s' invalid. Allowed values are %s" .type (join "," (keys $presets)) | fail -}} -{{- end -}} -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/_secrets.tpl b/postgresql-ha/charts/common/templates/_secrets.tpl deleted file mode 100644 index e87575a..0000000 --- a/postgresql-ha/charts/common/templates/_secrets.tpl +++ /dev/null @@ -1,182 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} -{{/* -Generate secret name. - -Usage: -{{ include "common.secrets.name" (dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $) }} - -Params: - - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user - to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility. - +info: https://github.com/bitnami/charts/tree/main/bitnami/common#existingsecret - - defaultNameSuffix - String - Optional. It is used only if we have several secrets in the same deployment. - - context - Dict - Required. The context for the template evaluation. -*/}} -{{- define "common.secrets.name" -}} -{{- $name := (include "common.names.fullname" .context) -}} - -{{- if .defaultNameSuffix -}} -{{- $name = printf "%s-%s" $name .defaultNameSuffix | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{- with .existingSecret -}} -{{- if not (typeIs "string" .) -}} -{{- with .name -}} -{{- $name = . -}} -{{- end -}} -{{- else -}} -{{- $name = . -}} -{{- end -}} -{{- end -}} - -{{- printf "%s" $name -}} -{{- end -}} - -{{/* -Generate secret key. - -Usage: -{{ include "common.secrets.key" (dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName") }} - -Params: - - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user - to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility. - +info: https://github.com/bitnami/charts/tree/main/bitnami/common#existingsecret - - key - String - Required. Name of the key in the secret. -*/}} -{{- define "common.secrets.key" -}} -{{- $key := .key -}} - -{{- if .existingSecret -}} - {{- if not (typeIs "string" .existingSecret) -}} - {{- if .existingSecret.keyMapping -}} - {{- $key = index .existingSecret.keyMapping $.key -}} - {{- end -}} - {{- end }} -{{- end -}} - -{{- printf "%s" $key -}} -{{- end -}} - -{{/* -Generate secret password or retrieve one if already created. - -Usage: -{{ include "common.secrets.passwords.manage" (dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $) }} - -Params: - - secret - String - Required - Name of the 'Secret' resource where the password is stored. - - key - String - Required - Name of the key in the secret. - - providedValues - List - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value. - - length - int - Optional - Length of the generated random password. - - strong - Boolean - Optional - Whether to add symbols to the generated random password. - - chartName - String - Optional - Name of the chart used when said chart is deployed as a subchart. - - context - Context - Required - Parent context. - - failOnNew - Boolean - Optional - Default to true. If set to false, skip errors adding new keys to existing secrets. - - skipB64enc - Boolean - Optional - Default to false. If set to true, no the secret will not be base64 encrypted. - - skipQuote - Boolean - Optional - Default to false. If set to true, no quotes will be added around the secret. -The order in which this function returns a secret password: - 1. Already existing 'Secret' resource - (If a 'Secret' resource is found under the name provided to the 'secret' parameter to this function and that 'Secret' resource contains a key with the name passed as the 'key' parameter to this function then the value of this existing secret password will be returned) - 2. Password provided via the values.yaml - (If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned) - 3. Randomly generated secret password - (A new random secret password with the length specified in the 'length' parameter will be generated and returned) - -*/}} -{{- define "common.secrets.passwords.manage" -}} - -{{- $password := "" }} -{{- $subchart := "" }} -{{- $chartName := default "" .chartName }} -{{- $passwordLength := default 10 .length }} -{{- $providedPasswordKey := include "common.utils.getKeyFromList" (dict "keys" .providedValues "context" $.context) }} -{{- $providedPasswordValue := include "common.utils.getValueFromKey" (dict "key" $providedPasswordKey "context" $.context) }} -{{- $secretData := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret).data }} -{{- if $secretData }} - {{- if hasKey $secretData .key }} - {{- $password = index $secretData .key | b64dec }} - {{- else if not (eq .failOnNew false) }} - {{- printf "\nPASSWORDS ERROR: The secret \"%s\" does not contain the key \"%s\"\n" .secret .key | fail -}} - {{- else if $providedPasswordValue }} - {{- $password = $providedPasswordValue | toString }} - {{- end -}} -{{- else if $providedPasswordValue }} - {{- $password = $providedPasswordValue | toString }} -{{- else }} - - {{- if .context.Values.enabled }} - {{- $subchart = $chartName }} - {{- end -}} - - {{- $requiredPassword := dict "valueKey" $providedPasswordKey "secret" .secret "field" .key "subchart" $subchart "context" $.context -}} - {{- $requiredPasswordError := include "common.validations.values.single.empty" $requiredPassword -}} - {{- $passwordValidationErrors := list $requiredPasswordError -}} - {{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $.context) -}} - - {{- if .strong }} - {{- $subStr := list (lower (randAlpha 1)) (randNumeric 1) (upper (randAlpha 1)) | join "_" }} - {{- $password = randAscii $passwordLength }} - {{- $password = regexReplaceAllLiteral "\\W" $password "@" | substr 5 $passwordLength }} - {{- $password = printf "%s%s" $subStr $password | toString | shuffle }} - {{- else }} - {{- $password = randAlphaNum $passwordLength }} - {{- end }} -{{- end -}} -{{- if not .skipB64enc }} -{{- $password = $password | b64enc }} -{{- end -}} -{{- if .skipQuote -}} -{{- printf "%s" $password -}} -{{- else -}} -{{- printf "%s" $password | quote -}} -{{- end -}} -{{- end -}} - -{{/* -Reuses the value from an existing secret, otherwise sets its value to a default value. - -Usage: -{{ include "common.secrets.lookup" (dict "secret" "secret-name" "key" "keyName" "defaultValue" .Values.myValue "context" $) }} - -Params: - - secret - String - Required - Name of the 'Secret' resource where the password is stored. - - key - String - Required - Name of the key in the secret. - - defaultValue - String - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value. - - context - Context - Required - Parent context. - -*/}} -{{- define "common.secrets.lookup" -}} -{{- $value := "" -}} -{{- $secretData := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret).data -}} -{{- if and $secretData (hasKey $secretData .key) -}} - {{- $value = index $secretData .key -}} -{{- else if .defaultValue -}} - {{- $value = .defaultValue | toString | b64enc -}} -{{- end -}} -{{- if $value -}} -{{- printf "%s" $value -}} -{{- end -}} -{{- end -}} - -{{/* -Returns whether a previous generated secret already exists - -Usage: -{{ include "common.secrets.exists" (dict "secret" "secret-name" "context" $) }} - -Params: - - secret - String - Required - Name of the 'Secret' resource where the password is stored. - - context - Context - Required - Parent context. -*/}} -{{- define "common.secrets.exists" -}} -{{- $secret := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret) }} -{{- if $secret }} - {{- true -}} -{{- end -}} -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/_storage.tpl b/postgresql-ha/charts/common/templates/_storage.tpl deleted file mode 100644 index 7780da1..0000000 --- a/postgresql-ha/charts/common/templates/_storage.tpl +++ /dev/null @@ -1,22 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} -{{/* -Return the proper Storage Class -{{ include "common.storage.class" ( dict "persistence" .Values.path.to.the.persistence "global" $) }} -*/}} -{{- define "common.storage.class" -}} - -{{- $storageClass := default .persistence.storageClass ((.global).storageClass) -}} -{{- if $storageClass -}} - {{- if (eq "-" $storageClass) -}} - {{- printf "storageClassName: \"\"" -}} - {{- else }} - {{- printf "storageClassName: %s" $storageClass -}} - {{- end -}} -{{- end -}} - -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/_tplvalues.tpl b/postgresql-ha/charts/common/templates/_tplvalues.tpl deleted file mode 100644 index c84d72c..0000000 --- a/postgresql-ha/charts/common/templates/_tplvalues.tpl +++ /dev/null @@ -1,38 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} -{{/* -Renders a value that contains template perhaps with scope if the scope is present. -Usage: -{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ ) }} -{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ "scope" $app ) }} -*/}} -{{- define "common.tplvalues.render" -}} -{{- $value := typeIs "string" .value | ternary .value (.value | toYaml) }} -{{- if contains "{{" (toJson .value) }} - {{- if .scope }} - {{- tpl (cat "{{- with $.RelativeScope -}}" $value "{{- end }}") (merge (dict "RelativeScope" .scope) .context) }} - {{- else }} - {{- tpl $value .context }} - {{- end }} -{{- else }} - {{- $value }} -{{- end }} -{{- end -}} - -{{/* -Merge a list of values that contains template after rendering them. -Merge precedence is consistent with http://masterminds.github.io/sprig/dicts.html#merge-mustmerge -Usage: -{{ include "common.tplvalues.merge" ( dict "values" (list .Values.path.to.the.Value1 .Values.path.to.the.Value2) "context" $ ) }} -*/}} -{{- define "common.tplvalues.merge" -}} -{{- $dst := dict -}} -{{- range .values -}} -{{- $dst = include "common.tplvalues.render" (dict "value" . "context" $.context "scope" $.scope) | fromYaml | merge $dst -}} -{{- end -}} -{{ $dst | toYaml }} -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/_utils.tpl b/postgresql-ha/charts/common/templates/_utils.tpl deleted file mode 100644 index d53c74a..0000000 --- a/postgresql-ha/charts/common/templates/_utils.tpl +++ /dev/null @@ -1,77 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} -{{/* -Print instructions to get a secret value. -Usage: -{{ include "common.utils.secret.getvalue" (dict "secret" "secret-name" "field" "secret-value-field" "context" $) }} -*/}} -{{- define "common.utils.secret.getvalue" -}} -{{- $varname := include "common.utils.fieldToEnvVar" . -}} -export {{ $varname }}=$(kubectl get secret --namespace {{ include "common.names.namespace" .context | quote }} {{ .secret }} -o jsonpath="{.data.{{ .field }}}" | base64 -d) -{{- end -}} - -{{/* -Build env var name given a field -Usage: -{{ include "common.utils.fieldToEnvVar" dict "field" "my-password" }} -*/}} -{{- define "common.utils.fieldToEnvVar" -}} - {{- $fieldNameSplit := splitList "-" .field -}} - {{- $upperCaseFieldNameSplit := list -}} - - {{- range $fieldNameSplit -}} - {{- $upperCaseFieldNameSplit = append $upperCaseFieldNameSplit ( upper . ) -}} - {{- end -}} - - {{ join "_" $upperCaseFieldNameSplit }} -{{- end -}} - -{{/* -Gets a value from .Values given -Usage: -{{ include "common.utils.getValueFromKey" (dict "key" "path.to.key" "context" $) }} -*/}} -{{- define "common.utils.getValueFromKey" -}} -{{- $splitKey := splitList "." .key -}} -{{- $value := "" -}} -{{- $latestObj := $.context.Values -}} -{{- range $splitKey -}} - {{- if not $latestObj -}} - {{- printf "please review the entire path of '%s' exists in values" $.key | fail -}} - {{- end -}} - {{- $value = ( index $latestObj . ) -}} - {{- $latestObj = $value -}} -{{- end -}} -{{- printf "%v" (default "" $value) -}} -{{- end -}} - -{{/* -Returns first .Values key with a defined value or first of the list if all non-defined -Usage: -{{ include "common.utils.getKeyFromList" (dict "keys" (list "path.to.key1" "path.to.key2") "context" $) }} -*/}} -{{- define "common.utils.getKeyFromList" -}} -{{- $key := first .keys -}} -{{- $reverseKeys := reverse .keys }} -{{- range $reverseKeys }} - {{- $value := include "common.utils.getValueFromKey" (dict "key" . "context" $.context ) }} - {{- if $value -}} - {{- $key = . }} - {{- end -}} -{{- end -}} -{{- printf "%s" $key -}} -{{- end -}} - -{{/* -Checksum a template at "path" containing a *single* resource (ConfigMap,Secret) for use in pod annotations, excluding the metadata (see #18376). -Usage: -{{ include "common.utils.checksumTemplate" (dict "path" "/configmap.yaml" "context" $) }} -*/}} -{{- define "common.utils.checksumTemplate" -}} -{{- $obj := include (print .context.Template.BasePath .path) .context | fromYaml -}} -{{ omit $obj "apiVersion" "kind" "metadata" | toYaml | sha256sum }} -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/_warnings.tpl b/postgresql-ha/charts/common/templates/_warnings.tpl deleted file mode 100644 index e4dbecd..0000000 --- a/postgresql-ha/charts/common/templates/_warnings.tpl +++ /dev/null @@ -1,109 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} -{{/* -Warning about using rolling tag. -Usage: -{{ include "common.warnings.rollingTag" .Values.path.to.the.imageRoot }} -*/}} -{{- define "common.warnings.rollingTag" -}} - -{{- if and (contains "bitnami/" .repository) (not (.tag | toString | regexFind "-r\\d+$|sha256:")) }} -WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. -+info https://docs.vmware.com/en/VMware-Tanzu-Application-Catalog/services/tutorials/GUID-understand-rolling-tags-containers-index.html -{{- end }} -{{- end -}} - -{{/* -Warning about replaced images from the original. -Usage: -{{ include "common.warnings.modifiedImages" (dict "images" (list .Values.path.to.the.imageRoot) "context" $) }} -*/}} -{{- define "common.warnings.modifiedImages" -}} -{{- $affectedImages := list -}} -{{- $printMessage := false -}} -{{- $originalImages := .context.Chart.Annotations.images -}} -{{- range .images -}} - {{- $fullImageName := printf (printf "%s/%s:%s" .registry .repository .tag) -}} - {{- if not (contains $fullImageName $originalImages) }} - {{- $affectedImages = append $affectedImages (printf "%s/%s:%s" .registry .repository .tag) -}} - {{- $printMessage = true -}} - {{- end -}} -{{- end -}} -{{- if $printMessage }} - -⚠ SECURITY WARNING: Original containers have been substituted. This Helm chart was designed, tested, and validated on multiple platforms using a specific set of Bitnami and Tanzu Application Catalog containers. Substituting other containers is likely to cause degraded security and performance, broken chart features, and missing environment variables. - -Substituted images detected: -{{- range $affectedImages }} - - {{ . }} -{{- end }} -{{- end -}} -{{- end -}} - -{{/* -Warning about not setting the resource object in all deployments. -Usage: -{{ include "common.warnings.resources" (dict "sections" (list "path1" "path2") context $) }} -Example: -{{- include "common.warnings.resources" (dict "sections" (list "csiProvider.provider" "server" "volumePermissions" "") "context" $) }} -The list in the example assumes that the following values exist: - - csiProvider.provider.resources - - server.resources - - volumePermissions.resources - - resources -*/}} -{{- define "common.warnings.resources" -}} -{{- $values := .context.Values -}} -{{- $printMessage := false -}} -{{ $affectedSections := list -}} -{{- range .sections -}} - {{- if eq . "" -}} - {{/* Case where the resources section is at the root (one main deployment in the chart) */}} - {{- if not (index $values "resources") -}} - {{- $affectedSections = append $affectedSections "resources" -}} - {{- $printMessage = true -}} - {{- end -}} - {{- else -}} - {{/* Case where the are multiple resources sections (more than one main deployment in the chart) */}} - {{- $keys := split "." . -}} - {{/* We iterate through the different levels until arriving to the resource section. Example: a.b.c.resources */}} - {{- $section := $values -}} - {{- range $keys -}} - {{- $section = index $section . -}} - {{- end -}} - {{- if not (index $section "resources") -}} - {{/* If the section has enabled=false or replicaCount=0, do not include it */}} - {{- if and (hasKey $section "enabled") -}} - {{- if index $section "enabled" -}} - {{/* enabled=true */}} - {{- $affectedSections = append $affectedSections (printf "%s.resources" .) -}} - {{- $printMessage = true -}} - {{- end -}} - {{- else if and (hasKey $section "replicaCount") -}} - {{/* We need a casting to int because number 0 is not treated as an int by default */}} - {{- if (gt (index $section "replicaCount" | int) 0) -}} - {{/* replicaCount > 0 */}} - {{- $affectedSections = append $affectedSections (printf "%s.resources" .) -}} - {{- $printMessage = true -}} - {{- end -}} - {{- else -}} - {{/* Default case, add it to the affected sections */}} - {{- $affectedSections = append $affectedSections (printf "%s.resources" .) -}} - {{- $printMessage = true -}} - {{- end -}} - {{- end -}} - {{- end -}} -{{- end -}} -{{- if $printMessage }} - -WARNING: There are "resources" sections in the chart not set. Using "resourcesPreset" is not recommended for production. For production installations, please set the following values according to your workload needs: -{{- range $affectedSections }} - - {{ . }} -{{- end }} -+info https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -{{- end -}} -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/validations/_cassandra.tpl b/postgresql-ha/charts/common/templates/validations/_cassandra.tpl deleted file mode 100644 index 3f41ff8..0000000 --- a/postgresql-ha/charts/common/templates/validations/_cassandra.tpl +++ /dev/null @@ -1,77 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} -{{/* -Validate Cassandra required passwords are not empty. - -Usage: -{{ include "common.validations.values.cassandra.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where Cassandra values are stored, e.g: "cassandra-passwords-secret" - - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.cassandra.passwords" -}} - {{- $existingSecret := include "common.cassandra.values.existingSecret" . -}} - {{- $enabled := include "common.cassandra.values.enabled" . -}} - {{- $dbUserPrefix := include "common.cassandra.values.key.dbUser" . -}} - {{- $valueKeyPassword := printf "%s.password" $dbUserPrefix -}} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "cassandra-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.cassandra.values.existingSecret" (dict "context" $) }} -Params: - - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false -*/}} -{{- define "common.cassandra.values.existingSecret" -}} - {{- if .subchart -}} - {{- .context.Values.cassandra.dbUser.existingSecret | quote -}} - {{- else -}} - {{- .context.Values.dbUser.existingSecret | quote -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled cassandra. - -Usage: -{{ include "common.cassandra.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.cassandra.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.cassandra.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key dbUser - -Usage: -{{ include "common.cassandra.values.key.dbUser" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false -*/}} -{{- define "common.cassandra.values.key.dbUser" -}} - {{- if .subchart -}} - cassandra.dbUser - {{- else -}} - dbUser - {{- end -}} -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/validations/_mariadb.tpl b/postgresql-ha/charts/common/templates/validations/_mariadb.tpl deleted file mode 100644 index 6ea8c0f..0000000 --- a/postgresql-ha/charts/common/templates/validations/_mariadb.tpl +++ /dev/null @@ -1,108 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} -{{/* -Validate MariaDB required passwords are not empty. - -Usage: -{{ include "common.validations.values.mariadb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where MariaDB values are stored, e.g: "mysql-passwords-secret" - - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.mariadb.passwords" -}} - {{- $existingSecret := include "common.mariadb.values.auth.existingSecret" . -}} - {{- $enabled := include "common.mariadb.values.enabled" . -}} - {{- $architecture := include "common.mariadb.values.architecture" . -}} - {{- $authPrefix := include "common.mariadb.values.key.auth" . -}} - {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} - {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} - {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} - {{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mariadb-root-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} - - {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} - {{- if not (empty $valueUsername) -}} - {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mariadb-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} - {{- end -}} - - {{- if (eq $architecture "replication") -}} - {{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mariadb-replication-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.mariadb.values.auth.existingSecret" (dict "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false -*/}} -{{- define "common.mariadb.values.auth.existingSecret" -}} - {{- if .subchart -}} - {{- .context.Values.mariadb.auth.existingSecret | quote -}} - {{- else -}} - {{- .context.Values.auth.existingSecret | quote -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled mariadb. - -Usage: -{{ include "common.mariadb.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.mariadb.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.mariadb.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for architecture - -Usage: -{{ include "common.mariadb.values.architecture" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false -*/}} -{{- define "common.mariadb.values.architecture" -}} - {{- if .subchart -}} - {{- .context.Values.mariadb.architecture -}} - {{- else -}} - {{- .context.Values.architecture -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key auth - -Usage: -{{ include "common.mariadb.values.key.auth" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false -*/}} -{{- define "common.mariadb.values.key.auth" -}} - {{- if .subchart -}} - mariadb.auth - {{- else -}} - auth - {{- end -}} -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/validations/_mongodb.tpl b/postgresql-ha/charts/common/templates/validations/_mongodb.tpl deleted file mode 100644 index d4cd38c..0000000 --- a/postgresql-ha/charts/common/templates/validations/_mongodb.tpl +++ /dev/null @@ -1,113 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} -{{/* -Validate MongoDB® required passwords are not empty. - -Usage: -{{ include "common.validations.values.mongodb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where MongoDB® values are stored, e.g: "mongodb-passwords-secret" - - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.mongodb.passwords" -}} - {{- $existingSecret := include "common.mongodb.values.auth.existingSecret" . -}} - {{- $enabled := include "common.mongodb.values.enabled" . -}} - {{- $authPrefix := include "common.mongodb.values.key.auth" . -}} - {{- $architecture := include "common.mongodb.values.architecture" . -}} - {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} - {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} - {{- $valueKeyDatabase := printf "%s.database" $authPrefix -}} - {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} - {{- $valueKeyReplicaSetKey := printf "%s.replicaSetKey" $authPrefix -}} - {{- $valueKeyAuthEnabled := printf "%s.enabled" $authPrefix -}} - - {{- $authEnabled := include "common.utils.getValueFromKey" (dict "key" $valueKeyAuthEnabled "context" .context) -}} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") (eq $authEnabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mongodb-root-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} - - {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} - {{- $valueDatabase := include "common.utils.getValueFromKey" (dict "key" $valueKeyDatabase "context" .context) }} - {{- if and $valueUsername $valueDatabase -}} - {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mongodb-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} - {{- end -}} - - {{- if (eq $architecture "replicaset") -}} - {{- $requiredReplicaSetKey := dict "valueKey" $valueKeyReplicaSetKey "secret" .secret "field" "mongodb-replica-set-key" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredReplicaSetKey -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.mongodb.values.auth.existingSecret" (dict "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MongoDb is used as subchart or not. Default: false -*/}} -{{- define "common.mongodb.values.auth.existingSecret" -}} - {{- if .subchart -}} - {{- .context.Values.mongodb.auth.existingSecret | quote -}} - {{- else -}} - {{- .context.Values.auth.existingSecret | quote -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled mongodb. - -Usage: -{{ include "common.mongodb.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.mongodb.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.mongodb.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key auth - -Usage: -{{ include "common.mongodb.values.key.auth" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false -*/}} -{{- define "common.mongodb.values.key.auth" -}} - {{- if .subchart -}} - mongodb.auth - {{- else -}} - auth - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for architecture - -Usage: -{{ include "common.mongodb.values.architecture" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false -*/}} -{{- define "common.mongodb.values.architecture" -}} - {{- if .subchart -}} - {{- .context.Values.mongodb.architecture -}} - {{- else -}} - {{- .context.Values.architecture -}} - {{- end -}} -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/validations/_mysql.tpl b/postgresql-ha/charts/common/templates/validations/_mysql.tpl deleted file mode 100644 index 924812a..0000000 --- a/postgresql-ha/charts/common/templates/validations/_mysql.tpl +++ /dev/null @@ -1,108 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} -{{/* -Validate MySQL required passwords are not empty. - -Usage: -{{ include "common.validations.values.mysql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where MySQL values are stored, e.g: "mysql-passwords-secret" - - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.mysql.passwords" -}} - {{- $existingSecret := include "common.mysql.values.auth.existingSecret" . -}} - {{- $enabled := include "common.mysql.values.enabled" . -}} - {{- $architecture := include "common.mysql.values.architecture" . -}} - {{- $authPrefix := include "common.mysql.values.key.auth" . -}} - {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} - {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} - {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} - {{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mysql-root-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} - - {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} - {{- if not (empty $valueUsername) -}} - {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mysql-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} - {{- end -}} - - {{- if (eq $architecture "replication") -}} - {{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mysql-replication-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.mysql.values.auth.existingSecret" (dict "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false -*/}} -{{- define "common.mysql.values.auth.existingSecret" -}} - {{- if .subchart -}} - {{- .context.Values.mysql.auth.existingSecret | quote -}} - {{- else -}} - {{- .context.Values.auth.existingSecret | quote -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled mysql. - -Usage: -{{ include "common.mysql.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.mysql.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.mysql.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for architecture - -Usage: -{{ include "common.mysql.values.architecture" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false -*/}} -{{- define "common.mysql.values.architecture" -}} - {{- if .subchart -}} - {{- .context.Values.mysql.architecture -}} - {{- else -}} - {{- .context.Values.architecture -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key auth - -Usage: -{{ include "common.mysql.values.key.auth" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false -*/}} -{{- define "common.mysql.values.key.auth" -}} - {{- if .subchart -}} - mysql.auth - {{- else -}} - auth - {{- end -}} -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/validations/_postgresql.tpl b/postgresql-ha/charts/common/templates/validations/_postgresql.tpl deleted file mode 100644 index 0fa0b14..0000000 --- a/postgresql-ha/charts/common/templates/validations/_postgresql.tpl +++ /dev/null @@ -1,134 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} -{{/* -Validate PostgreSQL required passwords are not empty. - -Usage: -{{ include "common.validations.values.postgresql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where postgresql values are stored, e.g: "postgresql-passwords-secret" - - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.postgresql.passwords" -}} - {{- $existingSecret := include "common.postgresql.values.existingSecret" . -}} - {{- $enabled := include "common.postgresql.values.enabled" . -}} - {{- $valueKeyPostgresqlPassword := include "common.postgresql.values.key.postgressPassword" . -}} - {{- $valueKeyPostgresqlReplicationEnabled := include "common.postgresql.values.key.replicationPassword" . -}} - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - {{- $requiredPostgresqlPassword := dict "valueKey" $valueKeyPostgresqlPassword "secret" .secret "field" "postgresql-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlPassword -}} - - {{- $enabledReplication := include "common.postgresql.values.enabled.replication" . -}} - {{- if (eq $enabledReplication "true") -}} - {{- $requiredPostgresqlReplicationPassword := dict "valueKey" $valueKeyPostgresqlReplicationEnabled "secret" .secret "field" "postgresql-replication-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlReplicationPassword -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to decide whether evaluate global values. - -Usage: -{{ include "common.postgresql.values.use.global" (dict "key" "key-of-global" "context" $) }} -Params: - - key - String - Required. Field to be evaluated within global, e.g: "existingSecret" -*/}} -{{- define "common.postgresql.values.use.global" -}} - {{- if .context.Values.global -}} - {{- if .context.Values.global.postgresql -}} - {{- index .context.Values.global.postgresql .key | quote -}} - {{- end -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.postgresql.values.existingSecret" (dict "context" $) }} -*/}} -{{- define "common.postgresql.values.existingSecret" -}} - {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "existingSecret" "context" .context) -}} - - {{- if .subchart -}} - {{- default (.context.Values.postgresql.existingSecret | quote) $globalValue -}} - {{- else -}} - {{- default (.context.Values.existingSecret | quote) $globalValue -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled postgresql. - -Usage: -{{ include "common.postgresql.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.postgresql.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.postgresql.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key postgressPassword. - -Usage: -{{ include "common.postgresql.values.key.postgressPassword" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false -*/}} -{{- define "common.postgresql.values.key.postgressPassword" -}} - {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "postgresqlUsername" "context" .context) -}} - - {{- if not $globalValue -}} - {{- if .subchart -}} - postgresql.postgresqlPassword - {{- else -}} - postgresqlPassword - {{- end -}} - {{- else -}} - global.postgresql.postgresqlPassword - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled.replication. - -Usage: -{{ include "common.postgresql.values.enabled.replication" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false -*/}} -{{- define "common.postgresql.values.enabled.replication" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.postgresql.replication.enabled -}} - {{- else -}} - {{- printf "%v" .context.Values.replication.enabled -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key replication.password. - -Usage: -{{ include "common.postgresql.values.key.replicationPassword" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false -*/}} -{{- define "common.postgresql.values.key.replicationPassword" -}} - {{- if .subchart -}} - postgresql.replication.password - {{- else -}} - replication.password - {{- end -}} -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/validations/_redis.tpl b/postgresql-ha/charts/common/templates/validations/_redis.tpl deleted file mode 100644 index f477825..0000000 --- a/postgresql-ha/charts/common/templates/validations/_redis.tpl +++ /dev/null @@ -1,81 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - - -{{/* vim: set filetype=mustache: */}} -{{/* -Validate Redis® required passwords are not empty. - -Usage: -{{ include "common.validations.values.redis.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where redis values are stored, e.g: "redis-passwords-secret" - - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.redis.passwords" -}} - {{- $enabled := include "common.redis.values.enabled" . -}} - {{- $valueKeyPrefix := include "common.redis.values.keys.prefix" . -}} - {{- $standarizedVersion := include "common.redis.values.standarized.version" . }} - - {{- $existingSecret := ternary (printf "%s%s" $valueKeyPrefix "auth.existingSecret") (printf "%s%s" $valueKeyPrefix "existingSecret") (eq $standarizedVersion "true") }} - {{- $existingSecretValue := include "common.utils.getValueFromKey" (dict "key" $existingSecret "context" .context) }} - - {{- $valueKeyRedisPassword := ternary (printf "%s%s" $valueKeyPrefix "auth.password") (printf "%s%s" $valueKeyPrefix "password") (eq $standarizedVersion "true") }} - {{- $valueKeyRedisUseAuth := ternary (printf "%s%s" $valueKeyPrefix "auth.enabled") (printf "%s%s" $valueKeyPrefix "usePassword") (eq $standarizedVersion "true") }} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $useAuth := include "common.utils.getValueFromKey" (dict "key" $valueKeyRedisUseAuth "context" .context) -}} - {{- if eq $useAuth "true" -}} - {{- $requiredRedisPassword := dict "valueKey" $valueKeyRedisPassword "secret" .secret "field" "redis-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredRedisPassword -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled redis. - -Usage: -{{ include "common.redis.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.redis.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.redis.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right prefix path for the values - -Usage: -{{ include "common.redis.values.key.prefix" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false -*/}} -{{- define "common.redis.values.keys.prefix" -}} - {{- if .subchart -}}redis.{{- else -}}{{- end -}} -{{- end -}} - -{{/* -Checks whether the redis chart's includes the standarizations (version >= 14) - -Usage: -{{ include "common.redis.values.standarized.version" (dict "context" $) }} -*/}} -{{- define "common.redis.values.standarized.version" -}} - - {{- $standarizedAuth := printf "%s%s" (include "common.redis.values.keys.prefix" .) "auth" -}} - {{- $standarizedAuthValues := include "common.utils.getValueFromKey" (dict "key" $standarizedAuth "context" .context) }} - - {{- if $standarizedAuthValues -}} - {{- true -}} - {{- end -}} -{{- end -}} diff --git a/postgresql-ha/charts/common/templates/validations/_validations.tpl b/postgresql-ha/charts/common/templates/validations/_validations.tpl deleted file mode 100644 index 7cdee61..0000000 --- a/postgresql-ha/charts/common/templates/validations/_validations.tpl +++ /dev/null @@ -1,51 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} -{{/* -Validate values must not be empty. - -Usage: -{{- $validateValueConf00 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-00") -}} -{{- $validateValueConf01 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-01") -}} -{{ include "common.validations.values.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} - -Validate value params: - - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" - - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" - - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" -*/}} -{{- define "common.validations.values.multiple.empty" -}} - {{- range .required -}} - {{- include "common.validations.values.single.empty" (dict "valueKey" .valueKey "secret" .secret "field" .field "context" $.context) -}} - {{- end -}} -{{- end -}} - -{{/* -Validate a value must not be empty. - -Usage: -{{ include "common.validations.value.empty" (dict "valueKey" "mariadb.password" "secret" "secretName" "field" "my-password" "subchart" "subchart" "context" $) }} - -Validate value params: - - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" - - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" - - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" - - subchart - String - Optional - Name of the subchart that the validated password is part of. -*/}} -{{- define "common.validations.values.single.empty" -}} - {{- $value := include "common.utils.getValueFromKey" (dict "key" .valueKey "context" .context) }} - {{- $subchart := ternary "" (printf "%s." .subchart) (empty .subchart) }} - - {{- if not $value -}} - {{- $varname := "my-value" -}} - {{- $getCurrentValue := "" -}} - {{- if and .secret .field -}} - {{- $varname = include "common.utils.fieldToEnvVar" . -}} - {{- $getCurrentValue = printf " To get the current value:\n\n %s\n" (include "common.utils.secret.getvalue" .) -}} - {{- end -}} - {{- printf "\n '%s' must not be empty, please add '--set %s%s=$%s' to the command.%s" .valueKey $subchart .valueKey $varname $getCurrentValue -}} - {{- end -}} -{{- end -}} diff --git a/postgresql-ha/charts/common/values.yaml b/postgresql-ha/charts/common/values.yaml deleted file mode 100644 index de2cac5..0000000 --- a/postgresql-ha/charts/common/values.yaml +++ /dev/null @@ -1,8 +0,0 @@ -# Copyright Broadcom, Inc. All Rights Reserved. -# SPDX-License-Identifier: APACHE-2.0 - -## bitnami/common -## It is required by CI/CD tools and processes. -## @skip exampleValue -## -exampleValue: common-chart diff --git a/postgresql-ha/templates/NOTES.txt b/postgresql-ha/templates/NOTES.txt deleted file mode 100644 index 11ee289..0000000 --- a/postgresql-ha/templates/NOTES.txt +++ /dev/null @@ -1,109 +0,0 @@ -CHART NAME: {{ .Chart.Name }} -CHART VERSION: {{ .Chart.Version }} -APP VERSION: {{ .Chart.AppVersion }} - -{{- $clusterDomain:= .Values.clusterDomain }} -** Please be patient while the chart is being deployed ** - -{{- if .Values.diagnosticMode.enabled }} -The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with: - - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }} - -Get the list of pods by executing: - - kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }} - -Access the pod you want to debug by executing - - kubectl exec --namespace {{ .Release.Namespace }} -ti -- bash - -In order to replicate the container startup scripts, check the /opt/bitnami/scripts folder. - - Default PostgreSQL startup command - - /opt/bitnami/scripts/postgresql-repmgr/entrypoint.sh /opt/bitnami/scripts/postgresql-repmgr/run.sh - - Default PgPool startup command - - /opt/bitnami/scripts/pgpool/entrypoint.sh /opt/bitnami/scripts/pgpool/run.sh - -{{- else }} -PostgreSQL can be accessed through Pgpool via port {{ .Values.service.ports.postgresql }} on the following DNS name from within your cluster: - - {{ include "postgresql-ha.pgpool" . }}.{{ .Release.Namespace }}.svc.{{ $clusterDomain }} - -Pgpool acts as a load balancer for PostgreSQL and forward read/write connections to the primary node while read-only connections are forwarded to standby nodes. - -To get the password for {{ (include "postgresql-ha.postgresqlUsername" .) | quote }} run: - - export POSTGRES_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "postgresql-ha.postgresqlSecretName" . }} -o jsonpath="{.data.password}" | base64 -d) - -To get the password for {{ (include "postgresql-ha.postgresqlRepmgrUsername" .) | quote }} run: - - export REPMGR_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "postgresql-ha.postgresqlSecretName" . }} -o jsonpath="{.data.repmgr-password}" | base64 -d) - -To connect to your database run the following command: - - kubectl run {{ include "common.names.fullname" . }}-client --rm --tty -i --restart='Never' --namespace {{ .Release.Namespace }} --image {{ include "postgresql-ha.postgresql.image" . }} --env="PGPASSWORD=$POSTGRES_PASSWORD" {{ if and (.Values.pgpool.networkPolicy.enabled) (not .Values.pgpool.networkPolicy.allowExternal) }}--labels="{{ include "common.names.fullname" . }}-client=true" {{- end }} \ - --command -- psql -h {{ include "postgresql-ha.pgpool" . }} -p {{ .Values.service.ports.postgresql }} -U {{ include "postgresql-ha.postgresqlUsername" . }}{{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} -d {{ include "postgresql-ha.postgresqlDatabase" . }}{{- end }} - -{{- if and (.Values.postgresql.networkPolicy.enabled) (not .Values.postgresql.networkPolicy.allowExternal) }} - -Note: Since NetworkPolicy is enabled, only pods with label "{{ include "postgresql-ha.postgresql" . }}-client=true" can access postgresql will be able to connect to PostgreSQL. - -{{- end }} - -{{- if and (.Values.pgpool.networkPolicy.enabled) (not .Values.pgpool.networkPolicy.allowExternal) }} - -Note: Since NetworkPolicy is enabled, only pods with label "{{ include "postgresql-ha.pgpool" . }}-client=true" can access postgresql will be able to connect PgPool. - -{{- end }} - -To connect to your database from outside the cluster execute the following commands: - -{{- if contains "NodePort" .Values.service.type }} - - export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") - export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "postgresql-ha.pgpool" . }} - PGPASSWORD="$POSTGRES_PASSWORD" psql -h $NODE_IP -p $NODE_PORT -U {{ include "postgresql-ha.postgresqlUsername" . }}{{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} -d {{ include "postgresql-ha.postgresqlDatabase" . }}{{- end }} - -{{- else if contains "LoadBalancer" .Values.service.type }} - - NOTE: It may take a few minutes for the LoadBalancer IP to be available. - Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ include "postgresql-ha.pgpool" . }} - - export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "postgresql-ha.pgpool" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}") - PGPASSWORD="$POSTGRES_PASSWORD" psql -h $SERVICE_IP -p {{ .Values.service.ports.postgresql }} -U {{ include "postgresql-ha.postgresqlUsername" . }}{{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} -d {{ include "postgresql-ha.postgresqlDatabase" . }}{{- end }} - -{{- else if contains "ClusterIP" .Values.service.type }} - - kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "postgresql-ha.pgpool" . }} {{ .Values.service.ports.postgresql }}:{{ .Values.service.ports.postgresql }} & - psql -h 127.0.0.1 -p {{ .Values.service.ports.postgresql }} -U {{ include "postgresql-ha.postgresqlUsername" . }}{{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} -d {{ include "postgresql-ha.postgresqlDatabase" . }}{{- end }} - -{{- end }} -{{- end }} - -{{- include "postgresql-ha.validateValues" . }} -{{- include "postgresql-ha.checkRollingTags" . }} - -{{- $passwordValidationErrors := list -}} -{{- $requiredPasswords := list -}} -{{- if not (include "postgresql-ha.postgresql.existingSecretProvided" . ) }} -{{- $secretName := include "postgresql-ha.postgresqlSecretName" . -}} -{{- $requiredPostgresqlPassword := dict "valueKey" "postgresql.password" "secret" $secretName "field" "password" "context" $ -}} -{{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlPassword -}} -{{- $requiredRepmgrPassword := dict "valueKey" "postgresql.repmgrPassword" "secret" $secretName "field" "repmgr-password" "context" $ -}} -{{- $requiredPasswords = append $requiredPasswords $requiredRepmgrPassword -}} -{{- end }} -{{- if not (include "postgresql-ha.pgpool.existingSecretProvided" . ) }} -{{- $secretName := include "postgresql-ha.pgpoolSecretName" . -}} -{{- $requiredPgpoolPassword := dict "valueKey" "pgpool.adminPassword" "secret" $secretName "field" "admin-password" "context" $ -}} -{{- $requiredPasswords = append $requiredPasswords $requiredPgpoolPassword -}} -{{- end }} -{{- $passwordValidationErrors = include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .) -}} - -{{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $) -}} -{{- include "common.warnings.resources" (dict "sections" (list "metrics" "pgpool" "postgresql" "volumePermissions" "witness") "context" $) }} -{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.postgresql.image .Values.pgpool.image .Values.metrics.image .Values.volumePermissions.image) "context" $) }} \ No newline at end of file diff --git a/postgresql-ha/templates/_helpers.tpl b/postgresql-ha/templates/_helpers.tpl deleted file mode 100644 index f43bc60..0000000 --- a/postgresql-ha/templates/_helpers.tpl +++ /dev/null @@ -1,736 +0,0 @@ -{{/* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{/* vim: set filetype=mustache: */}} - -{{/* -Fully qualified app name for PostgreSQL -*/}} -{{- define "postgresql-ha.postgresql" -}} -{{- if .Values.fullnameOverride -}} -{{- printf "%s-postgresql" .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- printf "%s-postgresql" .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s-postgresql" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Fully qualified app name for Pgpool -*/}} -{{- define "postgresql-ha.pgpool" -}} -{{- if .Values.fullnameOverride -}} -{{- printf "%s-pgpool" .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- printf "%s-pgpool" .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s-pgpool" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Fully qualified app name for LDAP -*/}} -{{- define "postgresql-ha.ldap" -}} -{{- if .Values.fullnameOverride -}} -{{- printf "%s-ldap" .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- printf "%s-ldap" .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s-ldap" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - - -{{/* - Create the name of the service account to use - */}} -{{- define "postgresql-ha.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} - {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Return the proper PostgreSQL image name -*/}} -{{- define "postgresql-ha.postgresql.image" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.postgresql.image "global" .Values.global ) -}} -{{- end -}} - -{{/* -Return the proper Pgpool image name -*/}} -{{- define "postgresql-ha.pgpool.image" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.pgpool.image "global" .Values.global ) -}} -{{- end -}} - -{{/* -Return the proper PostgreSQL Prometheus exporter image name -*/}} -{{- define "postgresql-ha.volumePermissions.image" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.volumePermissions.image "global" .Values.global ) -}} -{{- end -}} - -{{/* -Return the proper PostgreSQL Prometheus exporter image name -*/}} -{{- define "postgresql-ha.metrics.image" -}} -{{- include "common.images.image" ( dict "imageRoot" .Values.metrics.image "global" .Values.global ) -}} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names -*/}} -{{- define "postgresql-ha.image.pullSecrets" -}} -{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.postgresql.image .Values.pgpool.image .Values.volumePermissions.image .Values.metrics.image) "context" $) -}} -{{- end -}} - -{{/* -Return the PostgreSQL username -*/}} -{{- define "postgresql-ha.postgresqlUsername" -}} -{{- if .Values.global -}} - {{- if .Values.global.postgresql -}} - {{- if .Values.global.postgresql.username -}} - {{- .Values.global.postgresql.username -}} - {{- else -}} - {{- .Values.postgresql.username -}} - {{- end -}} - {{- else -}} - {{- .Values.postgresql.username -}} - {{- end -}} -{{- else -}} - {{- .Values.postgresql.username -}} -{{- end -}} -{{- end -}} - -{{/* -Return PostgreSQL postgres user password -*/}} -{{- define "postgresql-ha.postgresqlPostgresPassword" -}} -{{- if .Values.global -}} - {{- if .Values.global.postgresql -}} - {{- if .Values.global.postgresql.postgresPassword -}} - {{- .Values.global.postgresql.postgresPassword -}} - {{- else -}} - {{- ternary (randAlphaNum 10) .Values.postgresql.postgresPassword (empty .Values.postgresql.postgresPassword) -}} - {{- end -}} - {{- else -}} - {{- ternary (randAlphaNum 10) .Values.postgresql.postgresPassword (empty .Values.postgresql.postgresPassword) -}} - {{- end -}} -{{- else -}} - {{- ternary (randAlphaNum 10) .Values.postgresql.postgresPassword (empty .Values.postgresql.postgresPassword) -}} -{{- end -}} -{{- end -}} - -{{/* -Return true if PostgreSQL postgres user password has been provided -*/}} -{{- define "postgresql-ha.postgresqlPasswordProvided" -}} -{{- if .Values.global -}} - {{- if .Values.global.postgresql -}} - {{- if .Values.global.postgresql.postgresPassword -}} - {{- true -}} - {{- end -}} - {{- if .Values.postgresql.postgresPassword -}} - {{- true -}} - {{- end -}} - {{- else -}} - {{- if .Values.postgresql.postgresPassword -}} - {{- true -}} - {{- end -}} - {{- end -}} -{{- else -}} - {{- if .Values.postgresql.postgresPassword -}} - {{- true -}} - {{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Return the PostgreSQL password -*/}} -{{- define "postgresql-ha.postgresqlPassword" -}} -{{- if .Values.global }} - {{- if .Values.global.postgresql }} - {{- if .Values.global.postgresql.password }} - {{- .Values.global.postgresql.password -}} - {{- else -}} - {{- ternary (randAlphaNum 10) .Values.postgresql.password (empty .Values.postgresql.password) -}} - {{- end -}} - {{- else -}} - {{- ternary (randAlphaNum 10) .Values.postgresql.password (empty .Values.postgresql.password) -}} - {{- end -}} -{{- else -}} - {{- ternary (randAlphaNum 10) .Values.postgresql.password (empty .Values.postgresql.password) -}} -{{- end -}} -{{- end -}} - -{{/* -Return the Pgpool Admin username -*/}} -{{- define "postgresql-ha.pgpoolAdminUsername" -}} -{{- if .Values.global -}} - {{- if .Values.global.pgpool -}} - {{- if .Values.global.pgpool.adminUsername -}} - {{- .Values.global.pgpool.adminUsername -}} - {{- else -}} - {{- .Values.pgpool.adminUsername -}} - {{- end -}} - {{- else -}} - {{- .Values.pgpool.adminUsername -}} - {{- end -}} -{{- else -}} - {{- .Values.pgpool.adminUsername -}} -{{- end -}} -{{- end -}} - -{{/* -Return the Pgpool Admin password -*/}} -{{- define "postgresql-ha.pgpoolAdminPassword" -}} -{{- if .Values.global -}} - {{- if .Values.global.pgpool -}} - {{- if .Values.global.pgpool.adminPassword -}} - {{- .Values.global.pgpool.adminPassword -}} - {{- else -}} - {{- ternary (randAlphaNum 10) .Values.pgpool.adminPassword (empty .Values.pgpool.adminPassword) -}} - {{- end -}} - {{- else -}} - {{- ternary (randAlphaNum 10) .Values.pgpool.adminPassword (empty .Values.pgpool.adminPassword) -}} - {{- end -}} -{{- else -}} - {{- ternary (randAlphaNum 10) .Values.pgpool.adminPassword (empty .Values.pgpool.adminPassword) -}} -{{- end -}} -{{- end -}} - -{{/* -Get the metrics ConfigMap name. -*/}} -{{- define "postgresql.metricsCM" -}} -{{- printf "%s-metrics" (include "common.names.fullname" .) -}} -{{- end -}} - -{{/* -Return the PostgreSQL database to create -*/}} -{{- define "postgresql-ha.postgresqlDatabase" -}} -{{- $postgresqlDatabase := default "postgres" .Values.postgresql.database -}} -{{- if .Values.global -}} - {{- if .Values.global.postgresql -}} - {{- if .Values.global.postgresql.database -}} - {{- default "postgres" .Values.global.postgresql.database -}} - {{- else -}} - {{- $postgresqlDatabase -}} - {{- end -}} - {{- else -}} - {{- $postgresqlDatabase -}} - {{- end -}} -{{- else -}} - {{- $postgresqlDatabase -}} -{{- end -}} -{{- end -}} - -{{/* -Return the PostgreSQL repmgr username -*/}} -{{- define "postgresql-ha.postgresqlRepmgrUsername" -}} -{{- if .Values.global -}} - {{- if .Values.global.postgresql -}} - {{- if .Values.global.postgresql.repmgrUsername -}} - {{- .Values.global.postgresql.repmgrUsername -}} - {{- else -}} - {{- .Values.postgresql.repmgrUsername -}} - {{- end -}} - {{- else -}} - {{- .Values.postgresql.repmgrUsername -}} - {{- end -}} -{{- else -}} - {{- .Values.postgresql.repmgrUsername -}} -{{- end -}} -{{- end -}} - -{{/* -Return the PostgreSQL repmgr password -*/}} -{{- define "postgresql-ha.postgresqlRepmgrPassword" -}} -{{- if .Values.global -}} - {{- if .Values.global.postgresql -}} - {{- if .Values.global.postgresql.repmgrPassword -}} - {{- .Values.global.postgresql.repmgrPassword -}} - {{- else -}} - {{- ternary (randAlphaNum 10) .Values.postgresql.repmgrPassword (empty .Values.postgresql.repmgrPassword) -}} - {{- end -}} - {{- else -}} - {{- ternary (randAlphaNum 10) .Values.postgresql.repmgrPassword (empty .Values.postgresql.repmgrPassword) -}} - {{- end -}} -{{- else -}} - {{- ternary (randAlphaNum 10) .Values.postgresql.repmgrPassword (empty .Values.postgresql.repmgrPassword) -}} -{{- end -}} -{{- end -}} - -{{/* -Return the database to use for repmgr -*/}} -{{- define "postgresql-ha.repmgrDatabase" -}} -{{- if .Values.global -}} - {{- if .Values.global.postgresql -}} - {{- if .Values.global.postgresql.repmgrDatabase -}} - {{- .Values.global.postgresql.repmgrDatabase -}} - {{- else -}} - {{- .Values.postgresql.repmgrDatabase -}} - {{- end -}} - {{- else -}} - {{- .Values.postgresql.repmgrDatabase -}} - {{- end -}} -{{- else -}} - {{- .Values.postgresql.repmgrDatabase -}} -{{- end -}} -{{- end -}} - -{{/* -Return true if a secret object should be created for PostgreSQL -*/}} -{{- define "postgresql-ha.postgresqlCreateSecret" -}} -{{- if .Values.global -}} - {{- if .Values.global.postgresql -}} - {{- if .Values.global.postgresql.existingSecret -}} - {{- else if (not .Values.postgresql.existingSecret) -}} - {{- true -}} - {{- end -}} - {{- else if (not .Values.postgresql.existingSecret) -}} - {{- true -}} - {{- end -}} -{{- else if (not .Values.postgresql.existingSecret) -}} - {{- true -}} -{{- end -}} -{{- end -}} - -{{/* -Return the PostgreSQL credentials secret. -*/}} -{{- define "postgresql-ha.postgresqlSecretName" -}} -{{- if .Values.global -}} - {{- if .Values.global.postgresql -}} - {{- if .Values.global.postgresql.existingSecret -}} - {{- printf "%s" (tpl .Values.global.postgresql.existingSecret $) -}} - {{- else if .Values.postgresql.existingSecret -}} - {{- printf "%s" (tpl .Values.postgresql.existingSecret $) -}} - {{- else -}} - {{- printf "%s" (include "postgresql-ha.postgresql" .) -}} - {{- end -}} - {{- else if .Values.postgresql.existingSecret -}} - {{- printf "%s" (tpl .Values.postgresql.existingSecret $) -}} - {{- else -}} - {{- printf "%s" (include "postgresql-ha.postgresql" .) -}} - {{- end -}} -{{- else -}} - {{- if .Values.postgresql.existingSecret -}} - {{- printf "%s" (tpl .Values.postgresql.existingSecret $) -}} - {{- else -}} - {{- printf "%s" (include "postgresql-ha.postgresql" .) -}} - {{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Return true if a secret object should be created for Pgpool -*/}} -{{- define "postgresql-ha.pgpoolCreateSecret" -}} -{{- if .Values.global -}} - {{- if .Values.global.pgpool -}} - {{- if .Values.global.pgpool.existingSecret -}} - {{- else if (not .Values.pgpool.existingSecret) -}} - {{- true -}} - {{- end -}} - {{- else if (not .Values.pgpool.existingSecret) -}} - {{- true -}} - {{- end -}} -{{- else if (not .Values.pgpool.existingSecret) -}} - {{- true -}} -{{- end -}} -{{- end -}} - -{{/* -Return the Pgpool credentials secret. -*/}} -{{- define "postgresql-ha.pgpoolSecretName" -}} -{{- if .Values.global -}} - {{- if .Values.global.pgpool -}} - {{- if .Values.global.pgpool.existingSecret -}} - {{- printf "%s" (tpl .Values.global.pgpool.existingSecret $) -}} - {{- else if .Values.pgpool.existingSecret -}} - {{- printf "%s" (tpl .Values.pgpool.existingSecret $) -}} - {{- else -}} - {{- printf "%s" (include "postgresql-ha.pgpool" .) -}} - {{- end -}} - {{- else if .Values.pgpool.existingSecret -}} - {{- printf "%s" (tpl .Values.pgpool.existingSecret $) -}} - {{- else -}} - {{- printf "%s" (include "postgresql-ha.pgpool" .) -}} - {{- end -}} -{{- else -}} - {{- if .Values.pgpool.existingSecret -}} - {{- printf "%s" (tpl .Values.pgpool.existingSecret $) -}} - {{- else -}} - {{- printf "%s" (include "postgresql-ha.pgpool" .) -}} - {{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Return the PostgreSQL configuration configmap. -*/}} -{{- define "postgresql-ha.postgresqlConfigurationCM" -}} -{{- if .Values.postgresql.configurationCM -}} -{{- printf "%s" (tpl .Values.postgresql.configurationCM $) -}} -{{- else -}} -{{- printf "%s-configuration" (include "postgresql-ha.postgresql" .) -}} -{{- end -}} -{{- end -}} - -{{/* -Return the PostgreSQL extended configuration configmap. -*/}} -{{- define "postgresql-ha.postgresqlExtendedConfCM" -}} -{{- if .Values.postgresql.extendedConfCM -}} -{{- printf "%s" (tpl .Values.postgresql.extendedConfCM $) -}} -{{- else -}} -{{- printf "%s-extended-configuration" (include "postgresql-ha.postgresql" .) -}} -{{- end -}} -{{- end -}} - -{{/* -Return the Pgpool configuration configmap. -*/}} -{{- define "postgresql-ha.pgpoolConfigurationCM" -}} -{{- if .Values.pgpool.configurationCM -}} -{{- printf "%s" (tpl .Values.pgpool.configurationCM $) -}} -{{- else -}} -{{- printf "%s-configuration" (include "postgresql-ha.pgpool" .) -}} -{{- end -}} -{{- end -}} - -{{/* -Return the PostgreSQL initdb scripts configmap. -*/}} -{{- define "postgresql-ha.postgresqlInitdbScriptsCM" -}} -{{- if .Values.postgresql.initdbScriptsCM -}} -{{- printf "%s" (tpl .Values.postgresql.initdbScriptsCM $) -}} -{{- else -}} -{{- printf "%s-initdb-scripts" (include "postgresql-ha.postgresql" .) -}} -{{- end -}} -{{- end -}} - -{{/* -Get the initialization scripts Secret name. -*/}} -{{- define "postgresql-ha.postgresqlInitdbScriptsSecret" -}} -{{- if .Values.postgresql.initdbScriptsSecret -}} -{{- include "common.tplvalues.render" (dict "value" .Values.postgresql.initdbScriptsSecret "context" $) -}} -{{- end -}} -{{- end -}} - -{{/* -Return the Pgpool initdb scripts configmap. -*/}} -{{- define "postgresql-ha.pgpoolInitdbScriptsCM" -}} -{{- if .Values.pgpool.initdbScriptsCM -}} -{{- printf "%s" (tpl .Values.pgpool.initdbScriptsCM $) -}} -{{- else -}} -{{- printf "%s-initdb-scripts" (include "postgresql-ha.pgpool" .) -}} -{{- end -}} -{{- end -}} - -{{/* -Get the pgpool initialization scripts Secret name. -*/}} -{{- define "postgresql-ha.pgpoolInitdbScriptsSecret" -}} -{{- if .Values.pgpool.initdbScriptsSecret -}} -{{- include "common.tplvalues.render" (dict "value" .Values.pgpool.initdbScriptsSecret "context" $) -}} -{{- end -}} -{{- end -}} - -{{/* -Return the LDAP bind password -*/}} -{{- define "postgresql-ha.ldapPassword" -}} -{{- if .Values.global }} - {{- if .Values.global.ldap }} - {{- if .Values.global.ldap.bindpw }} - {{- .Values.global.ldap.bindpw -}} - {{- else -}} - {{- ternary (randAlphaNum 10) .Values.ldap.bindpw (empty .Values.ldap.bindpw) -}} - {{- end -}} - {{- else -}} - {{- ternary (randAlphaNum 10) .Values.ldap.bindpw (empty .Values.ldap.bindpw) -}} - {{- end -}} -{{- else -}} - {{- ternary (randAlphaNum 10) .Values.ldap.bindpw (empty .Values.ldap.bindpw) -}} -{{- end -}} -{{- end -}} - -{{/* -Return the LDAP credentials secret. -*/}} -{{- define "postgresql-ha.ldapSecretName" -}} -{{- if .Values.global }} - {{- if .Values.global.ldap }} - {{- if .Values.global.ldap.existingSecret }} - {{- printf "%s" .Values.global.ldap.existingSecret -}} - {{- else if .Values.ldap.existingSecret -}} - {{- printf "%s" .Values.ldap.existingSecret -}} - {{- else -}} - {{- printf "%s" (include "postgresql-ha.ldap" .) -}} - {{- end -}} - {{- else if .Values.ldap.existingSecret -}} - {{- printf "%s" .Values.ldap.existingSecret -}} - {{- else -}} - {{- printf "%s" (include "postgresql-ha.ldap" .) -}} - {{- end -}} -{{- else -}} - {{- if .Values.ldap.existingSecret -}} - {{- printf "%s" .Values.ldap.existingSecret -}} - {{- else -}} - {{- printf "%s" (include "postgresql-ha.ldap" .) -}} - {{- end -}} -{{- end -}} -{{- end -}} - -{{/* Check if there are rolling tags in the images */}} -{{- define "postgresql-ha.checkRollingTags" -}} -{{- include "common.warnings.rollingTag" .Values.postgresql.image -}} -{{- include "common.warnings.rollingTag" .Values.pgpool.image -}} -{{- include "common.warnings.rollingTag" .Values.metrics.image -}} -{{- include "common.warnings.rollingTag" .Values.volumePermissions.image -}} -{{- end -}} - -{{/* -Compile all warnings into a single message, and call fail. -*/}} -{{- define "postgresql-ha.validateValues" -}} -{{- $messages := list -}} -{{- $messages := append $messages (include "postgresql-ha.validateValues.nodesHostnames" .) -}} -{{- $messages := append $messages (include "postgresql-ha.validateValues.ldap" .) -}} -{{- $messages := append $messages (include "postgresql-ha.validateValues.ldapPgHba" .) -}} -{{- $messages := append $messages (include "postgresql-ha.validateValues.upgradeRepmgrExtension" .) -}} -{{- $messages := without $messages "" -}} -{{- $message := join "\n" $messages -}} - -{{- if $message -}} -{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}} -{{- end -}} -{{- end -}} - -{{/* Validate values of PostgreSQL HA - PostgreSQL nodes hostnames cannot be longer than 128 characters */}} -{{- define "postgresql-ha.validateValues.nodesHostnames" -}} -{{- $postgresqlFullname := include "postgresql-ha.postgresql" . }} -{{- $postgresqlHeadlessServiceName := printf "%s-headless" (include "postgresql-ha.postgresql" .) }} -{{- $nodeHostname := printf "%s-00.%s" $postgresqlFullname $postgresqlHeadlessServiceName }} -{{- if gt (len $nodeHostname) 128 -}} -postgresql-ha: Nodes hostnames - PostgreSQL nodes hostnames ({{ $nodeHostname }}) exceeds the characters limit for Pgpool: 128. - Consider using a shorter release name or namespace. -{{- end -}} -{{- end -}} - -{{/* Validate values of PostgreSQL HA - must provide mandatory LDAP parameters when LDAP is enabled */}} -{{- define "postgresql-ha.validateValues.ldap" -}} -{{- if and .Values.ldap.enabled (or (empty .Values.ldap.uri) (and (empty .Values.ldap.basedn) (empty .Values.ldap.base)) (empty .Values.ldap.binddn) (and (empty .Values.ldap.bindpw) (empty .Values.ldap.existingSecret))) -}} -postgresql-ha: LDAP - Invalid LDAP configuration. When enabling LDAP support, the parameters "ldap.uri", - "ldap.basedn", "ldap.binddn", and "ldap.bindpw" are mandatory. Please provide them: - - $ helm install {{ .Release.Name }} oci://registry-1.docker.io/bitnamicharts/postgresql-ha \ - --set ldap.enabled=true \ - --set ldap.uri="ldap://my_ldap_server" \ - --set ldap.basedn="dc=example\,dc=org" \ - --set ldap.binddn="cn=admin\,dc=example\,dc=org" \ - --set ldap.bindpw="admin" -{{- end -}} -{{- end -}} - -{{/* Validate values of PostgreSQL HA - PostgreSQL HBA configuration must trust every user when LDAP is enabled */}} -{{- define "postgresql-ha.validateValues.ldapPgHba" -}} -{{- if and .Values.ldap.enabled (not .Values.postgresql.pgHbaTrustAll) }} -postgresql-ha: LDAP & pg_hba.conf - PostgreSQL HBA configuration must trust every user when LDAP is enabled. - Please configure HBA to trust every user (--set postgresql.pgHbaTrustAll=true) -{{- end -}} -{{- end -}} - -{{/* Validate values of PostgreSQL HA - There must be an unique replica when upgrading repmgr extension */}} -{{- define "postgresql-ha.validateValues.upgradeRepmgrExtension" -}} -{{- $postgresqlReplicaCount := int .Values.postgresql.replicaCount }} -{{- if and .Values.postgresql.upgradeRepmgrExtension (gt $postgresqlReplicaCount 1) }} -postgresql-ha: Upgrade repmgr extension - There must be only one replica when upgrading repmgr extension: - - $ helm upgrade {{ .Release.Name }} oci://registry-1.docker.io/bitnamicharts/postgresql-ha \ - --set postgresql.replicaCount=1 \ - --set postgresql.upgradeRepmgrExtension=true -{{- end -}} -{{- end -}} - -{{/* Set PGPASSWORD as environment variable depends on configuration */}} -{{- define "postgresql-ha.pgpassword" -}} -{{- if .Values.postgresql.usePasswordFile -}} -PGPASSWORD=$(< $POSTGRES_PASSWORD_FILE) -{{- else -}} -PGPASSWORD=$POSTGRES_PASSWORD -{{- end -}} -{{- end -}} - -{{/* -Return the Pgpool secret containing custom users to be added to -pool_passwd file. -*/}} -{{- define "postgresql-ha.pgpoolCustomUsersSecretName" -}} -{{- if .Values.pgpool.customUsersSecret -}} -{{- printf "%s" (tpl .Values.pgpool.customUsersSecret $) -}} -{{- else -}} -{{- printf "%s-custom-users" (include "postgresql-ha.pgpool" .) -}} -{{- end -}} -{{- end -}} - -{{/* -Return the path to the cert file. -*/}} -{{- define "postgresql-ha.pgpool.tlsCert" -}} -{{- if and .Values.pgpool.tls.enabled .Values.pgpool.tls.autoGenerated }} - {{- printf "/opt/bitnami/pgpool/certs/tls.crt" -}} -{{- else -}} -{{- required "Certificate filename is required when TLS in enabled" .Values.pgpool.tls.certFilename | printf "/opt/bitnami/pgpool/certs/%s" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the path to the cert key file. -*/}} -{{- define "postgresql-ha.pgpool.tlsCertKey" -}} -{{- if and .Values.pgpool.tls.enabled .Values.pgpool.tls.autoGenerated }} - {{- printf "/opt/bitnami/pgpool/certs/tls.key" -}} -{{- else -}} - {{- required "Certificate Key filename is required when TLS in enabled" .Values.pgpool.tls.certKeyFilename | printf "/opt/bitnami/pgpool/certs/%s" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the path to the CA cert file. -*/}} -{{- define "postgresql-ha.pgpool.tlsCACert" -}} -{{- if and .Values.pgpool.tls.enabled .Values.pgpool.tls.autoGenerated }} - {{- printf "/opt/bitnami/pgpool/certs/ca.crt" -}} -{{- else -}} - {{- printf "/opt/bitnami/pgpool/certs/%s" .Values.pgpool.tls.certCAFilename -}} -{{- end -}} -{{- end -}} - -{{/* -Return true if a TLS credentials secret object should be created -*/}} -{{- define "postgresql-ha.createTlsSecret" -}} -{{- if and .Values.pgpool.tls.enabled .Values.pgpool.tls.autoGenerated (not .Values.pgpool.tls.certificatesSecret) }} - {{- true -}} -{{- end -}} -{{- end -}} - -{{/* -Return the path to the CA cert file. -*/}} -{{- define "postgresql-ha.tlsSecretName" -}} -{{- if .Values.pgpool.tls.enabled }} -{{- if .Values.pgpool.tls.autoGenerated }} - {{- printf "%s-crt" (include "postgresql-ha.pgpool" .) -}} -{{- else -}} - {{ required "A secret containing TLS certificates is required when TLS is enabled" (tpl .Values.pgpool.tls.certificatesSecret $) }} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Return true if PostgreSQL postgres existingSecret has been provided -*/}} -{{- define "postgresql-ha.postgresql.existingSecretProvided" -}} -{{- if .Values.global -}} - {{- if .Values.global.postgresql -}} - {{- if .Values.global.postgresql.existingSecret -}} - {{- true -}} - {{- else if .Values.postgresql.existingSecret -}} - {{- true -}} - {{- end -}} - {{- else if .Values.postgresql.existingSecret -}} - {{- true -}} - {{- end -}} -{{- else -}} - {{- if .Values.postgresql.existingSecret -}} - {{- true -}} - {{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Return true if PostgreSQL pgpool existingSecret has been provided -*/}} -{{- define "postgresql-ha.pgpool.existingSecretProvided" -}} -{{- if .Values.global -}} - {{- if .Values.global.pgpool -}} - {{- if .Values.global.pgpool.existingSecret -}} - {{- true -}} - {{- else if .Values.pgpool.existingSecret -}} - {{- true -}} - {{- end -}} - {{- else if .Values.pgpool.existingSecret -}} - {{- true -}} - {{- end -}} -{{- else -}} - {{- if .Values.pgpool.existingSecret -}} - {{- true -}} - {{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Return the path to the cert file. -*/}} -{{- define "postgresql-ha.postgresql.tlsCert" -}} -{{- required "Certificate filename is required when TLS in enabled" .Values.postgresql.tls.certFilename | printf "/opt/bitnami/postgresql/certs/%s" -}} -{{- end -}} - -{{/* -Return the path to the cert key file. -*/}} -{{- define "postgresql-ha.postgresql.tlsCertKey" -}} -{{- required "Certificate Key filename is required when TLS in enabled" .Values.postgresql.tls.certKeyFilename | printf "/opt/bitnami/postgresql/certs/%s" -}} -{{- end -}} - -{{/* -Get the readiness probe command -*/}} -{{- define "postgresql-ha.readinessProbeCommand" -}} -{{- $block := index .context.Values .component }} -{{- if eq .component "postgresql" -}} -- | - exec pg_isready -U "postgres" {{- if $block.tls.enabled }} -d "sslcert={{ include "postgresql-ha.postgresql.tlsCert" . }} sslkey={{ include "postgresql-ha.postgresql.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ $block.containerPorts.postgresql }} -{{- if contains "bitnami/" $block.image.repository }} - [ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ] -{{- end }} -{{- else -}} -- exec pg_isready -U "postgres" -h 127.0.0.1 -p {{ $block.containerPorts.postgresql }} -{{- end }} -{{- end -}} diff --git a/postgresql-ha/templates/pgpool/configmap.yaml b/postgresql-ha/templates/pgpool/configmap.yaml deleted file mode 100644 index eaf2c6c..0000000 --- a/postgresql-ha/templates/pgpool/configmap.yaml +++ /dev/null @@ -1,22 +0,0 @@ -{{- /* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if and .Values.pgpool.configuration (not .Values.pgpool.configurationCM) }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ printf "%s-configuration" (include "postgresql-ha.pgpool" .) }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: pgpool - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -data: - pgpool.conf: |- - {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.configuration "context" $) | nindent 4 }} -{{- end }} diff --git a/postgresql-ha/templates/pgpool/custom-users-secrets.yaml b/postgresql-ha/templates/pgpool/custom-users-secrets.yaml deleted file mode 100644 index 173f81c..0000000 --- a/postgresql-ha/templates/pgpool/custom-users-secrets.yaml +++ /dev/null @@ -1,23 +0,0 @@ -{{- /* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if and (not .Values.pgpool.customUsersSecret) .Values.pgpool.customUsers.usernames }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ printf "%s-custom-users" (include "postgresql-ha.pgpool" .) }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: pgpool - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -type: Opaque -data: - usernames: {{ .Values.pgpool.customUsers.usernames | b64enc | quote }} - passwords: {{ .Values.pgpool.customUsers.passwords | b64enc | quote }} -{{- end -}} diff --git a/postgresql-ha/templates/pgpool/deployment.yaml b/postgresql-ha/templates/pgpool/deployment.yaml deleted file mode 100644 index adc0fe2..0000000 --- a/postgresql-ha/templates/pgpool/deployment.yaml +++ /dev/null @@ -1,449 +0,0 @@ -{{- /* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} -kind: Deployment -metadata: - name: {{ include "postgresql-ha.pgpool" . }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.labels .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: pgpool - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- if and (not .Values.pgpool.customUsersSecret) .Values.pgpool.customUsers.usernames }} - checksum/custom-users-secrets: {{ include (print $.Template.BasePath "/pgpool/custom-users-secrets.yaml") . | sha256sum }} - {{- end }} - {{- end }} -spec: - replicas: {{ .Values.pgpool.replicaCount }} - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.podLabels .Values.commonLabels $versionLabel ) "context" . ) }} - selector: - matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} - app.kubernetes.io/component: pgpool - {{- if .Values.pgpool.updateStrategy }} - strategy: {{- toYaml .Values.pgpool.updateStrategy | nindent 4 }} - {{- end }} - {{- if .Values.pgpool.minReadySeconds }} - minReadySeconds: {{ .Values.pgpool.minReadySeconds }} - {{- end }} - template: - metadata: - labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} - app.kubernetes.io/component: pgpool - {{- if .Values.pgpool.podAnnotations }} - annotations: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.podAnnotations "context" $) | nindent 8 }} - {{- end }} - spec: - {{- include "postgresql-ha.image.pullSecrets" . | nindent 6 }} - automountServiceAccountToken: {{ .Values.pgpool.automountServiceAccountToken }} - {{- if .Values.pgpool.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.hostAliases "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.pgpool.affinity }} - affinity: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.affinity "context" $) | nindent 8 }} - {{- else }} - affinity: - podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.pgpool.podAffinityPreset "component" "pgpool" "customLabels" $podLabels "context" $) | nindent 10 }} - podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.pgpool.podAntiAffinityPreset "component" "pgpool" "customLabels" $podLabels "context" $) | nindent 10 }} - nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.pgpool.nodeAffinityPreset.type "key" .Values.pgpool.nodeAffinityPreset.key "values" .Values.pgpool.nodeAffinityPreset.values) | nindent 10 }} - {{- end }} - {{- if .Values.pgpool.nodeSelector }} - nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.nodeSelector "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.pgpool.tolerations }} - tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.tolerations "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.pgpool.priorityClassName }} - priorityClassName: {{ .Values.pgpool.priorityClassName }} - {{- end }} - {{- if .Values.pgpool.schedulerName }} - schedulerName: {{ .Values.pgpool.schedulerName | quote }} - {{- end }} - {{- if .Values.pgpool.topologySpreadConstraints }} - topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.topologySpreadConstraints "context" .) | nindent 8 }} - {{- end }} - {{- if .Values.pgpool.podSecurityContext.enabled }} - securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.pgpool.podSecurityContext "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.pgpool.terminationGracePeriodSeconds }} - terminationGracePeriodSeconds: {{ .Values.pgpool.terminationGracePeriodSeconds }} - {{- end }} - {{- if .Values.serviceAccount.create }} - serviceAccountName: {{ include "postgresql-ha.serviceAccountName" . }} - {{- end }} - {{- if or .Values.pgpool.tls.enabled .Values.pgpool.initContainers }} - initContainers: - {{- if .Values.pgpool.tls.enabled }} - - name: init-chmod-data - image: {{ template "postgresql-ha.volumePermissions.image" . }} - imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} - command: - - /bin/sh - - -cx - - | - cp /tmp/certs/* /opt/bitnami/pgpool/certs/ - {{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }} - chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/pgpool/certs/ - {{- else }} - chown -R {{ .Values.pgpool.containerSecurityContext.runAsUser }}:{{ .Values.pgpool.podSecurityContext.fsGroup }} /opt/bitnami/pgpool/certs/ - {{- end }} - chmod 600 {{ template "postgresql-ha.pgpool.tlsCertKey" . }} - {{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }} - securityContext: {{- omit .Values.volumePermissions.podSecurityContext "runAsUser" | toYaml | nindent 12 }} - {{- else }} - securityContext: {{- .Values.volumePermissions.podSecurityContext | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.volumePermissions.resources }} - resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} - {{- else if ne .Values.volumePermissions.resourcesPreset "none" }} - resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }} - {{- end }} - volumeMounts: - - name: raw-certificates - mountPath: /tmp/certs - - name: pgpool-certificates - mountPath: /opt/bitnami/pgpool/certs - - name: empty-dir - mountPath: /tmp - subPath: tmp-dir - {{- end }} - {{- if .Values.pgpool.initContainers }} - {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.initContainers "context" $) | nindent 8 }} - {{- end }} - {{- end }} - # Auxiliary vars to populate environment variables - {{- $postgresqlReplicaCount := int .Values.postgresql.replicaCount }} - {{- $postgresqlFullname := include "postgresql-ha.postgresql" . }} - {{- $postgresalContainerPort := int .Values.postgresql.containerPorts.postgresql }} - {{- $postgresqlHeadlessServiceName := printf "%s-headless" (include "postgresql-ha.postgresql" .) }} - containers: - - name: pgpool - image: {{ include "postgresql-ha.pgpool.image" . }} - imagePullPolicy: {{ .Values.pgpool.image.pullPolicy | quote }} - {{- if .Values.pgpool.containerSecurityContext.enabled }} - securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.pgpool.containerSecurityContext "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - {{- else if .Values.pgpool.command }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.command "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- else if .Values.pgpool.args }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.args "context" $) | nindent 12 }} - {{- end }} - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.pgpool.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.lifecycleHooks "context" $) | nindent 12 }} - {{- end }} - {{- end }} - env: - - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" (or .Values.pgpool.image.debug .Values.diagnosticMode.enabled) | quote }} - {{- if or .Values.pgpool.customUsersSecret .Values.pgpool.customUsers.usernames }} - - name: PGPOOL_POSTGRES_CUSTOM_USERS - valueFrom: - secretKeyRef: - name: {{ include "postgresql-ha.pgpoolCustomUsersSecretName" . }} - key: usernames - - name: PGPOOL_POSTGRES_CUSTOM_PASSWORDS - valueFrom: - secretKeyRef: - name: {{ include "postgresql-ha.pgpoolCustomUsersSecretName" . }} - key: passwords - {{- end }} - - name: PGPOOL_BACKEND_NODES - value: {{ range $e, $i := until $postgresqlReplicaCount }}{{ $i }}:{{ $postgresqlFullname }}-{{ $i }}.{{ $postgresqlHeadlessServiceName }}:{{ $postgresalContainerPort }},{{ end }} - - name: PGPOOL_SR_CHECK_USER - value: {{ (include "postgresql-ha.postgresqlRepmgrUsername" .) | quote }} - {{- if .Values.postgresql.usePasswordFile }} - - name: PGPOOL_SR_CHECK_PASSWORD_FILE - value: "/opt/bitnami/pgpool/secrets/pgpool-sr-check-password" - {{- else }} - - name: PGPOOL_SR_CHECK_PASSWORD - valueFrom: - secretKeyRef: - name: {{ include "postgresql-ha.postgresqlSecretName" . }} - key: repmgr-password - {{- end }} - - name: PGPOOL_SR_CHECK_DATABASE - value: {{ .Values.pgpool.srCheckDatabase | quote }} - - name: PGPOOL_ENABLE_LDAP - value: {{ ternary "yes" "no" .Values.ldap.enabled | quote }} - {{- if .Values.ldap.enabled }} - - name: LDAP_URI - value: {{ .Values.ldap.uri | quote }} - - name: LDAP_BASE - value: {{ coalesce .Values.ldap.base .Values.ldap.basedn | quote }} - - name: LDAP_BIND_DN - value: {{ .Values.ldap.binddn | quote }} - - name: LDAP_BIND_PASSWORD - valueFrom: - secretKeyRef: - name: {{ include "postgresql-ha.ldapSecretName" . }} - key: bind-password - {{- if .Values.ldap.bslookup }} - - name: LDAP_BASE_LOOKUP - value: {{ .Values.ldap.bslookup | quote }} - {{- end }} - {{- if .Values.ldap.scope }} - - name: LDAP_SCOPE - value: {{ .Values.ldap.scope | quote }} - {{- end }} - {{- if .Values.ldap.tlsReqcert }} - - name: LDAP_TLS_REQCERT - value: {{ .Values.ldap.tlsReqcert | quote }} - {{- end }} - - name: LDAP_NSS_INITGROUPS_IGNOREUSERS - value: {{ .Values.ldap.nssInitgroupsIgnoreusers | quote }} - {{- end }} - - name: PGPOOL_POSTGRES_USERNAME - value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }} - {{- if .Values.postgresql.usePasswordFile }} - - name: PGPOOL_POSTGRES_PASSWORD_FILE - value: "/opt/bitnami/pgpool/secrets/pgpool-password" - {{- else }} - - name: PGPOOL_POSTGRES_PASSWORD - valueFrom: - secretKeyRef: - name: {{ include "postgresql-ha.postgresqlSecretName" . }} - key: password - {{- end }} - - name: PGPOOL_ADMIN_USERNAME - value: {{ (include "postgresql-ha.pgpoolAdminUsername" .) | quote }} - {{- if .Values.pgpool.usePasswordFile }} - - name: PGPOOL_ADMIN_PASSWORD_FILE - value: "/opt/bitnami/pgpool/secrets/admin-password" - {{- else }} - - name: PGPOOL_ADMIN_PASSWORD - valueFrom: - secretKeyRef: - name: {{ include "postgresql-ha.pgpoolSecretName" . }} - key: admin-password - {{- end }} - - name: PGPOOL_AUTHENTICATION_METHOD - value: {{ .Values.pgpool.authenticationMethod | quote }} - - name: PGPOOL_ENABLE_LOAD_BALANCING - value: {{ ternary "yes" "no" .Values.pgpool.useLoadBalancing | quote }} - {{- if .Values.pgpool.useLoadBalancing }} - - name: PGPOOL_DISABLE_LOAD_BALANCE_ON_WRITE - value: {{ .Values.pgpool.disableLoadBalancingOnWrite | quote }} - {{- end }} - - name: PGPOOL_ENABLE_LOG_CONNECTIONS - value: {{ ternary "yes" "no" .Values.pgpool.logConnections | quote }} - - name: PGPOOL_ENABLE_LOG_HOSTNAME - value: {{ ternary "yes" "no" .Values.pgpool.logHostname | quote }} - - name: PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT - value: {{ ternary "yes" "no" .Values.pgpool.logPerNodeStatement | quote }} - {{- if .Values.pgpool.logLinePrefix }} - - name: PGPOOL_LOG_LINE_PREFIX - value: {{ .Values.pgpool.logLinePrefix | quote }} - {{- end }} - {{- if .Values.pgpool.numInitChildren }} - - name: PGPOOL_NUM_INIT_CHILDREN - value: {{ .Values.pgpool.numInitChildren | quote }} - {{- end }} - {{- if .Values.pgpool.reservedConnections }} - - name: PGPOOL_RESERVED_CONNECTIONS - value: '{{ .Values.pgpool.reservedConnections }}' - {{- end }} - {{- if .Values.pgpool.maxPool }} - - name: PGPOOL_MAX_POOL - value: {{ .Values.pgpool.maxPool | quote }} - {{- end }} - {{- if .Values.pgpool.childMaxConnections }} - - name: PGPOOL_CHILD_MAX_CONNECTIONS - value: {{ .Values.pgpool.childMaxConnections | quote }} - {{- end }} - {{- $childlifetime := .Values.pgpool.childLifeTime | quote }} - {{- if or $childlifetime (eq "0" $childlifetime) }} - - name: PGPOOL_CHILD_LIFE_TIME - value: {{ $childlifetime }} - {{- end }} - {{- if .Values.pgpool.clientIdleLimit }} - - name: PGPOOL_CLIENT_IDLE_LIMIT - value: {{ .Values.pgpool.clientIdleLimit | quote }} - {{- end }} - {{- if .Values.pgpool.connectionLifeTime }} - - name: PGPOOL_CONNECTION_LIFE_TIME - value: {{ .Values.pgpool.connectionLifeTime | quote }} - {{- end }} - {{- if or .Values.pgpool.configuration .Values.pgpool.configurationCM }} - - name: PGPOOL_USER_CONF_FILE - value: "/opt/bitnami/pgpool/user_config/pgpool.conf" - {{- end }} - - name: PGPOOL_ENABLE_TLS - value: {{ ternary "yes" "no" .Values.pgpool.tls.enabled | quote }} - {{- if .Values.pgpool.tls.enabled }} - - name: PGPOOL_TLS_PREFER_SERVER_CIPHERS - value: {{ ternary "yes" "no" .Values.pgpool.tls.preferServerCiphers | quote }} - - name: PGPOOL_TLS_CERT_FILE - value: {{ template "postgresql-ha.pgpool.tlsCert" . }} - - name: PGPOOL_TLS_KEY_FILE - value: {{ template "postgresql-ha.pgpool.tlsCertKey" . }} - {{- if .Values.pgpool.tls.certCAFilename }} - - name: PGPOOL_TLS_CA_FILE - value: {{ template "postgresql-ha.pgpool.tlsCACert" . }} - {{- end }} - {{- end }} - - name: PGPOOL_HEALTH_CHECK_PSQL_TIMEOUT - {{- if .Values.pgpool.customLivenessProbe }} - value: {{ add 1 (default 1 .Values.pgpool.customLivenessProbe.timeoutSeconds) | quote }} - {{- else }} - value: {{ add 1 (default 1 .Values.pgpool.livenessProbe.timeoutSeconds) | quote }} - {{- end }} - {{- if .Values.pgpool.extraEnvVars }} - {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - envFrom: - {{- if .Values.pgpool.extraEnvVarsCM }} - - configMapRef: - name: {{ .Values.pgpool.extraEnvVarsCM }} - {{- end }} - {{- if .Values.pgpool.extraEnvVarsSecret }} - - secretRef: - name: {{ .Values.pgpool.extraEnvVarsSecret }} - {{- end }} - ports: - - name: postgresql - containerPort: {{ .Values.pgpool.containerPorts.postgresql }} - protocol: TCP - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.pgpool.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.customLivenessProbe "context" $) | nindent 12 }} - {{- else if .Values.pgpool.livenessProbe.enabled }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.pgpool.livenessProbe "enabled") "context" $) | nindent 12 }} - exec: - command: - - /opt/bitnami/scripts/pgpool/healthcheck.sh - {{- end }} - {{- if .Values.pgpool.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.customReadinessProbe "context" $) | nindent 12 }} - {{- else if .Values.pgpool.readinessProbe.enabled }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.pgpool.readinessProbe "enabled") "context" $) | nindent 12 }} - exec: - command: - - bash - - -ec - - PGPASSWORD=${PGPOOL_POSTGRES_PASSWORD} psql -U {{ (include "postgresql-ha.postgresqlUsername" .) | quote }} {{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }}{{- end }} -h /opt/bitnami/pgpool/tmp -tA -c "SELECT 1" >/dev/null - {{- end }} - {{- if .Values.pgpool.customStartupProbe }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.customStartupProbe "context" $) | nindent 12 }} - {{- else if .Values.pgpool.startupProbe.enabled }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.pgpool.startupProbe "enabled") "context" $) | nindent 12 }} - exec: - command: - - /opt/bitnami/scripts/pgpool/healthcheck.sh - {{- end }} - {{- end }} - {{- if .Values.pgpool.resources }} - resources: {{- toYaml .Values.pgpool.resources | nindent 12 }} - {{- else if ne .Values.pgpool.resourcesPreset "none" }} - resources: {{- include "common.resources.preset" (dict "type" .Values.pgpool.resourcesPreset) | nindent 12 }} - {{- end }} - volumeMounts: - - name: empty-dir - mountPath: /tmp - subPath: tmp-dir - - name: empty-dir - mountPath: /opt/bitnami/pgpool/etc - subPath: app-etc-dir - - name: empty-dir - mountPath: /opt/bitnami/pgpool/conf - subPath: app-conf-dir - - name: empty-dir - mountPath: /opt/bitnami/pgpool/tmp - subPath: app-tmp-dir - - name: empty-dir - mountPath: /opt/bitnami/pgpool/logs - subPath: app-logs-dir - {{- if or .Values.pgpool.configuration .Values.pgpool.configurationCM .Values.pgpool.initdbScripts .Values.pgpool.initdbScriptsCM .Values.pgpool.initdbScriptsSecret .Values.postgresql.usePasswordFile .Values.pgpool.usePasswordFile .Values.pgpool.tls.enabled .Values.pgpool.extraVolumeMounts }} - {{- if or .Values.pgpool.configuration .Values.pgpool.configurationCM }} - - name: pgpool-config - mountPath: /opt/bitnami/pgpool/user_config/ - {{- end }} - {{- if or .Values.pgpool.initdbScripts .Values.pgpool.initdbScriptsCM }} - - name: custom-init-scripts - mountPath: /docker-entrypoint-initdb.d/ - {{- end }} - {{- if .Values.pgpool.initdbScriptsSecret }} - - name: custom-init-scripts-secret - mountPath: /docker-entrypoint-initdb.d/secret - {{- end }} - {{- if .Values.postgresql.usePasswordFile }} - - name: postgresql-password - subPath: pgpool-password - mountPath: /opt/bitnami/pgpool/secrets/pgpool-password - - name: postgresql-password - subPath: pgpool-sr-check-password - mountPath: /opt/bitnami/pgpool/secrets/pgpool-sr-check-password - {{- end }} - {{- if .Values.pgpool.usePasswordFile }} - - name: pgpool-password - subPath: admin-password - mountPath: /opt/bitnami/pgpool/secrets/admin-password - {{- end }} - {{- if .Values.pgpool.tls.enabled }} - - name: pgpool-certificates - mountPath: /opt/bitnami/pgpool/certs - {{- end }} - {{- if .Values.pgpool.extraVolumeMounts }} - {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.extraVolumeMounts "context" $) | nindent 12 }} - {{- end }} - {{- end }} - {{- if .Values.pgpool.sidecars }} - {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.sidecars "context" $) | nindent 8 }} - {{- end }} - volumes: - - name: empty-dir - emptyDir: {} - {{- if or .Values.pgpool.configuration .Values.pgpool.configurationCM .Values.pgpool.initdbScripts .Values.pgpool.initdbScriptsCM .Values.pgpool.initdbScriptsSecret .Values.pgpool.usePasswordFile .Values.postgresql.usePasswordFile .Values.pgpool.tls.enabled .Values.pgpool.extraVolumes }} - {{- if or .Values.pgpool.configuration .Values.pgpool.configurationCM }} - - name: pgpool-config - configMap: - name: {{ include "postgresql-ha.pgpoolConfigurationCM" . }} - {{- end }} - {{- if or .Values.pgpool.initdbScripts .Values.pgpool.initdbScriptsCM }} - - name: custom-init-scripts - configMap: - name: {{ template "postgresql-ha.pgpoolInitdbScriptsCM" . }} - {{- end }} - {{- if .Values.pgpool.initdbScriptsSecret }} - - name: custom-init-scripts-secret - secret: - secretName: {{ template "postgresql-ha.pgpoolInitdbScriptsSecret" . }} - {{- end }} - {{- if .Values.postgresql.usePasswordFile }} - - name: postgresql-password - secret: - secretName: {{ include "postgresql-ha.postgresqlSecretName" . }} - items: - - key: password - path: pgpool-password - - key: repmgr-password - path: pgpool-sr-check-password - {{- end }} - {{- if .Values.pgpool.usePasswordFile }} - - name: pgpool-password - secret: - secretName: {{ include "postgresql-ha.pgpoolSecretName" . }} - items: - - key: admin-password - path: admin-password - {{- end }} - {{- if .Values.pgpool.tls.enabled }} - - name: raw-certificates - secret: - secretName: {{ include "postgresql-ha.tlsSecretName" . }} - - name: pgpool-certificates - emptyDir: {} - {{- end }} - {{- if .Values.pgpool.extraVolumes }} - {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.extraVolumes "context" $) | nindent 8 }} - {{- end }} - {{- end }} diff --git a/postgresql-ha/templates/pgpool/initdb-scripts-configmap.yaml b/postgresql-ha/templates/pgpool/initdb-scripts-configmap.yaml deleted file mode 100644 index 0c85dac..0000000 --- a/postgresql-ha/templates/pgpool/initdb-scripts-configmap.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- /* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if and .Values.pgpool.initdbScripts (not .Values.pgpool.initdbScriptsCM) }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ printf "%s-initdb-scripts" (include "postgresql-ha.pgpool" .) }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: pgpool - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -data: - {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.initdbScripts "context" $) | nindent 4 }} -{{- end }} diff --git a/postgresql-ha/templates/pgpool/secrets.yaml b/postgresql-ha/templates/pgpool/secrets.yaml deleted file mode 100644 index c3f1a07..0000000 --- a/postgresql-ha/templates/pgpool/secrets.yaml +++ /dev/null @@ -1,22 +0,0 @@ -{{- /* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if (include "postgresql-ha.pgpoolCreateSecret" .) }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "postgresql-ha.pgpool" . }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: pgpool - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -type: Opaque -data: - admin-password: {{ (include "postgresql-ha.pgpoolAdminPassword" .) | b64enc | quote }} -{{- end -}} diff --git a/postgresql-ha/templates/pgpool/service.yaml b/postgresql-ha/templates/pgpool/service.yaml deleted file mode 100644 index c3f1460..0000000 --- a/postgresql-ha/templates/pgpool/service.yaml +++ /dev/null @@ -1,54 +0,0 @@ -{{- /* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -apiVersion: v1 -kind: Service -metadata: - name: {{ include "postgresql-ha.pgpool" . }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.serviceLabels .Values.commonLabels $versionLabel ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: pgpool - {{- if or .Values.pgpool.serviceAnnotations .Values.service.annotations .Values.commonAnnotations }} - {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.serviceAnnotations .Values.service.annotations .Values.commonAnnotations ) "context" . ) }} - annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} - {{- end }} -spec: - type: {{ .Values.service.type }} - {{- if .Values.service.sessionAffinity }} - sessionAffinity: {{ .Values.service.sessionAffinity }} - {{- end }} - {{- if .Values.service.sessionAffinityConfig }} - sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.service.sessionAffinityConfig "context" $) | nindent 4 }} - {{- end }} - {{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort") }} - externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }} - {{- end }} - {{- if and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancerSourceRanges }} - loadBalancerSourceRanges: {{- toYaml .Values.service.loadBalancerSourceRanges | nindent 4 }} - {{- end }} - {{- if and (not (empty .Values.service.loadBalancerIP)) (eq .Values.service.type "LoadBalancer") }} - loadBalancerIP: {{ .Values.service.loadBalancerIP }} - {{- end }} - {{- if and (eq .Values.service.type "ClusterIP") .Values.service.clusterIP }} - clusterIP: {{ .Values.service.clusterIP }} - {{- end }} - ports: - - name: {{ .Values.service.portName | quote }} - port: {{ .Values.service.ports.postgresql }} - targetPort: postgresql - protocol: TCP - {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.postgresql)) }} - nodePort: {{ .Values.service.nodePorts.postgresql }} - {{- else if eq .Values.service.type "ClusterIP" }} - nodePort: null - {{- end }} - {{- if .Values.service.extraPorts }} - {{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }} - {{- end }} - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.podLabels .Values.commonLabels ) "context" . ) }} - selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: pgpool diff --git a/postgresql-ha/templates/postgresql/configmap.yaml b/postgresql-ha/templates/postgresql/configmap.yaml deleted file mode 100644 index 322097d..0000000 --- a/postgresql-ha/templates/postgresql/configmap.yaml +++ /dev/null @@ -1,30 +0,0 @@ -{{- /* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if and (or .Values.postgresql.repmgrConfiguration .Values.postgresql.configuration .Values.postgresql.pgHbaConfiguration) (not .Values.postgresql.configurationCM) }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ printf "%s-configuration" (include "postgresql-ha.postgresql" .) }} - namespace: {{ include "common.names.namespace" . | quote }} - labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: postgresql - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -data: - {{- if .Values.postgresql.repmgrConfiguration }} - repmgr.conf: |- - {{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.repmgrConfiguration "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.postgresql.configuration }} - postgresql.conf: |- - {{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.configuration "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.postgresql.pgHbaConfiguration }} - pg_hba.conf: |- - {{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.pgHbaConfiguration "context" $ ) | nindent 4 }} - {{- end }} -{{- end }} diff --git a/postgresql-ha/templates/postgresql/hooks-scripts-configmap.yaml b/postgresql-ha/templates/postgresql/hooks-scripts-configmap.yaml deleted file mode 100644 index 8977a25..0000000 --- a/postgresql-ha/templates/postgresql/hooks-scripts-configmap.yaml +++ /dev/null @@ -1,136 +0,0 @@ -{{- /* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ printf "%s-hooks-scripts" (include "postgresql-ha.postgresql" .) }} - namespace: {{ include "common.names.namespace" . | quote }} - labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: postgresql - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -data: - pre-stop.sh: |- - #!/bin/bash - set -o errexit - set -o pipefail - set -o nounset - - # Debug section - exec 3>&1 - exec 4>&2 - - # Process input parameters - MIN_DELAY_AFTER_PG_STOP_SECONDS=$1 - - # Load Libraries - . /opt/bitnami/scripts/liblog.sh - . /opt/bitnami/scripts/libpostgresql.sh - . /opt/bitnami/scripts/librepmgr.sh - - # Load PostgreSQL & repmgr environment variables - . /opt/bitnami/scripts/postgresql-env.sh - - # Auxiliary functions - is_new_primary_ready() { - return_value=1 - currenty_primary_node="$(repmgr_get_primary_node)" - currenty_primary_host="$(echo $currenty_primary_node | awk '{print $1}')" - - info "$currenty_primary_host != $REPMGR_NODE_NETWORK_NAME" - if [[ $(echo $currenty_primary_node | wc -w) -eq 2 ]] && [[ "$currenty_primary_host" != "$REPMGR_NODE_NETWORK_NAME" ]]; then - info "New primary detected, leaving the cluster..." - return_value=0 - else - info "Waiting for a new primary to be available..." - fi - return $return_value - } - - export MODULE="pre-stop-hook" - - if [[ "${BITNAMI_DEBUG}" == "true" ]]; then - info "Bash debug is on" - else - info "Bash debug is off" - exec 1>/dev/null - exec 2>/dev/null - fi - - postgresql_enable_nss_wrapper - - # Prepare env vars for managing roles - readarray -t primary_node < <(repmgr_get_upstream_node) - primary_host="${primary_node[0]}" - - # Stop postgresql for graceful exit. - PG_STOP_TIME=$EPOCHSECONDS - postgresql_stop - - if [[ -z "$primary_host" ]] || [[ "$primary_host" == "$REPMGR_NODE_NETWORK_NAME" ]]; then - info "Primary node need to wait for a new primary node before leaving the cluster" - retry_while is_new_primary_ready 10 5 - else - info "Standby node doesn't need to wait for a new primary switchover. Leaving the cluster" - fi - - # Make sure pre-stop hook waits at least 25 seconds after stop of PG to make sure PGPOOL detects node is down. - # default terminationGracePeriodSeconds=30 seconds - PG_STOP_DURATION=$(($EPOCHSECONDS - $PG_STOP_TIME)) - if (( $PG_STOP_DURATION < $MIN_DELAY_AFTER_PG_STOP_SECONDS )); then - WAIT_TO_PG_POOL_TIME=$(($MIN_DELAY_AFTER_PG_STOP_SECONDS - $PG_STOP_DURATION)) - info "PG stopped including primary switchover in $PG_STOP_DURATION. Waiting additional $WAIT_TO_PG_POOL_TIME seconds for PG pool" - sleep $WAIT_TO_PG_POOL_TIME - fi - - readiness-probe.sh: |- - #!/bin/bash - set -o errexit - set -o pipefail - set -o nounset - - # Debug section - exec 3>&1 - exec 4>&2 - - # Load Libraries - . /opt/bitnami/scripts/liblog.sh - . /opt/bitnami/scripts/libpostgresql.sh - - # Load PostgreSQL & repmgr environment variables - . /opt/bitnami/scripts/postgresql-env.sh - - # Process input parameters - MIN_DELAY_AFTER_POD_READY_FIRST_TIME=$1 - TMP_FIRST_READY_FILE_TS="/tmp/ts-first-ready.mark" - TMP_DELAY_APPLIED_FILE="/tmp/delay-applied.mark" - - DB_CHECK_RESULT=$(echo "SELECT 1" | postgresql_execute_print_output "$POSTGRESQL_DATABASE" "$POSTGRESQL_USERNAME" "$POSTGRESQL_PASSWORD" "-h 127.0.0.1 -tA" || echo "command failed") - if [[ "$DB_CHECK_RESULT" == "1" ]]; then - if [[ ! -f "$TMP_DELAY_APPLIED_FILE" ]]; then - # DB up, but initial readiness delay not applied - if [[ -f "$TMP_FIRST_READY_FILE_TS" ]]; then - # calculate delay from the first readiness success - FIRST_READY_TS=$(cat $TMP_FIRST_READY_FILE_TS) - CURRENT_DELAY_SECONDS=$(($EPOCHSECONDS - $FIRST_READY_TS)) - if (( $CURRENT_DELAY_SECONDS > $MIN_DELAY_AFTER_POD_READY_FIRST_TIME )); then - # minimal delay of the first readiness state passed - report success and mark delay as applied - touch "$TMP_DELAY_APPLIED_FILE" - else - # minimal delay of the first readiness state not reached yet - report failure - exit 1 - fi - else - # first ever readiness test success - store timestamp and report failure - echo $EPOCHSECONDS > $TMP_FIRST_READY_FILE_TS - exit 1 - fi - fi - else - # DB test failed - report failure - exit 1 - fi diff --git a/postgresql-ha/templates/postgresql/metrics-service.yaml b/postgresql-ha/templates/postgresql/metrics-service.yaml deleted file mode 100644 index 42d6c27..0000000 --- a/postgresql-ha/templates/postgresql/metrics-service.yaml +++ /dev/null @@ -1,47 +0,0 @@ -{{- /* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if and .Values.metrics.enabled .Values.metrics.service.enabled }} -apiVersion: v1 -kind: Service -metadata: - name: {{ printf "%s-metrics" (include "postgresql-ha.postgresql" .) }} - namespace: {{ include "common.names.namespace" . | quote }} - labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: postgresql - {{- if .Values.metrics.serviceMonitor.selector }} - {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 4 }} - {{- end }} - {{- if or .Values.metrics.annotations .Values.commonAnnotations }} - {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.annotations .Values.commonAnnotations ) "context" . ) }} - annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} - {{- end }} -spec: - type: {{ .Values.metrics.service.type }} - {{- if (or (eq .Values.metrics.service.type "LoadBalancer") (eq .Values.metrics.service.type "NodePort")) }} - externalTrafficPolicy: {{ .Values.metrics.service.externalTrafficPolicy | quote }} - {{- end }} - {{ if .Values.metrics.service.clusterIP }} - clusterIP: {{ .Values.metrics.service.clusterIP }} - {{ end }} - {{ if eq .Values.metrics.service.type "LoadBalancer" }} - loadBalancerSourceRanges: {{ .Values.metrics.service.loadBalancerSourceRanges }} - {{ end }} - {{- if (and (eq .Values.metrics.service.type "LoadBalancer") (not (empty .Values.metrics.service.loadBalancerIP))) }} - loadBalancerIP: {{ .Values.metrics.service.loadBalancerIP }} - {{- end }} - ports: - - name: metrics - port: {{ .Values.metrics.service.ports.metrics }} - targetPort: metrics - {{- if (and (or (eq .Values.metrics.service.type "NodePort") (eq .Values.metrics.service.type "LoadBalancer")) (not (empty .Values.metrics.service.nodePorts.metrics))) }} - nodePort: {{ .Values.metrics.service.nodePorts.metrics }} - {{- else if eq .Values.metrics.service.type "ClusterIP" }} - nodePort: null - {{- end }} - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }} - selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: postgresql -{{- end }} diff --git a/postgresql-ha/templates/postgresql/pdb.yaml b/postgresql-ha/templates/postgresql/pdb.yaml deleted file mode 100644 index cd9ce4f..0000000 --- a/postgresql-ha/templates/postgresql/pdb.yaml +++ /dev/null @@ -1,28 +0,0 @@ -{{- /* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if .Values.postgresql.pdb.create }} -apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} -kind: PodDisruptionBudget -metadata: - name: {{ include "postgresql-ha.postgresql" . }} - namespace: {{ include "common.names.namespace" . | quote }} - labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: postgresql - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - {{- if .Values.postgresql.pdb.minAvailable }} - minAvailable: {{ .Values.postgresql.pdb.minAvailable }} - {{- end }} - {{- if or .Values.postgresql.pdb.maxUnavailable (not .Values.postgresql.pdb.minAvailable) }} - maxUnavailable: {{ .Values.postgresql.pdb.maxUnavailable | default 1 }} - {{- end }} - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }} - selector: - matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} - app.kubernetes.io/component: postgresql -{{- end }} diff --git a/postgresql-ha/templates/postgresql/secrets.yaml b/postgresql-ha/templates/postgresql/secrets.yaml deleted file mode 100644 index d5c668e..0000000 --- a/postgresql-ha/templates/postgresql/secrets.yaml +++ /dev/null @@ -1,24 +0,0 @@ -{{- /* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if (include "postgresql-ha.postgresqlCreateSecret" .) }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "postgresql-ha.postgresql" . }} - namespace: {{ include "common.names.namespace" . | quote }} - labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: postgresql - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -type: Opaque -data: - {{- if and (include "postgresql-ha.postgresqlPostgresPassword" .) (not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres")) }} - postgres-password: {{ include "postgresql-ha.postgresqlPostgresPassword" . | b64enc | quote }} - {{- end }} - password: {{ (include "postgresql-ha.postgresqlPassword" .) | b64enc | quote }} - repmgr-password: {{ (include "postgresql-ha.postgresqlRepmgrPassword" .) | b64enc | quote }} -{{- end -}} diff --git a/postgresql-ha/templates/postgresql/service-headless.yaml b/postgresql-ha/templates/postgresql/service-headless.yaml deleted file mode 100644 index de4bf8f..0000000 --- a/postgresql-ha/templates/postgresql/service-headless.yaml +++ /dev/null @@ -1,28 +0,0 @@ -{{- /* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -apiVersion: v1 -kind: Service -metadata: - name: {{ printf "%s-headless" (include "postgresql-ha.postgresql" .) }} - namespace: {{ include "common.names.namespace" . | quote }} - labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- if or .Values.commonAnnotations .Values.service.headless.annotations }} - {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonAnnotations .Values.service.headless.annotations ) "context" . ) }} - annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} - {{- end }} -spec: - type: ClusterIP - clusterIP: None - publishNotReadyAddresses: {{ .Values.postgresql.headlessWithNotReadyAddresses }} - ports: - - name: {{ .Values.service.portName | quote }} - port: {{ .Values.postgresql.containerPorts.postgresql }} - targetPort: postgresql - protocol: TCP - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }} - selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: postgresql - role: data diff --git a/postgresql-ha/templates/postgresql/service.yaml b/postgresql-ha/templates/postgresql/service.yaml deleted file mode 100644 index d03d48a..0000000 --- a/postgresql-ha/templates/postgresql/service.yaml +++ /dev/null @@ -1,31 +0,0 @@ -{{- /* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -apiVersion: v1 -kind: Service -metadata: - name: {{ include "postgresql-ha.postgresql" . }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.serviceLabels .Values.commonLabels ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: postgresql - {{- if or .Values.postgresql.serviceAnnotations .Values.service.annotations .Values.commonAnnotations }} - {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.serviceAnnotations .Values.service.annotations .Values.commonAnnotations ) "context" . ) }} - annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} - {{- end }} -spec: - type: ClusterIP - ports: - - name: {{ .Values.service.portName | quote }} - port: {{ .Values.service.ports.postgresql }} - targetPort: postgresql - protocol: TCP - {{- if .Values.service.extraPorts }} - {{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }} - {{- end }} - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }} - selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: postgresql - role: data diff --git a/postgresql-ha/templates/postgresql/statefulset.yaml b/postgresql-ha/templates/postgresql/statefulset.yaml deleted file mode 100644 index 35a1736..0000000 --- a/postgresql-ha/templates/postgresql/statefulset.yaml +++ /dev/null @@ -1,678 +0,0 @@ -{{- /* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} -kind: StatefulSet -metadata: - name: {{ include "postgresql-ha.postgresql" . }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.labels .Values.commonLabels ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: postgresql - role: data - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - replicas: {{ .Values.postgresql.replicaCount }} - podManagementPolicy: {{ .Values.postgresql.podManagementPolicy | quote }} - serviceName: {{ printf "%s-headless" (include "postgresql-ha.postgresql" .) }} - updateStrategy: {{- toYaml .Values.postgresql.updateStrategy | nindent 4 }} - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }} - selector: - matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} - app.kubernetes.io/component: postgresql - role: data - template: - metadata: - labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} - app.kubernetes.io/component: postgresql - role: data - {{- if or .Values.postgresql.podAnnotations (and .Values.metrics.enabled .Values.metrics.annotations) }} - annotations: - {{- if .Values.postgresql.podAnnotations }} - {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.podAnnotations "context" $) | nindent 8 }} - {{- end }} - {{- if and .Values.metrics.enabled .Values.metrics.annotations }} - {{- include "common.tplvalues.render" (dict "value" .Values.metrics.annotations "context" $) | nindent 8 }} - {{- end }} - {{- end }} - spec: - {{- include "postgresql-ha.image.pullSecrets" . | nindent 6 }} - automountServiceAccountToken: {{ .Values.postgresql.automountServiceAccountToken }} - {{- if .Values.postgresql.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.hostAliases "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.postgresql.affinity }} - affinity: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.affinity "context" $) | nindent 8 }} - {{- else }} - affinity: - podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.postgresql.podAffinityPreset "component" "postgresql" "customLabels" $podLabels "context" $) | nindent 10 }} - podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.postgresql.podAntiAffinityPreset "component" "postgresql" "customLabels" $podLabels "context" $) | nindent 10 }} - nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.postgresql.nodeAffinityPreset.type "key" .Values.postgresql.nodeAffinityPreset.key "values" .Values.postgresql.nodeAffinityPreset.values) | nindent 10 }} - {{- end }} - {{- if .Values.postgresql.nodeSelector }} - nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.nodeSelector "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.postgresql.tolerations }} - tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.tolerations "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.postgresql.topologySpreadConstraints }} - topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.topologySpreadConstraints "context" .) | nindent 8 }} - {{- end }} - {{- if .Values.postgresql.priorityClassName }} - priorityClassName: {{ .Values.postgresql.priorityClassName | quote }} - {{- end }} - {{- if .Values.postgresql.schedulerName }} - schedulerName: {{ .Values.postgresql.schedulerName }} - {{- end }} - {{- if .Values.postgresql.terminationGracePeriodSeconds }} - terminationGracePeriodSeconds: {{ .Values.postgresql.terminationGracePeriodSeconds }} - {{- end }} - {{- if .Values.postgresql.podSecurityContext.enabled }} - securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.postgresql.podSecurityContext "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.serviceAccount.create }} - serviceAccountName: {{ include "postgresql-ha.serviceAccountName" . }} - {{- end }} - hostNetwork: {{ .Values.postgresql.hostNetwork }} - hostIPC: {{ .Values.postgresql.hostIPC }} - {{- if or .Values.postgresql.tls.enabled .Values.postgresql.initContainers .Values.postgresql.extraInitContainers (and .Values.volumePermissions.enabled (or (or (not (empty .Values.postgresql.extendedConf)) (not (empty .Values.postgresql.extendedConfCM))) .Values.persistence.enabled)) }} - initContainers: - {{- if .Values.postgresql.tls.enabled }} - - name: init-chmod-tls - image: {{ template "postgresql-ha.volumePermissions.image" . }} - imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} - command: - - /bin/sh - - -cx - - | - cp /tmp/certs/* /opt/bitnami/postgresql/certs/ - {{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }} - chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/postgresql/certs/ - {{- else }} - chown -R {{ .Values.postgresql.containerSecurityContext.runAsUser }}:{{ .Values.postgresql.podSecurityContext.fsGroup }} /opt/bitnami/postgresql/certs/ - {{- end }} - chmod 600 {{ template "postgresql-ha.postgresql.tlsCertKey" . }} - {{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }} - securityContext: {{- omit .Values.volumePermissions.podSecurityContext "runAsUser" | toYaml | nindent 12 }} - {{- else }} - securityContext: {{- .Values.volumePermissions.podSecurityContext | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.volumePermissions.resources }} - resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} - {{- else if ne .Values.volumePermissions.resourcesPreset "none" }} - resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }} - {{- end }} - volumeMounts: - - name: raw-certificates - mountPath: /tmp/certs - - name: postgresql-certificates - mountPath: /opt/bitnami/postgresql/certs - - name: empty-dir - mountPath: /tmp - subPath: tmp-dir - {{- end }} - {{- if and .Values.volumePermissions.enabled (or (or (not (empty .Values.postgresql.extendedConf)) (not (empty .Values.postgresql.extendedConfCM))) .Values.persistence.enabled) }} - - name: init-chmod-data - image: {{ include "postgresql-ha.volumePermissions.image" . }} - imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} - command: - - sh - - -c - - | - mkdir -p {{ .Values.persistence.mountPath }}/conf {{ .Values.persistence.mountPath }}/data {{ .Values.persistence.mountPath }}/lock - chmod 700 {{ .Values.persistence.mountPath }}/conf {{ .Values.persistence.mountPath }}/data {{ .Values.persistence.mountPath }}/lock - chown {{ .Values.postgresql.containerSecurityContext.runAsUser }}:{{ .Values.postgresql.podSecurityContext.fsGroup }} {{ .Values.persistence.mountPath }} - find {{ .Values.persistence.mountPath }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | \ - xargs -r chown -R {{ .Values.postgresql.containerSecurityContext.runAsUser }}:{{ .Values.postgresql.podSecurityContext.fsGroup }} - {{- if .Values.volumePermissions.podSecurityContext.enabled }} - securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.podSecurityContext "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.volumePermissions.resources }} - resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} - {{- else if ne .Values.volumePermissions.resourcesPreset "none" }} - resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }} - {{- end }} - volumeMounts: - - name: data - mountPath: {{ .Values.persistence.mountPath }} - - name: empty-dir - mountPath: /tmp - subPath: tmp-dir - {{- end }} - {{- if or .Values.postgresql.initContainers .Values.postgresql.extraInitContainers }} - {{- include "common.tplvalues.render" ( dict "value" (coalesce .Values.postgresql.initContainers .Values.postgresql.extraInitContainers) "context" $ ) | nindent 8 }} - {{- end }} - {{- end }} - containers: - - name: postgresql - image: {{ include "postgresql-ha.postgresql.image" . }} - imagePullPolicy: {{ .Values.postgresql.image.pullPolicy | quote }} - {{- if .Values.postgresql.containerSecurityContext.enabled }} - securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.postgresql.containerSecurityContext "context" $) | nindent 12 }} - {{- end }} - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.postgresql.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.lifecycleHooks "context" $) | nindent 12 }} - {{- else }} - lifecycle: - preStop: - exec: - command: - - /pre-stop.sh - - {{ .Values.postgresql.preStopDelayAfterPgStopSeconds | quote }} - {{- end }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - {{- else if .Values.postgresql.command }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.command "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- else if .Values.postgresql.args }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.args "context" $) | nindent 12 }} - {{- end }} - # Auxiliary vars to populate environment variables - {{- $postgresqlReplicaCount := int .Values.postgresql.replicaCount }} - {{- $postgresqlFullname := include "postgresql-ha.postgresql" . }} - {{- $postgresqlHeadlessServiceName := printf "%s-headless" (include "postgresql-ha.postgresql" .) }} - {{- $clusterDomain:= .Values.clusterDomain }} - env: - - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" (or .Values.postgresql.image.debug .Values.diagnosticMode.enabled) | quote }} - # PostgreSQL configuration - - name: POSTGRESQL_VOLUME_DIR - value: {{ .Values.persistence.mountPath | quote }} - - name: PGDATA - value: {{ printf "%s/%s" .Values.persistence.mountPath "data" | quote }} - {{- if and (or (not (include "postgresql-ha.postgresqlCreateSecret" .)) (include "postgresql-ha.postgresqlPasswordProvided" .)) (not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres")) }} - {{- if .Values.postgresql.usePasswordFile }} - - name: POSTGRES_POSTGRES_PASSWORD_FILE - value: "/opt/bitnami/postgresql/secrets/postgres-password" - {{- else }} - - name: POSTGRES_POSTGRES_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "postgresql-ha.postgresqlSecretName" . }} - key: postgres-password - {{- end }} - {{- end }} - - name: POSTGRES_USER - value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }} - {{- if .Values.postgresql.usePasswordFile }} - - name: POSTGRES_PASSWORD_FILE - value: "/opt/bitnami/postgresql/secrets/password" - {{- else }} - - name: POSTGRES_PASSWORD - valueFrom: - secretKeyRef: - name: {{ include "postgresql-ha.postgresqlSecretName" . }} - {{- if (include "postgresql-ha.postgresqlCreateSecret" .) }} - key: password - {{- else }} - {{- if ( index ( lookup "v1" "Secret" (include "common.names.namespace" .) (include "postgresql-ha.postgresqlSecretName" .) ) ".data.postgres-password" ) }} - key: postgres-password - {{- else }} - key: password - {{- end }} - {{- end }} - {{- end }} - {{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} - - name: POSTGRES_DB - value: {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} - {{- end }} - - name: POSTGRESQL_LOG_HOSTNAME - value: {{ .Values.postgresql.audit.logHostname | quote }} - - name: POSTGRESQL_LOG_CONNECTIONS - value: {{ .Values.postgresql.audit.logConnections | quote }} - - name: POSTGRESQL_LOG_DISCONNECTIONS - value: {{ .Values.postgresql.audit.logDisconnections | quote }} - {{- if .Values.postgresql.audit.logLinePrefix }} - - name: POSTGRESQL_LOG_LINE_PREFIX - value: {{ .Values.postgresql.audit.logLinePrefix | quote }} - {{- end }} - {{- if .Values.postgresql.audit.logTimezone }} - - name: POSTGRESQL_LOG_TIMEZONE - value: {{ .Values.postgresql.audit.logTimezone | quote }} - {{- end }} - {{- if .Values.postgresql.audit.pgAuditLog }} - - name: POSTGRESQL_PGAUDIT_LOG - value: {{ .Values.postgresql.audit.pgAuditLog | quote }} - {{- end }} - - name: POSTGRESQL_PGAUDIT_LOG_CATALOG - value: {{ .Values.postgresql.audit.pgAuditLogCatalog | quote }} - - name: POSTGRESQL_CLIENT_MIN_MESSAGES - value: {{ .Values.postgresql.audit.clientMinMessages | quote }} - - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES - value: {{ .Values.postgresql.sharedPreloadLibraries | quote }} - {{- if .Values.postgresql.maxConnections }} - - name: POSTGRESQL_MAX_CONNECTIONS - value: {{ .Values.postgresql.maxConnections | quote }} - {{- end }} - {{- if .Values.postgresql.usePgRewind }} - - name: REPMGR_USE_PGREWIND - value: {{ .Values.postgresql.usePgRewind | quote }} - {{- end }} - {{- if .Values.postgresql.postgresConnectionLimit }} - - name: POSTGRESQL_POSTGRES_CONNECTION_LIMIT - value: {{ .Values.postgresql.postgresConnectionLimit | quote }} - {{- end }} - {{- if .Values.postgresql.dbUserConnectionLimit }} - - name: POSTGRESQL_USERNAME_CONNECTION_LIMIT - value: {{ .Values.postgresql.dbUserConnectionLimit | quote }} - {{- end }} - {{- if .Values.postgresql.tcpKeepalivesInterval }} - - name: POSTGRESQL_TCP_KEEPALIVES_INTERVAL - value: {{ .Values.postgresql.tcpKeepalivesInterval | quote }} - {{- end }} - {{- if .Values.postgresql.tcpKeepalivesIdle }} - - name: POSTGRESQL_TCP_KEEPALIVES_IDLE - value: {{ .Values.postgresql.tcpKeepalivesIdle | quote }} - {{- end }} - {{- if .Values.postgresql.tcpKeepalivesCount }} - - name: POSTGRESQL_TCP_KEEPALIVES_COUNT - value: {{ .Values.postgresql.tcpKeepalivesCount | quote }} - {{- end }} - {{- if .Values.postgresql.statementTimeout }} - - name: POSTGRESQL_STATEMENT_TIMEOUT - value: {{ .Values.postgresql.statementTimeout | quote }} - {{- end }} - {{- if .Values.postgresql.pghbaRemoveFilters }} - - name: POSTGRESQL_PGHBA_REMOVE_FILTERS - value: {{ .Values.postgresql.pghbaRemoveFilters | quote }} - {{- end }} - - name: POSTGRESQL_ENABLE_TLS - value: {{ ternary "yes" "no" .Values.postgresql.tls.enabled | quote }} - {{- if .Values.postgresql.tls.enabled }} - - name: POSTGRESQL_TLS_PREFER_SERVER_CIPHERS - value: {{ ternary "yes" "no" .Values.postgresql.tls.preferServerCiphers | quote }} - - name: POSTGRESQL_TLS_CERT_FILE - value: {{ template "postgresql-ha.postgresql.tlsCert" . }} - - name: POSTGRESQL_TLS_KEY_FILE - value: {{ template "postgresql-ha.postgresql.tlsCertKey" . }} - {{- end }} - - name: POSTGRESQL_PORT_NUMBER - value: {{ .Values.postgresql.containerPorts.postgresql | quote }} - # Repmgr configuration - - name: REPMGR_PORT_NUMBER - value: {{ .Values.postgresql.containerPorts.postgresql | quote }} - - name: REPMGR_PRIMARY_PORT - value: {{ .Values.postgresql.containerPorts.postgresql | quote }} - - name: MY_POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: REPMGR_UPGRADE_EXTENSION - value: {{ ternary "yes" "no" .Values.postgresql.upgradeRepmgrExtension | quote }} - - name: REPMGR_PGHBA_TRUST_ALL - value: {{ ternary "yes" "no" .Values.postgresql.pgHbaTrustAll | quote }} - - name: REPMGR_MOUNTED_CONF_DIR - value: "/bitnami/repmgr/conf" - - name: REPMGR_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: REPMGR_PARTNER_NODES - value: {{ range $e, $i := until $postgresqlReplicaCount }}{{ $postgresqlFullname }}-{{ $i }}.{{ $postgresqlHeadlessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }},{{ end }} - - name: REPMGR_PRIMARY_HOST - value: {{ printf "%s-0.%s.$(REPMGR_NAMESPACE).svc.%s" $postgresqlFullname $postgresqlHeadlessServiceName $clusterDomain | quote }} - - name: REPMGR_NODE_NAME - value: "$(MY_POD_NAME)" - - name: REPMGR_NODE_NETWORK_NAME - value: "$(MY_POD_NAME).{{ $postgresqlHeadlessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }}" - - name: REPMGR_NODE_TYPE - value: "data" - - name: REPMGR_LOG_LEVEL - value: {{ .Values.postgresql.repmgrLogLevel | quote }} - - name: REPMGR_CONNECT_TIMEOUT - value: {{ .Values.postgresql.repmgrConnectTimeout | quote }} - - name: REPMGR_RECONNECT_ATTEMPTS - value: {{ .Values.postgresql.repmgrReconnectAttempts | quote }} - - name: REPMGR_RECONNECT_INTERVAL - value: {{ .Values.postgresql.repmgrReconnectInterval | quote }} - - name: REPMGR_USERNAME - value: {{ (include "postgresql-ha.postgresqlRepmgrUsername" .) | quote }} - {{- if .Values.postgresql.usePasswordFile }} - - name: REPMGR_PASSWORD_FILE - value: "/opt/bitnami/postgresql/secrets/repmgr-password" - {{- else }} - - name: REPMGR_PASSWORD - valueFrom: - secretKeyRef: - name: {{ include "postgresql-ha.postgresqlSecretName" . }} - key: repmgr-password - {{- end }} - {{- if .Values.postgresql.repmgrUsePassfile }} - - name: REPMGR_USE_PASSFILE - value: {{ ternary "true" "false" .Values.postgresql.repmgrUsePassfile | quote }} - - name: REPMGR_PASSFILE_PATH - value: {{ default "/opt/bitnami/repmgr/conf/.pgpass" .Values.postgresql.repmgrPassfilePath }} - {{- end }} - {{- if (include "postgresql-ha.repmgrDatabase" .) }} - - name: REPMGR_DATABASE - value: {{ (include "postgresql-ha.repmgrDatabase" .) | quote }} - {{- end }} - - name: REPMGR_FENCE_OLD_PRIMARY - value: {{ ternary "yes" "no" .Values.postgresql.repmgrFenceOldPrimary | quote }} - {{- if .Values.postgresql.repmgrChildNodesCheckInterval }} - - name: REPMGR_CHILD_NODES_CHECK_INTERVAL - value: {{ .Values.postgresql.repmgrChildNodesCheckInterval | quote }} - {{- end }} - {{- if .Values.postgresql.repmgrChildNodesConnectedMinCount }} - - name: REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT - value: {{ .Values.postgresql.repmgrChildNodesConnectedMinCount | quote }} - {{- end }} - {{- if .Values.postgresql.repmgrChildNodesDisconnectTimeout }} - - name: REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT - value: {{ .Values.postgresql.repmgrChildNodesDisconnectTimeout | quote }} - {{- end }} - {{- if .Values.postgresql.syncReplication }} - - name: POSTGRESQL_NUM_SYNCHRONOUS_REPLICAS - value: {{ sub (int .Values.postgresql.replicaCount) 1 | quote }} - {{- end }} - {{- if .Values.postgresql.syncReplicationMode }} - - name: POSTGRESQL_SYNCHRONOUS_REPLICAS_MODE - value: {{ .Values.postgresql.syncReplicationMode | quote }} - {{- end }} - {{- if .Values.postgresql.extraEnvVars }} - {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - envFrom: - {{- if .Values.postgresql.extraEnvVarsCM }} - - configMapRef: - name: {{ .Values.postgresql.extraEnvVarsCM }} - {{- end }} - {{- if .Values.postgresql.extraEnvVarsSecret }} - - secretRef: - name: {{ .Values.postgresql.extraEnvVarsSecret }} - {{- end }} - ports: - - name: postgresql - containerPort: {{ .Values.postgresql.containerPorts.postgresql }} - protocol: TCP - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.postgresql.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.customLivenessProbe "context" $) | nindent 12 }} - {{- else if .Values.postgresql.livenessProbe.enabled }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.postgresql.livenessProbe "enabled") "context" $) | nindent 12 }} - exec: - command: - - bash - - -ec - - '{{ include "postgresql-ha.pgpassword" . }} psql -w -U {{ include "postgresql-ha.postgresqlUsername" . | quote }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} -h 127.0.0.1 -p {{ .Values.postgresql.containerPorts.postgresql }} -c "SELECT 1"' - {{- end }} - {{- if .Values.postgresql.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.customReadinessProbe "context" $) | nindent 12 }} - {{- else if .Values.postgresql.readinessProbe.enabled }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.postgresql.readinessProbe "enabled") "context" $) | nindent 12 }} - exec: - {{- if .Values.postgresql.headlessWithNotReadyAddresses }} - command: - - /readiness-probe.sh - - {{ add .Values.pgpool.livenessProbe.periodSeconds .Values.pgpool.livenessProbe.timeoutSeconds | quote }} - {{- else }} - command: - - bash - - -ec - {{- include "postgresql-ha.readinessProbeCommand" (dict "component" "postgresql" "context" $) | nindent 16 }} - {{- end }} - {{- end }} - {{- if .Values.postgresql.customStartupProbe }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.customStartupProbe "context" $) | nindent 12 }} - {{- else if .Values.postgresql.startupProbe.enabled }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.postgresql.startupProbe "enabled") "context" $) | nindent 12 }} - exec: - command: - - bash - - -ec - - '{{ include "postgresql-ha.pgpassword" . }} psql -w -U {{ include "postgresql-ha.postgresqlUsername" . | quote }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} -h 127.0.0.1 -p {{ .Values.postgresql.containerPorts.postgresql }} -c "SELECT 1"' - {{- end }} - {{- end }} - {{- if .Values.postgresql.resources }} - resources: {{- toYaml .Values.postgresql.resources | nindent 12 }} - {{- else if ne .Values.postgresql.resourcesPreset "none" }} - resources: {{- include "common.resources.preset" (dict "type" .Values.postgresql.resourcesPreset) | nindent 12 }} - {{- end }} - volumeMounts: - - name: empty-dir - mountPath: /tmp - subPath: tmp-dir - - name: empty-dir - mountPath: /opt/bitnami/postgresql/conf - subPath: app-conf-dir - - name: empty-dir - mountPath: /opt/bitnami/postgresql/tmp - subPath: app-tmp-dir - - name: empty-dir - mountPath: /opt/bitnami/repmgr/conf - subPath: repmgr-conf-dir - - name: empty-dir - mountPath: /opt/bitnami/repmgr/tmp - subPath: repmgr-tmp-dir - - name: empty-dir - mountPath: /opt/bitnami/repmgr/logs - subPath: repmgr-logs-dir - {{- if or .Values.postgresql.repmgrConfiguration .Values.postgresql.configuration .Values.postgresql.pgHbaConfiguration .Values.postgresql.configurationCM }} - - name: postgresql-config - mountPath: /bitnami/repmgr/conf - {{- end }} - {{- if or .Values.postgresql.extendedConf .Values.postgresql.extendedConfCM }} - - name: postgresql-extended-config - mountPath: /bitnami/postgresql/conf/conf.d/ - {{- end }} - {{- if or .Values.postgresql.initdbScriptsCM .Values.postgresql.initdbScripts }} - - name: custom-init-scripts - mountPath: /docker-entrypoint-initdb.d/ - {{- end }} - {{- if .Values.postgresql.initdbScriptsSecret }} - - name: custom-init-scripts-secret - mountPath: /docker-entrypoint-initdb.d/secret - {{- end }} - {{- if .Values.postgresql.usePasswordFile }} - - name: password - mountPath: /opt/bitnami/postgresql/secrets/ - {{- end }} - {{- if .Values.postgresql.tls.enabled }} - - name: postgresql-certificates - mountPath: /opt/bitnami/postgresql/certs - {{- end }} - - name: data - mountPath: {{ .Values.persistence.mountPath }} - - name: hooks-scripts - mountPath: /pre-stop.sh - subPath: pre-stop.sh - - name: hooks-scripts - mountPath: /readiness-probe.sh - subPath: readiness-probe.sh - {{- if .Values.postgresql.extraVolumeMounts }} - {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.extraVolumeMounts "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.metrics.enabled }} - - name: metrics - image: {{ include "postgresql-ha.metrics.image" . }} - imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} - {{- if .Values.metrics.podSecurityContext.enabled }} - securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.metrics.podSecurityContext "context" $) | nindent 12 }} - {{- end }} - env: - - name: PG_EXPORTER_WEB_LISTEN_ADDRESS - value: :{{ .Values.metrics.containerPorts.http }} - - name: DATA_SOURCE_URI - value: {{ printf "127.0.0.1:%d/%s?sslmode=disable" (.Values.postgresql.containerPorts.postgresql | int64) (include "postgresql-ha.postgresqlDatabase" .) | quote }} - {{- if .Values.postgresql.usePasswordFile }} - - name: DATA_SOURCE_PASS_FILE - value: "/opt/bitnami/postgresql/secrets/password" - {{- else }} - - name: DATA_SOURCE_PASS - valueFrom: - secretKeyRef: - name: {{ include "postgresql-ha.postgresqlSecretName" . }} - key: password - {{- end }} - - name: DATA_SOURCE_USER - value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }} - {{- if .Values.metrics.extraEnvVars }} - {{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - envFrom: - {{- if .Values.metrics.extraEnvVarsCM }} - - configMapRef: - name: {{ .Values.metrics.extraEnvVarsCM }} - {{- end }} - {{- if .Values.metrics.extraEnvVarsSecret }} - - secretRef: - name: {{ .Values.metrics.extraEnvVarsSecret }} - {{- end }} - ports: - - name: metrics - containerPort: {{ .Values.metrics.containerPorts.http }} - protocol: TCP - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.metrics.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }} - {{- else if .Values.metrics.livenessProbe.enabled }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }} - tcpSocket: - port: metrics - {{- end }} - {{- if .Values.metrics.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }} - {{- else if .Values.metrics.readinessProbe.enabled }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }} - httpGet: - path: / - port: metrics - {{- end }} - {{- if .Values.metrics.customStartupProbe }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }} - {{- else if .Values.metrics.startupProbe.enabled }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }} - httpGet: - path: / - port: metrics - {{- end }} - {{- end }} - {{- if .Values.metrics.resources }} - resources: {{- toYaml .Values.metrics.resources | nindent 12 }} - {{- else if ne .Values.metrics.resourcesPreset "none" }} - resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }} - {{- end }} - volumeMounts: - - name: empty-dir - mountPath: /tmp - subPath: tmp-dir - {{- if or .Values.postgresql.usePasswordFile .Values.metrics.customMetrics }} - {{- if .Values.postgresql.usePasswordFile }} - - name: password - mountPath: /opt/bitnami/postgresql/secrets/ - {{- end }} - {{- if .Values.metrics.customMetrics }} - - name: custom-metrics - mountPath: /conf - readOnly: true - {{- end }} - {{- end }} - {{- if .Values.metrics.customMetrics }} - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- else }} - args: ["--extend.query-path", "/conf/custom-metrics.yaml"] - {{- end }} - {{- end }} - {{- end }} - {{- if .Values.postgresql.sidecars }} - {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.sidecars "context" $) | nindent 8 }} - {{- end }} - volumes: - {{- if .Values.postgresql.extraVolumes }} - {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.extraVolumes "context" $) | nindent 8 }} - {{- end }} - - name: empty-dir - emptyDir: {} - {{- if and .Values.metrics.enabled .Values.metrics.customMetrics }} - - name: custom-metrics - configMap: - name: {{ include "postgresql.metricsCM" . }} - {{- end }} - - name: hooks-scripts - configMap: - name: {{ printf "%s-hooks-scripts" (include "postgresql-ha.postgresql" .) }} - defaultMode: 0755 - {{- if or .Values.postgresql.repmgrConfiguration .Values.postgresql.configuration .Values.postgresql.pgHbaConfiguration .Values.postgresql.configurationCM }} - - name: postgresql-config - configMap: - name: {{ include "postgresql-ha.postgresqlConfigurationCM" . }} - {{- end }} - {{- if or .Values.postgresql.extendedConf .Values.postgresql.extendedConfCM }} - - name: postgresql-extended-config - configMap: - name: {{ template "postgresql-ha.postgresqlExtendedConfCM" . }} - {{- end }} - {{- if .Values.postgresql.initdbScriptsSecret }} - - name: custom-init-scripts-secret - secret: - secretName: {{ template "postgresql-ha.postgresqlInitdbScriptsSecret" . }} - {{- end }} - {{- if .Values.postgresql.usePasswordFile }} - - name: password - secret: - secretName: {{ include "postgresql-ha.postgresqlSecretName" . }} - {{- end }} - {{- if or .Values.postgresql.initdbScriptsCM .Values.postgresql.initdbScripts }} - - name: custom-init-scripts - configMap: - name: {{ template "postgresql-ha.postgresqlInitdbScriptsCM" . }} - {{- end }} - {{- if .Values.postgresql.tls.enabled }} - - name: raw-certificates - secret: - secretName: {{ required "A secret containing TLS certificates is required when TLS is enabled" (tpl .Values.postgresql.tls.certificatesSecret .) }} - - name: postgresql-certificates - emptyDir: {} - {{- end }} - {{- if and .Values.persistence.enabled .Values.persistence.existingClaim }} - - name: data - persistentVolumeClaim: - {{- with .Values.persistence.existingClaim }} - claimName: {{ tpl . $ }} - {{- end }} - {{- else if not .Values.persistence.enabled }} - - name: data - emptyDir: {} - {{- else if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} - {{- if .Values.persistentVolumeClaimRetentionPolicy.enabled }} - persistentVolumeClaimRetentionPolicy: - whenDeleted: {{ .Values.persistentVolumeClaimRetentionPolicy.whenDeleted }} - whenScaled: {{ .Values.persistentVolumeClaimRetentionPolicy.whenScaled }} - {{- end }} - volumeClaimTemplates: - - apiVersion: v1 - kind: PersistentVolumeClaim - metadata: - name: data - {{- if .Values.persistence.annotations }} - annotations: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.annotations "context" $) | nindent 10 }} - {{- end }} - {{- if .Values.persistence.labels }} - labels: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.labels "context" $) | nindent 10 }} - {{- end }} - spec: - accessModes: - {{- range .Values.persistence.accessModes }} - - {{ . | quote }} - {{- end }} - resources: - requests: - storage: {{ .Values.persistence.size | quote }} - {{- if .Values.persistence.selector }} - selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.selector "context" $) | nindent 10 }} - {{- end -}} - {{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 8 }} - {{- end }} diff --git a/postgresql-ha/templates/postgresql/witness-statefulset.yaml b/postgresql-ha/templates/postgresql/witness-statefulset.yaml deleted file mode 100644 index 7f6b49a..0000000 --- a/postgresql-ha/templates/postgresql/witness-statefulset.yaml +++ /dev/null @@ -1,629 +0,0 @@ -{{- /* -Copyright Broadcom, Inc. All Rights Reserved. -SPDX-License-Identifier: APACHE-2.0 -*/}} - -{{- if .Values.witness.create }} -apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} -kind: StatefulSet -metadata: - name: {{ printf "%s-witness" (include "postgresql-ha.postgresql" .) }} - namespace: {{ include "common.names.namespace" . | quote }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.witness.labels .Values.commonLabels ) "context" . ) }} - labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: postgresql - role: witness - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - replicas: {{ .Values.witness.replicaCount }} - podManagementPolicy: Parallel - serviceName: {{ printf "%s-witness" (include "postgresql-ha.postgresql" .) }} - updateStrategy: {{- toYaml .Values.witness.updateStrategy | nindent 4 }} - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.witness.podLabels .Values.commonLabels ) "context" . ) }} - selector: - matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} - app.kubernetes.io/component: postgresql - role: witness - template: - metadata: - labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} - app.kubernetes.io/component: postgresql - role: witness - {{- if or .Values.witness.podAnnotations (and .Values.metrics.enabled .Values.metrics.annotations) }} - annotations: - {{- if .Values.witness.podAnnotations }} - {{- include "common.tplvalues.render" (dict "value" .Values.witness.podAnnotations "context" $) | nindent 8 }} - {{- end }} - {{- if and .Values.metrics.enabled .Values.metrics.annotations }} - {{- include "common.tplvalues.render" (dict "value" .Values.metrics.annotations "context" $) | nindent 8 }} - {{- end }} - {{- end }} - spec: - {{- include "postgresql-ha.image.pullSecrets" . | nindent 6 }} - automountServiceAccountToken: {{ .Values.witness.automountServiceAccountToken }} - {{- if .Values.witness.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.witness.hostAliases "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.witness.affinity }} - affinity: {{- include "common.tplvalues.render" (dict "value" .Values.witness.affinity "context" $) | nindent 8 }} - {{- else }} - affinity: - podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.witness.podAffinityPreset "component" "postgresql" "customLabels" $podLabels "context" $) | nindent 10 }} - podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.witness.podAntiAffinityPreset "component" "postgresql" "customLabels" $podLabels "context" $) | nindent 10 }} - nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.witness.nodeAffinityPreset.type "key" .Values.witness.nodeAffinityPreset.key "values" .Values.witness.nodeAffinityPreset.values) | nindent 10 }} - {{- end }} - {{- if .Values.witness.nodeSelector }} - nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.witness.nodeSelector "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.witness.tolerations }} - tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.witness.tolerations "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.witness.topologySpreadConstraints }} - topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.witness.topologySpreadConstraints "context" .) | nindent 8 }} - {{- end }} - {{- if .Values.witness.priorityClassName }} - priorityClassName: {{ .Values.witness.priorityClassName | quote }} - {{- end }} - {{- if .Values.witness.schedulerName }} - schedulerName: {{ .Values.witness.schedulerName }} - {{- end }} - {{- if .Values.witness.terminationGracePeriodSeconds }} - terminationGracePeriodSeconds: {{ .Values.witness.terminationGracePeriodSeconds }} - {{- end }} - {{- if .Values.witness.podSecurityContext.enabled }} - securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.witness.podSecurityContext "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.serviceAccount.create }} - serviceAccountName: {{ include "postgresql-ha.serviceAccountName" . }} - {{- end }} - hostNetwork: {{ .Values.witness.hostNetwork }} - hostIPC: {{ .Values.witness.hostIPC }} - initContainers: - {{- if .Values.postgresql.tls.enabled }} - - name: init-chmod-tls - image: {{ template "postgresql-ha.volumePermissions.image" . }} - imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} - command: - - /bin/sh - - -cx - - | - cp /tmp/certs/* /opt/bitnami/postgresql/certs/ - {{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }} - chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/postgresql/certs/ - {{- else }} - chown -R {{ .Values.witness.containerSecurityContext.runAsUser }}:{{ .Values.witness.podSecurityContext.fsGroup }} /opt/bitnami/postgresql/certs/ - {{- end }} - chmod 600 {{ template "postgresql-ha.postgresql.tlsCertKey" . }} - {{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }} - securityContext: {{- omit .Values.volumePermissions.podSecurityContext "runAsUser" | toYaml | nindent 12 }} - {{- else }} - securityContext: {{- .Values.volumePermissions.podSecurityContext | toYaml | nindent 12 }} - {{- end }} - volumeMounts: - - name: raw-certificates - mountPath: /tmp/certs - - name: postgresql-certificates - mountPath: /opt/bitnami/postgresql/certs - - name: empty-dir - mountPath: /tmp - subPath: tmp-dir - {{- end }} - {{- if and .Values.volumePermissions.enabled (or (or (not (empty .Values.witness.extendedConf)) (not (empty .Values.witness.extendedConfCM))) .Values.persistence.enabled) }} - - name: init-chmod-data - image: {{ include "postgresql-ha.volumePermissions.image" . }} - imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} - command: - - sh - - -c - - | - mkdir -p {{ .Values.persistence.mountPath }}/conf {{ .Values.persistence.mountPath }}/data {{ .Values.persistence.mountPath }}/lock - chmod 700 {{ .Values.persistence.mountPath }}/conf {{ .Values.persistence.mountPath }}/data {{ .Values.persistence.mountPath }}/lock - chown {{ .Values.witness.containerSecurityContext.runAsUser }}:{{ .Values.witness.podSecurityContext.fsGroup }} {{ .Values.persistence.mountPath }} - find {{ .Values.persistence.mountPath }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | \ - xargs -r chown -R {{ .Values.witness.containerSecurityContext.runAsUser }}:{{ .Values.witness.podSecurityContext.fsGroup }} - securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.podSecurityContext "context" $) | nindent 12 }} - {{- if .Values.volumePermissions.resources }} - resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} - {{- else if ne .Values.volumePermissions.resourcesPreset "none" }} - resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }} - {{- end }} - volumeMounts: - - name: data - mountPath: {{ .Values.persistence.mountPath }} - - name: empty-dir - mountPath: /tmp - subPath: tmp-dir - {{- end }} - {{- if or .Values.witness.initContainers .Values.witness.extraInitContainers }} - {{- include "common.tplvalues.render" ( dict "value" (coalesce .Values.witness.initContainers .Values.witness.extraInitContainers) "context" $ ) | nindent 8 }} - {{- end }} - containers: - - name: postgresql - image: {{ include "postgresql-ha.postgresql.image" . }} - imagePullPolicy: {{ .Values.postgresql.image.pullPolicy | quote }} - {{- if .Values.witness.containerSecurityContext.enabled }} - securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.witness.containerSecurityContext "context" $) | nindent 12 }} - {{- end }} - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.witness.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.witness.lifecycleHooks "context" $) | nindent 12 }} - {{- else }} - lifecycle: - preStop: - exec: - command: - - /pre-stop.sh - {{- end }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - {{- else if .Values.witness.command }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.witness.command "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- else if .Values.witness.args }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.witness.args "context" $) | nindent 12 }} - {{- end }} - # Auxiliary vars to populate environment variables - {{- $postgresqlReplicaCount := int .Values.witness.replicaCount }} - {{- $postgresqlFullname := include "postgresql-ha.postgresql" . }} - {{- $postgresqlHeadlessServiceName := printf "%s-headless" (include "postgresql-ha.postgresql" .) }} - {{- $postgresqlWitnessServiceName := printf "%s-witness" (include "postgresql-ha.postgresql" .) }} - {{- $clusterDomain:= .Values.clusterDomain }} - env: - - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" (or .Values.postgresql.image.debug .Values.diagnosticMode.enabled) | quote }} - # PostgreSQL configuration - - name: POSTGRESQL_VOLUME_DIR - value: {{ .Values.persistence.mountPath | quote }} - - name: PGDATA - value: {{ printf "%s/%s" .Values.persistence.mountPath "data" | quote }} - {{- if and (or (not (include "postgresql-ha.postgresqlCreateSecret" .)) (include "postgresql-ha.postgresqlPasswordProvided" .)) (not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres")) }} - {{- if .Values.witness.usePasswordFile }} - - name: POSTGRES_POSTGRES_PASSWORD_FILE - value: "/opt/bitnami/postgresql/secrets/postgres-password" - {{- else }} - - name: POSTGRES_POSTGRES_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "postgresql-ha.postgresqlSecretName" . }} - key: postgres-password - {{- end }} - {{- end }} - - name: POSTGRES_USER - value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }} - {{- if .Values.witness.usePasswordFile }} - - name: POSTGRES_PASSWORD_FILE - value: "/opt/bitnami/postgresql/secrets/password" - {{- else }} - - name: POSTGRES_PASSWORD - valueFrom: - secretKeyRef: - name: {{ include "postgresql-ha.postgresqlSecretName" . }} - {{- if (include "postgresql-ha.postgresqlCreateSecret" .) }} - key: password - {{- else }} - {{- if ( index ( lookup "v1" "Secret" (include "common.names.namespace" .) (include "postgresql-ha.postgresqlSecretName" .) ) ".data.postgres-password" ) }} - key: postgres-password - {{- else }} - key: password - {{- end }} - {{- end }} - {{- end }} - {{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} - - name: POSTGRES_DB - value: {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} - {{- end }} - - name: POSTGRESQL_LOG_HOSTNAME - value: {{ .Values.witness.audit.logHostname | quote }} - - name: POSTGRESQL_LOG_CONNECTIONS - value: {{ .Values.witness.audit.logConnections | quote }} - - name: POSTGRESQL_LOG_DISCONNECTIONS - value: {{ .Values.witness.audit.logDisconnections | quote }} - {{- if .Values.witness.audit.logLinePrefix }} - - name: POSTGRESQL_LOG_LINE_PREFIX - value: {{ .Values.witness.audit.logLinePrefix | quote }} - {{- end }} - {{- if .Values.witness.audit.logTimezone }} - - name: POSTGRESQL_LOG_TIMEZONE - value: {{ .Values.witness.audit.logTimezone | quote }} - {{- end }} - {{- if .Values.witness.audit.pgAuditLog }} - - name: POSTGRESQL_PGAUDIT_LOG - value: {{ .Values.witness.audit.pgAuditLog | quote }} - {{- end }} - - name: POSTGRESQL_PGAUDIT_LOG_CATALOG - value: {{ .Values.witness.audit.pgAuditLogCatalog | quote }} - - name: POSTGRESQL_CLIENT_MIN_MESSAGES - value: {{ .Values.witness.audit.clientMinMessages | quote }} - - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES - value: {{ .Values.postgresql.sharedPreloadLibraries | quote }} - {{- if .Values.witness.maxConnections }} - - name: POSTGRESQL_MAX_CONNECTIONS - value: {{ .Values.witness.maxConnections | quote }} - {{- end }} - {{- if .Values.witness.postgresConnectionLimit }} - - name: POSTGRESQL_POSTGRES_CONNECTION_LIMIT - value: {{ .Values.witness.postgresConnectionLimit | quote }} - {{- end }} - {{- if .Values.witness.dbUserConnectionLimit }} - - name: POSTGRESQL_USERNAME_CONNECTION_LIMIT - value: {{ .Values.witness.dbUserConnectionLimit | quote }} - {{- end }} - {{- if .Values.witness.tcpKeepalivesInterval }} - - name: POSTGRESQL_TCP_KEEPALIVES_INTERVAL - value: {{ .Values.witness.tcpKeepalivesInterval | quote }} - {{- end }} - {{- if .Values.witness.tcpKeepalivesIdle }} - - name: POSTGRESQL_TCP_KEEPALIVES_IDLE - value: {{ .Values.witness.tcpKeepalivesIdle | quote }} - {{- end }} - {{- if .Values.witness.tcpKeepalivesCount }} - - name: POSTGRESQL_TCP_KEEPALIVES_COUNT - value: {{ .Values.witness.tcpKeepalivesCount | quote }} - {{- end }} - {{- if .Values.witness.statementTimeout }} - - name: POSTGRESQL_STATEMENT_TIMEOUT - value: {{ .Values.witness.statementTimeout | quote }} - {{- end }} - {{- if .Values.witness.pghbaRemoveFilters }} - - name: POSTGRESQL_PGHBA_REMOVE_FILTERS - value: {{ .Values.witness.pghbaRemoveFilters | quote }} - {{- end }} - - name: POSTGRESQL_ENABLE_TLS - value: {{ ternary "yes" "no" .Values.postgresql.tls.enabled | quote }} - {{- if .Values.postgresql.tls.enabled }} - - name: POSTGRESQL_TLS_PREFER_SERVER_CIPHERS - value: {{ ternary "yes" "no" .Values.postgresql.tls.preferServerCiphers | quote }} - - name: POSTGRESQL_TLS_CERT_FILE - value: {{ template "postgresql-ha.postgresql.tlsCert" . }} - - name: POSTGRESQL_TLS_KEY_FILE - value: {{ template "postgresql-ha.postgresql.tlsCertKey" . }} - {{- end }} - - name: POSTGRESQL_PORT_NUMBER - value: {{ .Values.witness.containerPorts.postgresql | quote }} - # Repmgr configuration - - name: REPMGR_PORT_NUMBER - value: {{ .Values.witness.containerPorts.postgresql | quote }} - - name: REPMGR_PRIMARY_PORT - value: {{ .Values.witness.containerPorts.postgresql | quote }} - - name: MY_POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: REPMGR_UPGRADE_EXTENSION - value: {{ ternary "yes" "no" .Values.witness.upgradeRepmgrExtension | quote }} - - name: REPMGR_PGHBA_TRUST_ALL - value: {{ ternary "yes" "no" .Values.witness.pgHbaTrustAll | quote }} - - name: REPMGR_MOUNTED_CONF_DIR - value: "/bitnami/repmgr/conf" - - name: REPMGR_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: REPMGR_PARTNER_NODES - value: {{ range $e, $i := until $postgresqlReplicaCount }}{{ $postgresqlFullname }}-{{ $i }}.{{ $postgresqlHeadlessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }},{{ end }} - - name: REPMGR_PRIMARY_HOST - value: {{ printf "%s-0.%s.$(REPMGR_NAMESPACE).svc.%s" $postgresqlFullname $postgresqlHeadlessServiceName $clusterDomain | quote }} - - name: REPMGR_NODE_NAME - value: "$(MY_POD_NAME)" - - name: REPMGR_NODE_NETWORK_NAME - value: "$(MY_POD_NAME).{{ $postgresqlWitnessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }}" - - name: REPMGR_NODE_TYPE - value: "witness" - - name: REPMGR_NODE_ID_START_SEED - value: "2000" - - name: REPMGR_LOG_LEVEL - value: {{ .Values.witness.repmgrLogLevel | quote }} - - name: REPMGR_CONNECT_TIMEOUT - value: {{ .Values.witness.repmgrConnectTimeout | quote }} - - name: REPMGR_RECONNECT_ATTEMPTS - value: {{ .Values.witness.repmgrReconnectAttempts | quote }} - - name: REPMGR_RECONNECT_INTERVAL - value: {{ .Values.witness.repmgrReconnectInterval | quote }} - - name: REPMGR_USERNAME - value: {{ (include "postgresql-ha.postgresqlRepmgrUsername" .) | quote }} - {{- if .Values.witness.usePasswordFile }} - - name: REPMGR_PASSWORD_FILE - value: "/opt/bitnami/postgresql/secrets/repmgr-password" - {{- else }} - - name: REPMGR_PASSWORD - valueFrom: - secretKeyRef: - name: {{ include "postgresql-ha.postgresqlSecretName" . }} - key: repmgr-password - {{- end }} - {{- if .Values.postgresql.repmgrUsePassfile }} - - name: REPMGR_USE_PASSFILE - value: {{ ternary "true" "false" .Values.postgresql.repmgrUsePassfile | quote }} - - name: REPMGR_PASSFILE_PATH - value: {{ default "/opt/bitnami/repmgr/conf/.pgpass" .Values.postgresql.repmgrPassfilePath }} - {{- end }} - {{- if (include "postgresql-ha.repmgrDatabase" .) }} - - name: REPMGR_DATABASE - value: {{ (include "postgresql-ha.repmgrDatabase" .) | quote }} - {{- end }} - {{- if .Values.witness.extraEnvVars }} - {{- include "common.tplvalues.render" (dict "value" .Values.witness.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - envFrom: - {{- if .Values.witness.extraEnvVarsCM }} - - configMapRef: - name: {{ .Values.witness.extraEnvVarsCM }} - {{- end }} - {{- if .Values.witness.extraEnvVarsSecret }} - - secretRef: - name: {{ .Values.witness.extraEnvVarsSecret }} - {{- end }} - ports: - - name: postgresql - containerPort: {{ .Values.witness.containerPorts.postgresql }} - protocol: TCP - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.witness.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.witness.customLivenessProbe "context" $) | nindent 12 }} - {{- else if .Values.witness.livenessProbe.enabled }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.witness.livenessProbe "enabled") "context" $) | nindent 12 }} - exec: - command: - - bash - - -ec - - '{{ include "postgresql-ha.pgpassword" . }} psql -w -U {{ include "postgresql-ha.postgresqlUsername" . | quote }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} -h 127.0.0.1 -p {{ .Values.witness.containerPorts.postgresql }} -c "SELECT 1"' - {{- end }} - {{- if .Values.witness.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.witness.customReadinessProbe "context" $) | nindent 12 }} - {{- else if .Values.witness.readinessProbe.enabled }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.witness.readinessProbe "enabled") "context" $) | nindent 12 }} - exec: - command: - - bash - - -ec - {{- include "postgresql-ha.readinessProbeCommand" (dict "component" "witness" "context" $) | nindent 16 }} - {{- end }} - {{- if .Values.witness.customStartupProbe }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.witness.customStartupProbe "context" $) | nindent 12 }} - {{- else if .Values.witness.startupProbe.enabled }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.witness.startupProbe "enabled") "context" $) | nindent 12 }} - exec: - command: - - bash - - -ec - - '{{ include "postgresql-ha.pgpassword" . }} psql -w -U {{ include "postgresql-ha.postgresqlUsername" . | quote }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} -h 127.0.0.1 -p {{ .Values.witness.containerPorts.postgresql }} -c "SELECT 1"' - {{- end }} - {{- end }} - {{- if .Values.witness.resources }} - resources: {{- toYaml .Values.witness.resources | nindent 12 }} - {{- else if ne .Values.witness.resourcesPreset "none" }} - resources: {{- include "common.resources.preset" (dict "type" .Values.witness.resourcesPreset) | nindent 12 }} - {{- end }} - volumeMounts: - - name: empty-dir - mountPath: /tmp - subPath: tmp-dir - - name: empty-dir - mountPath: /opt/bitnami/postgresql/conf - subPath: app-conf-dir - - name: empty-dir - mountPath: /opt/bitnami/postgresql/tmp - subPath: app-tmp-dir - - name: empty-dir - mountPath: /opt/bitnami/repmgr/conf - subPath: repmgr-conf-dir - - name: empty-dir - mountPath: /opt/bitnami/repmgr/tmp - subPath: repmgr-tmp-dir - - name: empty-dir - mountPath: /opt/bitnami/repmgr/logs - subPath: repmgr-logs-dir - {{- if or .Values.witness.repmgrConfiguration .Values.witness.configuration .Values.witness.pgHbaConfiguration .Values.witness.configurationCM }} - - name: postgresql-config - mountPath: /bitnami/repmgr/conf - {{- end }} - {{- if or .Values.witness.extendedConf .Values.witness.extendedConfCM }} - - name: postgresql-extended-config - mountPath: /bitnami/postgresql/conf/conf.d/ - {{- end }} - {{- if or .Values.witness.initdbScriptsCM .Values.witness.initdbScripts }} - - name: custom-init-scripts - mountPath: /docker-entrypoint-initdb.d/ - {{- end }} - {{- if .Values.witness.initdbScriptsSecret }} - - name: custom-init-scripts-secret - mountPath: /docker-entrypoint-initdb.d/secret - {{- end }} - {{- if .Values.witness.usePasswordFile }} - - name: password - mountPath: /opt/bitnami/postgresql/secrets/ - {{- end }} - {{- if .Values.postgresql.tls.enabled }} - - name: postgresql-certificates - mountPath: /opt/bitnami/postgresql/certs - {{- end }} - - name: data - mountPath: {{ .Values.persistence.mountPath }} - - name: hooks-scripts - mountPath: /pre-stop.sh - subPath: pre-stop.sh - {{- if .Values.witness.extraVolumeMounts }} - {{- include "common.tplvalues.render" (dict "value" .Values.witness.extraVolumeMounts "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.metrics.enabled }} - - name: metrics - image: {{ include "postgresql-ha.metrics.image" . }} - imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} - {{- if .Values.metrics.podSecurityContext.enabled }} - securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.metrics.podSecurityContext "context" $) | nindent 12 }} - {{- end }} - env: - - name: PG_EXPORTER_WEB_LISTEN_ADDRESS - value: :{{ .Values.metrics.containerPorts.http }} - - name: DATA_SOURCE_URI - value: {{ printf "127.0.0.1:%d/%s?sslmode=disable" (.Values.witness.containerPorts.postgresql | int64) (include "postgresql-ha.postgresqlDatabase" .) | quote }} - {{- if .Values.witness.usePasswordFile }} - - name: DATA_SOURCE_PASS_FILE - value: "/opt/bitnami/postgresql/secrets/password" - {{- else }} - - name: DATA_SOURCE_PASS - valueFrom: - secretKeyRef: - name: {{ include "postgresql-ha.postgresqlSecretName" . }} - key: password - {{- end }} - - name: DATA_SOURCE_USER - value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }} - {{- if .Values.metrics.extraEnvVars }} - {{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - envFrom: - {{- if .Values.metrics.extraEnvVarsCM }} - - configMapRef: - name: {{ .Values.metrics.extraEnvVarsCM }} - {{- end }} - {{- if .Values.metrics.extraEnvVarsSecret }} - - secretRef: - name: {{ .Values.metrics.extraEnvVarsSecret }} - {{- end }} - ports: - - name: metrics - containerPort: {{ .Values.metrics.containerPorts.http }} - protocol: TCP - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.metrics.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }} - {{- else if .Values.metrics.livenessProbe.enabled }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }} - tcpSocket: - port: metrics - {{- end }} - {{- if .Values.metrics.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }} - {{- else if .Values.metrics.readinessProbe.enabled }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }} - httpGet: - path: / - port: metrics - {{- end }} - {{- if .Values.metrics.customStartupProbe }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }} - {{- else if .Values.metrics.startupProbe.enabled }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }} - httpGet: - path: / - port: metrics - {{- end }} - {{- end }} - {{- if .Values.metrics.resources }} - resources: {{- toYaml .Values.metrics.resources | nindent 12 }} - {{- else if ne .Values.metrics.resourcesPreset "none" }} - resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }} - {{- end }} - volumeMounts: - - name: empty-dir - mountPath: /tmp - subPath: tmp-dir - {{- if .Values.postgresql.usePasswordFile }} - - name: password - mountPath: /opt/bitnami/postgresql/secrets/ - {{- end }} - {{- if .Values.metrics.customMetrics }} - - name: custom-metrics - mountPath: /conf - readOnly: true - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- else }} - args: ["--extend.query-path", "/conf/custom-metrics.yaml"] - {{- end }} - {{- end }} - {{- end }} - {{- if .Values.witness.sidecars }} - {{- include "common.tplvalues.render" (dict "value" .Values.witness.sidecars "context" $) | nindent 8 }} - {{- end }} - volumes: - {{- if .Values.witness.extraVolumes }} - {{- include "common.tplvalues.render" (dict "value" .Values.witness.extraVolumes "context" $) | nindent 8 }} - {{- end }} - - name: empty-dir - emptyDir: {} - {{- if and .Values.metrics.enabled .Values.metrics.customMetrics }} - - name: custom-metrics - configMap: - name: {{ include "postgresql.metricsCM" . }} - {{- end }} - - name: hooks-scripts - configMap: - name: {{ printf "%s-hooks-scripts" (include "postgresql-ha.postgresql" .) }} - defaultMode: 0755 - {{- if or .Values.witness.repmgrConfiguration .Values.witness.configuration .Values.witness.pgHbaConfiguration .Values.witness.configurationCM }} - - name: postgresql-config - configMap: - name: {{ include "postgresql-ha.postgresqlConfigurationCM" . }} - {{- end }} - {{- if or .Values.witness.extendedConf .Values.witness.extendedConfCM }} - - name: postgresql-extended-config - configMap: - name: {{ template "postgresql-ha.postgresqlExtendedConfCM" . }} - {{- end }} - {{- if .Values.witness.initdbScriptsSecret }} - - name: custom-init-scripts-secret - secret: - secretName: {{ template "postgresql-ha.postgresqlInitdbScriptsSecret" . }} - {{- end }} - {{- if .Values.witness.usePasswordFile }} - - name: password - secret: - secretName: {{ include "postgresql-ha.postgresqlSecretName" . }} - {{- end }} - {{- if or .Values.witness.initdbScriptsCM .Values.witness.initdbScripts }} - - name: custom-init-scripts - configMap: - name: {{ template "postgresql-ha.postgresqlInitdbScriptsCM" . }} - {{- end }} - {{- if .Values.postgresql.tls.enabled }} - - name: raw-certificates - secret: - secretName: {{ required "A secret containing TLS certificates is required when TLS is enabled" (tpl .Values.postgresql.tls.certificatesSecret .) }} - - name: postgresql-certificates - emptyDir: {} - {{- end }} - {{- if and .Values.persistence.enabled .Values.persistence.existingClaim }} - - name: data - persistentVolumeClaim: - {{- with .Values.persistence.existingClaim }} - claimName: {{ tpl . $ }} - {{- end }} - {{- else if not .Values.persistence.enabled }} - - name: data - emptyDir: {} - {{- else if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} - volumeClaimTemplates: - - apiVersion: v1 - kind: PersistentVolumeClaim - metadata: - name: data - {{- if .Values.persistence.annotations }} - annotations: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.annotations "context" $) | nindent 10 }} - {{- end }} - {{- if .Values.persistence.labels }} - labels: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.labels "context" $) | nindent 10 }} - {{- end }} - spec: - accessModes: - {{- range .Values.persistence.accessModes }} - - {{ . | quote }} - {{- end }} - resources: - requests: - storage: {{ .Values.persistence.size | quote }} - {{- if .Values.persistence.selector }} - selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.selector "context" $) | nindent 10 }} - {{- end -}} - {{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 8 }} - {{- end }} -{{- end }} diff --git a/postgresql-ha/values.yaml b/postgresql-ha/values.yaml deleted file mode 100644 index c3314f8..0000000 --- a/postgresql-ha/values.yaml +++ /dev/null @@ -1,2292 +0,0 @@ -# Copyright Broadcom, Inc. All Rights Reserved. -# SPDX-License-Identifier: APACHE-2.0 - -## @section Global parameters -## Global Docker image parameters -## Please, note that this will override the image parameters, including dependencies, configured to use the global value -## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass - -## @param global.imageRegistry Global Docker image registry -## @param global.imagePullSecrets Global Docker registry secret names as an array -## @param global.storageClass Global StorageClass for Persistent Volume(s) -## @param global.postgresql.username PostgreSQL username (overrides `postgresql.username`) -## @param global.postgresql.password PostgreSQL password (overrides `postgresql.password`) -## @param global.postgresql.database PostgreSQL database (overrides `postgresql.database`) -## @param global.postgresql.repmgrUsername PostgreSQL repmgr username (overrides `postgresql.repmgrUsername`) -## @param global.postgresql.repmgrPassword PostgreSQL repmgr password (overrides `postgresql.repmgrpassword`) -## @param global.postgresql.repmgrDatabase PostgreSQL repmgr database (overrides `postgresql.repmgrDatabase`) -## @param global.postgresql.existingSecret Name of existing secret to use for PostgreSQL passwords (overrides `postgresql.existingSecret`) -## @param global.ldap.bindpw LDAP bind password (overrides `ldap.bindpw`) -## @param global.ldap.existingSecret Name of existing secret to use for LDAP passwords (overrides `ldap.existingSecret`) -## @param global.pgpool.adminUsername Pgpool Admin username (overrides `pgpool.adminUsername`) -## @param global.pgpool.adminPassword Pgpool Admin password (overrides `pgpool.adminPassword`) -## @param global.pgpool.existingSecret Pgpool existing secret -## -global: - imageRegistry: "registry.co-work.ru" - ## E.g. - ## imagePullSecrets: - ## - myRegistryKeySecretName - ## - imagePullSecrets: [docker-registry-secret] - storageClass: "client3" - security: - allowInsecureImages: true - - postgresql: - username: "" - password: "" - database: "" - repmgrUsername: "" - repmgrPassword: "" - repmgrDatabase: "" - existingSecret: "pg-ha-creds" - ldap: - bindpw: "" - existingSecret: "" - pgpool: - adminUsername: "" - adminPassword: "" - existingSecret: "pg-ha-creds" - ## Compatibility adaptations for Kubernetes platforms - ## - compatibility: - ## Compatibility adaptations for Openshift - ## - openshift: - ## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) - ## - adaptSecurityContext: auto -## @section Common parameters - -## @param kubeVersion Override Kubernetes version -## -kubeVersion: "" -## @param nameOverride String to partially override common.names.fullname template (will maintain the release name) -## -nameOverride: "" -## @param fullnameOverride String to fully override common.names.fullname template -## -fullnameOverride: "postgresql-ha" -## @param namespaceOverride String to fully override common.names.namespace -## -namespaceOverride: "" -## @param commonLabels Common labels to add to all resources (sub-charts are not considered). Evaluated as a template -## -commonLabels: {} -## @param commonAnnotations Common annotations to add to all resources (sub-charts are not considered). Evaluated as a template -## -commonAnnotations: {} -## @param clusterDomain Kubernetes Cluster Domain -## -clusterDomain: cluster.local -## @param extraDeploy Array of extra objects to deploy with the release (evaluated as a template) -## -extraDeploy: [] -## Diagnostic mode in the deployment -## -diagnosticMode: - ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) - ## - enabled: false - ## @param diagnosticMode.command [array] Command to override all containers in the deployment - ## - command: - - sleep - ## @param diagnosticMode.args [array] Args to override all containers in the deployment - ## - args: - - infinity -## @section PostgreSQL with Repmgr parameters - -## PostgreSQL parameters -## -postgresql: - ## ref: https://hub.docker.com/r/bitnami/postgresql/tags/ - ## @param postgresql.image.registry [default: REGISTRY_NAME] PostgreSQL with Repmgr image registry - ## @param postgresql.image.repository [default: REPOSITORY_NAME/postgresql-repmgr] PostgreSQL with Repmgr image repository - ## @skip postgresql.image.tag PostgreSQL with Repmgr image tag - ## @param postgresql.image.digest PostgreSQL image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag - ## @param postgresql.image.pullPolicy PostgreSQL with Repmgr image pull policy - ## @param postgresql.image.pullSecrets Specify docker-registry secret names as an array - ## @param postgresql.image.debug Specify if debug logs should be enabled - ## - image: - registry: docker.io - repository: bitnami/postgresql-repmgr - tag: 16.3.0-debian-12-r9 - digest: "" - ## Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## Example: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## Set to true if you would like to see extra information on logs - ## - debug: false - ## @param postgresql.labels Labels to add to the StatefulSet. Evaluated as template - ## - labels: {} - ## @param postgresql.podLabels Labels to add to the StatefulSet pods. Evaluated as template - ## - podLabels: {} - ## @param postgresql.serviceAnnotations Provide any additional annotations for PostgreSQL service - ## - serviceAnnotations: {} - ## @param postgresql.replicaCount Number of replicas to deploy. Use an odd number. Having 3 replicas is the minimum to get quorum when promoting a new primary. - ## - replicaCount: 3 - ## @param postgresql.updateStrategy.type Postgresql statefulset strategy type - ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies - ## e.g: - ## updateStrategy: - ## type: RollingUpdate - ## rollingUpdate: - ## maxSurge: 25% - ## maxUnavailable: 25% - ## - updateStrategy: - type: RollingUpdate - ## @param postgresql.containerPorts.postgresql PostgreSQL port - ## - containerPorts: - postgresql: 5432 - ## @param postgresql.automountServiceAccountToken Mount Service Account token in pod - ## - automountServiceAccountToken: false - ## @param postgresql.hostAliases Deployment pod host aliases - ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ - ## - hostAliases: [] - ## @param postgresql.hostNetwork Specify if host network should be enabled for PostgreSQL pod - ## - hostNetwork: false - ## @param postgresql.hostIPC Specify if host IPC should be enabled for PostgreSQL pod - ## - hostIPC: false - ## @param postgresql.podAnnotations Additional pod annotations - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ - ## - podAnnotations: {} - ## @param postgresql.podAffinityPreset PostgreSQL pod affinity preset. Ignored if `postgresql.affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAffinityPreset: "" - ## @param postgresql.podAntiAffinityPreset PostgreSQL pod anti-affinity preset. Ignored if `postgresql.affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAntiAffinityPreset: soft - ## PostgreSQL node affinity preset - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity - ## - nodeAffinityPreset: - ## @param postgresql.nodeAffinityPreset.type PostgreSQL node affinity preset type. Ignored if `postgresql.affinity` is set. Allowed values: `soft` or `hard` - ## - type: "" - ## @param postgresql.nodeAffinityPreset.key PostgreSQL node label key to match Ignored if `postgresql.affinity` is set. - ## E.g. - ## key: "kubernetes.io/e2e-az-name" - ## - key: "" - ## @param postgresql.nodeAffinityPreset.values PostgreSQL node label values to match. Ignored if `postgresql.affinity` is set. - ## E.g. - ## values: - ## - e2e-az1 - ## - e2e-az2 - ## - values: [] - ## @param postgresql.affinity Affinity for PostgreSQL pods assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: postgresql.podAffinityPreset, postgresql.podAntiAffinityPreset, and postgresql.nodeAffinityPreset will be ignored when it's set - ## - affinity: {} - ## @param postgresql.nodeSelector Node labels for PostgreSQL pods assignment - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ - ## - nodeSelector: - tenant: client3 - ## @param postgresql.tolerations Tolerations for PostgreSQL pods assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - ## - tolerations: - - key: "node-role.kubernetes.io/control-plane" - operator: "Exists" - effect: "NoSchedule" - - ## @param postgresql.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template - ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods - ## - topologySpreadConstraints: [] - ## @param postgresql.priorityClassName Pod priority class - ## Ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ - ## - priorityClassName: "" - ## @param postgresql.schedulerName Use an alternate scheduler, e.g. "stork". - ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ - ## - schedulerName: "" - ## @param postgresql.terminationGracePeriodSeconds Seconds PostgreSQL pod needs to terminate gracefully - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods - ## - terminationGracePeriodSeconds: "" - ## K8s Security Context - ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - ## @param postgresql.podSecurityContext.enabled Enable security context for PostgreSQL with Repmgr - ## @param postgresql.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy - ## @param postgresql.podSecurityContext.sysctls Set kernel settings using the sysctl interface - ## @param postgresql.podSecurityContext.supplementalGroups Set filesystem extra groups - ## @param postgresql.podSecurityContext.fsGroup Group ID for the PostgreSQL with Repmgr filesystem - ## - podSecurityContext: - enabled: true - fsGroupChangePolicy: Always - sysctls: [] - supplementalGroups: [] - fsGroup: 1001 - ## Container Security Context - ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - ## @param postgresql.containerSecurityContext.enabled Enabled containers' Security Context - ## @param postgresql.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container - ## @param postgresql.containerSecurityContext.runAsUser Set containers' Security Context runAsUser - ## @param postgresql.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup - ## @param postgresql.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot - ## @param postgresql.containerSecurityContext.privileged Set container's Security Context privileged - ## @param postgresql.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem - ## @param postgresql.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation - ## @param postgresql.containerSecurityContext.capabilities.drop List of capabilities to be dropped - ## @param postgresql.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile - ## e.g: - ## containerSecurityContext: - ## enabled: true - ## capabilities: - ## drop: ["NET_RAW"] - ## readOnlyRootFilesystem: true - ## - containerSecurityContext: - enabled: true - seLinuxOptions: null - runAsUser: 1001 - runAsGroup: 1001 - runAsNonRoot: true - privileged: false - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - capabilities: - drop: ["ALL"] - seccompProfile: - type: "RuntimeDefault" - ## @param postgresql.command Override default container command (useful when using custom images) - ## - command: [] - ## @param postgresql.args Override default container args (useful when using custom images) - ## - args: [] - ## @param postgresql.lifecycleHooks LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template - ## - lifecycleHooks: {} - ## @param postgresql.extraEnvVars Array containing extra environment variables - ## For example: - ## - name: PG_EXPORTER_DISABLE_DEFAULT_METRICS - ## value: "true" - ## - extraEnvVars: [] - ## @param postgresql.extraEnvVarsCM ConfigMap with extra environment variables - ## - extraEnvVarsCM: "" - ## @param postgresql.extraEnvVarsSecret Secret with extra environment variables - ## - extraEnvVarsSecret: "" - ## @param postgresql.extraVolumes Extra volumes to add to the deployment - ## - extraVolumes: [] - ## @param postgresql.extraVolumeMounts Extra volume mounts to add to the container. Normally used with `extraVolumes`. - ## - extraVolumeMounts: [] - ## @param postgresql.initContainers Extra init containers to add to the deployment - ## - initContainers: [] - ## @param postgresql.sidecars Extra sidecar containers to add to the deployment - ## - sidecars: [] - ## PostgreSQL containers' resource requests and limits - ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param postgresql.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if postgresql.resources is set (postgresql.resources is recommended for production). - ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 - ## - resourcesPreset: "small" - ## @param postgresql.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) - ## Example: - ## resources: - ## requests: - ## cpu: 2 - ## memory: 512Mi - ## limits: - ## cpu: 3 - ## memory: 1024Mi - ## - resources: {} - ## The pod management policy of the statefulset. - ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies - ## @param postgresql.podManagementPolicy sets the pod management policy - podManagementPolicy: Parallel - ## PostgreSQL container's liveness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param postgresql.livenessProbe.enabled Enable livenessProbe - ## @param postgresql.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe - ## @param postgresql.livenessProbe.periodSeconds Period seconds for livenessProbe - ## @param postgresql.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe - ## @param postgresql.livenessProbe.failureThreshold Failure threshold for livenessProbe - ## @param postgresql.livenessProbe.successThreshold Success threshold for livenessProbe - ## - livenessProbe: - enabled: true - initialDelaySeconds: 30 - periodSeconds: 10 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 6 - ## PostgreSQL container's readiness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param postgresql.readinessProbe.enabled Enable readinessProbe - ## @param postgresql.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe - ## @param postgresql.readinessProbe.periodSeconds Period seconds for readinessProbe - ## @param postgresql.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe - ## @param postgresql.readinessProbe.failureThreshold Failure threshold for readinessProbe - ## @param postgresql.readinessProbe.successThreshold Success threshold for readinessProbe - ## - readinessProbe: - enabled: true - initialDelaySeconds: 5 - periodSeconds: 10 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 6 - ## PostgreSQL container's startup probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param postgresql.startupProbe.enabled Enable startupProbe - ## @param postgresql.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe - ## @param postgresql.startupProbe.periodSeconds Period seconds for startupProbe - ## @param postgresql.startupProbe.timeoutSeconds Timeout seconds for startupProbe - ## @param postgresql.startupProbe.failureThreshold Failure threshold for startupProbe - ## @param postgresql.startupProbe.successThreshold Success threshold for startupProbe - ## - startupProbe: - enabled: false - initialDelaySeconds: 5 - periodSeconds: 10 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 10 - ## @param postgresql.customLivenessProbe Override default liveness probe - ## - customLivenessProbe: {} - ## @param postgresql.customReadinessProbe Override default readiness probe - ## - customReadinessProbe: {} - ## @param postgresql.customStartupProbe Override default startup probe - ## - customStartupProbe: {} - ## Network Policies - ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ - ## - networkPolicy: - ## @param postgresql.networkPolicy.enabled Specifies whether a NetworkPolicy should be created - ## - enabled: true - ## @param postgresql.networkPolicy.allowExternal Don't require server label for connections - ## The Policy model to apply. When set to false, only pods with the correct - ## server label will have network access to the ports server is listening - ## on. When true, server will accept connections from any source - ## (with the correct destination port). - ## - allowExternal: true - ## @param postgresql.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. - ## - allowExternalEgress: true - ## @param postgresql.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy - ## e.g: - ## extraIngress: - ## - ports: - ## - port: 1234 - ## from: - ## - podSelector: - ## - matchLabels: - ## - role: frontend - ## - podSelector: - ## - matchExpressions: - ## - key: role - ## operator: In - ## values: - ## - frontend - extraIngress: [] - ## @param postgresql.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy - ## e.g: - ## extraEgress: - ## - ports: - ## - port: 1234 - ## to: - ## - podSelector: - ## - matchLabels: - ## - role: frontend - ## - podSelector: - ## - matchExpressions: - ## - key: role - ## operator: In - ## values: - ## - frontend - ## - extraEgress: [] - ## @param postgresql.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces - ## @param postgresql.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces - ## - ingressNSMatchLabels: {} - ingressNSPodMatchLabels: {} - ## Pod disruption budget configuration - ## @param postgresql.pdb.create Specifies whether to create a Pod disruption budget for PostgreSQL with Repmgr - ## @param postgresql.pdb.minAvailable Minimum number / percentage of pods that should remain scheduled - ## @param postgresql.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `postgresql.pdb.minAvailable` and `postgresql.pdb.maxUnavailable` are empty. - ## - pdb: - create: true - minAvailable: "2" - maxUnavailable: "" - ## PostgreSQL configuration parameters - ## @param postgresql.username PostgreSQL username - ## @param postgresql.password PostgreSQL password - ## @param postgresql.database PostgreSQL database - ## - username: postgres - password: "" - database: "" - ## @param postgresql.existingSecret PostgreSQL password using existing secret - ## - existingSecret: "" - ## @param postgresql.postgresPassword PostgreSQL password for the `postgres` user when `username` is not `postgres` - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#creating-a-database-user-on-first-run (see note!) - ## - postgresPassword: "" - ## @param postgresql.usePasswordFile Set to `true` to mount PostgreSQL secret as a file instead of passing environment variable - ## - usePasswordFile: "" - ## @param postgresql.repmgrUsePassfile Set to `true` to configure repmgrl to use `passfile` instead of `password` vars*:*:*:username:password" and use it to configure Repmgr instead of using password (Requires Postgresql 10+, otherwise ignored) - ## ref: https://repmgr.org/docs/current/configuration-password-management.html - ## https://www.postgresql.org/docs/current/libpq-pgpass.html - ## - repmgrUsePassfile: "" - ## @param postgresql.repmgrPassfilePath Custom path where `passfile` will be stored - ## - repmgrPassfilePath: "" - ## @param postgresql.upgradeRepmgrExtension Upgrade repmgr extension in the database - ## - upgradeRepmgrExtension: false - ## @param postgresql.pgHbaTrustAll Configures PostgreSQL HBA to trust every user - ## - pgHbaTrustAll: false - ## @param postgresql.syncReplication Make the replication synchronous. This will wait until the data is synchronized in all the replicas before other query can be run. This ensures the data availability at the expenses of speed. - ## - syncReplication: false - ## @param postgresql.syncReplicationMode This specifies the method to choose synchronous standbys from the listed servers. Valid values: empty, FIRST, ANY. - ## ref: https://www.postgresql.org/docs/current/runtime-config-replication.html#GUC-SYNCHRONOUS-STANDBY-NAMES - ## - syncReplicationMode: "" - ## Repmgr configuration parameters - ## @param postgresql.repmgrUsername PostgreSQL Repmgr username - ## @param postgresql.repmgrPassword PostgreSQL Repmgr password - ## @param postgresql.repmgrDatabase PostgreSQL Repmgr database - ## @param postgresql.repmgrLogLevel Repmgr log level (DEBUG, INFO, NOTICE, WARNING, ERROR, ALERT, CRIT or EMERG) - ## @param postgresql.repmgrConnectTimeout Repmgr backend connection timeout (in seconds) - ## @param postgresql.repmgrReconnectAttempts Repmgr backend reconnection attempts - ## @param postgresql.repmgrReconnectInterval Repmgr backend reconnection interval (in seconds) - ## @param postgresql.repmgrFenceOldPrimary Set if fencing of old primary in multiple primary situation is desired - ## @param postgresql.repmgrChildNodesCheckInterval Repmgr child nodes check interval (in seconds) - ## @param postgresql.repmgrChildNodesConnectedMinCount Repmgr minimum number of connected child nodes before being considered as failed primary for fencing - ## @param postgresql.repmgrChildNodesDisconnectTimeout Repmgr time before node will be fenced when insufficient child nodes are detected (in seconds) - ## - repmgrUsername: repmgr - repmgrPassword: "" - repmgrDatabase: repmgr - repmgrLogLevel: NOTICE - repmgrConnectTimeout: 5 - repmgrReconnectAttempts: 2 - repmgrReconnectInterval: 3 - repmgrFenceOldPrimary: false - repmgrChildNodesCheckInterval: 5 - repmgrChildNodesConnectedMinCount: 1 - repmgrChildNodesDisconnectTimeout: 30 - ## EXPERMENTAL: Use pg_rewind for standby failover - ## @param postgresql.usePgRewind Use pg_rewind for standby failover (experimental) - ## - usePgRewind: false - ## Audit settings - ## https://github.com/bitnami/containers/tree/main/bitnami/postgresql#auditing - ## - audit: - ## @param postgresql.audit.logHostname Add client hostnames to the log file - ## - logHostname: true - ## @param postgresql.audit.logConnections Add client log-in operations to the log file - ## - logConnections: false - ## @param postgresql.audit.logDisconnections Add client log-outs operations to the log file - ## - logDisconnections: false - ## @param postgresql.audit.pgAuditLog Add operations to log using the pgAudit extension - ## - pgAuditLog: "" - ## @param postgresql.audit.pgAuditLogCatalog Log catalog using pgAudit - ## - pgAuditLogCatalog: "off" - ## @param postgresql.audit.clientMinMessages Message log level to share with the user - ## - clientMinMessages: error - ## @param postgresql.audit.logLinePrefix Template string for the log line prefix - ## - logLinePrefix: "" - ## @param postgresql.audit.logTimezone Timezone for the log timestamps - ## - logTimezone: "" - ## @param postgresql.sharedPreloadLibraries Shared preload libraries (comma-separated list) - ## - sharedPreloadLibraries: "pgaudit, repmgr" - ## @param postgresql.maxConnections Maximum total connections - ## - maxConnections: "" - ## @param postgresql.postgresConnectionLimit Maximum connections for the postgres user - ## - postgresConnectionLimit: "" - ## @param postgresql.dbUserConnectionLimit Maximum connections for the created user - ## - dbUserConnectionLimit: "" - ## @param postgresql.tcpKeepalivesInterval TCP keepalives interval - ## - tcpKeepalivesInterval: "" - ## @param postgresql.tcpKeepalivesIdle TCP keepalives idle - ## - tcpKeepalivesIdle: "" - ## @param postgresql.tcpKeepalivesCount TCP keepalives count - ## - tcpKeepalivesCount: "" - ## @param postgresql.statementTimeout Statement timeout - ## - statementTimeout: "" - ## @param postgresql.pghbaRemoveFilters Comma-separated list of patterns to remove from the pg_hba.conf file - ## (cannot be used with custom pg_hba.conf) - ## - pghbaRemoveFilters: "" - ## @param postgresql.extraInitContainers Extra init containers - ## Example: - ## extraInitContainers: - ## - name: do-something - ## image: busybox - ## command: ['do', 'something'] - ## - extraInitContainers: [] - ## @param postgresql.repmgrConfiguration Repmgr configuration - ## You can use this parameter to specify the content for repmgr.conf - ## Otherwise, a repmgr.conf will be generated based on the environment variables - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#configuration - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#configuration-file - ## Example: - ## repmgrConfiguration: |- - ## ssh_options='-o "StrictHostKeyChecking no" -v' - ## use_replication_slots='1' - ## ... - ## - repmgrConfiguration: "" - ## @param postgresql.configuration PostgreSQL configuration - ## You can use this parameter to specify the content for postgresql.conf - ## Otherwise, a repmgr.conf will be generated based on the environment variables - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#configuration - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#configuration-file - ## Example: - ## configuration: |- - ## listen_addresses = '*' - ## port = '5432' - ## ... - ## - configuration: "" - ## @param postgresql.pgHbaConfiguration PostgreSQL client authentication configuration - ## You can use this parameter to specify the content for pg_hba.conf - ## Otherwise, a repmgr.conf will be generated based on the environment variables - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#configuration - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#configuration-file - ## Example: - ## pgHbaConfiguration: |- - ## host all repmgr 0.0.0.0/0 md5 - ## host repmgr repmgr 0.0.0.0/0 md - ## ... - ## - pgHbaConfiguration: "" - ## @param postgresql.configurationCM Name of existing ConfigMap with configuration files - ## NOTE: This will override postgresql.repmgrConfiguration, postgresql.configuration and postgresql.pgHbaConfiguration - ## - configurationCM: "" - ## @param postgresql.extendedConf Extended PostgreSQL configuration (appended to main or default configuration). Implies `volumePermissions.enabled`. - ## Similar to postgresql.configuration, but _appended_ to the main configuration - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#allow-settings-to-be-loaded-from-files-other-than-the-default-postgresqlconf - ## Example: - ## extendedConf: |- - ## deadlock_timeout = 1s - ## max_locks_per_transaction = 64 - ## ... - ## - extendedConf: "" - ## @param postgresql.extendedConfCM ConfigMap with PostgreSQL extended configuration - ## NOTE: This will override postgresql.extendedConf and implies `volumePermissions.enabled` - ## - extendedConfCM: "" - ## @param postgresql.initdbScripts Dictionary of initdb scripts - ## Specify dictionary of scripts to be run at first boot - ## The allowed extensions are `.sh`, `.sql` and `.sql.gz` - ## ref: https://github.com/bitnami/charts/tree/main/bitnami/postgresql-ha#initialize-a-fresh-instance - ## e.g: - ## initdbScripts: - ## my_init_script.sh: | - ## #!/bin/sh - ## echo "Do something." - ## - initdbScripts: - init.sql: | - CREATE DATABASE search_db; - CREATE DATABASE device; - CREATE DATABASE license; - - ## @param postgresql.initdbScriptsCM ConfigMap with scripts to be run at first boot - ## NOTE: This will override initdbScripts - ## - initdbScriptsCM: "" - ## @param postgresql.initdbScriptsSecret Secret with scripts to be run at first boot - ## Note: can be used with initdbScriptsCM or initdbScripts - ## - initdbScriptsSecret: "" - ## TLS configuration - ## - tls: - ## @param postgresql.tls.enabled Enable TLS traffic support for end-client connections - ## - enabled: false - ## @param postgresql.tls.preferServerCiphers Whether to use the server's TLS cipher preferences rather than the client's - ## - preferServerCiphers: true - ## @param postgresql.tls.certificatesSecret Name of an existing secret that contains the certificates - ## - certificatesSecret: "" - ## @param postgresql.tls.certFilename Certificate filename - ## - certFilename: "" - ## @param postgresql.tls.certKeyFilename Certificate key filename - ## - certKeyFilename: "" - ## @param postgresql.preStopDelayAfterPgStopSeconds Minimal number of seconds preStop hook waits after postgres instance is stopped - ## It is used to delay postgres pod termination. It gives pgpool time to detect that node goes down. Down up cycle in - ## pgpool makes sure postgres node is registered correctly in pgpool (mainly primary flag). - ## Note: it could be replaced with .spec.minReadySeconds for Kubernetes v1.25 or later once - ## https://github.com/kubernetes/kubernetes/issues/112066 is fixed. - ## Note: must be set to lower value than terminationGracePeriodSeconds (defaults to 30) so that preStop hook finishes - ## before grace period expires - ## - preStopDelayAfterPgStopSeconds: 25 - ## @param postgresql.headlessWithNotReadyAddresses set postgres headless service into publishNotReadyAddresses mode - ## It can be used to minimize/eliminate pgpool restarts during PG rolling upgrades or edge-case situations like - ## network split. It expects that no other external component will use PG headless service to connect or that - ## such component implements re-try logic. - ## This mode also enables enriched readiness probe implementation which delays first switch of POD to READY state - ## after start/restart of container. It gives pgpool time switch node back from DOWN to UP state during rolling - ## upgrade. - headlessWithNotReadyAddresses: false -witness: - ## ref: https://hub.docker.com/r/bitnami/postgresql/tags/ - ## @param witness.create Create PostgreSQL witness nodes - ## - create: false - ## @param witness.labels Labels to add to the StatefulSet. Evaluated as template - ## - labels: {} - ## @param witness.podLabels Labels to add to the StatefulSet pods. Evaluated as template - ## - podLabels: {} - ## @param witness.replicaCount Number of replicas to deploy. - ## - replicaCount: 1 - ## @param witness.updateStrategy.type Postgresql statefulset strategy type - ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies - ## e.g: - ## updateStrategy: - ## type: RollingUpdate - ## rollingUpdate: - ## maxSurge: 25% - ## maxUnavailable: 25% - ## - updateStrategy: - type: RollingUpdate - ## @param witness.containerPorts.postgresql PostgreSQL witness port - ## - containerPorts: - postgresql: 5432 - ## @param witness.automountServiceAccountToken Mount Service Account token in pod - ## - automountServiceAccountToken: false - ## @param witness.hostAliases Deployment pod host aliases - ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ - ## - hostAliases: [] - ## @param witness.hostNetwork Specify if host network should be enabled for PostgreSQL witness pod - ## - hostNetwork: false - ## @param witness.hostIPC Specify if host IPC should be enabled for PostgreSQL witness pod - ## - hostIPC: false - ## @param witness.podAnnotations Additional pod annotations - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ - ## - podAnnotations: {} - ## @param witness.podAffinityPreset PostgreSQL witness pod affinity preset. Ignored if `witness.affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAffinityPreset: "" - ## @param witness.podAntiAffinityPreset PostgreSQL witness pod anti-affinity preset. Ignored if `witness.affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAntiAffinityPreset: soft - ## PostgreSQL witness node affinity preset - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity - ## - nodeAffinityPreset: - ## @param witness.nodeAffinityPreset.type PostgreSQL witness node affinity preset type. Ignored if `witness.affinity` is set. Allowed values: `soft` or `hard` - ## - type: "" - ## @param witness.nodeAffinityPreset.key PostgreSQL witness node label key to match Ignored if `witness.affinity` is set. - ## E.g. - ## key: "kubernetes.io/e2e-az-name" - ## - key: "" - ## @param witness.nodeAffinityPreset.values PostgreSQL witness node label values to match. Ignored if `witness.affinity` is set. - ## E.g. - ## values: - ## - e2e-az1 - ## - e2e-az2 - ## - values: [] - ## @param witness.affinity Affinity for PostgreSQL witness pods assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: witness.podAffinityPreset, witness.podAntiAffinityPreset, and witness.nodeAffinityPreset will be ignored when it's set - ## - affinity: {} - ## @param witness.nodeSelector Node labels for PostgreSQL witness pods assignment - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ - ## - nodeSelector: - tenant: client3 - ## @param witness.tolerations Tolerations for PostgreSQL witness pods assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - ## - tolerations: - - key: "node-role.kubernetes.io/control-plane" - operator: "Exists" - effect: "NoSchedule" - - ## @param witness.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template - ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods - ## - topologySpreadConstraints: [] - ## @param witness.priorityClassName Pod priority class - ## Ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ - ## - priorityClassName: "" - ## @param witness.schedulerName Use an alternate scheduler, e.g. "stork". - ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ - ## - schedulerName: "" - ## @param witness.terminationGracePeriodSeconds Seconds PostgreSQL witness pod needs to terminate gracefully - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods - ## - terminationGracePeriodSeconds: "" - ## K8s Security Context - ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - ## @param witness.podSecurityContext.enabled Enable security context for PostgreSQL witness with Repmgr - ## @param witness.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy - ## @param witness.podSecurityContext.sysctls Set kernel settings using the sysctl interface - ## @param witness.podSecurityContext.supplementalGroups Set filesystem extra groups - ## @param witness.podSecurityContext.fsGroup Group ID for the PostgreSQL witness with Repmgr filesystem - ## - podSecurityContext: - enabled: true - fsGroupChangePolicy: Always - sysctls: [] - supplementalGroups: [] - fsGroup: 1001 - ## Container Security Context - ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - ## @param witness.containerSecurityContext.enabled Enabled containers' Security Context - ## @param witness.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container - ## @param witness.containerSecurityContext.runAsUser Set containers' Security Context runAsUser - ## @param witness.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup - ## @param witness.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot - ## @param witness.containerSecurityContext.privileged Set container's Security Context privileged - ## @param witness.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem - ## @param witness.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation - ## @param witness.containerSecurityContext.capabilities.drop List of capabilities to be dropped - ## @param witness.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile - ## e.g: - ## containerSecurityContext: - ## enabled: true - ## capabilities: - ## drop: ["NET_RAW"] - ## readOnlyRootFilesystem: false - ## - containerSecurityContext: - enabled: true - seLinuxOptions: null - runAsUser: 1001 - runAsGroup: 1001 - runAsNonRoot: true - privileged: false - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - capabilities: - drop: ["ALL"] - seccompProfile: - type: "RuntimeDefault" - ## @param witness.command Override default container command (useful when using custom images) - ## - command: [] - ## @param witness.args Override default container args (useful when using custom images) - ## - args: [] - ## @param witness.lifecycleHooks LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template - ## - lifecycleHooks: {} - ## @param witness.extraEnvVars Array containing extra environment variables - ## For example: - ## - name: PG_EXPORTER_DISABLE_DEFAULT_METRICS - ## value: "true" - ## - extraEnvVars: [] - ## @param witness.extraEnvVarsCM ConfigMap with extra environment variables - ## - extraEnvVarsCM: "" - ## @param witness.extraEnvVarsSecret Secret with extra environment variables - ## - extraEnvVarsSecret: "" - ## @param witness.extraVolumes Extra volumes to add to the deployment - ## - extraVolumes: [] - ## @param witness.extraVolumeMounts Extra volume mounts to add to the container. Normally used with `extraVolumes`. - ## - extraVolumeMounts: [] - ## @param witness.initContainers Extra init containers to add to the deployment - ## - initContainers: [] - ## @param witness.sidecars Extra sidecar containers to add to the deployment - ## - sidecars: [] - ## PostgreSQL containers' resource requests and limits - ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param witness.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if witness.resources is set (witness.resources is recommended for production). - ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 - ## - resourcesPreset: "small" - ## @param witness.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) - ## Example: - ## resources: - ## requests: - ## cpu: 2 - ## memory: 512Mi - ## limits: - ## cpu: 3 - ## memory: 1024Mi - ## - resources: {} - ## PostgreSQL container's liveness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param witness.livenessProbe.enabled Enable livenessProbe - ## @param witness.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe - ## @param witness.livenessProbe.periodSeconds Period seconds for livenessProbe - ## @param witness.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe - ## @param witness.livenessProbe.failureThreshold Failure threshold for livenessProbe - ## @param witness.livenessProbe.successThreshold Success threshold for livenessProbe - ## - livenessProbe: - enabled: true - initialDelaySeconds: 30 - periodSeconds: 10 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 6 - ## PostgreSQL container's readiness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param witness.readinessProbe.enabled Enable readinessProbe - ## @param witness.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe - ## @param witness.readinessProbe.periodSeconds Period seconds for readinessProbe - ## @param witness.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe - ## @param witness.readinessProbe.failureThreshold Failure threshold for readinessProbe - ## @param witness.readinessProbe.successThreshold Success threshold for readinessProbe - ## - readinessProbe: - enabled: true - initialDelaySeconds: 5 - periodSeconds: 10 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 6 - ## PostgreSQL container's startup probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param witness.startupProbe.enabled Enable startupProbe - ## @param witness.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe - ## @param witness.startupProbe.periodSeconds Period seconds for startupProbe - ## @param witness.startupProbe.timeoutSeconds Timeout seconds for startupProbe - ## @param witness.startupProbe.failureThreshold Failure threshold for startupProbe - ## @param witness.startupProbe.successThreshold Success threshold for startupProbe - ## - startupProbe: - enabled: false - initialDelaySeconds: 5 - periodSeconds: 10 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 10 - ## @param witness.customLivenessProbe Override default liveness probe - ## - customLivenessProbe: {} - ## @param witness.customReadinessProbe Override default readiness probe - ## - customReadinessProbe: {} - ## @param witness.customStartupProbe Override default startup probe - ## - customStartupProbe: {} - ## Pod disruption budget configuration - ## @param witness.pdb.create Specifies whether to create a Pod disruption budget for PostgreSQL witness with Repmgr - ## @param witness.pdb.minAvailable Minimum number / percentage of pods that should remain scheduled - ## @param witness.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `witness.pdb.minAvailable` and `witness.pdb.maxUnavailable` are empty. - ## - pdb: - create: true - minAvailable: "" - maxUnavailable: "" - ## @param witness.upgradeRepmgrExtension Upgrade repmgr extension in the database - ## - upgradeRepmgrExtension: false - ## @param witness.pgHbaTrustAll Configures PostgreSQL HBA to trust every user - ## - pgHbaTrustAll: false - ## Repmgr configuration parameters - ## @param witness.repmgrLogLevel Repmgr log level (DEBUG, INFO, NOTICE, WARNING, ERROR, ALERT, CRIT or EMERG) - ## @param witness.repmgrConnectTimeout Repmgr backend connection timeout (in seconds) - ## @param witness.repmgrReconnectAttempts Repmgr backend reconnection attempts - ## @param witness.repmgrReconnectInterval Repmgr backend reconnection interval (in seconds) - ## - repmgrLogLevel: NOTICE - repmgrConnectTimeout: 5 - repmgrReconnectAttempts: 2 - repmgrReconnectInterval: 3 - ## Audit settings - ## https://github.com/bitnami/containers/tree/main/bitnami/postgresql#auditing - ## - audit: - ## @param witness.audit.logHostname Add client hostnames to the log file - ## - logHostname: true - ## @param witness.audit.logConnections Add client log-in operations to the log file - ## - logConnections: false - ## @param witness.audit.logDisconnections Add client log-outs operations to the log file - ## - logDisconnections: false - ## @param witness.audit.pgAuditLog Add operations to log using the pgAudit extension - ## - pgAuditLog: "" - ## @param witness.audit.pgAuditLogCatalog Log catalog using pgAudit - ## - pgAuditLogCatalog: "off" - ## @param witness.audit.clientMinMessages Message log level to share with the user - ## - clientMinMessages: error - ## @param witness.audit.logLinePrefix Template string for the log line prefix - ## - logLinePrefix: "" - ## @param witness.audit.logTimezone Timezone for the log timestamps - ## - logTimezone: "" - ## @param witness.maxConnections Maximum total connections - ## - maxConnections: "" - ## @param witness.postgresConnectionLimit Maximum connections for the postgres user - ## - postgresConnectionLimit: "" - ## @param witness.dbUserConnectionLimit Maximum connections for the created user - ## - dbUserConnectionLimit: "" - ## @param witness.tcpKeepalivesInterval TCP keepalives interval - ## - tcpKeepalivesInterval: "" - ## @param witness.tcpKeepalivesIdle TCP keepalives idle - ## - tcpKeepalivesIdle: "" - ## @param witness.tcpKeepalivesCount TCP keepalives count - ## - tcpKeepalivesCount: "" - ## @param witness.statementTimeout Statement timeout - ## - statementTimeout: "" - ## @param witness.pghbaRemoveFilters Comma-separated list of patterns to remove from the pg_hba.conf file - ## (cannot be used with custom pg_hba.conf) - ## - pghbaRemoveFilters: "" - ## @param witness.extraInitContainers Extra init containers - ## Example: - ## extraInitContainers: - ## - name: do-something - ## image: busybox - ## command: ['do', 'something'] - ## - extraInitContainers: [] - ## @param witness.repmgrConfiguration Repmgr configuration - ## You can use this parameter to specify the content for repmgr.conf - ## Otherwise, a repmgr.conf will be generated based on the environment variables - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#configuration - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#configuration-file - ## Example: - ## repmgrConfiguration: |- - ## ssh_options='-o "StrictHostKeyChecking no" -v' - ## use_replication_slots='1' - ## ... - ## - repmgrConfiguration: "" - ## @param witness.configuration PostgreSQL configuration - ## You can use this parameter to specify the content for witness.conf - ## Otherwise, a repmgr.conf will be generated based on the environment variables - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#configuration - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#configuration-file - ## Example: - ## configuration: |- - ## listen_addresses = '*' - ## port = '5432' - ## ... - ## - configuration: "" - ## @param witness.pgHbaConfiguration PostgreSQL client authentication configuration - ## You can use this parameter to specify the content for pg_hba.conf - ## Otherwise, a repmgr.conf will be generated based on the environment variables - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#configuration - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#configuration-file - ## Example: - ## pgHbaConfiguration: |- - ## host all repmgr 0.0.0.0/0 md5 - ## host repmgr repmgr 0.0.0.0/0 md - ## ... - ## - pgHbaConfiguration: "" - ## @param witness.configurationCM Name of existing ConfigMap with configuration files - ## NOTE: This will override witness.repmgrConfiguration, witness.configuration and witness.pgHbaConfiguration - ## - configurationCM: "" - ## @param witness.extendedConf Extended PostgreSQL configuration (appended to main or default configuration). Implies `volumePermissions.enabled`. - ## Similar to witness.configuration, but _appended_ to the main configuration - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr#allow-settings-to-be-loaded-from-files-other-than-the-default-postgresqlconf - ## Example: - ## extendedConf: |- - ## deadlock_timeout = 1s - ## max_locks_per_transaction = 64 - ## ... - ## - extendedConf: "" - ## @param witness.extendedConfCM ConfigMap with PostgreSQL extended configuration - ## NOTE: This will override witness.extendedConf and implies `volumePermissions.enabled` - ## - extendedConfCM: "" - ## @param witness.initdbScripts Dictionary of initdb scripts - ## Specify dictionary of scripts to be run at first boot - ## The allowed extensions are `.sh`, `.sql` and `.sql.gz` - ## ref: https://github.com/bitnami/charts/tree/main/bitnami/postgresql-ha#initialize-a-fresh-instance - ## e.g: - ## initdbScripts: - ## my_init_script.sh: | - ## #!/bin/sh - ## echo "Do something." - ## - initdbScripts: {} - ## @param witness.initdbScriptsCM ConfigMap with scripts to be run at first boot - ## NOTE: This will override initdbScripts - ## - initdbScriptsCM: "" - ## @param witness.initdbScriptsSecret Secret with scripts to be run at first boot - ## Note: can be used with initdbScriptsCM or initdbScripts - ## - initdbScriptsSecret: "" -## @section Pgpool parameters - -## Pgpool parameters -## -pgpool: - ## Bitnami Pgpool image - ## ref: https://hub.docker.com/r/bitnami/pgpool/tags/ - ## @param pgpool.image.registry [default: REGISTRY_NAME] Pgpool image registry - ## @param pgpool.image.repository [default: REPOSITORY_NAME/pgpool] Pgpool image repository - ## @skip pgpool.image.tag Pgpool image tag - ## @param pgpool.image.digest Pgpool image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag - ## @param pgpool.image.pullPolicy Pgpool image pull policy - ## @param pgpool.image.pullSecrets Specify docker-registry secret names as an array - ## @param pgpool.image.debug Specify if debug logs should be enabled - ## - image: - registry: docker.io - repository: bitnami/pgpool - tag: 4.5.2-debian-12-r0 - digest: "" - ## Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## Example: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## Set to true if you would like to see extra information on logs - ## - debug: false - ## @param pgpool.customUsers.usernames Comma or semicolon separated list of additional users that will be performing connections to the database using pgpool. - ## @param pgpool.customUsers.passwords Comma or semicolon separated list of the associated passwords for the users above. Must have the same number of elements as the usernames list. - ## Use this property in order to create new user/password entries that will be appended to the "pgpool_passwd" file. - ## e.g: - ## customUsers: - ## usernames: "user01;user02" - ## passwords: "pass01;pass02" - customUsers: - usernames: "" - passwords: "" - ## @param pgpool.automountServiceAccountToken Mount Service Account token in pod - ## - automountServiceAccountToken: false - ## @param pgpool.hostAliases Deployment pod host aliases - ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ - ## - hostAliases: [] - ## @param pgpool.customUsersSecret Name of a secret containing the usernames and passwords of accounts that will be added to pgpool_passwd - ## The secret must contain the keys "usernames" and "passwords" respectively. - ## - customUsersSecret: "" - ## @param pgpool.existingSecret Pgpool admin password using existing secret - ## - existingSecret: "" - ## @param pgpool.srCheckDatabase Name of the database to perform streaming replication checks - ## - srCheckDatabase: postgres - ## @param pgpool.labels Labels to add to the Deployment. Evaluated as template - ## - labels: {} - ## @param pgpool.podLabels Labels to add to the pods. Evaluated as template - ## - podLabels: {} - ## @param pgpool.serviceLabels Labels to add to the service. Evaluated as template - ## - serviceLabels: {} - ## @param pgpool.serviceAnnotations Provide any additional annotations for Pgpool service - ## - serviceAnnotations: {} - ## @param pgpool.customLivenessProbe Override default liveness probe - ## - customLivenessProbe: {} - ## @param pgpool.customReadinessProbe Override default readiness probe - ## - customReadinessProbe: {} - ## @param pgpool.customStartupProbe Override default startup probe - ## - customStartupProbe: {} - ## @param pgpool.command Override default container command (useful when using custom images) - ## - command: [] - ## @param pgpool.args Override default container args (useful when using custom images) - ## - args: [] - ## @param pgpool.lifecycleHooks LifecycleHook to set additional configuration at startup, e.g. LDAP settings via REST API. Evaluated as a template - ## - lifecycleHooks: {} - ## @param pgpool.extraEnvVars Array containing extra environment variables - ## For example: - ## - name: BEARER_AUTH - ## value: true - ## - extraEnvVars: [] - ## @param pgpool.extraEnvVarsCM ConfigMap with extra environment variables - ## - extraEnvVarsCM: "" - ## @param pgpool.extraEnvVarsSecret Secret with extra environment variables - ## - extraEnvVarsSecret: "" - ## @param pgpool.extraVolumes Extra volumes to add to the deployment - ## - initContainers: [] - ## @param pgpool.sidecars Extra sidecar containers to add to the deployment - ## - sidecars: [] - ## @param pgpool.replicaCount The number of replicas to deploy - ## - replicaCount: 1 - ## @param pgpool.podAnnotations Additional pod annotations - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ - ## - podAnnotations: {} - ## @param pgpool.priorityClassName Pod priority class - ## Ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ - ## - priorityClassName: "" - ## @param pgpool.schedulerName Use an alternate scheduler, e.g. "stork". - ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ - ## - schedulerName: "" - ## @param pgpool.terminationGracePeriodSeconds Seconds pgpool pod needs to terminate gracefully - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods - ## - terminationGracePeriodSeconds: "" - ## @param pgpool.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template - ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods - ## - topologySpreadConstraints: [] - ## @param pgpool.podAffinityPreset Pgpool pod affinity preset. Ignored if `pgpool.affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAffinityPreset: "" - ## @param pgpool.podAntiAffinityPreset Pgpool pod anti-affinity preset. Ignored if `pgpool.affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAntiAffinityPreset: soft - ## Pgpool node affinity preset - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity - ## - nodeAffinityPreset: - ## @param pgpool.nodeAffinityPreset.type Pgpool node affinity preset type. Ignored if `pgpool.affinity` is set. Allowed values: `soft` or `hard` - ## - type: "" - ## @param pgpool.nodeAffinityPreset.key Pgpool node label key to match Ignored if `pgpool.affinity` is set. - ## E.g. - ## key: "kubernetes.io/e2e-az-name" - ## - key: "" - ## @param pgpool.nodeAffinityPreset.values Pgpool node label values to match. Ignored if `pgpool.affinity` is set. - ## E.g. - ## values: - ## - e2e-az1 - ## - e2e-az2 - ## - values: [] - ## @param pgpool.affinity Affinity for Pgpool pods assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: pgpool.podAffinityPreset, pgpool.podAntiAffinityPreset, and pgpool.nodeAffinityPreset will be ignored when it's set - ## - affinity: {} - ## @param pgpool.nodeSelector Node labels for Pgpool pods assignment - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ - ## - nodeSelector: - tenant: client3 - ## @param pgpool.tolerations Tolerations for Pgpool pods assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - ## - tolerations: - - key: "node-role.kubernetes.io/control-plane" - operator: "Exists" - effect: "NoSchedule" - - ## K8s Security Context - ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - ## @param pgpool.podSecurityContext.enabled Enable security context for Pgpool - ## @param pgpool.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy - ## @param pgpool.podSecurityContext.sysctls Set kernel settings using the sysctl interface - ## @param pgpool.podSecurityContext.supplementalGroups Set filesystem extra groups - ## @param pgpool.podSecurityContext.fsGroup Group ID for the Pgpool filesystem - ## - podSecurityContext: - enabled: true - fsGroupChangePolicy: Always - sysctls: [] - supplementalGroups: [] - fsGroup: 1001 - ## Container Security Context - ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - ## @param pgpool.containerSecurityContext.enabled Enabled containers' Security Context - ## @param pgpool.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container - ## @param pgpool.containerSecurityContext.runAsUser Set containers' Security Context runAsUser - ## @param pgpool.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup - ## @param pgpool.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot - ## @param pgpool.containerSecurityContext.privileged Set container's Security Context privileged - ## @param pgpool.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem - ## @param pgpool.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation - ## @param pgpool.containerSecurityContext.capabilities.drop List of capabilities to be dropped - ## @param pgpool.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile - ## e.g: - ## containerSecurityContext: - ## enabled: true - ## capabilities: - ## drop: ["NET_RAW"] - ## readOnlyRootFilesystem: false - ## - containerSecurityContext: - enabled: true - seLinuxOptions: null - runAsUser: 1001 - runAsGroup: 1001 - runAsNonRoot: true - privileged: false - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - capabilities: - drop: ["ALL"] - seccompProfile: - type: "RuntimeDefault" - - extraVolumes: - - name: pgpool-run - emptyDir: {} - - extraVolumeMounts: - - name: pgpool-run - mountPath: /var/run/pgpool - ## Pgpool containers' resource requests and limits - ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param pgpool.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if pgpool.resources is set (pgpool.resources is recommended for production). - ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 - ## - resourcesPreset: "small" - ## @param pgpool.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) - ## Example: - ## resources: - ## requests: - ## cpu: 2 - ## memory: 512Mi - ## limits: - ## cpu: 3 - ## memory: 1024Mi - ## - resources: {} - ## Pgpool container's liveness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param pgpool.livenessProbe.enabled Enable livenessProbe - ## @param pgpool.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe - ## @param pgpool.livenessProbe.periodSeconds Period seconds for livenessProbe - ## @param pgpool.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe - ## @param pgpool.livenessProbe.failureThreshold Failure threshold for livenessProbe - ## @param pgpool.livenessProbe.successThreshold Success threshold for livenessProbe - ## - livenessProbe: - enabled: true - initialDelaySeconds: 60 - periodSeconds: 10 - timeoutSeconds: 10 - successThreshold: 1 - failureThreshold: 6 - ## Pgpool container's readiness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param pgpool.readinessProbe.enabled Enable readinessProbe - ## @param pgpool.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe - ## @param pgpool.readinessProbe.periodSeconds Period seconds for readinessProbe - ## @param pgpool.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe - ## @param pgpool.readinessProbe.failureThreshold Failure threshold for readinessProbe - ## @param pgpool.readinessProbe.successThreshold Success threshold for readinessProbe - ## - readinessProbe: - enabled: true - initialDelaySeconds: 60 - periodSeconds: 10 - timeoutSeconds: 10 - successThreshold: 1 - failureThreshold: 6 - ## Pgpool container's startup probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param pgpool.startupProbe.enabled Enable startupProbe - ## @param pgpool.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe - ## @param pgpool.startupProbe.periodSeconds Period seconds for startupProbe - ## @param pgpool.startupProbe.timeoutSeconds Timeout seconds for startupProbe - ## @param pgpool.startupProbe.failureThreshold Failure threshold for startupProbe - ## @param pgpool.startupProbe.successThreshold Success threshold for startupProbe - ## - startupProbe: - enabled: true - initialDelaySeconds: 30 - periodSeconds: 10 - timeoutSeconds: 10 - successThreshold: 1 - failureThreshold: 30 - ## Network Policies - ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ - ## - networkPolicy: - ## @param pgpool.networkPolicy.enabled Specifies whether a NetworkPolicy should be created - ## - enabled: true - ## @param pgpool.networkPolicy.allowExternal Don't require server label for connections - ## The Policy model to apply. When set to false, only pods with the correct - ## server label will have network access to the ports server is listening - ## on. When true, server will accept connections from any source - ## (with the correct destination port). - ## - allowExternal: true - ## @param pgpool.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. - ## - allowExternalEgress: true - ## @param pgpool.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy - ## e.g: - ## extraIngress: - ## - ports: - ## - port: 1234 - ## from: - ## - podSelector: - ## - matchLabels: - ## - role: frontend - ## - podSelector: - ## - matchExpressions: - ## - key: role - ## operator: In - ## values: - ## - frontend - extraIngress: [] - ## @param pgpool.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy - ## e.g: - ## extraEgress: - ## - ports: - ## - port: 1234 - ## to: - ## - podSelector: - ## - matchLabels: - ## - role: frontend - ## - podSelector: - ## - matchExpressions: - ## - key: role - ## operator: In - ## values: - ## - frontend - ## - extraEgress: [] - ## @param pgpool.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces - ## @param pgpool.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces - ## - ingressNSMatchLabels: {} - ingressNSPodMatchLabels: {} - ## Pod disruption budget configuration - ## @param pgpool.pdb.create Specifies whether a Pod disruption budget should be created for Pgpool pods - ## @param pgpool.pdb.minAvailable Minimum number / percentage of pods that should remain scheduled - ## @param pgpool.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `pgpool.pdb.minAvailable` and `pgpool.pdb.maxUnavailable` are empty. - ## - pdb: - create: true - minAvailable: "" - maxUnavailable: "" - ## @param pgpool.updateStrategy Strategy used to replace old Pods by new ones - ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy - ## - updateStrategy: {} - ## @param pgpool.containerPorts.postgresql Pgpool port - ## - containerPorts: - postgresql: 5432 - ## @param pgpool.minReadySeconds How many seconds a pod needs to be ready before killing the next, during update - ## - minReadySeconds: "" - ## Credentials for the pgpool administrator - ## @param pgpool.adminUsername Pgpool Admin username - ## @param pgpool.adminPassword Pgpool Admin password - ## - adminUsername: admin - adminPassword: "" - ## @param pgpool.usePasswordFile Set to `true` to mount pgpool secret as a file instead of passing environment variable - ## - usePasswordFile: "" - ## Authentication method for pgpool container (PGPOOL_AUTHENTICATION_METHOD) - ## @param pgpool.authenticationMethod Pgpool authentication method. Use 'md5' for PSQL < 14. - ## - authenticationMethod: scram-sha-256 - ## @param pgpool.logConnections Log all client connections (PGPOOL_ENABLE_LOG_CONNECTIONS) - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration - ## - logConnections: true - ## @param pgpool.logHostname Log the client hostname instead of IP address (PGPOOL_ENABLE_LOG_HOSTNAME) - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration - ## - logHostname: true - ## @param pgpool.logPerNodeStatement Log every SQL statement for each DB node separately (PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT) - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration - ## - logPerNodeStatement: true - ## @param pgpool.logLinePrefix Format of the log entry lines (PGPOOL_LOG_LINE_PREFIX) - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration - ## ref: https://www.pgpool.net/docs/latest/en/html/runtime-config-logging.html - ## - logLinePrefix: "" - ## @param pgpool.clientMinMessages Log level for clients - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration - ## - clientMinMessages: error - ## @param pgpool.numInitChildren The number of preforked Pgpool-II server processes. It is also the concurrent - ## connections limit to Pgpool-II from clients. Must be a positive integer. (PGPOOL_NUM_INIT_CHILDREN) - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration - ## - numInitChildren: "200" - ## @param pgpool.reservedConnections Number of reserved connections. When zero, excess connection block. When non-zero, excess connections are refused with an error message. - ## When this parameter is set to 1 or greater, incoming connections from clients are not accepted with error message - ## "Sorry, too many clients already", rather than blocked if the number of current connections from clients is more than - ## (num_init_children - reserved_connections). - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration - ## - reservedConnections: 10 - ## @param pgpool.maxPool The maximum number of cached connections in each child process (PGPOOL_MAX_POOL) - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration - ## - maxPool: "4" - ## @param pgpool.childMaxConnections The maximum number of client connections in each child process (PGPOOL_CHILD_MAX_CONNECTIONS) - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration - ## - childMaxConnections: "1000" - ## @param pgpool.childLifeTime The time in seconds to terminate a Pgpool-II child process if it remains idle (PGPOOL_CHILD_LIFE_TIME) - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration - ## - childLifeTime: "300" - ## @param pgpool.clientIdleLimit The time in seconds to disconnect a client if it remains idle since the last query (PGPOOL_CLIENT_IDLE_LIMIT) - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration - ## - clientIdleLimit: "60" - ## @param pgpool.connectionLifeTime The time in seconds to terminate the cached connections to the PostgreSQL backend (PGPOOL_CONNECTION_LIFE_TIME) - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration - ## - connectionLifeTime: "600" - ## @param pgpool.useLoadBalancing Use Pgpool Load-Balancing - ## - useLoadBalancing: true - ## @param pgpool.disableLoadBalancingOnWrite LoadBalancer on write actions behavior - ## one of: [off, transaction, trans_transaction, always] - ## - disableLoadBalancingOnWrite: transaction - ## @param pgpool.configuration Pgpool configuration - ## You can use this parameter to specify the content for pgpool.conf - ## Otherwise, a repmgr.conf will be generated based on the environment variables - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration - ## ref: https://github.com/bitnami/containers/tree/main/bitnami/pgpool#configuration-file - ## Example: - ## configuration: |- - ## listen_addresses = '*' - ## port = '5432' - ## ... - ## - configuration: |- - failover_on_backend_error = 'off' - auto_failback = 'on' - health_check_period = '5' - health_check_timeout = '5' - health_check_max_retries = '3' - health_check_retry_delay = '5' - sr_check_period = '3' - ## @param pgpool.configurationCM ConfigMap with Pgpool configuration - ## NOTE: This will override pgpool.configuration parameter - ## The file used must be named `pgpool.conf` - ## - configurationCM: "" - ## @param pgpool.initdbScripts Dictionary of initdb scripts - ## Specify dictionary of scripts to be run every time Pgpool container is initialized - ## The allowed extension is `.sh` - ## ref: https://github.com/bitnami/charts/tree/main/bitnami/postgresql-ha#initialize-a-fresh-instance - ## e.g: - ## initdbScripts: - ## my_init_script.sh: | - ## #!/bin/sh - ## echo "Do something." - ## - initdbScripts: {} - ## @param pgpool.initdbScriptsCM ConfigMap with scripts to be run every time Pgpool container is initialized - ## NOTE: This will override pgpool.initdbScripts - ## - initdbScriptsCM: "" - ## @param pgpool.initdbScriptsSecret Secret with scripts to be run every time Pgpool container is initialized - ## Note: can be used with initdbScriptsCM or initdbScripts - ## - initdbScriptsSecret: "" - ## - ## TLS configuration - ## - tls: - ## @param pgpool.tls.enabled Enable TLS traffic support for end-client connections - ## - enabled: false - ## @param pgpool.tls.autoGenerated Create self-signed TLS certificates. Currently only supports PEM certificates - ## - autoGenerated: false - ## @param pgpool.tls.preferServerCiphers Whether to use the server's TLS cipher preferences rather than the client's - ## - preferServerCiphers: true - ## @param pgpool.tls.certificatesSecret Name of an existing secret that contains the certificates - ## - certificatesSecret: "" - ## @param pgpool.tls.certFilename Certificate filename - ## - certFilename: "" - ## @param pgpool.tls.certKeyFilename Certificate key filename - ## - certKeyFilename: "" - ## @param pgpool.tls.certCAFilename CA Certificate filename - ## If provided, PgPool will authenticate TLS/SSL clients by requesting them a certificate - ## ref: https://www.pgpool.net/docs/latest/en/html/runtime-ssl.html - ## - certCAFilename: "" -## @section LDAP parameters - -## LDAP parameters -## @param ldap.enabled Enable LDAP support -## @param ldap.existingSecret Name of existing secret to use for LDAP passwords -## @param ldap.uri LDAP URL beginning in the form `ldap[s]://:` -## DEPRECATED ldap.base will be removed in a future, please use 'ldap.basedn' instead -## @param ldap.basedn LDAP base DN -## @param ldap.binddn LDAP bind DN -## @param ldap.bindpw LDAP bind password -## @param ldap.bslookup LDAP base lookup -## @param ldap.scope LDAP search scope -## @param ldap.tlsReqcert LDAP TLS check on server certificates -## @param ldap.nssInitgroupsIgnoreusers LDAP ignored users -## -ldap: - enabled: false - existingSecret: "" - uri: "" - basedn: "" - binddn: "" - bindpw: "" - bslookup: "" - scope: "" - tlsReqcert: "" - nssInitgroupsIgnoreusers: root,nslcd -## @section Other Parameters - -## RBAC configuration -## Required for PSP -## -rbac: - ## @param rbac.create Create Role and RoleBinding (required for PSP to work) - ## - create: false - ## @param rbac.rules Custom RBAC rules to set - ## e.g: - ## rules: - ## - apiGroups: - ## - "" - ## resources: - ## - pods - ## verbs: - ## - get - ## - list - ## - rules: [] -## ServiceAccount configuration -## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ -## -serviceAccount: - ## @param serviceAccount.create Enable creation of ServiceAccount for Airflow pods - ## - create: true - ## @param serviceAccount.name The name of the ServiceAccount to use. - ## If not set and create is true, a name is generated using the common.names.fullname template - ## - name: "" - ## @param serviceAccount.annotations Additional custom annotations for the ServiceAccount - ## - annotations: {} - ## @param serviceAccount.automountServiceAccountToken Allows auto mount of ServiceAccountToken on the serviceAccount created - ## Can be set to false if pods using this serviceAccount do not need to use K8s API - ## - automountServiceAccountToken: false -## Pod Security Policy configuration -## ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/ -## @param psp.create Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later -## -psp: - create: false -## @section Metrics parameters - -## PostgreSQL Prometheus exporter parameters -## -metrics: - ## Bitnami PostgreSQL Prometheus exporter image - ## @param metrics.enabled Enable PostgreSQL Prometheus exporter - ## - enabled: true - ## ref: https://hub.docker.com/r/bitnami/pgpool/tags/ - ## @param metrics.image.registry [default: REGISTRY_NAME] PostgreSQL Prometheus exporter image registry - ## @param metrics.image.repository [default: REPOSITORY_NAME/postgres-exporter] PostgreSQL Prometheus exporter image repository - ## @skip metrics.image.tag PostgreSQL Prometheus exporter image tag - ## @param metrics.image.digest PostgreSQL Prometheus exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag - ## @param metrics.image.pullPolicy PostgreSQL Prometheus exporter image pull policy - ## @param metrics.image.pullSecrets Specify docker-registry secret names as an array - ## @param metrics.image.debug Specify if debug logs should be enabled - ## - image: - registry: docker.io - repository: bitnami/postgres-exporter - tag: 0.15.0-debian-12-r32 - digest: "" - ## Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## Example: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## Set to true if you would like to see extra information on logs - ## - debug: false - ## K8s Security Context - ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - ## @param metrics.podSecurityContext.enabled Enable security context for PostgreSQL Prometheus exporter - ## @param metrics.podSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container - ## @param metrics.podSecurityContext.runAsUser User ID for the PostgreSQL Prometheus exporter container - ## @param metrics.podSecurityContext.runAsGroup Group ID for the PostgreSQL Prometheus exporter container - ## @param metrics.podSecurityContext.runAsNonRoot Set PostgreSQL Prometheus exporter container's Security Context runAsNonRoot - ## @param metrics.podSecurityContext.seccompProfile.type Set PostgreSQL Prometheus exporter container's Security Context seccompProfile - ## - podSecurityContext: - enabled: true - seLinuxOptions: null - runAsUser: 1001 - runAsGroup: 1001 - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - ## Prometheus exporter containers' resource requests and limits - ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param metrics.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production). - ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 - ## - resourcesPreset: "nano" - ## @param metrics.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) - ## Example: - ## resources: - ## requests: - ## cpu: 2 - ## memory: 512Mi - ## limits: - ## cpu: 3 - ## memory: 1024Mi - ## - resources: {} - ## @param metrics.containerPorts.http Prometheus metrics exporter port - ## - containerPorts: - http: 9187 - ## Prometheus exporter container's liveness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param metrics.livenessProbe.enabled Enable livenessProbe - ## @param metrics.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe - ## @param metrics.livenessProbe.periodSeconds Period seconds for livenessProbe - ## @param metrics.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe - ## @param metrics.livenessProbe.failureThreshold Failure threshold for livenessProbe - ## @param metrics.livenessProbe.successThreshold Success threshold for livenessProbe - ## - livenessProbe: - enabled: true - initialDelaySeconds: 30 - periodSeconds: 10 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 6 - ## Prometheus exporter container's readiness probe - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param metrics.readinessProbe.enabled Enable readinessProbe - ## @param metrics.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe - ## @param metrics.readinessProbe.periodSeconds Period seconds for readinessProbe - ## @param metrics.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe - ## @param metrics.readinessProbe.failureThreshold Failure threshold for readinessProbe - ## @param metrics.readinessProbe.successThreshold Success threshold for readinessProbe - ## - readinessProbe: - enabled: true - initialDelaySeconds: 5 - periodSeconds: 10 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 6 - ## Prometheus exporter container's startup probes - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## @param metrics.startupProbe.enabled Enable startupProbe - ## @param metrics.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe - ## @param metrics.startupProbe.periodSeconds Period seconds for startupProbe - ## @param metrics.startupProbe.timeoutSeconds Timeout seconds for startupProbe - ## @param metrics.startupProbe.failureThreshold Failure threshold for startupProbe - ## @param metrics.startupProbe.successThreshold Success threshold for startupProbe - ## - startupProbe: - enabled: false - initialDelaySeconds: 5 - periodSeconds: 10 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 10 - ## @param metrics.customLivenessProbe Override default liveness probe - ## - customLivenessProbe: {} - ## @param metrics.customReadinessProbe Override default readiness probe - ## - customReadinessProbe: {} - ## @param metrics.customStartupProbe Override default startup probe - ## - customStartupProbe: {} - ## Metrics service parameters - ## - service: - ## @param metrics.service.enabled PostgreSQL Prometheus exporter metrics service enabled - ## - enabled: true - ## @param metrics.service.type PostgreSQL Prometheus exporter metrics service type - ## - type: ClusterIP - ## @param metrics.service.ports.metrics PostgreSQL Prometheus exporter metrics service port - ## - ports: - metrics: 9187 - ## @param metrics.service.nodePorts.metrics PostgreSQL Prometheus exporter Node Port - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport - ## - nodePorts: - metrics: "" - ## @param metrics.service.clusterIP PostgreSQL Prometheus exporter metrics service Cluster IP - ## e.g.: - ## clusterIP: None - ## - clusterIP: "" - ## @param metrics.service.loadBalancerIP PostgreSQL Prometheus exporter service Load Balancer IP - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer - ## - loadBalancerIP: "" - ## @param metrics.service.loadBalancerSourceRanges PostgreSQL Prometheus exporter service Load Balancer sources - ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service - ## e.g: - ## loadBalancerSourceRanges: - ## - 10.10.10.0/24 - ## - loadBalancerSourceRanges: [] - ## @param metrics.service.externalTrafficPolicy PostgreSQL Prometheus exporter service external traffic policy - ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip - ## - externalTrafficPolicy: Cluster - ## @param metrics.annotations [object] Annotations for PostgreSQL Prometheus exporter service - ## - annotations: - prometheus.io/scrape: "true" - prometheus.io/port: "9187" - ## @param metrics.customMetrics Additional custom metrics - ## ref: https://github.com/wrouesnel/postgres_exporter#adding-new-metrics-via-a-config-file - ## customMetrics: - ## pg_database: - ## query: "SELECT d.datname AS name, CASE WHEN pg_catalog.has_database_privilege(d.datname, 'CONNECT') THEN pg_catalog.pg_database_size(d.datname) ELSE 0 END AS size_bytes FROM pg_catalog.pg_database d where datname not in ('template0', 'template1', 'postgres')" - ## metrics: - ## - name: - ## usage: "LABEL" - ## description: "Name of the database" - ## - size_bytes: - ## usage: "GAUGE" - ## description: "Size of the database in bytes" - ## - customMetrics: {} - ## @param metrics.extraEnvVars Array containing extra environment variables - ## For example: - ## - name: BEARER_AUTH - ## value: true - ## - extraEnvVars: [] - ## @param metrics.extraEnvVarsCM ConfigMap with extra environment variables - ## - extraEnvVarsCM: "" - ## @param metrics.extraEnvVarsSecret Secret with extra environment variables - ## - extraEnvVarsSecret: "" - ## Metrics serviceMonitor parameters - ## Enable this if you're using Prometheus Operator - ## - serviceMonitor: - ## @param metrics.serviceMonitor.enabled if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`) - ## - enabled: false - ## @param metrics.serviceMonitor.namespace Optional namespace which Prometheus is running in - ## Fallback to the prometheus default unless specified - ## - namespace: "" - ## @param metrics.serviceMonitor.interval How frequently to scrape metrics (use by default, falling back to Prometheus' default) - ## e.g: - ## interval: 10s - ## - interval: "" - ## @param metrics.serviceMonitor.scrapeTimeout Service monitor scrape timeout - ## e.g: - ## scrapeTimeout: 10s - ## - scrapeTimeout: "" - ## @param metrics.serviceMonitor.annotations Additional annotations for the ServiceMonitor - ## - annotations: {} - ## @param metrics.serviceMonitor.labels Additional labels that can be used so ServiceMonitor will be discovered by Prometheus - ## - labels: {} - ## @param metrics.serviceMonitor.selector [object] Defaults to what's used if you follow CoreOS Prometheus Install Instructions () - ## Prometheus Selector Label (https://github.com/bitnami/charts/tree/main/bitnami/kube-prometheus#prometheus-operator-parameters) - ## Kube Prometheus Selector Label (https://github.com/bitnami/charts/tree/main/bitnami/kube-prometheus#exporters) - ## - selector: - prometheus: kube-prometheus - ## @param metrics.serviceMonitor.relabelings ServiceMonitor relabelings. Value is evaluated as a template - ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig - ## - relabelings: [] - ## @param metrics.serviceMonitor.metricRelabelings ServiceMonitor metricRelabelings. Value is evaluated as a template - ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig - ## - metricRelabelings: [] - ## @param metrics.serviceMonitor.honorLabels Specify honorLabels parameter to add the scrape endpoint - ## - honorLabels: false - ## @param metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in prometheus. - ## - jobLabel: "" -## @section Volume permissions parameters - -## Init Container parameters -## volumePermissions: Change the owner and group of the persistent volume mountpoint -## -volumePermissions: - ## @param volumePermissions.enabled Enable init container to adapt volume permissions - ## - enabled: false - ## @param volumePermissions.image.registry [default: REGISTRY_NAME] Init container volume-permissions image registry - ## @param volumePermissions.image.repository [default: REPOSITORY_NAME/os-shell] Init container volume-permissions image repository - ## @skip volumePermissions.image.tag Init container volume-permissions image tag - ## @param volumePermissions.image.digest Init container volume-permissions image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag - ## @param volumePermissions.image.pullPolicy Init container volume-permissions image pull policy - ## @param volumePermissions.image.pullSecrets Specify docker-registry secret names as an array - ## - image: - registry: docker.io - repository: bitnami/os-shell - tag: 12-debian-12-r22 - digest: "" - ## Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## Example: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## K8s Security Context - ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - ## @param volumePermissions.podSecurityContext.enabled Whether to enable security context for the volume-permissions init container - ## @param volumePermissions.podSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container - ## @param volumePermissions.podSecurityContext.runAsUser Init container volume-permissions User ID - ## @param volumePermissions.podSecurityContext.runAsGroup Group ID for the init container volume-permissions container - ## @param volumePermissions.podSecurityContext.runAsNonRoot Set Security Context runAsNonRoot for the init container volume-permissions container - ## @param volumePermissions.podSecurityContext.seccompProfile.type Set Security Context seccompProfile for the init container volume-permissions container - ## - podSecurityContext: - enabled: true - seLinuxOptions: null - runAsUser: 0 - runAsGroup: 0 - runAsNonRoot: false - seccompProfile: - type: RuntimeDefault - ## Init container' resource requests and limits - ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param volumePermissions.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). - ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 - ## - resourcesPreset: "small" - ## @param volumePermissions.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) - ## Example: - ## resources: - ## requests: - ## cpu: 2 - ## memory: 512Mi - ## limits: - ## cpu: 3 - ## memory: 1024Mi - ## - resources: {} -## @section Persistence parameters - -## Enable persistence using Persistent Volume Claims -## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/ -## -persistence: - ## @param persistence.enabled Enable data persistence - ## - enabled: true - ## @param persistence.existingClaim A manually managed Persistent Volume and Claim - ## If defined, PVC must be created manually before volume will be bound. - ## All replicas will share this PVC, using existingClaim with replicas > 1 is only useful in very special use cases. - ## The value is evaluated as a template. - ## - existingClaim: "" - ## @param persistence.storageClass Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. - ## - storageClass: "client3" - ## @param persistence.mountPath The path the volume will be mounted at, useful when using different PostgreSQL images. - ## - mountPath: /bitnami/postgresql - ## @param persistence.accessModes List of access modes of data volume - ## - accessModes: - - ReadWriteOnce - ## @param persistence.size Persistent Volume Claim size - ## - size: 8Gi - ## @param persistence.annotations Persistent Volume Claim annotations - ## - annotations: {} - ## @param persistence.labels Persistent Volume Claim labels - ## - labels: {} - ## @param persistence.selector Selector to match an existing Persistent Volume (this value is evaluated as a template) - ## selector: - ## matchLabels: - ## app: my-app - ## - selector: {} -## Persistent Volume Claim Retention Policy -## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention -## -persistentVolumeClaimRetentionPolicy: - ## @param persistentVolumeClaimRetentionPolicy.enabled Enable Persistent volume retention policy for postgresql Statefulset - ## - enabled: false - ## @param persistentVolumeClaimRetentionPolicy.whenScaled Volume retention behavior when the replica count of the StatefulSet is reduced - ## - whenScaled: Retain - ## @param persistentVolumeClaimRetentionPolicy.whenDeleted Volume retention behavior that applies when the StatefulSet is deleted - ## - whenDeleted: Retain -## @section Traffic Exposure parameters - -## PostgreSQL service parameters -## -service: - ## @param service.type Kubernetes service type (`ClusterIP`, `NodePort` or `LoadBalancer`) - ## - type: ClusterIP - ## @param service.ports.postgresql PostgreSQL port - ## - ports: - postgresql: 5432 - ## @param service.portName PostgreSQL service port name - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#multi-port-services - ## - portName: postgresql - ## @param service.nodePorts.postgresql Kubernetes service nodePort - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport - ## - nodePorts: - postgresql: "" - ## @param service.loadBalancerIP Load balancer IP if service type is `LoadBalancer` - ## Set the LoadBalancer service type to internal only - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer - ## - loadBalancerIP: "" - ## @param service.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer - ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service - ## - ## loadBalancerSourceRanges: - ## - 10.10.10.0/24 - ## - loadBalancerSourceRanges: [] - ## @param service.clusterIP Set the Cluster IP to use - ## Static clusterIP or None for headless services - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address - ## e.g: - ## clusterIP: None - ## - clusterIP: "" - ## @param service.externalTrafficPolicy Enable client source IP preservation - ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip - ## - externalTrafficPolicy: Cluster - ## @param service.extraPorts Extra ports to expose (normally used with the `sidecar` value) - ## - extraPorts: [] - ## @param service.sessionAffinity Control where client requests go, to the same pod or round-robin - ## Values: ClientIP or None - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/ - ## - sessionAffinity: "None" - ## @param service.sessionAffinityConfig Additional settings for the sessionAffinity - ## sessionAffinityConfig: - ## clientIP: - ## timeoutSeconds: 300 - sessionAffinityConfig: {} - ## @param service.annotations Provide any additional annotations both for PostgreSQL and Pgpool services - ## - annotations: {} - ## @param service.serviceLabels Labels for PostgreSQL service - ## - serviceLabels: {} - ## Headless service properties - ## - headless: - ## @param service.headless.annotations Annotations for the headless service. - ## - annotations: {} -## @section Backup parameters -## This section implements a trivial logical dump cronjob of the database. -## This only comes with the consistency guarantees of the dump program. -## This is not a snapshot based roll forward/backward recovery backup. -## ref: https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/ -backup: - ## @param backup.enabled Enable the logical dump of the database "regularly" - enabled: false - cronjob: - ## @param backup.cronjob.schedule Set the cronjob parameter schedule - schedule: "@daily" - ## @param backup.cronjob.timeZone Set the cronjob parameter timeZone - timeZone: "" - ## @param backup.cronjob.concurrencyPolicy Set the cronjob parameter concurrencyPolicy - concurrencyPolicy: Allow - ## @param backup.cronjob.failedJobsHistoryLimit Set the cronjob parameter failedJobsHistoryLimit - failedJobsHistoryLimit: 1 - ## @param backup.cronjob.successfulJobsHistoryLimit Set the cronjob parameter successfulJobsHistoryLimit - successfulJobsHistoryLimit: 3 - ## @param backup.cronjob.startingDeadlineSeconds Set the cronjob parameter startingDeadlineSeconds - startingDeadlineSeconds: "" - ## @param backup.cronjob.ttlSecondsAfterFinished Set the cronjob parameter ttlSecondsAfterFinished - ttlSecondsAfterFinished: "" - ## @param backup.cronjob.restartPolicy Set the cronjob parameter restartPolicy - restartPolicy: OnFailure - ## @param backup.cronjob.podSecurityContext.enabled Enable PodSecurityContext for CronJob/Backup - ## @param backup.cronjob.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy - ## @param backup.cronjob.podSecurityContext.sysctls Set kernel settings using the sysctl interface - ## @param backup.cronjob.podSecurityContext.supplementalGroups Set filesystem extra groups - ## @param backup.cronjob.podSecurityContext.fsGroup Group ID for the CronJob - podSecurityContext: - enabled: true - fsGroupChangePolicy: Always - sysctls: [] - supplementalGroups: [] - fsGroup: 1001 - ## backup container's Security Context - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container - ## @param backup.cronjob.containerSecurityContext.enabled Enable container security context - ## @param backup.cronjob.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container - ## @param backup.cronjob.containerSecurityContext.runAsUser User ID for the backup container - ## @param backup.cronjob.containerSecurityContext.runAsGroup Group ID for the backup container - ## @param backup.cronjob.containerSecurityContext.runAsNonRoot Set backup container's Security Context runAsNonRoot - ## @param backup.cronjob.containerSecurityContext.readOnlyRootFilesystem Is the container itself readonly - ## @param backup.cronjob.containerSecurityContext.allowPrivilegeEscalation Is it possible to escalate backup pod(s) privileges - ## @param backup.cronjob.containerSecurityContext.seccompProfile.type Set backup container's Security Context seccompProfile type - ## @param backup.cronjob.containerSecurityContext.capabilities.drop Set backup container's Security Context capabilities to drop - containerSecurityContext: - enabled: true - seLinuxOptions: null - runAsUser: 1001 - runAsGroup: 1001 - runAsNonRoot: true - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - seccompProfile: - type: RuntimeDefault - capabilities: - drop: - - ALL - ## @param backup.cronjob.command Set backup container's command to run - command: - - /bin/sh - - -c - - "pg_dumpall --clean --if-exists --load-via-partition-root --quote-all-identifiers --no-password --file=${PGDUMP_DIR}/pg_dumpall-$(date '+%Y-%m-%d-%H-%M').pgdump" - ## @param backup.cronjob.labels Set the cronjob labels - labels: {} - ## @param backup.cronjob.annotations Set the cronjob annotations - annotations: {} - ## @param backup.cronjob.nodeSelector Node labels for PostgreSQL backup CronJob pod assignment - ## ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: - tenant: client3 - ## @param backup.cronjob.tolerations Tolerations for PostgreSQL backup CronJob pod assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - ## - tolerations: - - key: "node-role.kubernetes.io/control-plane" - operator: "Exists" - effect: "NoSchedule" - - storage: - ## @param backup.cronjob.storage.existingClaim Provide an existing `PersistentVolumeClaim` (only when `architecture=standalone`) - ## If defined, PVC must be created manually before volume will be bound - ## - existingClaim: "" - ## @param backup.cronjob.storage.resourcePolicy Setting it to "keep" to avoid removing PVCs during a helm delete operation. Leaving it empty will delete PVCs after the chart deleted - ## - resourcePolicy: "" - ## @param backup.cronjob.storage.storageClass PVC Storage Class for the backup data volume - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. - ## - storageClass: "client3" - ## @param backup.cronjob.storage.accessModes PV Access Mode - ## - accessModes: - - ReadWriteOnce - ## @param backup.cronjob.storage.size PVC Storage Request for the backup data volume - ## - size: 8Gi - ## @param backup.cronjob.storage.annotations PVC annotations - ## - annotations: {} - ## @param backup.cronjob.storage.mountPath Path to mount the volume at - ## - mountPath: /backup/pgdump - ## @param backup.cronjob.storage.subPath Subdirectory of the volume to mount at - ## and one PV for multiple services. - ## - subPath: "" - ## Fine tuning for volumeClaimTemplates - ## - volumeClaimTemplates: - ## @param backup.cronjob.storage.volumeClaimTemplates.selector A label query over volumes to consider for binding (e.g. when using local volumes) - ## A label query over volumes to consider for binding (e.g. when using local volumes) - ## See https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#labelselector-v1-meta for more details - ## - selector: {} diff --git a/postgresql-ha/.helmignore b/postgresql/.helmignore similarity index 100% rename from postgresql-ha/.helmignore rename to postgresql/.helmignore diff --git a/postgresql/CHANGELOG.md b/postgresql/CHANGELOG.md new file mode 100644 index 0000000..d596e4e --- /dev/null +++ b/postgresql/CHANGELOG.md @@ -0,0 +1,2552 @@ +# Changelog + +## 16.7.24 (2025-08-08) + +* [bitnami/postgresql] Remove hardcoded references to image repository ([#35694](https://github.com/bitnami/charts/pull/35694)) + +## 16.7.23 (2025-08-08) + +* [bitnami/postgresql] :zap: :arrow_up: Update dependency references (#35631) ([652fbf8](https://github.com/bitnami/charts/commit/652fbf8f02c27adce46fcdb9fa979a0240f97039)), closes [#35631](https://github.com/bitnami/charts/issues/35631) + +## 16.7.22 (2025-08-07) + +* [bitnami/*] docs: update BSI warning on charts' notes (#35340) ([07483a5](https://github.com/bitnami/charts/commit/07483a5ed964b409266dc025e4b55bf2eb0f621c)), closes [#35340](https://github.com/bitnami/charts/issues/35340) +* [bitnami/postgresql] :zap: :arrow_up: Update dependency references (#35518) ([4f82f0a](https://github.com/bitnami/charts/commit/4f82f0aa93399b88880c20b83cecd14d1876c749)), closes [#35518](https://github.com/bitnami/charts/issues/35518) + +## 16.7.21 (2025-07-21) + +* [bitnami/postgresql] :zap: :arrow_up: Update dependency references (#35235) ([e3f9cac](https://github.com/bitnami/charts/commit/e3f9cac9c285f30febbce7a27d83dfa582a6fc09)), closes [#35235](https://github.com/bitnami/charts/issues/35235) + +## 16.7.20 (2025-07-18) + +* [bitnami/*] Adapt main README and change ascii (#35173) ([73d15e0](https://github.com/bitnami/charts/commit/73d15e03e04647efa902a1d14a09ea8657429cd0)), closes [#35173](https://github.com/bitnami/charts/issues/35173) +* [bitnami/*] Adapt welcome message to BSI (#35170) ([e1c8146](https://github.com/bitnami/charts/commit/e1c8146831516fb35de736a6f3fd10e5e7a44286)), closes [#35170](https://github.com/bitnami/charts/issues/35170) +* [bitnami/*] Add BSI to charts' READMEs (#35174) ([4973fd0](https://github.com/bitnami/charts/commit/4973fd08dd7e95398ddcc4054538023b542e19f2)), closes [#35174](https://github.com/bitnami/charts/issues/35174) +* [bitnami/postgresql] Rename backup.cronjob.timeZone to backup.cronjob.timezone (#35153) ([8a2dca9](https://github.com/bitnami/charts/commit/8a2dca9f6b2d37d2975fb1f3ddfe23c9ca963336)), closes [#35153](https://github.com/bitnami/charts/issues/35153) + +## 16.7.19 (2025-07-15) + +* [bitnami/postgresql] :zap: :arrow_up: Update dependency references (#35116) ([15c6eee](https://github.com/bitnami/charts/commit/15c6eeeee5d8454b93eeada473a80a0230d6d3ae)), closes [#35116](https://github.com/bitnami/charts/issues/35116) + +## 16.7.18 (2025-07-12) + +* [bitnami/postgresql] :zap: :arrow_up: Update dependency references (#35031) ([57712c4](https://github.com/bitnami/charts/commit/57712c4ec8815f8a641234c2be519610ca31ff14)), closes [#35031](https://github.com/bitnami/charts/issues/35031) + +## 16.7.17 (2025-07-11) + +* [bitnami/postgresql] :zap: :arrow_up: Update dependency references (#35012) ([b57f28f](https://github.com/bitnami/charts/commit/b57f28f07f6d93331979a6460c7204dfc67fb29e)), closes [#35012](https://github.com/bitnami/charts/issues/35012) + +## 16.7.16 (2025-07-09) + +* [bitnami/postgresql] :zap: :arrow_up: Update dependency references (#34943) ([c3ac2ad](https://github.com/bitnami/charts/commit/c3ac2ad4660570101dd734c6b2b1caf480ef4ad1)), closes [#34943](https://github.com/bitnami/charts/issues/34943) + +## 16.7.15 (2025-07-01) + +* [bitnami/postgresql] :zap: :arrow_up: Update dependency references (#34741) ([d71b40e](https://github.com/bitnami/charts/commit/d71b40e05b95ab88db99478d3c2ee04e131b63bd)), closes [#34741](https://github.com/bitnami/charts/issues/34741) + +## 16.7.14 (2025-06-26) + +* [bitnami/postgresql] Update dependencies (#34650) ([25dc474](https://github.com/bitnami/charts/commit/25dc47460564f2c15aadd286037a32710665fce0)), closes [#34650](https://github.com/bitnami/charts/issues/34650) + +## 16.7.13 (2025-06-19) + +* [bitnami/postgresql] Fix invalid template reference in postgresql update-password job (#34527) ([6ee27f5](https://github.com/bitnami/charts/commit/6ee27f537363be3f3e5279bfe726e6bae5c3cfb5)), closes [#34527](https://github.com/bitnami/charts/issues/34527) + +## 16.7.12 (2025-06-16) + +* [bitnami/postgresql] :zap: :arrow_up: Update dependency references (#34377) ([858195b](https://github.com/bitnami/charts/commit/858195b20aa25e8b985e5d1a8e85b8498870987a)), closes [#34377](https://github.com/bitnami/charts/issues/34377) + +## 16.7.11 (2025-06-11) + +* [bitnami/postgresql] :zap: :arrow_up: Update dependency references (#34353) ([ea1c058](https://github.com/bitnami/charts/commit/ea1c058afa569f454a2955380428a5276a89c885)), closes [#34353](https://github.com/bitnami/charts/issues/34353) +* Fix incorrect value paths in password update job documentation (#34057) ([8e61c28](https://github.com/bitnami/charts/commit/8e61c28f6fabe634533eca525aa4ab35065f28b2)), closes [#34057](https://github.com/bitnami/charts/issues/34057) + +## 16.7.10 (2025-06-06) + +* [bitnami/postgresql] :zap: :arrow_up: Update dependency references (#34210) ([5880187](https://github.com/bitnami/charts/commit/5880187fcb235887cbe944dad6e38152471badb9)), closes [#34210](https://github.com/bitnami/charts/issues/34210) + +## 16.7.9 (2025-06-03) + +* [bitnami/postgresql] :zap: :arrow_up: Update dependency references (#34076) ([1063457](https://github.com/bitnami/charts/commit/10634578d525989118eba62cc72d2eb86b96029f)), closes [#34076](https://github.com/bitnami/charts/issues/34076) + +## 16.7.8 (2025-05-30) + +* [bitnami/postgresql] :zap: :arrow_up: Update dependency references (#34009) ([41b1852](https://github.com/bitnami/charts/commit/41b1852d4b83df903fc4148e09a8406922a821d3)), closes [#34009](https://github.com/bitnami/charts/issues/34009) + +## 16.7.7 (2025-05-30) + +* [bitnami/postgresql] :zap: :arrow_up: Update dependency references (#33992) ([8d6133c](https://github.com/bitnami/charts/commit/8d6133cdb968ce73091026ec8b8031fd8cdd767e)), closes [#33992](https://github.com/bitnami/charts/issues/33992) + +## 16.7.6 (2025-05-30) + +* [bitnami/postgresql] Update dependencies (#33986) ([400a5e5](https://github.com/bitnami/charts/commit/400a5e5dc0b0db3d222a588f49b6b8577da2dd75)), closes [#33986](https://github.com/bitnami/charts/issues/33986) + +## 16.7.5 (2025-05-27) + +* [bitnami/*] Add CNAB link for charts on Azure MP (#33695) ([6312371](https://github.com/bitnami/charts/commit/63123718de94dbedd798d380807b57031e98ed4f)), closes [#33695](https://github.com/bitnami/charts/issues/33695) +* [bitnami/*] Update CNAB tip (#33741) ([2bc74f3](https://github.com/bitnami/charts/commit/2bc74f3f539481ceaa12833c114047583912b748)), closes [#33741](https://github.com/bitnami/charts/issues/33741) +* [bitnami/postgresql] :zap: :arrow_up: Update dependency references (#33916) ([96adefd](https://github.com/bitnami/charts/commit/96adefd64d7296b21fd2f491cc14bef9f9e31548)), closes [#33916](https://github.com/bitnami/charts/issues/33916) + +## 16.7.4 (2025-05-13) + +* [bitnami/postgresql] Support for global postgresql fullnameOverride (#33616) ([7e006db](https://github.com/bitnami/charts/commit/7e006db0e1ed2d6dbc1bf1ffc3ebeac48726efa5)), closes [#33616](https://github.com/bitnami/charts/issues/33616) + +## 16.7.3 (2025-05-13) + +* [bitnami/postgresql] :zap: :arrow_up: Update dependency references (#33619) ([ab01617](https://github.com/bitnami/charts/commit/ab0161760fa3754e64945e5a94fd95866c8b929e)), closes [#33619](https://github.com/bitnami/charts/issues/33619) + +## 16.7.2 (2025-05-09) + +* [bitnami/kubeapps] Deprecation followup (#33579) ([77e312c](https://github.com/bitnami/charts/commit/77e312c1772d4d7c4dc5d3ac0e80f4e452e3a062)), closes [#33579](https://github.com/bitnami/charts/issues/33579) +* [bitnami/postgresql] :zap: :arrow_up: Update dependency references (#33598) ([6fa611b](https://github.com/bitnami/charts/commit/6fa611bcc3611666ac322d421ed6c2a0eb10646c)), closes [#33598](https://github.com/bitnami/charts/issues/33598) + +## 16.7.1 (2025-05-08) + +* [bitnami/postgresql] :zap: :arrow_up: Update dependency references (#33577) ([71ca86a](https://github.com/bitnami/charts/commit/71ca86a822cee8d5125cab0cc7b8adc43d3f115f)), closes [#33577](https://github.com/bitnami/charts/issues/33577) + +## 16.7.0 (2025-05-08) + +* [bitnami/postgresql] Global postgres fullname override, needed when the fullname needs to be shared ([81a2c5f](https://github.com/bitnami/charts/commit/81a2c5f710bb3ba6a8a338cde54a309f3697bf32)), closes [#33198](https://github.com/bitnami/charts/issues/33198) + +## 16.6.7 (2025-05-06) + +* [bitnami/postgresql] Release 16.6.7 (#33384) ([71bd413](https://github.com/bitnami/charts/commit/71bd413abfa6e4622f5a479c2d6ffe965b7986b1)), closes [#33384](https://github.com/bitnami/charts/issues/33384) + +## 16.6.6 (2025-04-25) + +* [bitnami/postgresql] fix(backup): mount secrets with password file (#33144) ([121d54e](https://github.com/bitnami/charts/commit/121d54ed2dae38cf311ef7a70287e20e7b68bd3e)), closes [#33144](https://github.com/bitnami/charts/issues/33144) + +## 16.6.5 (2025-04-24) + +* [bitnami/postgresql] Release 16.6.5 (#33165) ([67bec6a](https://github.com/bitnami/charts/commit/67bec6a685cbec208524c7f67397e2a55549b187)), closes [#33165](https://github.com/bitnami/charts/issues/33165) + +## 16.6.4 (2025-04-23) + +* [bitnami/postgresql] Fix annotations not applied to passwordUpdateJob (#32969) ([307b38e](https://github.com/bitnami/charts/commit/307b38e8a536a10902ef3d667ef82396b737b94d)), closes [#32969](https://github.com/bitnami/charts/issues/32969) + +## 16.6.3 (2025-04-09) + +* [bitnami/postgresql] Release 16.6.3 (#32915) ([ea17904](https://github.com/bitnami/charts/commit/ea1790406d0ec080c9eed3157402f702eb6c73a1)), closes [#32915](https://github.com/bitnami/charts/issues/32915) + +## 16.6.2 (2025-04-07) + +* [bitnami/postgresql] Release 16.6.2 (#32842) ([9668041](https://github.com/bitnami/charts/commit/96680412e57a9beefcebc0d86be4e859fd393197)), closes [#32842](https://github.com/bitnami/charts/issues/32842) + +## 16.6.1 (2025-04-07) + +* [bitnami/postgresql] Release 16.6.1 (#32834) ([d254ab7](https://github.com/bitnami/charts/commit/d254ab737a59c0c0a546979057f89bcf74d788a0)), closes [#32834](https://github.com/bitnami/charts/issues/32834) + +## 16.6.0 (2025-03-27) + +* [bitnami/postgresql] Set `usePasswordFiles=true` by default (#32115) ([2203c41](https://github.com/bitnami/charts/commit/2203c41cb173248d26c8fb073d28e93165888ebc)), closes [#32115](https://github.com/bitnami/charts/issues/32115) + +## 16.5.6 (2025-03-23) + +* [bitnami/postgresql] Release 16.5.6 (#32576) ([7aac5fd](https://github.com/bitnami/charts/commit/7aac5fd297380af0d94f85922657fbc999dfaadc)), closes [#32576](https://github.com/bitnami/charts/issues/32576) + +## 16.5.5 (2025-03-20) + +* [bitnami/postgresql] allow custom service labels for primary and read (#32368) ([6703679](https://github.com/bitnami/charts/commit/6703679964429f2b0fdf853a8ac812bf7dec5302)), closes [#32368](https://github.com/bitnami/charts/issues/32368) + +## 16.5.4 (2025-03-20) + +* [bitnami/postgresql] Release 16.5.4 (#32527) ([423422d](https://github.com/bitnami/charts/commit/423422dab9ddcb40b1e8e9bb007ade8e82da7892)), closes [#32527](https://github.com/bitnami/charts/issues/32527) + +## 16.5.3 (2025-03-19) + +* [bitnami/postgresql] Release 16.5.3 (#32525) ([150c5aa](https://github.com/bitnami/charts/commit/150c5aa26dfe351cfbdeb17e480c1de935430a9b)), closes [#32525](https://github.com/bitnami/charts/issues/32525) + +## 16.5.2 (2025-03-17) + +* [bitnami/postgresql] Release 16.5.2 (#32484) ([89b026d](https://github.com/bitnami/charts/commit/89b026dc5e9d23f3cd35d0e07ff57b9b605f4376)), closes [#32484](https://github.com/bitnami/charts/issues/32484) + +## 16.5.1 (2025-03-17) + +* [bitnami/*] Add tanzuCategory annotation (#32409) ([a8fba5c](https://github.com/bitnami/charts/commit/a8fba5cb01f6f4464ca7f69c50b0fbe97d837a95)), closes [#32409](https://github.com/bitnami/charts/issues/32409) +* [bitnami/postgresql] Release 16.5.1 (#32482) ([758a0c6](https://github.com/bitnami/charts/commit/758a0c6fe0de62873a475692ed2e12378784e051)), closes [#32482](https://github.com/bitnami/charts/issues/32482) + +## 16.5.0 (2025-03-10) + +* [bitnami/postgresql] Add secretAnnotation value (#31984) ([7284b3f](https://github.com/bitnami/charts/commit/7284b3f65ac7a209ba65396bbc2f6cc8c188ddec)), closes [#31984](https://github.com/bitnami/charts/issues/31984) + +## 16.4.16 (2025-03-03) + +* [bitnami/postgresql] Release 16.4.16 (#32250) ([353c702](https://github.com/bitnami/charts/commit/353c702d65c42071ba93ae2d01286528fc8a0c9f)), closes [#32250](https://github.com/bitnami/charts/issues/32250) + +## 16.4.15 (2025-03-03) + +* [bitnami/postgresql] Release 16.4.15 (#32238) ([e55c589](https://github.com/bitnami/charts/commit/e55c589d64b918346a475d22578b90cab4f51c38)), closes [#32238](https://github.com/bitnami/charts/issues/32238) + +## 16.4.14 (2025-02-21) + +* [bitnami/postgresql] Release 16.4.14 (#32131) ([3fc13a0](https://github.com/bitnami/charts/commit/3fc13a01d65efa3d3f9624c8c01e7de286edfbad)), closes [#32131](https://github.com/bitnami/charts/issues/32131) + +## 16.4.13 (2025-02-21) + +* [bitnami/postgresql] Release 16.4.13 (#32097) ([9817d01](https://github.com/bitnami/charts/commit/9817d0155847035dc6c7edba6422ce9f56223909)), closes [#32097](https://github.com/bitnami/charts/issues/32097) + +## 16.4.12 (2025-02-20) + +* [bitnami/postgresql] Release 16.4.12 (#32086) ([3847abe](https://github.com/bitnami/charts/commit/3847abe0791e4d01718d221c215306b6a23a26b7)), closes [#32086](https://github.com/bitnami/charts/issues/32086) + +## 16.4.11 (2025-02-20) + +* [bitnami/*] Fix typo in named template name (#31858) ([b739b69](https://github.com/bitnami/charts/commit/b739b69532e637bd33b4a44eeb422c3e749eac77)), closes [#31858](https://github.com/bitnami/charts/issues/31858) +* [bitnami/postgresql] Release 16.4.11 (#32029) ([12c6e53](https://github.com/bitnami/charts/commit/12c6e531eafa7cfed5f78a98fec9062eaaa8c133)), closes [#32029](https://github.com/bitnami/charts/issues/32029) + +## 16.4.9 (2025-02-14) + +* [bitnami/postgresql] Release 16.4.9 (#31935) ([2a9fe24](https://github.com/bitnami/charts/commit/2a9fe2448aedccf5779c7f73ad45328edaa11156)), closes [#31935](https://github.com/bitnami/charts/issues/31935) + +## 16.4.8 (2025-02-13) + +* [bitnami/*] Use CDN url for the Bitnami Application Icons (#31881) ([d9bb11a](https://github.com/bitnami/charts/commit/d9bb11a9076b9bfdcc70ea022c25ef50e9713657)), closes [#31881](https://github.com/bitnami/charts/issues/31881) +* [bitnami/postgresql] Release 16.4.8 (#31919) ([3a013d5](https://github.com/bitnami/charts/commit/3a013d5224e3bf9db42a1540f66c5c1aa2eeecfd)), closes [#31919](https://github.com/bitnami/charts/issues/31919) + +## 16.4.7 (2025-02-10) + +* [bitnami/postgresql] use adminPassword for metrics user when custom user is not set on primary (#318 ([ca8f930](https://github.com/bitnami/charts/commit/ca8f9307b80e6a192b51d333fbe8b927b2949be1)), closes [#31840](https://github.com/bitnami/charts/issues/31840) + +## 16.4.6 (2025-02-03) + +* [bitnami/postgresql] Release 16.4.6 (#31702) ([0a0a5d3](https://github.com/bitnami/charts/commit/0a0a5d33825e523f8fa780bdec97b685fd74d0e3)), closes [#31702](https://github.com/bitnami/charts/issues/31702) +* Update copyright year (#31682) ([e9f02f5](https://github.com/bitnami/charts/commit/e9f02f5007068751f7eb2270fece811e685c99b6)), closes [#31682](https://github.com/bitnami/charts/issues/31682) + +## 16.4.5 (2025-01-20) + +* [bitnami/postgresql] Release 16.4.5 (#31484) ([b11637c](https://github.com/bitnami/charts/commit/b11637c36ab924cd764ead95e30838a0c4af8321)), closes [#31484](https://github.com/bitnami/charts/issues/31484) + +## 16.4.4 (2025-01-20) + +* [bitnami/postgresql] Release 16.4.4 (#31482) ([e784f18](https://github.com/bitnami/charts/commit/e784f187c01d6a2d7a1237ae5015bd5cb6e4e4b8)), closes [#31482](https://github.com/bitnami/charts/issues/31482) + +## 16.4.3 (2025-01-14) + +* bitnami/postgresql Fix missing dot in include statement for passwordUpdate job template (#31364) ([901b26c](https://github.com/bitnami/charts/commit/901b26c4b7be8935d9764d51df4b76d8dede0117)), closes [#31364](https://github.com/bitnami/charts/issues/31364) + +## 16.4.2 (2025-01-13) + +* [bitnami/postgresql] Release 16.4.2 (#31342) ([946b638](https://github.com/bitnami/charts/commit/946b638fd63e2d7e74865d591ef403b4dce229b3)), closes [#31342](https://github.com/bitnami/charts/issues/31342) + +## 16.4.1 (2025-01-13) + +* Dynamic assignment of custom schema name if defined in update-password job (#31146) ([364ac45](https://github.com/bitnami/charts/commit/364ac45ea6a20b693662b14a17122885f4e43364)), closes [#31146](https://github.com/bitnami/charts/issues/31146) + +## 16.3.5 (2025-01-03) + +* Revert "[bitnami/postgresql] Add Storage Class Configuration to Templates (#30858)" (#31204) ([c03fe0c](https://github.com/bitnami/charts/commit/c03fe0c3e359db15c2c096d52e6e28e480dfdbd6)), closes [#30858](https://github.com/bitnami/charts/issues/30858) [#31204](https://github.com/bitnami/charts/issues/31204) + +## 16.3.4 (2024-12-23) + +* [bitnami/postgresql] Release 16.3.4 (#31143) ([05a9583](https://github.com/bitnami/charts/commit/05a9583f949b49fab2673774a4f56ff686d959f4)), closes [#31143](https://github.com/bitnami/charts/issues/31143) + +## 16.3.3 (2024-12-20) + +* [bitnami/postgresql] Release 16.3.3 (#31133) ([41671f2](https://github.com/bitnami/charts/commit/41671f2e787863686079e1358054142d61d15982)), closes [#31133](https://github.com/bitnami/charts/issues/31133) + +## 16.3.2 (2024-12-16) + +* [bitnami/*] Fix typo in README (#31052) ([b41a51d](https://github.com/bitnami/charts/commit/b41a51d1bd04841fc108b78d3b8357a5292771c8)), closes [#31052](https://github.com/bitnami/charts/issues/31052) +* [bitnami/postgresql] Release 16.3.2 (#31060) ([1406ab1](https://github.com/bitnami/charts/commit/1406ab116e0fcfbb8fe2eaec1adc5fe494c0f329)), closes [#31060](https://github.com/bitnami/charts/issues/31060) + +## 16.3.1 (2024-12-13) + +* [bitnami/postgresql] Add Storage Class Configuration to Templates (#30858) ([b0d2c2e](https://github.com/bitnami/charts/commit/b0d2c2e53c9033d3827597c561931fbb331eb99b)), closes [#30858](https://github.com/bitnami/charts/issues/30858) + +## 16.3.0 (2024-12-10) + +* [bitnami/*] Add Bitnami Premium to NOTES.txt (#30854) ([3dfc003](https://github.com/bitnami/charts/commit/3dfc00376df6631f0ce54b8d440d477f6caa6186)), closes [#30854](https://github.com/bitnami/charts/issues/30854) +* [bitnami/postgresql] Detect non-standard images (#30936) ([ac96151](https://github.com/bitnami/charts/commit/ac96151bdbe5e99b00dcde62a4d72f1827fa46b2)), closes [#30936](https://github.com/bitnami/charts/issues/30936) + +## 16.2.5 (2024-12-03) + +* [bitnami/postgresql] Release 16.2.5 (#30733) ([34606c1](https://github.com/bitnami/charts/commit/34606c10dedd06431182d0563fb61703e691ddf1)), closes [#30733](https://github.com/bitnami/charts/issues/30733) + +## 16.2.4 (2024-12-03) + +* [bitnami/*] docs: :memo: Add "Backup & Restore" section (#30711) ([35ab536](https://github.com/bitnami/charts/commit/35ab5363741e7548f4076f04da6e62d10153c60c)), closes [#30711](https://github.com/bitnami/charts/issues/30711) +* [bitnami/*] docs: :memo: Add "Prometheus metrics" (batch 5) (#30674) ([ed2a546](https://github.com/bitnami/charts/commit/ed2a54617faf763169e6b01a89100b9db32e1000)), closes [#30674](https://github.com/bitnami/charts/issues/30674) +* [bitnami/postgresql] use adminPassword for metrics user when custom user is not set (#30720) ([8f4bc7b](https://github.com/bitnami/charts/commit/8f4bc7b46b0ce02286cc9973ff8f054a1f9c3fde)), closes [#30720](https://github.com/bitnami/charts/issues/30720) + +## 16.2.3 (2024-11-28) + +* [bitnami/postgresql] Release 16.2.3 (#30645) ([22a4c51](https://github.com/bitnami/charts/commit/22a4c51dc3b85e73b017cb6f6c73e15e6e4b811c)), closes [#30645](https://github.com/bitnami/charts/issues/30645) + +## 16.2.2 (2024-11-21) + +* [bitnami/postgresql] Release 16.2.2 (#30570) ([7b3a6d5](https://github.com/bitnami/charts/commit/7b3a6d5808e79d68a7c9edb6bca54aff262a6264)), closes [#30570](https://github.com/bitnami/charts/issues/30570) + +## 16.2.1 (2024-11-14) + +* [bitnami/postgresql] Release 16.2.1 (#30463) ([2360527](https://github.com/bitnami/charts/commit/236052763a4d81ca42d1068203ce5d6ee3f61b20)), closes [#30463](https://github.com/bitnami/charts/issues/30463) + +## 16.2.0 (2024-11-14) + +* [bitnami/postgresql] feat: :sparkles: Add password update job (#30444) ([ea896db](https://github.com/bitnami/charts/commit/ea896dbfbfaf7d386ca40c4072a61aa958cb7fb1)), closes [#30444](https://github.com/bitnami/charts/issues/30444) + +## 16.1.2 (2024-11-06) + +* [bitnami/postgresql] Release 16.1.2 (#30250) ([423c554](https://github.com/bitnami/charts/commit/423c55454743745dc486e426089141fa814fd401)), closes [#30250](https://github.com/bitnami/charts/issues/30250) + +## 16.1.1 (2024-11-04) + +* [bitnami/postgresql] metrics.collectors applies to read replicas (#30133) ([696f113](https://github.com/bitnami/charts/commit/696f113b68a7f541de7f073cf3efec5b25ccf10b)), closes [#30133](https://github.com/bitnami/charts/issues/30133) + +## 16.1.0 (2024-10-30) + +* [bitnami/*] Remove wrong comment about imagePullPolicy (#30107) ([a51f9e4](https://github.com/bitnami/charts/commit/a51f9e4bb0fbf77199512d35de7ac8abe055d026)), closes [#30107](https://github.com/bitnami/charts/issues/30107) +* [bitnami/postgresql] Added support for `namespaceOverride` (#30113) ([4253372](https://github.com/bitnami/charts/commit/4253372e0b770e941c4894cdd7a904d3fdabeb19)), closes [#30113](https://github.com/bitnami/charts/issues/30113) + +## 16.0.6 (2024-10-24) + +* [bitnami/postgresql] Release 16.0.6 (#30069) ([e431b4a](https://github.com/bitnami/charts/commit/e431b4a915cb29593faedff990bba9516dc25ef6)), closes [#30069](https://github.com/bitnami/charts/issues/30069) + +## 16.0.5 (2024-10-22) + +* [bitnami/postgresql] Release 16.0.5 (#30046) ([a825e37](https://github.com/bitnami/charts/commit/a825e37775f041dc3404f727ff33661364dbc8a3)), closes [#30046](https://github.com/bitnami/charts/issues/30046) + +## 16.0.4 (2024-10-21) + +* [bitnami/postgresql] Release 16.0.4 (#30013) ([8435f88](https://github.com/bitnami/charts/commit/8435f88ae01cc20203022eb97904ee3abeb96467)), closes [#30013](https://github.com/bitnami/charts/issues/30013) + +## 16.0.3 (2024-10-16) + +* [bitnami/postgresql] Release 16.0.3 (#29942) ([7b3f2bb](https://github.com/bitnami/charts/commit/7b3f2bb7a65a78cba10fe8dfe87fd47b55dd8ec0)), closes [#29942](https://github.com/bitnami/charts/issues/29942) + +## 16.0.2 (2024-10-16) + +* [bitnami/postgresql] Release 16.0.2 (#29938) ([766c157](https://github.com/bitnami/charts/commit/766c1577e867aea17e1e9b21cc25f9e27b299273)), closes [#29938](https://github.com/bitnami/charts/issues/29938) +* Update documentation links to techdocs.broadcom.com (#29931) ([f0d9ad7](https://github.com/bitnami/charts/commit/f0d9ad78f39f633d275fc576d32eae78ded4d0b8)), closes [#29931](https://github.com/bitnami/charts/issues/29931) + +## 16.0.1 (2024-10-04) + +* [bitnami/postgresql] Release 16.0.1 (#29776) ([9d7fcdc](https://github.com/bitnami/charts/commit/9d7fcdc44c4f0939fb0006fb04d4161080cb558a)), closes [#29776](https://github.com/bitnami/charts/issues/29776) + +## 16.0.0 (2024-10-02) + +* [bitnami/postgresql] Release 16.0.0 (#29723) ([aeedc0e](https://github.com/bitnami/charts/commit/aeedc0e67b1593191aa0c3cb2239864d0b3c9a58)), closes [#29723](https://github.com/bitnami/charts/issues/29723) + +## 15.5.38 (2024-10-01) + +* [bitnami/postgresql] Release 15.5.38 (#29681) ([105fcbb](https://github.com/bitnami/charts/commit/105fcbb5c090c6f0b10858cdcc33dfc255c0c7e4)), closes [#29681](https://github.com/bitnami/charts/issues/29681) + +## 15.5.37 (2024-09-30) + +* [bitnami/postgresql] Release 15.5.37 (#29660) ([45cada1](https://github.com/bitnami/charts/commit/45cada10883f6ac5ad4ecaadf3c0d6aa1d9912bb)), closes [#29660](https://github.com/bitnami/charts/issues/29660) + +## 15.5.36 (2024-09-26) + +* [bitnami/postgresql] Release 15.5.36 (#29640) ([074e377](https://github.com/bitnami/charts/commit/074e377c582055f6b7039c63d7d37db5f97b770d)), closes [#29640](https://github.com/bitnami/charts/issues/29640) + +## 15.5.35 (2024-09-26) + +* [bitnami/postgresql] Release 15.5.35 (#29610) ([1f3717a](https://github.com/bitnami/charts/commit/1f3717afe128dea9ff69598952245930b1e7ced6)), closes [#29610](https://github.com/bitnami/charts/issues/29610) + +## 15.5.34 (2024-09-23) + +* [bitnami/postgresql] Release 15.5.34 (#29580) ([1450838](https://github.com/bitnami/charts/commit/1450838c829ccf48edb386b459244bf59f9080fa)), closes [#29580](https://github.com/bitnami/charts/issues/29580) + +## 15.5.33 (2024-09-23) + +* [bitnami/postgresql] Release 15.5.33 (#29579) ([e081955](https://github.com/bitnami/charts/commit/e0819554cf864099182049333aa47f7fd3ba341b)), closes [#29579](https://github.com/bitnami/charts/issues/29579) + +## 15.5.32 (2024-09-17) + +* [bitnami/postgresql] test: :white_check_mark: Improve reliability of ginkgo tests (#29472) ([c43177e](https://github.com/bitnami/charts/commit/c43177e1b362f27319a215c7394bcb612bed4924)), closes [#29472](https://github.com/bitnami/charts/issues/29472) + +## 15.5.31 (2024-09-13) + +* [bitnami/postgresql] Release 15.5.31 (#29404) ([baf9a0f](https://github.com/bitnami/charts/commit/baf9a0facb2d1a659bf53d13c4088929bbf86400)), closes [#29404](https://github.com/bitnami/charts/issues/29404) + +## 15.5.30 (2024-09-13) + +* [bitnami/postgresql] collect metrics as postgres user (#29201) ([7240870](https://github.com/bitnami/charts/commit/72408702b553e51a2848ce061bf917934737c42e)), closes [#29201](https://github.com/bitnami/charts/issues/29201) + +## 15.5.29 (2024-09-10) + +* [bitnami/postgresql] Release 15.5.29 (#29330) ([3c161f7](https://github.com/bitnami/charts/commit/3c161f7033eff31b2f3d98879bcac07c7070c0d6)), closes [#29330](https://github.com/bitnami/charts/issues/29330) + +## 15.5.28 (2024-09-05) + +* [bitnami/postgresql] Release 15.5.28 (#29206) ([2b42eb7](https://github.com/bitnami/charts/commit/2b42eb7ab7d9d5376ec44b36ca92fb22c52085af)), closes [#29206](https://github.com/bitnami/charts/issues/29206) + +## 15.5.27 (2024-08-30) + +* [bitnami/postgresql] Release 15.5.27 (#29122) ([08dfd32](https://github.com/bitnami/charts/commit/08dfd32dc50004050b6aca1d6c3418062b65402f)), closes [#29122](https://github.com/bitnami/charts/issues/29122) + +## 15.5.26 (2024-08-27) + +* [bitnami/postgresql] Release 15.5.26 (#29040) ([fd112fb](https://github.com/bitnami/charts/commit/fd112fb348a6f68686d863684e38e03e61f2e1a3)), closes [#29040](https://github.com/bitnami/charts/issues/29040) + +## 15.5.25 (2024-08-27) + +* [bitnami/postgresql] Release 15.5.25 (#29037) ([8267ba0](https://github.com/bitnami/charts/commit/8267ba0828c6325d96b0c18fba40906c1718db26)), closes [#29037](https://github.com/bitnami/charts/issues/29037) + +## 15.5.24 (2024-08-23) + +* [bitnami/postgresql] eval. certificatesSecret as template (#28831) ([05c09db](https://github.com/bitnami/charts/commit/05c09dbb8e60cde19c44ee6d795e31a48f9f77ba)), closes [#28831](https://github.com/bitnami/charts/issues/28831) + +## 15.5.23 (2024-08-19) + +* [bitnami/postgresql] Release 15.5.23 (#28922) ([d60e431](https://github.com/bitnami/charts/commit/d60e4314329df6fd2490237ce13395cb391aaa7e)), closes [#28922](https://github.com/bitnami/charts/issues/28922) + +## 15.5.22 (2024-08-16) + +* [bitnami/postgresql] Release 15.5.22 (#28905) ([9666e6a](https://github.com/bitnami/charts/commit/9666e6a662dfb6985b537794e8617949c51178fe)), closes [#28905](https://github.com/bitnami/charts/issues/28905) + +## 15.5.21 (2024-08-09) + +* [bitnami/postgresql] Release 15.5.21 (#28800) ([da5f1c5](https://github.com/bitnami/charts/commit/da5f1c5478a8033a7a3cfa44a7ed6618952509af)), closes [#28800](https://github.com/bitnami/charts/issues/28800) + +## 15.5.20 (2024-07-25) + +* [bitnami/postgresql] Release 15.5.20 (#28489) ([89f10d4](https://github.com/bitnami/charts/commit/89f10d4d1b7c4e88015f9f4c3c9002dc1d749860)), closes [#28489](https://github.com/bitnami/charts/issues/28489) + +## 15.5.19 (2024-07-24) + +* [bitnami/postgresql] Release 15.5.19 (#28352) ([59696e9](https://github.com/bitnami/charts/commit/59696e992ceec9b12255560d346e59f2f62b543e)), closes [#28352](https://github.com/bitnami/charts/issues/28352) + +## 15.5.18 (2024-07-23) + +* [bitnami/postgresql] Release 15.5.18 (#28221) ([8976498](https://github.com/bitnami/charts/commit/8976498507646c6a690381a38d690aa32b25a2f7)), closes [#28221](https://github.com/bitnami/charts/issues/28221) + +## 15.5.17 (2024-07-16) + +* [bitnami/postgresql] Global StorageClass as default value (#28082) ([6267bb7](https://github.com/bitnami/charts/commit/6267bb792f70eb0b67800132f5fbd488087e347b)), closes [#28082](https://github.com/bitnami/charts/issues/28082) + +## 15.5.16 (2024-07-11) + +* [bitnami/postgresql] Move comments inside conditionals (#27627) ([7d3b0f0](https://github.com/bitnami/charts/commit/7d3b0f0f13b79e75ee38ce1f5b59911c0cedb187)), closes [#27627](https://github.com/bitnami/charts/issues/27627) + +## 15.5.15 (2024-07-09) + +* Postgres exporter URI fix (#27734) ([d8d0dfe](https://github.com/bitnami/charts/commit/d8d0dfe79932c19f1b9b66bc5ac1addf0643da21)), closes [#27734](https://github.com/bitnami/charts/issues/27734) + +## 15.5.14 (2024-07-05) + +* [bitnami/postgresql] Release 15.5.14 (#27819) ([a4baae5](https://github.com/bitnami/charts/commit/a4baae5538d74b732fca029ad6ee5783279c4d54)), closes [#27819](https://github.com/bitnami/charts/issues/27819) + +## 15.5.13 (2024-07-03) + +* [bitnami/postgresql] Release 15.5.13 (#27733) ([e51f4a8](https://github.com/bitnami/charts/commit/e51f4a8818f15e6c0b636294d50d223140cc43d5)), closes [#27733](https://github.com/bitnami/charts/issues/27733) + +## 15.5.12 (2024-07-02) + +* postgres exporter monitor all databases (#27586) ([4feb56d](https://github.com/bitnami/charts/commit/4feb56d610de6e958fd0d7052958b88bcb21e1ab)), closes [#27586](https://github.com/bitnami/charts/issues/27586) + +## 15.5.11 (2024-06-26) + +* [bitnami/*] Update README changing TAC wording (#27530) ([52dfed6](https://github.com/bitnami/charts/commit/52dfed6bac44d791efabfaf06f15daddc4fefb0c)), closes [#27530](https://github.com/bitnami/charts/issues/27530) +* [bitnami/postgresql] Release 15.5.11 (#27548) ([0fe73e3](https://github.com/bitnami/charts/commit/0fe73e31c5dad97c86b9db11af28388d0324aea8)), closes [#27548](https://github.com/bitnami/charts/issues/27548) + +## 15.5.10 (2024-06-25) + +* [bitnami/postgresql] Release 15.5.10 (#27521) ([59f0aa2](https://github.com/bitnami/charts/commit/59f0aa2b948cdcd5a30f3f9111b2d422e0a8b81b)), closes [#27521](https://github.com/bitnami/charts/issues/27521) + +## 15.5.9 (2024-06-20) + +* [bitnami/postgresql] Remove deprecated (and removed) annotation (#27463) ([2907ba0](https://github.com/bitnami/charts/commit/2907ba00566e8cc3675865fbf3e43b43702d4998)), closes [#27463](https://github.com/bitnami/charts/issues/27463) + +## 15.5.8 (2024-06-20) + +* [bitnami/postgresql] Add pre-init scripts (#26467) ([0cdafb8](https://github.com/bitnami/charts/commit/0cdafb8a29c7bfe22c1781ef10154e11e3a7bd09)), closes [#26467](https://github.com/bitnami/charts/issues/26467) + +## 15.5.7 (2024-06-18) + +* [bitnami/postgresql] Release 15.5.7 (#27401) ([2fff79d](https://github.com/bitnami/charts/commit/2fff79d0d54da3680cb8dac3652884c82c314e74)), closes [#27401](https://github.com/bitnami/charts/issues/27401) + +## 15.5.6 (2024-06-17) + +* [bitnami/postgresql] Release 15.5.6 (#27293) ([d36be80](https://github.com/bitnami/charts/commit/d36be805cdc81aaa34d197072c112360a7ce99f5)), closes [#27293](https://github.com/bitnami/charts/issues/27293) + +## 15.5.5 (2024-06-11) + +* [bitnami/postgresql] Release 15.5.5 (#27096) ([c84850a](https://github.com/bitnami/charts/commit/c84850a09c75ce557f87d33fe9c400f66d3a8d1e)), closes [#27096](https://github.com/bitnami/charts/issues/27096) + +## 15.5.4 (2024-06-06) + +* [bitnami/postgresql] Release 15.5.4 (#27006) ([613a7a4](https://github.com/bitnami/charts/commit/613a7a431aa8752cb28ee634c4db0c83ef98e827)), closes [#27006](https://github.com/bitnami/charts/issues/27006) + +## 15.5.3 (2024-06-06) + +* [bitnami/postgresql] Release 15.5.3 (#26914) ([f7df496](https://github.com/bitnami/charts/commit/f7df496fce1cb33658e68af08d382287487e5b0b)), closes [#26914](https://github.com/bitnami/charts/issues/26914) + +## 15.5.2 (2024-06-04) + +* [bitnami/postgresql] Bump chart version (#26660) ([4269aa0](https://github.com/bitnami/charts/commit/4269aa0ee711838c59430d48825c58f34fbe674d)), closes [#26660](https://github.com/bitnami/charts/issues/26660) + +## 15.5.1 (2024-05-29) + +* [bitnami/postgresql] Release 15.5.1 (#26546) ([99f0841](https://github.com/bitnami/charts/commit/99f08414ce828db081402ba37cf48c0ad2624fee)), closes [#26546](https://github.com/bitnami/charts/issues/26546) + +## 15.5.0 (2024-05-29) + +* [bitnami/postgresql] Enable PodDisruptionBudgets (#26530) ([c6b2f1c](https://github.com/bitnami/charts/commit/c6b2f1cc32e0b9a8d884b61e8dc17f1089366d06)), closes [#26530](https://github.com/bitnami/charts/issues/26530) + +## 15.4.2 (2024-05-28) + +* [bitnami/postgresql] Release 15.4.2 (#26475) ([748b515](https://github.com/bitnami/charts/commit/748b51516a41ff8af151a530a0e5e0d9a62808e4)), closes [#26475](https://github.com/bitnami/charts/issues/26475) + +## 15.4.1 (2024-05-27) + +* [bitnami/postgresql] Release 15.4.1 (#26451) ([8852396](https://github.com/bitnami/charts/commit/8852396da928e9834a1e4d14c9d1aeb9f61b3b73)), closes [#26451](https://github.com/bitnami/charts/issues/26451) + +## 15.4.0 (2024-05-21) + +* [bitnami/*] ci: :construction_worker: Add tag and changelog support (#25359) ([91c707c](https://github.com/bitnami/charts/commit/91c707c9e4e574725a09505d2d313fb93f1b4c0a)), closes [#25359](https://github.com/bitnami/charts/issues/25359) +* [bitnami/postgresql] feat: :sparkles: :lock: Add warning when original images are replaced (#26264) ([53777c8](https://github.com/bitnami/charts/commit/53777c8e5104e447deb800e88b68bfc8fd3f494b)), closes [#26264](https://github.com/bitnami/charts/issues/26264) + +## 15.3.5 (2024-05-20) + +* [bitnami/postgresql] Release 15.3.5 updating components versions (#26147) ([0bafcd7](https://github.com/bitnami/charts/commit/0bafcd70c0b04d3e1147ed82c2b1d992c552ef35)), closes [#26147](https://github.com/bitnami/charts/issues/26147) + +## 15.3.4 (2024-05-20) + +* [bitnami/postgresql] Release 15.3.4 updating components versions (#26142) ([231e25b](https://github.com/bitnami/charts/commit/231e25baf23367f31f1e52a89a2cf2636c516247)), closes [#26142](https://github.com/bitnami/charts/issues/26142) + +## 15.3.3 (2024-05-18) + +* [bitnami/postgresql] Release 15.3.3 updating components versions (#26066) ([21f932c](https://github.com/bitnami/charts/commit/21f932c438a019828908268ae04703e50b1d7f3d)), closes [#26066](https://github.com/bitnami/charts/issues/26066) + +## 15.3.2 (2024-05-14) + +* [bitnami/postgresql] Release 15.3.2 updating components versions (#25812) ([3f7c2cb](https://github.com/bitnami/charts/commit/3f7c2cbbe905e1e992445194cd5fce48eb3bb87c)), closes [#25812](https://github.com/bitnami/charts/issues/25812) + +## 15.3.1 (2024-05-13) + +* [bitnami/postgresql] Release 15.3.1 updating components versions (#25723) ([031d2cf](https://github.com/bitnami/charts/commit/031d2cf9ee9aacb9d92eecade873f1377953b813)), closes [#25723](https://github.com/bitnami/charts/issues/25723) + +## 15.3.0 (2024-05-13) + +* [bitnami/postgresql] Allow loadBalancerClass to be customized (#25569) ([e6fecf9](https://github.com/bitnami/charts/commit/e6fecf9c391077ae43889342a88febeea6eb88cd)), closes [#25569](https://github.com/bitnami/charts/issues/25569) + +## 15.2.13 (2024-05-13) + +* [bitnami/postgresql] Allow backup pod to use DNS (#25534) ([960550a](https://github.com/bitnami/charts/commit/960550afa50fa58649997e89f67cf5b3d3fd0e7d)), closes [#25534](https://github.com/bitnami/charts/issues/25534) + +## 15.2.12 (2024-05-10) + +* [bitnami/postgresql] Release 15.2.12 updating components versions (#25678) ([0fd1557](https://github.com/bitnami/charts/commit/0fd15577a18c135b71ada7ebcd4db2bee16f3aa7)), closes [#25678](https://github.com/bitnami/charts/issues/25678) + +## 15.2.11 (2024-05-10) + +* [bitnami/postgresql] Release 15.2.11 updating components versions (#25672) ([9b809c6](https://github.com/bitnami/charts/commit/9b809c6ba398109c8c3f5402363e4ee1c7c33b46)), closes [#25672](https://github.com/bitnami/charts/issues/25672) + +## 15.2.10 (2024-05-10) + +* [bitnami/*] Change non-root and rolling-tags doc URLs (#25628) ([b067c94](https://github.com/bitnami/charts/commit/b067c94f6bcde427863c197fd355f0b5ba12ff5b)), closes [#25628](https://github.com/bitnami/charts/issues/25628) +* [bitnami/*] Set new header/owner (#25558) ([8d1dc11](https://github.com/bitnami/charts/commit/8d1dc11f5fb30db6fba50c43d7af59d2f79deed3)), closes [#25558](https://github.com/bitnami/charts/issues/25558) +* [bitnami/postgresql] add backup.cronjob.tolerations options (#25664) ([4a798ec](https://github.com/bitnami/charts/commit/4a798ecc98067f6af6012381da0c83068d366074)), closes [#25664](https://github.com/bitnami/charts/issues/25664) + +## 15.2.9 (2024-05-06) + +* [bitnami/postgresql] Remove unicode characters (#25546) ([219d22f](https://github.com/bitnami/charts/commit/219d22f67782538a891ded326417fce8c6641577)), closes [#25546](https://github.com/bitnami/charts/issues/25546) + +## 15.2.8 (2024-05-01) + +* [bitnami/postgresql] Release 15.2.8 updating components versions (#25484) ([d3084fc](https://github.com/bitnami/charts/commit/d3084fcaee1bfbc02f2564e7794944b781a31706)), closes [#25484](https://github.com/bitnami/charts/issues/25484) + +## 15.2.7 (2024-04-25) + +* [bitnami/postgresql] Release 15.2.7 updating components versions (#25391) ([0db34f6](https://github.com/bitnami/charts/commit/0db34f643131878ec6d1e9e84a91272b300dd0c5)), closes [#25391](https://github.com/bitnami/charts/issues/25391) + +## 15.2.6 (2024-04-25) + +* [bitnami/multiple charts] Fix typo: "NetworkPolice" vs "NetworkPolicy" (#25348) ([6970c1b](https://github.com/bitnami/charts/commit/6970c1ba245873506e73d459c6eac1e4919b778f)), closes [#25348](https://github.com/bitnami/charts/issues/25348) +* [bitnami/postgresql] Remove RW emptyDir for postgresql logs (#25206) ([8bae0c5](https://github.com/bitnami/charts/commit/8bae0c591364e80bd3ae7ae5e053a4c52be5b78f)), closes [#25206](https://github.com/bitnami/charts/issues/25206) +* Replace VMware by Broadcom copyright text (#25306) ([a5e4bd0](https://github.com/bitnami/charts/commit/a5e4bd0e35e419203793976a78d9d0a13de92c76)), closes [#25306](https://github.com/bitnami/charts/issues/25306) + +## 15.2.5 (2024-04-10) + +* [bitnami/postgresql] Release 15.2.5 updating components versions (#25099) ([eba61bd](https://github.com/bitnami/charts/commit/eba61bd31721b220163f799a5694d234f677ae1b)), closes [#25099](https://github.com/bitnami/charts/issues/25099) + +## 15.2.4 (2024-04-05) + +* [bitnami/postgresql] Release 15.2.4 updating components versions (#24972) ([62e4683](https://github.com/bitnami/charts/commit/62e46834f798b69bcb8efcc1209bb1305eea2643)), closes [#24972](https://github.com/bitnami/charts/issues/24972) + +## 15.2.3 (2024-04-05) + +* [bitnami/postgresql] Release 15.2.3 (#24924) ([1f68239](https://github.com/bitnami/charts/commit/1f682398e96a9663d366e1ff0e74b97fbbbc858b)), closes [#24924](https://github.com/bitnami/charts/issues/24924) +* Update resourcesPreset comments (#24467) ([92e3e8a](https://github.com/bitnami/charts/commit/92e3e8a507326d2a20a8f10ab3e7746a2ec5c554)), closes [#24467](https://github.com/bitnami/charts/issues/24467) + +## 15.2.2 (2024-04-02) + +* [bitnami/postgresql] Release 15.2.2 updating components versions (#24840) ([34f94f3](https://github.com/bitnami/charts/commit/34f94f3412659c884e0f1358a38b3efc392887a9)), closes [#24840](https://github.com/bitnami/charts/issues/24840) + +## 15.2.1 (2024-04-02) + +* [bitnami/postgresql] fix: :bug: Always mount data directory (#24667) ([85f7422](https://github.com/bitnami/charts/commit/85f7422ad7489ad6f14a50021fe7f1eb910b5d7b)), closes [#24667](https://github.com/bitnami/charts/issues/24667) + +## 15.2.0 (2024-04-01) + +* [bitnami/postgresql] Allow customizing primary persistence volume/claim (#24625) ([79b5845](https://github.com/bitnami/charts/commit/79b584590e90fc8f1be7bbffd1706e762b520f9a)), closes [#24625](https://github.com/bitnami/charts/issues/24625) + +## 15.1.4 (2024-03-25) + +* [bitnami/postgresql] Release 15.1.4 updating components versions (#24641) ([9fea6e0](https://github.com/bitnami/charts/commit/9fea6e050249771a0e81b9415f8f7de496749a57)), closes [#24641](https://github.com/bitnami/charts/issues/24641) + +## 15.1.3 (2024-03-25) + +* [bitnami/postgresql] Release 15.1.3 updating components versions (#24640) ([a318638](https://github.com/bitnami/charts/commit/a318638310d74d34d71f82d0df115f8f2f15841a)), closes [#24640](https://github.com/bitnami/charts/issues/24640) + +## 15.1.2 (2024-03-21) + +* [bitnami/postgresql] feat: add parameter backup.cronjob.storage.existingVolume (#23979) ([0a3ebd5](https://github.com/bitnami/charts/commit/0a3ebd57a2315d4e0cd99948fdc6ef944d39673e)), closes [#23979](https://github.com/bitnami/charts/issues/23979) +* [bitnami/postgresql] fixing tls for cronjobs (#24468) ([5e7f4e1](https://github.com/bitnami/charts/commit/5e7f4e1401c96562c12b4161599ba21e6cbeb04b)), closes [#24468](https://github.com/bitnami/charts/issues/24468) + +## 15.1.1 (2024-03-21) + +* [bitnami/postgres] don't include backup netpol when backup aren't enabled (#24572) ([10584d1](https://github.com/bitnami/charts/commit/10584d11404dc2871092d2a2fabd1cab55058a14)), closes [#24572](https://github.com/bitnami/charts/issues/24572) + +## 15.1.0 (2024-03-20) + +* [bitnami/postgresql] Add a NetworkPolicy to allow backup pods to access primary nodes (#24363) ([dc93455](https://github.com/bitnami/charts/commit/dc9345576e47210f8f176a31369abe460a4cf3f9)), closes [#24363](https://github.com/bitnami/charts/issues/24363) + +## 15.0.0 (2024-03-18) + +* [bitnami/*] Reorder Chart sections (#24455) ([0cf4048](https://github.com/bitnami/charts/commit/0cf4048e8743f70a9753d460655bd030cbff6824)), closes [#24455](https://github.com/bitnami/charts/issues/24455) +* [bitnami/postgresql] feat!: :lock: :boom: Improve security defaults (#24171) ([3911a57](https://github.com/bitnami/charts/commit/3911a570a329b23dc808d0e1cfe8b27bdf9b33a7)), closes [#24171](https://github.com/bitnami/charts/issues/24171) + +## 14.3.3 (2024-03-11) + +* [bitnami/postgresql] Release 14.3.3 updating components versions (#24358) ([239ba28](https://github.com/bitnami/charts/commit/239ba28cd0d6ecfcbf035dd8269676026fed0998)), closes [#24358](https://github.com/bitnami/charts/issues/24358) + +## 14.3.2 (2024-03-11) + +* [bitnami/postgresql] Fix TLS by removing faulty white trimming in cronjob.yaml (#24239) ([1a67326](https://github.com/bitnami/charts/commit/1a6732655b99d4a0cf75437db3651cfa1f49133a)), closes [#24239](https://github.com/bitnami/charts/issues/24239) +* [bitnami/postgresql] Release 14.3.2 updating components versions (#24357) ([17bcbcb](https://github.com/bitnami/charts/commit/17bcbcbc7033692d51a13395beb0b606f7826784)), closes [#24357](https://github.com/bitnami/charts/issues/24357) + +## 14.3.1 (2024-03-07) + +* [bitnami/postgresql] Release 14.3.1 updating components versions (#24237) ([33b8e70](https://github.com/bitnami/charts/commit/33b8e700bdecedd8e2130d442adc4593bb76816c)), closes [#24237](https://github.com/bitnami/charts/issues/24237) + +## 14.3.0 (2024-03-05) + +* [bitnami/postgresql] postgresql backup container adds resources parameter (#23955) ([8da2a95](https://github.com/bitnami/charts/commit/8da2a95d6f21b42215058299cf9ca35b4d2f0c0b)), closes [#23955](https://github.com/bitnami/charts/issues/23955) +* [bitnami/postgresql] feat: :sparkles: :lock: Add automatic adaptation for Openshift restricted-v2 SC ([1a2217f](https://github.com/bitnami/charts/commit/1a2217f8087e90a49fde1bd0de7713f32c223aff)), closes [#24141](https://github.com/bitnami/charts/issues/24141) + +## 14.2.4 (2024-03-04) + +* [bitnami/postgresql] Set allowExternalEgress=true by default (#24036) ([cfa4d49](https://github.com/bitnami/charts/commit/cfa4d4951d9bd72209c77c786efe3267cd5ba070)), closes [#24036](https://github.com/bitnami/charts/issues/24036) + +## 14.2.3 (2024-02-23) + +* Add missing version, kind to volumeClaimTemplates (#23862) ([50b25b8](https://github.com/bitnami/charts/commit/50b25b83cb85112731676f61024d033964808120)), closes [#23862](https://github.com/bitnami/charts/issues/23862) + +## 14.2.2 (2024-02-22) + +* [bitnami/postgresql] Release 14.2.2 updating components versions (#23820) ([2da202b](https://github.com/bitnami/charts/commit/2da202b8f0f0bdf733da4cd1ef23f3b32fde3931)), closes [#23820](https://github.com/bitnami/charts/issues/23820) + +## 14.2.1 (2024-02-21) + +* [bitnami/postgresql] feat: :sparkles: :lock: Add readOnlyRootFilesystem support (#23565) ([d96a96f](https://github.com/bitnami/charts/commit/d96a96f3e29d7df6b8fdbc54be853161299b8734)), closes [#23565](https://github.com/bitnami/charts/issues/23565) +* [bitnami/postgresql] Release 14.2.1 updating components versions (#23682) ([60d8d72](https://github.com/bitnami/charts/commit/60d8d729982d4db88b6e0cc8955b6f7381c0623e)), closes [#23682](https://github.com/bitnami/charts/issues/23682) + +## 14.2.0 (2024-02-20) + +* [bitnami/*] Bump all versions (#23602) ([b70ee2a](https://github.com/bitnami/charts/commit/b70ee2a30e4dc256bf0ac52928fb2fa7a70f049b)), closes [#23602](https://github.com/bitnami/charts/issues/23602) + +## 14.1.3 (2024-02-19) + +* [bitnami/postgresql] Release 14.1.3 updating components versions (#23587) ([0c94e7a](https://github.com/bitnami/charts/commit/0c94e7a8e21b9c91f79bf30d5b697d6a764d6e55)), closes [#23587](https://github.com/bitnami/charts/issues/23587) + +## 14.1.2 (2024-02-18) + +* [bitnami/postgresql] Release 14.1.2 updating components versions (#23585) ([0f5b808](https://github.com/bitnami/charts/commit/0f5b8086977a59738cfdb67f545739c8fd73e734)), closes [#23585](https://github.com/bitnami/charts/issues/23585) + +## 14.1.1 (2024-02-16) + +* [bitnami/postgresql] Do not create a NetworkPolicy for "read" instance when "standalone" (#23392) ([7ef876c](https://github.com/bitnami/charts/commit/7ef876ceb4e94d8d48d8b1f756608b05a8f14f80)), closes [#23392](https://github.com/bitnami/charts/issues/23392) + +## 14.1.0 (2024-02-15) + +* [bitnami/postgresql] feat: :sparkles: :lock: Add resource preset support (#23509) ([0c94e15](https://github.com/bitnami/charts/commit/0c94e1516891a7aacd5b2e44f7ee0d421cf05ddc)), closes [#23509](https://github.com/bitnami/charts/issues/23509) + +## 14.0.5 (2024-02-12) + +* [bitnami/postgresql] fix: :bug: Set correct references in network policy (#23328) ([e8c2230](https://github.com/bitnami/charts/commit/e8c2230b05620e2049a30048122cdc3ac2c5fdaf)), closes [#23328](https://github.com/bitnami/charts/issues/23328) + +## 14.0.4 (2024-02-08) + +* [bitnami/postgresql] Release 14.0.4 updating components versions (#23354) ([81e3d65](https://github.com/bitnami/charts/commit/81e3d65d94881275fef258f5208bf3174dd5b908)), closes [#23354](https://github.com/bitnami/charts/issues/23354) + +## 14.0.3 (2024-02-08) + +* [bitnami/postgresql] Release 14.0.3 updating components versions (#23350) ([60ea843](https://github.com/bitnami/charts/commit/60ea84363857fe523d805de75f59ef172e00b1a2)), closes [#23350](https://github.com/bitnami/charts/issues/23350) + +## 14.0.2 (2024-02-08) + +* [bitnami/postgresql] Release 14.0.2 updating components versions (#23333) ([7f5a8e6](https://github.com/bitnami/charts/commit/7f5a8e60bf2deb3722ddfeadefb67e087c92a5e9)), closes [#23333](https://github.com/bitnami/charts/issues/23333) + +## 14.0.1 (2024-02-03) + +* [bitnami/postgresql] Release 14.0.1 updating components versions (#23129) ([e81bc0c](https://github.com/bitnami/charts/commit/e81bc0c8d51ea35baeaf5e3fca88b80da73fb003)), closes [#23129](https://github.com/bitnami/charts/issues/23129) + +## 14.0.0 (2024-02-01) + +* [bitnami/postgresql] feat!: :lock: :recycle: Refactor and enable networkPolicy (#22750) ([2508c4b](https://github.com/bitnami/charts/commit/2508c4b3de023afed4645746cff2b548ad68c48e)), closes [#22750](https://github.com/bitnami/charts/issues/22750) + +## 13.4.4 (2024-02-01) + +* [bitnami/postgresql] Release 13.4.4 updating components versions (#23002) ([a87898d](https://github.com/bitnami/charts/commit/a87898d5d5d33a60a1ccab904532ef62b6b57171)), closes [#23002](https://github.com/bitnami/charts/issues/23002) + +## 13.4.3 (2024-01-29) + +* [bitnami/postgresql] Release 13.4.3 updating components versions (#22811) ([fdc3ad4](https://github.com/bitnami/charts/commit/fdc3ad42b565d457a063ab240dcd08b860a53741)), closes [#22811](https://github.com/bitnami/charts/issues/22811) + +## 13.4.2 (2024-01-27) + +* [bitnami/*] Move documentation sections from docs.bitnami.com back to the README (#22203) ([7564f36](https://github.com/bitnami/charts/commit/7564f36ca1e95ff30ee686652b7ab8690561a707)), closes [#22203](https://github.com/bitnami/charts/issues/22203) +* [bitnami/postgresql] fix: :bug: Set seLinuxOptions to null for Openshift compatibility (#22646) ([b119bec](https://github.com/bitnami/charts/commit/b119bec99913bfe3a782b70abafd80fe4d29f525)), closes [#22646](https://github.com/bitnami/charts/issues/22646) +* [bitnami/postgresql] Release 13.4.2 updating components versions (#22785) ([6682e9c](https://github.com/bitnami/charts/commit/6682e9cfcf31d3b42010b35d47c25eea5d29f05c)), closes [#22785](https://github.com/bitnami/charts/issues/22785) + +## 13.4.1 (2024-01-23) + +* [bitnami/postgresql] Release 13.4.1 updating components versions (#22677) ([0bb8b48](https://github.com/bitnami/charts/commit/0bb8b48aaeeac00ed421269393965ef3428bbe4a)), closes [#22677](https://github.com/bitnami/charts/issues/22677) + +## 13.4.0 (2024-01-22) + +* [bitnami/postgresql] fix: :lock: Move service-account token auto-mount to pod declaration (#22450) ([002c752](https://github.com/bitnami/charts/commit/002c752f871c8fa068a770dc80fec4cf798798ab)), closes [#22450](https://github.com/bitnami/charts/issues/22450) + +## 13.3.1 (2024-01-18) + +* [bitnami/postgresql] Release 13.3.1 updating components versions (#22359) ([361f7ab](https://github.com/bitnami/charts/commit/361f7ab0122fab9016a08505be10436f0bae2584)), closes [#22359](https://github.com/bitnami/charts/issues/22359) + +## 13.3.0 (2024-01-17) + +* [bitnami/postgresql] fix: :lock: Improve podSecurityContext and containerSecurityContext with essent ([fe72f51](https://github.com/bitnami/charts/commit/fe72f51910c589e767b79ec6f2aefe8b11c2c683)), closes [#22177](https://github.com/bitnami/charts/issues/22177) + +## 13.2.30 (2024-01-15) + +* [bitnami/*] Fix ref links (in comments) (#21822) ([e4fa296](https://github.com/bitnami/charts/commit/e4fa296106b225cf8c82445727c675c7c725e380)), closes [#21822](https://github.com/bitnami/charts/issues/21822) +* [bitnami/postgresql] fix: :lock: Do not use the default service account (#22026) ([1b20745](https://github.com/bitnami/charts/commit/1b20745ae73b9a3c85473bda08d54ba2b7dda5d2)), closes [#22026](https://github.com/bitnami/charts/issues/22026) + +## 13.2.29 (2024-01-10) + +* [bitnami/*] Fix docs.bitnami.com broken links (#21901) ([f35506d](https://github.com/bitnami/charts/commit/f35506d2dadee4f097986e7792df1f53ab215b5d)), closes [#21901](https://github.com/bitnami/charts/issues/21901) +* [bitnami/postgresql] Release 13.2.29 updating components versions (#21970) ([dcfb216](https://github.com/bitnami/charts/commit/dcfb2164d6075edb5336ddafce939d067d6c8810)), closes [#21970](https://github.com/bitnami/charts/issues/21970) +* fixed backup with autogenerated cert (#21888) ([2d25138](https://github.com/bitnami/charts/commit/2d25138ccdf2f19ce32255722d83d908bdd1cb14)), closes [#21888](https://github.com/bitnami/charts/issues/21888) + +## 13.2.28 (2024-01-09) + +* [bitnami/*] Update copyright: Year and company (#21815) ([6c4bf75](https://github.com/bitnami/charts/commit/6c4bf75dec58fc7c9aee9f089777b1a858c17d5b)), closes [#21815](https://github.com/bitnami/charts/issues/21815) +* [bitnami/postgresql] Release 13.2.28 updating components versions (#21902) ([d0f6b90](https://github.com/bitnami/charts/commit/d0f6b90b97537391b6c3cbbc8f8f0da2c9818f2f)), closes [#21902](https://github.com/bitnami/charts/issues/21902) + +## 13.2.27 (2023-12-31) + +* [bitnami/postgresql] Release 13.2.27 updating components versions (#21795) ([26711f8](https://github.com/bitnami/charts/commit/26711f8fd8d3aab5700e8267d3c0597034274b3d)), closes [#21795](https://github.com/bitnami/charts/issues/21795) + +## 13.2.26 (2023-12-27) + +* [bitnami/postgresql] Release 13.2.26 updating components versions (#21774) ([0f0f93b](https://github.com/bitnami/charts/commit/0f0f93b14978c839a51f244a8ce5f9878287fac8)), closes [#21774](https://github.com/bitnami/charts/issues/21774) + +## 13.2.25 (2023-12-20) + +* [bitnami/postgresql] Release 13.2.25 updating components versions (#21710) ([813da6b](https://github.com/bitnami/charts/commit/813da6b9098ed399551f387ad7c1b3f9fd0dc44e)), closes [#21710](https://github.com/bitnami/charts/issues/21710) + +## 13.2.24 (2023-12-05) + +* [bitnami/postgresql] Replace deprecated pull secret partial (#21392) ([cee371d](https://github.com/bitnami/charts/commit/cee371d10674dc61de5adda4a79f4c9a1e8f85d0)), closes [#21392](https://github.com/bitnami/charts/issues/21392) + +## 13.2.23 (2023-11-30) + +* [bitnami/postgresql] Release 13.2.23 updating components versions (#21336) ([c3dc56f](https://github.com/bitnami/charts/commit/c3dc56f3679650f1012e497b8a5e71d94dac163e)), closes [#21336](https://github.com/bitnami/charts/issues/21336) + +## 13.2.22 (2023-11-30) + +* [bitnami/postgresql] Release 13.2.22 updating components versions (#21335) ([f759303](https://github.com/bitnami/charts/commit/f7593033f47e7c8f777913373e4ad79cf4845176)), closes [#21335](https://github.com/bitnami/charts/issues/21335) + +## 13.2.21 (2023-11-27) + +* [bitnami/postgresql] Release 13.2.21 updating components versions (#21276) ([46a4f54](https://github.com/bitnami/charts/commit/46a4f54495d95276785a3b2cd37962ebd0a9be1e)), closes [#21276](https://github.com/bitnami/charts/issues/21276) + +## 13.2.20 (2023-11-27) + +* [bitnami/postgresql] Release 13.2.20 updating components versions (#21272) ([6de0ade](https://github.com/bitnami/charts/commit/6de0ade26a13c2aba94103e8132d277a81224bb7)), closes [#21272](https://github.com/bitnami/charts/issues/21272) + +## 13.2.19 (2023-11-27) + +* [bitnami/postgresql] Fix PostgreSQL password in metrics container (#21202) ([a7b72aa](https://github.com/bitnami/charts/commit/a7b72aa0f5f3630750c76c5fc0b83ca8bcfdcd26)), closes [#21202](https://github.com/bitnami/charts/issues/21202) + +## 13.2.18 (2023-11-26) + +* [bitnami/postgresql] Release 13.2.18 updating components versions (#21256) ([f4a4548](https://github.com/bitnami/charts/commit/f4a4548120a4bdd005f4e35787de9af65376c04d)), closes [#21256](https://github.com/bitnami/charts/issues/21256) + +## 13.2.17 (2023-11-26) + +* [bitnami/postgresql] Release 13.2.17 updating components versions (#21255) ([e395fd8](https://github.com/bitnami/charts/commit/e395fd838385ad716cc877d280af797f77146751)), closes [#21255](https://github.com/bitnami/charts/issues/21255) + +## 13.2.16 (2023-11-23) + +* [bitnami/postgresql] value to configure posgres_exporter collectors (#21162) ([0ba581c](https://github.com/bitnami/charts/commit/0ba581cc113264bb252e4c873217732a316ba71f)), closes [#21162](https://github.com/bitnami/charts/issues/21162) +* Update configmap.yaml (#21020) ([b91e518](https://github.com/bitnami/charts/commit/b91e518041dc4fe76b422801406efe7f9a4e4b49)), closes [#21020](https://github.com/bitnami/charts/issues/21020) + +## 13.2.15 (2023-11-21) + +* [bitnami/*] Rename solutions to "Bitnami package for ..." (#21038) ([b82f979](https://github.com/bitnami/charts/commit/b82f979e4fb63423fe6e2192c946d09d79c944fc)), closes [#21038](https://github.com/bitnami/charts/issues/21038) +* [bitnami/postgresql] Release 13.2.15 updating components versions (#21160) ([e6ec2c2](https://github.com/bitnami/charts/commit/e6ec2c2982653c0ae1ec8a25d3e6bf24a92bb215)), closes [#21160](https://github.com/bitnami/charts/issues/21160) + +## 13.2.14 (2023-11-20) + +* [bitnami/postgresql] Release 13.2.14 updating components versions (#21068) ([576be48](https://github.com/bitnami/charts/commit/576be48d9fd20b645b789312348f6956ca979489)), closes [#21068](https://github.com/bitnami/charts/issues/21068) + +## 13.2.13 (2023-11-20) + +* [bitnami/postgresql] Release 13.2.13 updating components versions (#21066) ([54a372f](https://github.com/bitnami/charts/commit/54a372fca8edd8316df8979a6f05d3c9722e6361)), closes [#21066](https://github.com/bitnami/charts/issues/21066) + +## 13.2.12 (2023-11-20) + +* [bitnami/postgresql] Release 13.2.12 updating components versions (#21057) ([0cffbfe](https://github.com/bitnami/charts/commit/0cffbfeb281a6c42d507f78f6e53c637527230ac)), closes [#21057](https://github.com/bitnami/charts/issues/21057) + +## 13.2.11 (2023-11-17) + +* [bitnami/postgresql] Release 13.2.11 updating components versions (#21044) ([17e4ada](https://github.com/bitnami/charts/commit/17e4adac62f77d314ebdaf722944b9191aea0a62)), closes [#21044](https://github.com/bitnami/charts/issues/21044) + +## 13.2.10 (2023-11-17) + +* [bitnami/*] Remove relative links to non-README sections, add verification for that and update TL;DR ([1103633](https://github.com/bitnami/charts/commit/11036334d82df0490aa4abdb591543cab6cf7d7f)), closes [#20967](https://github.com/bitnami/charts/issues/20967) +* [bitnami/postgresql] Release 13.2.10 updating components versions (#21039) ([2b176c0](https://github.com/bitnami/charts/commit/2b176c0ad026223c86cbd88bfe1fba8895519c51)), closes [#21039](https://github.com/bitnami/charts/issues/21039) + +## 13.2.9 (2023-11-13) + +* [bitnami/postgresql] Release 13.2.9 updating components versions (#20930) ([02dc5ff](https://github.com/bitnami/charts/commit/02dc5ff8c09a4f232152d4a62a628008866a397c)), closes [#20930](https://github.com/bitnami/charts/issues/20930) + +## 13.2.8 (2023-11-13) + +* [bitnami/postgresql] Release 13.2.8 updating components versions (#20929) ([129cbf1](https://github.com/bitnami/charts/commit/129cbf14077eb53393b08d1ae7a22f2fc6201323)), closes [#20929](https://github.com/bitnami/charts/issues/20929) + +## 13.2.7 (2023-11-13) + +* [bitnami/postgresql] Release 13.2.7 updating components versions (#20918) ([860eb62](https://github.com/bitnami/charts/commit/860eb627ff273acea6a48316f779df4ca6436b8a)), closes [#20918](https://github.com/bitnami/charts/issues/20918) + +## 13.2.6 (2023-11-13) + +* [bitnami/postgresql] Release 13.2.6 updating components versions (#20908) ([a942587](https://github.com/bitnami/charts/commit/a942587d48f1ac368c6d9dd4b3842a7a8f59d699)), closes [#20908](https://github.com/bitnami/charts/issues/20908) + +## 13.2.5 (2023-11-10) + +* [bitnami/postgresql] Release 13.2.5 updating components versions (#20889) ([ca3f6a7](https://github.com/bitnami/charts/commit/ca3f6a70982ee387dfd6c782a8dbefa0ad4ebebc)), closes [#20889](https://github.com/bitnami/charts/issues/20889) + +## 13.2.4 (2023-11-09) + +* [bitnami/postgresql] Release 13.2.4 updating components versions (#20876) ([435c8af](https://github.com/bitnami/charts/commit/435c8afe568f0dbeda81cf1a4219874b8d670e89)), closes [#20876](https://github.com/bitnami/charts/issues/20876) + +## 13.2.3 (2023-11-08) + +* [bitnami/postgresql] Release 13.2.3 updating components versions (#20772) ([0ed5ebf](https://github.com/bitnami/charts/commit/0ed5ebfb6b1384f71d667f8fd5e25defa234a9b6)), closes [#20772](https://github.com/bitnami/charts/issues/20772) + +## 13.2.2 (2023-11-06) + +* [bitnami/postgresql] Release 13.2.2 updating components versions (#20639) ([9b846d9](https://github.com/bitnami/charts/commit/9b846d924d7e92f09507df205278a9c8c78a637c)), closes [#20639](https://github.com/bitnami/charts/issues/20639) + +## 13.2.1 (2023-11-03) + +* [bitnami/postgresql] Release 13.2.1 updating components versions (#20614) ([68bad25](https://github.com/bitnami/charts/commit/68bad258cdd695a80e95acdc796dd78b36f4b060)), closes [#20614](https://github.com/bitnami/charts/issues/20614) + +## 13.2.0 (2023-10-31) + +* [bitnami/*] Rename VMware Application Catalog (#20361) ([3acc734](https://github.com/bitnami/charts/commit/3acc73472beb6fb56c4d99f929061001205bc57e)), closes [#20361](https://github.com/bitnami/charts/issues/20361) +* [bitnami/*] Skip image's tag in the README files of the Bitnami Charts (#19841) ([bb9a01b](https://github.com/bitnami/charts/commit/bb9a01b65911c87e48318db922cc05eb42785e42)), closes [#19841](https://github.com/bitnami/charts/issues/19841) +* [bitnami/*] Standardize documentation (#19835) ([af5f753](https://github.com/bitnami/charts/commit/af5f7530c1bc8c5ded53a6c4f7b8f384ac1804f2)), closes [#19835](https://github.com/bitnami/charts/issues/19835) +* [bitnami/postgresql] feat: :sparkles: Add support for PSA restricted policy (#20527) ([8da833a](https://github.com/bitnami/charts/commit/8da833aa06772fc456b71669770b66b3b9b46f9a)), closes [#20527](https://github.com/bitnami/charts/issues/20527) + +## 13.1.5 (2023-10-13) + +* [bitnami/postgresql] Release 13.1.5 (#20212) ([0272334](https://github.com/bitnami/charts/commit/0272334cc97897a11866dd07b631a54ba240fcb9)), closes [#20212](https://github.com/bitnami/charts/issues/20212) + +## 13.1.4 (2023-10-12) + +* [bitnami/postgresql] Release 13.1.4 (#20187) ([477cb86](https://github.com/bitnami/charts/commit/477cb8678f87eb34b154585907a9c03fd6be8535)), closes [#20187](https://github.com/bitnami/charts/issues/20187) + +## 13.1.3 (2023-10-09) + +* [bitnami/postgresql] Release 13.1.3 (#19931) ([2eb6312](https://github.com/bitnami/charts/commit/2eb63123658ba817d858ee83a2aa94e3133d75c1)), closes [#19931](https://github.com/bitnami/charts/issues/19931) + +## 13.1.2 (2023-10-09) + +* [bitnami/postgresql] Release 13.1.2 (#19882) ([5758fb2](https://github.com/bitnami/charts/commit/5758fb2b69f411e8ba87e71fd09af1029aa557d9)), closes [#19882](https://github.com/bitnami/charts/issues/19882) + +## 13.1.1 (2023-10-09) + +* [bitnami/*] Update Helm charts prerequisites (#19745) ([eb755dd](https://github.com/bitnami/charts/commit/eb755dd36a4dd3cf6635be8e0598f9a7f4c4a554)), closes [#19745](https://github.com/bitnami/charts/issues/19745) +* [bitnami/postgresql] Release 13.1.1 (#19775) ([f783262](https://github.com/bitnami/charts/commit/f783262472dff63aa58f0feaf8aa43de4cf17dcd)), closes [#19775](https://github.com/bitnami/charts/issues/19775) + +## 13.1.0 (2023-10-05) + +* [bitnami/postgresql] Add TimeZone to CronJob of backup (#19516) ([94d976d](https://github.com/bitnami/charts/commit/94d976d80446a4b5ff20825b5e6fadc8afe2b978)), closes [#19516](https://github.com/bitnami/charts/issues/19516) + +## 13.0.2 (2023-10-04) + +* [bitnami/postgresql] Support disabling backup cron containerSecurityContext (#19676) ([5ff8ad5](https://github.com/bitnami/charts/commit/5ff8ad5f3c754e3c2423d6abf46f522e8abe0410)), closes [#19676](https://github.com/bitnami/charts/issues/19676) + +## 13.0.1 (2023-09-29) + +* [bitnami/postgresql] Update README after major release (#19608) ([cd4442c](https://github.com/bitnami/charts/commit/cd4442ca2ac454b8fabf528631b9e5d910d3e847)), closes [#19608](https://github.com/bitnami/charts/issues/19608) +* [bitnami/postgresql] Use common capabilities for PSP (#19637) ([5593291](https://github.com/bitnami/charts/commit/5593291a4229e51c166dd63519c7c3d7cc61ca93)), closes [#19637](https://github.com/bitnami/charts/issues/19637) + +## 13.0.0 (2023-09-28) + +* [bitnami/postgresql] Release 13.0.0 (#19587) ([ed70b64](https://github.com/bitnami/charts/commit/ed70b64a2607bef3cc99bab2b2ac22999d07bdc2)), closes [#19587](https://github.com/bitnami/charts/issues/19587) + +## 12.12.10 (2023-09-27) + +* [bitnami/postgresql] Fix port used by backup's CronJob (#19517) ([d278c2b](https://github.com/bitnami/charts/commit/d278c2b6792e02c5f327e96df4f031cab7bc0819)), closes [#19517](https://github.com/bitnami/charts/issues/19517) + +## 12.12.9 (2023-09-26) + +* [bitnami/postgresql] Release 12.12.9 updating components versions (#19530) ([70ca410](https://github.com/bitnami/charts/commit/70ca4106446fec3f491dc5c87cacf85ece3f11af)), closes [#19530](https://github.com/bitnami/charts/issues/19530) +* bitnami/postgresql Added ImagePullSecrets and ImagePullPolicy to be passed through to backup-cronjo ([29dbf3a](https://github.com/bitnami/charts/commit/29dbf3a630c3666dc803900e353b558a6d78558c)), closes [#19509](https://github.com/bitnami/charts/issues/19509) + +## 12.12.8 (2023-09-26) + +* [bitnami/postgresql] Release 12.12.8 (#19521) ([ef790fa](https://github.com/bitnami/charts/commit/ef790faaa22c5bdd390341f069531719f6987af8)), closes [#19521](https://github.com/bitnami/charts/issues/19521) + +## 12.12.7 (2023-09-25) + +* [bitnami/postgresql] Release 12.12.7 (#19506) ([f8d9491](https://github.com/bitnami/charts/commit/f8d949156a8beccb9acb0fed17ed6e6cdec23f3f)), closes [#19506](https://github.com/bitnami/charts/issues/19506) + +## 12.12.6 (2023-09-22) + +* [bitnami/postgresql] Release 12.12.6 (#19481) ([acac1c2](https://github.com/bitnami/charts/commit/acac1c2f7d937fdef3c19ecb9c0acce279a2f320)), closes [#19481](https://github.com/bitnami/charts/issues/19481) + +## 12.12.5 (2023-09-22) + +* [bitnami/postgresql] Add SecurityContext to CronJob of backup (#19238) ([8edeb93](https://github.com/bitnami/charts/commit/8edeb93e6917915f6d1d81e745fec0a998e1454a)), closes [#19238](https://github.com/bitnami/charts/issues/19238) + +## 12.12.4 (2023-09-20) + +* [bitnami/postgresql] Release 12.12.4 (#19430) ([f8b45dc](https://github.com/bitnami/charts/commit/f8b45dc5d71d35d2f1822f7040ea4b8cdb3d00fd)), closes [#19430](https://github.com/bitnami/charts/issues/19430) + +## 12.12.3 (2023-09-19) + +* [bitnami/postgresql] Add nodeSelector to Backup Cronjob spec (#19398) ([7eea12f](https://github.com/bitnami/charts/commit/7eea12f052ceeb3c8bef32a18e3257bca16eb372)), closes [#19398](https://github.com/bitnami/charts/issues/19398) + +## 12.11.4 (2023-09-19) + +* [bitnami/postgresql] Release 12.11.4 (#19397) ([b6a06cc](https://github.com/bitnami/charts/commit/b6a06cc0c8acfe4fb47d1fe99e7ea6978d10718e)), closes [#19397](https://github.com/bitnami/charts/issues/19397) + +## 12.11.3 (2023-09-18) + +* [bitnami/postgresql] Release 12.11.3 (#19345) ([9407892](https://github.com/bitnami/charts/commit/9407892e59e1004bd702c03587fb4782c9949e48)), closes [#19345](https://github.com/bitnami/charts/issues/19345) +* Revert "Autogenerate schema files (#19194)" (#19335) ([73d80be](https://github.com/bitnami/charts/commit/73d80be525c88fb4b8a54451a55acd506e337062)), closes [#19194](https://github.com/bitnami/charts/issues/19194) [#19335](https://github.com/bitnami/charts/issues/19335) + +## 12.11.2 (2023-09-15) + +* Autogenerate schema files (#19194) ([a2c2090](https://github.com/bitnami/charts/commit/a2c2090b5ac97f47b745c8028c6452bf99739772)), closes [#19194](https://github.com/bitnami/charts/issues/19194) +* Fix global secretkeys usage (#19281) ([3c468cb](https://github.com/bitnami/charts/commit/3c468cb618180ac21dd6051324569ae8c1525ef3)), closes [#19281](https://github.com/bitnami/charts/issues/19281) + +## 12.11.1 (2023-09-08) + +* [bitnami/postgresql] chore: :bookmark: Bump version ([26ddfc4](https://github.com/bitnami/charts/commit/26ddfc4ef1f294267bce5013c374bf3f5301e70f)) + +## 12.11.0 (2023-09-07) + +* [bitnami/postgresql] Version the helper functions (#17847) ([c1a1349](https://github.com/bitnami/charts/commit/c1a1349e8bfa5c853798b3f26c470a8255374ecf)), closes [#17847](https://github.com/bitnami/charts/issues/17847) + +## 12.10.2 (2023-09-07) + +* [bitnami/postgresql] chore: :bookmark: Bump version ([b46e94e](https://github.com/bitnami/charts/commit/b46e94e5205bb3f2ec35afc024c34acf8a533afd)) + +## 12.10.1 (2023-09-06) + +* [bitnami/postgresql: Use merge helper]: (#19093) ([8eaef88](https://github.com/bitnami/charts/commit/8eaef88b982edabba62c4f4aca7ae5e61c152005)), closes [#19093](https://github.com/bitnami/charts/issues/19093) + +## 12.10.0 (2023-08-25) + +* [bitnami/postgresql] Add Persistent Volume Claim Retention Policy to Postgresql Statefulsets (#18276 ([85635f4](https://github.com/bitnami/charts/commit/85635f4e81edf49a2ba9baf301656a6e15ed261c)), closes [#18276](https://github.com/bitnami/charts/issues/18276) + +## 12.9.0 (2023-08-23) + +* [bitnami/postgresql] Support for customizing standard labels (#18408) ([bf18e4b](https://github.com/bitnami/charts/commit/bf18e4b271d2281b196c237ff4b3480b9f974426)), closes [#18408](https://github.com/bitnami/charts/issues/18408) + +## 12.8.5 (2023-08-22) + +* [bitnami/postgresql] Release 12.8.5 (#18771) ([85ffc53](https://github.com/bitnami/charts/commit/85ffc537f5a4979ae7f6c82c0c3a6cfbb3cc22a1)), closes [#18771](https://github.com/bitnami/charts/issues/18771) + +## 12.8.4 (2023-08-21) + +* [bitnami/postgresql] fix annotation typo (#18557) ([9748b69](https://github.com/bitnami/charts/commit/9748b6929f9297e669b8f53a2ea34fc1d6d86a58)), closes [#18557](https://github.com/bitnami/charts/issues/18557) + +## 12.8.3 (2023-08-17) + +* [bitnami/postgresql] Release 12.8.3 (#18576) ([6c950c1](https://github.com/bitnami/charts/commit/6c950c1345fb8023f2cc3287bdcbb1a5daade8f2)), closes [#18576](https://github.com/bitnami/charts/issues/18576) + +## 12.8.2 (2023-08-10) + +* [bitnami/postgresql] Release 12.8.2 (#18364) ([f34b599](https://github.com/bitnami/charts/commit/f34b599adba104713bb931dd69a8a328df116513)), closes [#18364](https://github.com/bitnami/charts/issues/18364) + +## 12.8.1 (2023-08-08) + +* [bitnami/postgresql] Release 12.8.1 (#18287) ([5887a90](https://github.com/bitnami/charts/commit/5887a907d3f84ed68760d87e41d0a343c84e12ed)), closes [#18287](https://github.com/bitnami/charts/issues/18287) + +## 12.8.0 (2023-08-01) + +* [bitnami/postgresql] Add trivial backup cronjob (#17852) ([56b223b](https://github.com/bitnami/charts/commit/56b223b24aea584d0ef8c58ba669baadedee0e75)), closes [#17852](https://github.com/bitnami/charts/issues/17852) + +## 12.7.3 (2023-07-31) + +* [bitnami/postgresql] Release 12.7.3 (#18068) ([0186212](https://github.com/bitnami/charts/commit/01862127c7e07b89b2f08bcad9cb593f6ea4dc41)), closes [#18068](https://github.com/bitnami/charts/issues/18068) + +## 12.7.2 (2023-07-31) + +* [bitnami/postgresql] Remove multi-line conditional (#17711) ([e7acf10](https://github.com/bitnami/charts/commit/e7acf10e9e9874dc1c9b26b849f47d39db1554d7)), closes [#17711](https://github.com/bitnami/charts/issues/17711) + +## 12.7.1 (2023-07-27) + +* [bitnami/postgresql] Release 12.7.1 (#17986) ([a071516](https://github.com/bitnami/charts/commit/a0715163ee9e1c554669783edbecd352e04be396)), closes [#17986](https://github.com/bitnami/charts/issues/17986) + +## 12.7.0 (2023-07-26) + +* [bitnami/postgresql] set some bits compatible with pss restricted (#17388) ([beb65fa](https://github.com/bitnami/charts/commit/beb65fae1f0aa7828d1d7773665e4cad8933062b)), closes [#17388](https://github.com/bitnami/charts/issues/17388) + +## 12.6.9 (2023-07-24) + +* [bitnami/postgresql] Release 12.6.9 (#17840) ([5141c42](https://github.com/bitnami/charts/commit/5141c42b918cf812393c29b4978d5330d0bf437f)), closes [#17840](https://github.com/bitnami/charts/issues/17840) + +## 12.6.8 (2023-07-20) + +* [bitnami/postgresl] Remove the password in text of the statefulset (#17780) ([3bfcc08](https://github.com/bitnami/charts/commit/3bfcc0812171abc52f11edc32c2d31650a1bbc8c)), closes [#17780](https://github.com/bitnami/charts/issues/17780) + +## 12.6.7 (2023-07-19) + +* Fixes usePasswordFiles (#17773) ([14d2b9a](https://github.com/bitnami/charts/commit/14d2b9aa78f3c1df413600e6a623215a827c2092)), closes [#17773](https://github.com/bitnami/charts/issues/17773) + +## 12.6.6 (2023-07-15) + +* [bitnami/postgresql] Release 12.6.6 (#17705) ([3e6c481](https://github.com/bitnami/charts/commit/3e6c4816902a5250fa97202590da88c65ffa2a94)), closes [#17705](https://github.com/bitnami/charts/issues/17705) + +## 12.6.5 (2023-07-11) + +* [bitnami/postgresql] fix invalid indentation for replica metrics extra envs (#17553) ([39b5188](https://github.com/bitnami/charts/commit/39b5188af308dc4d9ad777f20c8a4d7f6fb3a539)), closes [#17553](https://github.com/bitnami/charts/issues/17553) + +## 12.6.4 (2023-07-07) + +* [bitnami/postgresql] Fix postgres random password generation (#17502) ([afa4649](https://github.com/bitnami/charts/commit/afa4649ca1252dd82a250b3b9497575a9744dd0a)), closes [#17502](https://github.com/bitnami/charts/issues/17502) + +## 12.6.3 (2023-07-06) + +* [bitnami/postgresql] Fix multi-element array for primary.service.loadBalancerSourceRanges (#17461) ([dc59153](https://github.com/bitnami/charts/commit/dc59153da0c21373c83d9a6eb6b3a2e7373f9fe2)), closes [#17461](https://github.com/bitnami/charts/issues/17461) [#17450](https://github.com/bitnami/charts/issues/17450) + +## 12.6.2 (2023-07-04) + +* [bitnami/postgresql] Fix postgres password if customUser is empty (#17473) ([d6234d8](https://github.com/bitnami/charts/commit/d6234d8b8921470066e567832660164d84192975)), closes [#17473](https://github.com/bitnami/charts/issues/17473) + +## 12.6.1 (2023-07-04) + +* [bitnami/postgresql] Fix issues when using enablePostgresUser=false (#17398) ([262f4f1](https://github.com/bitnami/charts/commit/262f4f1d2906226cee8cabb49c8fedf97ecc30e4)), closes [#17398](https://github.com/bitnami/charts/issues/17398) + +## 12.6.0 (2023-06-29) + +* [bitnami/postgresql] checksum only data part of the ConfigMap (#17302) ([f5c4b4e](https://github.com/bitnami/charts/commit/f5c4b4e1e1dfc1ce898f3ceb4a9204a0ae78f59a)), closes [#17302](https://github.com/bitnami/charts/issues/17302) + +## 12.5.9 (2023-06-29) + +* [bitnami/postgresql] Release 12.5.9 (#17392) ([06ab2db](https://github.com/bitnami/charts/commit/06ab2db2211d173726ffbe90801481d0591dd7ed)), closes [#17392](https://github.com/bitnami/charts/issues/17392) +* Add copyright header (#17300) ([da68be8](https://github.com/bitnami/charts/commit/da68be8e951225133c7dfb572d5101ca3d61c5ae)), closes [#17300](https://github.com/bitnami/charts/issues/17300) +* Update charts readme (#17217) ([31b3c0a](https://github.com/bitnami/charts/commit/31b3c0afd968ff4429107e34101f7509e6a0e913)), closes [#17217](https://github.com/bitnami/charts/issues/17217) + +## 12.5.8 (2023-06-19) + +* [bitnami/PostgreSQL] Update statefulset to inlcude verbose PVC reference (#17140) ([ffa4eeb](https://github.com/bitnami/charts/commit/ffa4eeb0e853fd63fced31d1bd443c6587354f87)), closes [#17140](https://github.com/bitnami/charts/issues/17140) + +## 12.5.7 (2023-06-12) + +* [bitnami/*] Change copyright section in READMEs (#17006) ([ef986a1](https://github.com/bitnami/charts/commit/ef986a1605241102b3dcafe9fd8089e6fc1201ad)), closes [#17006](https://github.com/bitnami/charts/issues/17006) +* [bitnami/postgresql] Fix execution when enablePostgresUser is false (#17058) ([fc26fbd](https://github.com/bitnami/charts/commit/fc26fbd518a5bb0e546144d04e7178a138ccbd5b)), closes [#17058](https://github.com/bitnami/charts/issues/17058) +* [bitnami/several] Change copyright section in READMEs (#16989) ([5b6a5cf](https://github.com/bitnami/charts/commit/5b6a5cfb7625a751848a2e5cd796bd7278f406ca)), closes [#16989](https://github.com/bitnami/charts/issues/16989) + +## 12.5.6 (2023-05-30) + +* [bitnami/postgresql] Fix mountPath for extendedConfiguration (#16874) ([f5e2881](https://github.com/bitnami/charts/commit/f5e2881a6486cba5dada153af9ec1c2eef5b2607)), closes [#16874](https://github.com/bitnami/charts/issues/16874) +* [bitnami/postgresql] Release 12.5.6 (#16953) ([0448ae0](https://github.com/bitnami/charts/commit/0448ae0ee83f1aca2e4bc4eae484d57c32c053ea)), closes [#16953](https://github.com/bitnami/charts/issues/16953) + +## 12.5.5 (2023-05-23) + +* [bitnami/postgresql] Allow usePasswordFile when using existingSecret + custom keys (#16729) ([ff3a5e0](https://github.com/bitnami/charts/commit/ff3a5e09275e46e53e69ba3127fcd854f6131f31)), closes [#16729](https://github.com/bitnami/charts/issues/16729) + +## 12.5.4 (2023-05-22) + +* [bitnami/postgresql] Release 12.5.4 (#16861) ([d8aae34](https://github.com/bitnami/charts/commit/d8aae34620d86d9d7aa4a98d260cb8264ca3427e)), closes [#16861](https://github.com/bitnami/charts/issues/16861) + +## 12.5.3 (2023-05-21) + +* [bitnami/postgresql] Release 12.5.3 (#16838) ([de9b3a4](https://github.com/bitnami/charts/commit/de9b3a43a8f31a52cff599e46d6ac7db146ccb31)), closes [#16838](https://github.com/bitnami/charts/issues/16838) + +## 12.5.2 (2023-05-16) + +* [bitnami/postgresql] Bump the version (#16668) ([7addf44](https://github.com/bitnami/charts/commit/7addf44857481ba673384aa6ad8b5f95a02608ea)), closes [#16668](https://github.com/bitnami/charts/issues/16668) +* fix(postgres): use correct default value type for networkPolicy customRules (#16646) ([901f3b8](https://github.com/bitnami/charts/commit/901f3b82f4ecbf62ac968c7edfd061016036055a)), closes [#16646](https://github.com/bitnami/charts/issues/16646) + +## 12.5.1 (2023-05-12) + +* [bitnami/postgresql] Release 12.5.1 (#16621) ([7c233f3](https://github.com/bitnami/charts/commit/7c233f36112aed3567edf01f69017cd7a428be20)), closes [#16621](https://github.com/bitnami/charts/issues/16621) +* Add wording for enterprise page (#16560) ([8f22774](https://github.com/bitnami/charts/commit/8f2277440b976d52785ba9149762ad8620a73d1f)), closes [#16560](https://github.com/bitnami/charts/issues/16560) + +## 12.5.0 (2023-05-09) + +* [bitnami/several] Adapt Chart.yaml to set desired OCI annotations (#16546) ([fc9b18f](https://github.com/bitnami/charts/commit/fc9b18f2e98805d4df629acbcde696f44f973344)), closes [#16546](https://github.com/bitnami/charts/issues/16546) + +## 12.4.3 (2023-05-09) + +* [bitnami/postgresql] Release 12.4.3 (#16493) ([85c1bf6](https://github.com/bitnami/charts/commit/85c1bf652b5b423bc1e270ba3303f32adb52c368)), closes [#16493](https://github.com/bitnami/charts/issues/16493) + +## 12.4.2 (2023-04-27) + +* [bitnami/postgresql] Use username as key in the Service Binding secret (#16249) ([c6daf3d](https://github.com/bitnami/charts/commit/c6daf3d29502dca394284d0a4be1a91827d7f869)), closes [#16249](https://github.com/bitnami/charts/issues/16249) + +## 12.4.1 (2023-04-25) + +* [bitnami/postgresql] Release 12.4.1 (#16225) ([d6f37c5](https://github.com/bitnami/charts/commit/d6f37c5847c34bbbedb702c262df6dcd1c2f8b62)), closes [#16225](https://github.com/bitnami/charts/issues/16225) + +## 12.4.0 (2023-04-25) + +* [bitnami/several] Revert changes done by mistake in Chart.yaml repo (#16211) ([3a60f4b](https://github.com/bitnami/charts/commit/3a60f4b10d2e02dbf83fcf64906b43edb6725615)), closes [#16211](https://github.com/bitnami/charts/issues/16211) + +## 12.3.2 (2023-04-25) + +* [bitnami/postgresql] Release 12.3.2 (#16205) ([d1cbf66](https://github.com/bitnami/charts/commit/d1cbf66dbaebac3ffd5d92a69c88bb00146b280d)), closes [#16205](https://github.com/bitnami/charts/issues/16205) + +## 12.3.1 (2023-04-21) + +* [bitnami/postgresql] Release 12.3.1 (#16182) ([1426b53](https://github.com/bitnami/charts/commit/1426b53a4d6bb75d442df177f77daafe93e5b78b)), closes [#16182](https://github.com/bitnami/charts/issues/16182) + +## 12.3.0 (2023-04-20) + +* [bitnami/*] Make Helm charts 100% OCI (#15998) ([8841510](https://github.com/bitnami/charts/commit/884151035efcbf2e1b3206e7def85511073fb57d)), closes [#15998](https://github.com/bitnami/charts/issues/15998) + +## 12.2.8 (2023-04-14) + +* [bitnami/postgresql] Release 12.2.8 (#16072) ([8f03dec](https://github.com/bitnami/charts/commit/8f03decb1ff8c4bf5a7bf0ab40d3844474323d48)), closes [#16072](https://github.com/bitnami/charts/issues/16072) + +## 12.2.7 (2023-04-01) + +* [bitnami/postgresql] Release 12.2.7 (#15896) ([18e9565](https://github.com/bitnami/charts/commit/18e9565ed8d1fcc9cd072fc1c5fd2cc7ffbd0b3a)), closes [#15896](https://github.com/bitnami/charts/issues/15896) + +## 12.2.6 (2023-03-22) + +* [bitnami/postgresql] Release 12.2.6 (#15685) ([e42e0a1](https://github.com/bitnami/charts/commit/e42e0a158ee42c88a7fcd6cb67d50aa11a32e38e)), closes [#15685](https://github.com/bitnami/charts/issues/15685) + +## 12.2.5 (2023-03-20) + +* [bitnami/postgresql] Release 12.2.5 (#15632) ([71f1ab5](https://github.com/bitnami/charts/commit/71f1ab5bcf8e9fa7f0867b1104d3151bc3d0c662)), closes [#15632](https://github.com/bitnami/charts/issues/15632) + +## 12.2.4 (2023-03-19) + +* [bitnami/postgresql] Release 12.2.4 (#15600) ([2b7e88c](https://github.com/bitnami/charts/commit/2b7e88cecfc5d607a7d57c5519624a7d244e59eb)), closes [#15600](https://github.com/bitnami/charts/issues/15600) + +## 12.2.3 (2023-03-14) + +* [bitnami/charts] Apply linter to README files (#15357) ([0e29e60](https://github.com/bitnami/charts/commit/0e29e600d3adc8b1b46e506eccb3decfab3b4e63)), closes [#15357](https://github.com/bitnami/charts/issues/15357) +* [bitnami/postgresql] Release 12.2.3 (#15488) ([1b1ddca](https://github.com/bitnami/charts/commit/1b1ddcaac1815709423744fec139374165c6dc2b)), closes [#15488](https://github.com/bitnami/charts/issues/15488) + +## 12.2.2 (2023-03-01) + +* [bitnami/postgresql] Release 12.2.2 (#15233) ([ceb1e4f](https://github.com/bitnami/charts/commit/ceb1e4fefd2cd6363ec12190fe72f79f5252f78b)), closes [#15233](https://github.com/bitnami/charts/issues/15233) +* Fix postgres secret keys (#15023) ([eeb1faa](https://github.com/bitnami/charts/commit/eeb1faaa45e393f0bc10f2c9093f8c9720f0e6da)), closes [#15023](https://github.com/bitnami/charts/issues/15023) + +## 12.2.1 (2023-02-17) + +* [bitnami/*] Fix markdown linter issues 2 (#14890) ([aa96572](https://github.com/bitnami/charts/commit/aa9657237ee8df4a46db0d7fdf8a23230dd6902a)), closes [#14890](https://github.com/bitnami/charts/issues/14890) +* [bitnami/postgresql] Release 12.2.1 (#15025) ([727ecd8](https://github.com/bitnami/charts/commit/727ecd8f026c7752e9ecb8c3596820fc904182a4)), closes [#15025](https://github.com/bitnami/charts/issues/15025) + +## 12.2.0 (2023-02-16) + +* [bitnami/*] Fix markdown linter issues (#14874) ([a51e0e8](https://github.com/bitnami/charts/commit/a51e0e8d35495b907f3e70dd2f8e7c3bcbf4166a)), closes [#14874](https://github.com/bitnami/charts/issues/14874) +* [bitnami/*] Remove unexpected extra spaces (#14873) ([c97c714](https://github.com/bitnami/charts/commit/c97c714887380d47eae7bfeff316bf01595ecd1d)), closes [#14873](https://github.com/bitnami/charts/issues/14873) +* [bitnami/postgresql] feat: :sparkles: Add ServiceBinding-compatible secrets (#14893) ([68f6708](https://github.com/bitnami/charts/commit/68f67081020525f4b757a2f6f3132c8435b94673)), closes [#14893](https://github.com/bitnami/charts/issues/14893) + +## 12.1.15 (2023-02-09) + +* [bitnami/postgresql] Release 12.1.15 (#14821) ([9334f82](https://github.com/bitnami/charts/commit/9334f82858196b21a1c74c40deaf5a907119333f)), closes [#14821](https://github.com/bitnami/charts/issues/14821) + +## 12.1.14 (2023-02-02) + +* [bitnami/postgresql] Don't regenerate self-signed certs on upgrade (#14651) ([c9c6d20](https://github.com/bitnami/charts/commit/c9c6d2019c7e5f4e46622eddaa838e5983bb08d1)), closes [#14651](https://github.com/bitnami/charts/issues/14651) +* [bitnami/postgresql] Release 12.1.14 (#14717) ([02daab3](https://github.com/bitnami/charts/commit/02daab3ee027cf4271dfe16d6fa559383d4444d6)), closes [#14717](https://github.com/bitnami/charts/issues/14717) + +## 12.1.13 (2023-01-31) + +* [bitnami/*] Change copyright date (#14682) ([add4ec7](https://github.com/bitnami/charts/commit/add4ec701108ac36ed4de2dffbdf407a0d091067)), closes [#14682](https://github.com/bitnami/charts/issues/14682) +* [bitnami/postgresql] skip empty resources (#14602) ([5ee97f7](https://github.com/bitnami/charts/commit/5ee97f7cdb647606575d7f8aa0405ecad41ef48f)), closes [#14602](https://github.com/bitnami/charts/issues/14602) + +## 12.1.12 (2023-01-30) + +* [bitnami/postgresql] Release 12.1.12 (#14593) ([b55c70e](https://github.com/bitnami/charts/commit/b55c70ea72516611db13384a88142b085868584e)), closes [#14593](https://github.com/bitnami/charts/issues/14593) + +## 12.1.11 (2023-01-26) + +* [bitnami/postgresql] Release 12.1.11 (#14558) ([bab9d74](https://github.com/bitnami/charts/commit/bab9d741c5443f6dcb552a746ad7d07140d5cf55)), closes [#14558](https://github.com/bitnami/charts/issues/14558) + +## 12.1.10 (2023-01-26) + +* [bitnami/*] Add license annotation and remove obsolete engine parameter (#14293) ([da2a794](https://github.com/bitnami/charts/commit/da2a7943bae95b6e9b5b4ed972c15e990b69fdb0)), closes [#14293](https://github.com/bitnami/charts/issues/14293) +* [bitnami/*] Change licenses annotation format (#14377) ([0ab7608](https://github.com/bitnami/charts/commit/0ab760862c660fcc78cffadf8e1d8cdd70881473)), closes [#14377](https://github.com/bitnami/charts/issues/14377) +* [bitnami/*] Unify READMEs (#14472) ([2064fb8](https://github.com/bitnami/charts/commit/2064fb8dcc78a845cdede8211af8c3cc52551161)), closes [#14472](https://github.com/bitnami/charts/issues/14472) +* [bitnami/postgresql] Add note about password issue when reinstalling helm chart (#14547) ([8b8c516](https://github.com/bitnami/charts/commit/8b8c516e42712eb976463de8f9cd7146626e98b2)), closes [#14547](https://github.com/bitnami/charts/issues/14547) + +## 12.1.9 (2023-01-11) + +* [bitnami/postgresql] Release 12.1.9 (#14277) ([84b7a8a](https://github.com/bitnami/charts/commit/84b7a8ac34400d05e30d79ff91083eed4253659f)), closes [#14277](https://github.com/bitnami/charts/issues/14277) + +## 12.1.8 (2023-01-09) + +* [bitnami/postgresql] update chart version for conflict (#14240) ([9356608](https://github.com/bitnami/charts/commit/9356608e6a8aaec9adcff551b5287b08c4649ee4)), closes [#14240](https://github.com/bitnami/charts/issues/14240) +* feat(postgresql): allow auth.database to be templated (#14166) ([0a70ca9](https://github.com/bitnami/charts/commit/0a70ca94a8e0542bcf0889bb145703898b1e3734)), closes [#14166](https://github.com/bitnami/charts/issues/14166) + +## 12.1.7 (2023-01-05) + +* [bitnami/postgresql] Release 12.1.7 (#14194) ([6524f2c](https://github.com/bitnami/charts/commit/6524f2c5701b93e3f918ef433d1608339ef8b8e7)), closes [#14194](https://github.com/bitnami/charts/issues/14194) + +## 12.1.6 (2022-12-20) + +* [bitnami/postgresql] Renamed statefulset custom-metrics name to match metrics-configmap (#13953) ([1601a1b](https://github.com/bitnami/charts/commit/1601a1b831d4c45dbc285ed86c4b83ff52fbeb1f)), closes [#13953](https://github.com/bitnami/charts/issues/13953) + +## 12.1.5 (2022-12-16) + +* [bitnami/postgresql] Release 12.1.5 (#13987) ([a74a2cb](https://github.com/bitnami/charts/commit/a74a2cbaaec2dab3e9fba43b76c380c19d7b7ffd)), closes [#13987](https://github.com/bitnami/charts/issues/13987) + +## 12.1.4 (2022-12-14) + +* [bitnami/postgresql] Release 12.1.4 (#13964) ([c053dea](https://github.com/bitnami/charts/commit/c053dea48990418b5f143390ff00c540d4d80ebc)), closes [#13964](https://github.com/bitnami/charts/issues/13964) + +## 12.1.3 (2022-12-01) + +* [bitnami/postgresql] Release 12.1.3 (#13795) ([a327cfa](https://github.com/bitnami/charts/commit/a327cfaa92137e8504ffc3ecdbcbda5cc98dc997)), closes [#13795](https://github.com/bitnami/charts/issues/13795) + +## 12.1.2 (2022-11-11) + +* [bitnami/postgresql] Release 12.1.2 (#13470) ([4f6fd65](https://github.com/bitnami/charts/commit/4f6fd65db07d81f7d70c7573c7989688ae38d574)), closes [#13470](https://github.com/bitnami/charts/issues/13470) + +## 12.1.1 (2022-11-09) + +* [bitnami/postgresql] Release 12.1.1 (#13447) ([1ddbe4a](https://github.com/bitnami/charts/commit/1ddbe4a678046139e3ab3e44dba5212d12328c60)), closes [#13447](https://github.com/bitnami/charts/issues/13447) +* Update OpenShift specifc security settings (#13265) ([4ca827c](https://github.com/bitnami/charts/commit/4ca827c18c9a523eb753e223dca8e8d4e74c5226)), closes [#13265](https://github.com/bitnami/charts/issues/13265) + +## 12.1.0 (2022-11-03) + +* [bitnami/postgresql] Annotations for headless service (#13269) ([a4f111f](https://github.com/bitnami/charts/commit/a4f111f8678ad45f06eaf40d4c4e0463504f2482)), closes [#13269](https://github.com/bitnami/charts/issues/13269) + +## 12.0.1 (2022-11-01) + +* [bitnami/*] Update upgrading notes of PostgreSQL and PostgreSQL HA (#13226) ([a5a7d0e](https://github.com/bitnami/charts/commit/a5a7d0eb7592bcae2b59e63b3f13b5f1c925b536)), closes [#13226](https://github.com/bitnami/charts/issues/13226) +* [bitnami/postgresql] Release 12.0.1 (#13281) ([d839514](https://github.com/bitnami/charts/commit/d839514d4ea3072a816097493e74cf583d40e3cb)), closes [#13281](https://github.com/bitnami/charts/issues/13281) + +## 12.0.0 (2022-10-27) + +* [bitnami/postgresql] Release 12.0.0 (#13203) ([cc87b46](https://github.com/bitnami/charts/commit/cc87b46ad00d7fe06804f8c748a04e60a76361a5)), closes [#13203](https://github.com/bitnami/charts/issues/13203) + +## 11.9.13 (2022-10-26) + +* [bitnami/postgresql] Release 11.9.13 (#13168) ([c607694](https://github.com/bitnami/charts/commit/c6076945ecc47791d82e545a20ef690dd93ff662)), closes [#13168](https://github.com/bitnami/charts/issues/13168) + +## 11.9.12 (2022-10-25) + +* [bitnami/postgresql] Release 11.9.12 (#13146) ([b92ee13](https://github.com/bitnami/charts/commit/b92ee1340ec84aca8e49311ea53dee44cf1c9563)), closes [#13146](https://github.com/bitnami/charts/issues/13146) + +## 11.9.11 (2022-10-18) + +* [bitnami/postgresql] Release 11.9.11 (#13010) ([9ac77f4](https://github.com/bitnami/charts/commit/9ac77f4a3268fc56fee5dba39a0b91078d579214)), closes [#13010](https://github.com/bitnami/charts/issues/13010) + +## 11.9.10 (2022-10-17) + +* [bitnami/postgresql] Release 11.9.10 (#12993) ([e52f958](https://github.com/bitnami/charts/commit/e52f9583a965b5639fa4c6820945a9076d188e40)), closes [#12993](https://github.com/bitnami/charts/issues/12993) + +## 11.9.9 (2022-10-17) + +* [bitnami/*] Use new default branch name in links (#12943) ([a529e02](https://github.com/bitnami/charts/commit/a529e02597d49d944eba1eb0f190713293247176)), closes [#12943](https://github.com/bitnami/charts/issues/12943) +* [bitnami/postgresql] Release 11.9.9 (#12991) ([d58c9d6](https://github.com/bitnami/charts/commit/d58c9d67299088ceddab2db510826003e16694fc)), closes [#12991](https://github.com/bitnami/charts/issues/12991) + +## 11.9.8 (2022-10-07) + +* [bitnami/postgresql] Release 11.9.8 (#12837) ([d3ec8fa](https://github.com/bitnami/charts/commit/d3ec8fa952007380c6001c526b027a8bb064cbab)), closes [#12837](https://github.com/bitnami/charts/issues/12837) + +## 11.9.7 (2022-10-05) + +* [bitnami/postgresql] Update maintainers (#12818) ([8de3271](https://github.com/bitnami/charts/commit/8de3271bad9d9b8869771a37bb5f0667de01d120)), closes [#12818](https://github.com/bitnami/charts/issues/12818) +* Generic README instructions related to the repo (#12792) ([3cf6b10](https://github.com/bitnami/charts/commit/3cf6b10e10e60df4b3e191d6b99aa99a9f597755)), closes [#12792](https://github.com/bitnami/charts/issues/12792) + +## 11.9.6 (2022-10-03) + +* [bitnami/postgresql] Use plain connections from metrics sidecar (#12735) ([e07416d](https://github.com/bitnami/charts/commit/e07416d9247437744f957e279c78d797c7e11ad4)), closes [#12735](https://github.com/bitnami/charts/issues/12735) + +## 11.9.5 (2022-09-30) + +* [bitnami/postgresql] Release 11.9.5 (#12763) ([42ecc41](https://github.com/bitnami/charts/commit/42ecc41ddbed1696c253642e0606d560bb6e64f1)), closes [#12763](https://github.com/bitnami/charts/issues/12763) + +## 11.9.4 (2022-09-30) + +* [bitnami/postgresql] Release 11.9.4 (#12744) ([1fe59b8](https://github.com/bitnami/charts/commit/1fe59b85a2e68d4254e24060cdbd5e82e66d32cf)), closes [#12744](https://github.com/bitnami/charts/issues/12744) + +## 11.9.3 (2022-09-28) + +* [bitnami/postgresql] Release 11.9.3 (#12720) ([340dd2a](https://github.com/bitnami/charts/commit/340dd2a2d4171cd2ba6980f870543dbc63bf75e6)), closes [#12720](https://github.com/bitnami/charts/issues/12720) + +## 11.9.2 (2022-09-28) + +* [bitnami/postgresql] Use custom probes if given (#12548) ([99ea23d](https://github.com/bitnami/charts/commit/99ea23d43bfe872aa05d682f492b23379c96425e)), closes [#12548](https://github.com/bitnami/charts/issues/12548) [#12354](https://github.com/bitnami/charts/issues/12354) + +## 11.9.1 (2022-09-15) + +* [bitnami/postgresql] Release 11.9.1 (#12435) ([376814f](https://github.com/bitnami/charts/commit/376814f47edf504b324eb67b1e561516cd8da0f2)), closes [#12435](https://github.com/bitnami/charts/issues/12435) + +## 11.9.0 (2022-09-13) + +* [bitnami/postgresql] Add labels to volume claim template (#12353) ([7745b21](https://github.com/bitnami/charts/commit/7745b21d3ff34c01c74b3ea46639393461705b79)), closes [#12353](https://github.com/bitnami/charts/issues/12353) + +## 11.8.2 (2022-09-13) + +* [bitnami/postgresql] Release 11.8.2 (#12395) ([7dbfe5d](https://github.com/bitnami/charts/commit/7dbfe5dcdae9142ecb3be70f8716ac03a0ac2128)), closes [#12395](https://github.com/bitnami/charts/issues/12395) + +## 11.8.1 (2022-08-23) + +* [bitnami/postgresql] Update Chart.lock (#12073) ([b96782b](https://github.com/bitnami/charts/commit/b96782b1aa6256549fbb86fb1e4cb4502654c751)), closes [#12073](https://github.com/bitnami/charts/issues/12073) + +## 11.8.0 (2022-08-22) + +* [bitnami/postgresql] Add support for image digest apart from tag (#11942) ([65a637d](https://github.com/bitnami/charts/commit/65a637dbd26060b4db861fc7093b61d06a29acac)), closes [#11942](https://github.com/bitnami/charts/issues/11942) + +## 11.7.6 (2022-08-21) + +* [bitnami/postgresql] Release 11.7.6 (#11964) ([7e27b34](https://github.com/bitnami/charts/commit/7e27b348ffacbf5a99ab7c0c9df868c0fa5b6d21)), closes [#11964](https://github.com/bitnami/charts/issues/11964) + +## 11.7.5 (2022-08-20) + +* [bitnami/postgresql] Release 11.7.5 (#11868) ([bf274f7](https://github.com/bitnami/charts/commit/bf274f7dc230d87f313813f4241af7b60a95c4db)), closes [#11868](https://github.com/bitnami/charts/issues/11868) + +## 11.7.4 (2022-08-19) + +* [bitnami/postgresql] Release 11.7.4 (#11860) ([c7d6cc7](https://github.com/bitnami/charts/commit/c7d6cc718ebe974c0e64a47cfb7fb097bee69940)), closes [#11860](https://github.com/bitnami/charts/issues/11860) + +## 11.7.3 (2022-08-17) + +* [bitnami/postgresql] Release 11.7.3 (#11816) ([a3d2ec6](https://github.com/bitnami/charts/commit/a3d2ec6f971332d0b2fa98c396006f14a5966e5a)), closes [#11816](https://github.com/bitnami/charts/issues/11816) + +## 11.7.2 (2022-08-16) + +* [bitnami/postgresql] Release 11.7.2 (#11789) ([d255e13](https://github.com/bitnami/charts/commit/d255e13c728cfa9bf7a73673a690586ebea57fd2)), closes [#11789](https://github.com/bitnami/charts/issues/11789) + +## 11.7.1 (2022-08-11) + +* [bitnami/postgresql] Release 11.7.1 (#11735) ([5149dea](https://github.com/bitnami/charts/commit/5149dea3ba38dfd4ab2876619933fb1a5cd23d51)), closes [#11735](https://github.com/bitnami/charts/issues/11735) + +## 11.7.0 (2022-08-11) + +* [bitnami/postgresql] Allow custom role name for postgresql (#11626) ([110c42e](https://github.com/bitnami/charts/commit/110c42e9c140ca405f2068b89e31a732ae47dda1)), closes [#11626](https://github.com/bitnami/charts/issues/11626) + +## 11.6.26 (2022-08-09) + +* [bitnami/postgresql] Release 11.6.26 (#11662) ([5759dab](https://github.com/bitnami/charts/commit/5759dab11fd3ccebc4d9d4b10c1c4093caf7d7ef)), closes [#11662](https://github.com/bitnami/charts/issues/11662) + +## 11.6.25 (2022-08-05) + +* [bitnami/postgresql] extended configuration for read replicas (#11458) ([58137be](https://github.com/bitnami/charts/commit/58137be37febb030a08ce2cefdef4e3f49858ff4)), closes [#11458](https://github.com/bitnami/charts/issues/11458) [#11450](https://github.com/bitnami/charts/issues/11450) +* [bitnami/postgresql] replication documentation (#11421) ([4955d1d](https://github.com/bitnami/charts/commit/4955d1da56b91a686c67b2569324d7ddf9a9e77a)), closes [#11421](https://github.com/bitnami/charts/issues/11421) [#11394](https://github.com/bitnami/charts/issues/11394) + +## 11.6.24 (2022-08-04) + +* [bitnami/postgresql] Release 11.6.24 (#11585) ([44c6dd3](https://github.com/bitnami/charts/commit/44c6dd3ecff1ace208b47ecb89cd52f8e6d33f9d)), closes [#11585](https://github.com/bitnami/charts/issues/11585) + +## 11.6.23 (2022-08-04) + +* [bitnami/postgresql] extended configuration for read PVC (#11460) ([651b581](https://github.com/bitnami/charts/commit/651b5813347e670b04fe500e34818c96be1185c9)), closes [#11460](https://github.com/bitnami/charts/issues/11460) [#11449](https://github.com/bitnami/charts/issues/11449) + +## 11.6.22 (2022-08-03) + +* [bitnami/postgresql] Release 11.6.22 (#11548) ([52540e9](https://github.com/bitnami/charts/commit/52540e9eae6d5d16fa65cdfa31b34f6825e3d24c)), closes [#11548](https://github.com/bitnami/charts/issues/11548) + +## 11.6.21 (2022-08-01) + +* [bitnami/postgresql] Release 11.6.21 (#11441) ([21cc5f9](https://github.com/bitnami/charts/commit/21cc5f9ab8127da23f271f085a2e8bd916c2cc0f)), closes [#11441](https://github.com/bitnami/charts/issues/11441) + +## 11.6.20 (2022-07-30) + +* [bitnami/*] Update URLs to point to the new bitnami/containers monorepo (#11352) ([d665af0](https://github.com/bitnami/charts/commit/d665af0c708846192d8d5fb2f5f9ea65dd464ab0)), closes [#11352](https://github.com/bitnami/charts/issues/11352) +* [bitnami/postgresql] Release 11.6.20 (#11437) ([6d9e5c2](https://github.com/bitnami/charts/commit/6d9e5c2eb9834cc7e2a9553ac6b9d9bdae7995bf)), closes [#11437](https://github.com/bitnami/charts/issues/11437) + +## 11.6.19 (2022-07-24) + +* [bitnami/postgresql] Release 11.6.19 (#11323) ([9efa515](https://github.com/bitnami/charts/commit/9efa5151d7da98090c85f4ec621771434666c871)), closes [#11323](https://github.com/bitnami/charts/issues/11323) + +## 11.6.18 (2022-07-20) + +* [bitnami/postgresql] Release 11.6.18 (#11283) ([cdb4962](https://github.com/bitnami/charts/commit/cdb4962ff93a28e3aabd5e3bdc560b6e17f6a675)), closes [#11283](https://github.com/bitnami/charts/issues/11283) + +## 11.6.17 (2022-07-19) + +* [bitnami/postgresql] Release 11.6.17 (#11236) ([6de5828](https://github.com/bitnami/charts/commit/6de5828bcf59e8521739ff60b297f1d35fe99199)), closes [#11236](https://github.com/bitnami/charts/issues/11236) + +## 11.6.16 (2022-07-12) + +* [bitnami/postgresql] Release 11.6.16 (#11155) ([73e661a](https://github.com/bitnami/charts/commit/73e661a405fc092911e9a5e0fa11e77b7543be4f)), closes [#11155](https://github.com/bitnami/charts/issues/11155) + +## 11.6.15 (2022-07-06) + +* [bitnami/postgresql] Release 11.6.15 (#11065) ([c4033c8](https://github.com/bitnami/charts/commit/c4033c89bf65b75d85a263ec1c3683faacbdafde)), closes [#11065](https://github.com/bitnami/charts/issues/11065) + +## 11.6.14 (2022-07-05) + +* Fix postgresql read servicemonitor scraping metrics on primary pod (#11018) ([7ba5148](https://github.com/bitnami/charts/commit/7ba5148c8d5d4eaf542fe5277d45fff1a79bdf9d)), closes [#11018](https://github.com/bitnami/charts/issues/11018) + +## 11.6.13 (2022-07-04) + +* [bitnami/postgresql] add warning regarding setting the password (#10881) ([69de31e](https://github.com/bitnami/charts/commit/69de31ea674f606eae0e9492582007a14e0e13f2)), closes [#10881](https://github.com/bitnami/charts/issues/10881) + +## 11.6.12 (2022-06-30) + +* [bitnami/postgresql] Release 11.6.12 (#10971) ([e8f47f9](https://github.com/bitnami/charts/commit/e8f47f9832e77687a61f6c46b17b88a82bacac86)), closes [#10971](https://github.com/bitnami/charts/issues/10971) + +## 11.6.11 (2022-06-29) + +* [bitnami/postgresql] Typo (#10924) ([d379a39](https://github.com/bitnami/charts/commit/d379a39e6f09ab0f33c50c88f9ccabcbb44eac5c)), closes [#10924](https://github.com/bitnami/charts/issues/10924) + +## 11.6.10 (2022-06-25) + +* [bitnami/postgresql] Release 11.6.10 updating components versions ([2e145c8](https://github.com/bitnami/charts/commit/2e145c871000c33bcfd1106d88b867c1af29b9db)) + +## 11.6.9 (2022-06-24) + +* [bitnami/postgresql] Release 11.6.9 updating components versions ([9ce3859](https://github.com/bitnami/charts/commit/9ce3859b127e7e69a18313cc83ac4e719af28d73)) + +## 11.6.8 (2022-06-22) + +* [bitnami/postgresql] fix postgresql.replicationPasswordKey secret key logic (#10794) ([97cfeb4](https://github.com/bitnami/charts/commit/97cfeb4ad05d6f5425b5b6fd5e3c9b1ee779ec48)), closes [#10794](https://github.com/bitnami/charts/issues/10794) + +## 11.6.7 (2022-06-17) + +* [bitnami/postgresql] Release 11.6.7 updating components versions ([1012be6](https://github.com/bitnami/charts/commit/1012be6183d3a09defdb31d4d85cbaafac590dbe)) + +## 11.6.6 (2022-06-10) + +* [bitnami/postgresql] Release 11.6.6 updating components versions ([37b811c](https://github.com/bitnami/charts/commit/37b811c75cd5ae9e451fed3846f878efb1af1646)) + +## 11.6.5 (2022-06-08) + +* [bitnami/*] Replace Kubeapps URL in READMEs (and kubeapps Chart.yaml) and remove BKPR references (#1 ([c6a7914](https://github.com/bitnami/charts/commit/c6a7914361e5aea6016fb45bf4d621edfd111d32)), closes [#10600](https://github.com/bitnami/charts/issues/10600) +* [bitnami/postgresql] Fix topologySpreadConstraints default values (#10640) ([85ff7f5](https://github.com/bitnami/charts/commit/85ff7f5062a12852ddeea2359d9f61e2f6da6afd)), closes [#10640](https://github.com/bitnami/charts/issues/10640) + +## 11.6.4 (2022-06-07) + +* [bitnami/postgresql] Release 11.6.4 updating components versions ([aa2e023](https://github.com/bitnami/charts/commit/aa2e02363c04babe0527821292d9d91e9c407e16)) + +## 11.6.3 (2022-06-04) + +* [bitnami/postgresql] Release 11.6.3 updating components versions ([540669f](https://github.com/bitnami/charts/commit/540669fa16b4be8a23cdec1d854f2433f92b920f)) + +## 11.6.2 (2022-06-02) + +* [bitnami/postgresql] Ldap postgresql (#10528) ([af0ded6](https://github.com/bitnami/charts/commit/af0ded6edf41291cff72314754cba4d3afdf2fc5)), closes [#10528](https://github.com/bitnami/charts/issues/10528) + +## 11.6.1 (2022-06-01) + +* [bitnami/several] Replace maintainers email by url (#10523) ([ff3cf61](https://github.com/bitnami/charts/commit/ff3cf617a1680509b0f3855d17c4ccff7b29a0ff)), closes [#10523](https://github.com/bitnami/charts/issues/10523) + +## 11.6.0 (2022-05-31) + +* [bitnami/postgresql] LDAP standardisation (#10464) ([4bfda62](https://github.com/bitnami/charts/commit/4bfda622ef6492894cb216510658b6576050a364)), closes [#10464](https://github.com/bitnami/charts/issues/10464) + +## 11.5.2 (2022-05-30) + +* [bitnami/several] Replace base64 --decode with base64 -d (#10495) ([099286a](https://github.com/bitnami/charts/commit/099286ae7a87784cf809df0b64ab24f7ff0144c8)), closes [#10495](https://github.com/bitnami/charts/issues/10495) + +## 11.5.1 (2022-05-30) + +* [bitnami/postgresql] Fix issue with upgrade to 11.3.0 (#10452) ([38ecf5a](https://github.com/bitnami/charts/commit/38ecf5af1205a33e3bda7573a8ed90fdb17cddd7)), closes [#10452](https://github.com/bitnami/charts/issues/10452) + +## 11.5.0 (2022-05-27) + +* [bitnami/postgresql] Fix LDAP settings (#10449) ([3f94d34](https://github.com/bitnami/charts/commit/3f94d3460efef8006e86a44f6a9b892fdc292f12)), closes [#10449](https://github.com/bitnami/charts/issues/10449) + +## 11.4.0 (2022-05-26) + +* [bitnami/postgresql] Add missing service parameter (#10434) ([dae498b](https://github.com/bitnami/charts/commit/dae498ba73f2b2eb52f6ffed7dc51e7a4d5c4388)), closes [#10434](https://github.com/bitnami/charts/issues/10434) + +## 11.3.0 (2022-05-26) + +* [bitnami/postgresql] Make existing secret key names choosable (#10347) ([2c207c0](https://github.com/bitnami/charts/commit/2c207c0587d4deb73743cbe8b13629a7144964b9)), closes [#10347](https://github.com/bitnami/charts/issues/10347) + +## 11.2.6 (2022-05-21) + +* [bitnami/postgresql] Release 11.2.6 updating components versions ([7ab2181](https://github.com/bitnami/charts/commit/7ab21813ec1e5253ab49751b0ff6371c069a721d)) + +## 11.2.5 (2022-05-20) + +* [bitnami/postgresql] Release 11.2.5 updating components versions ([fbdd2c9](https://github.com/bitnami/charts/commit/fbdd2c9eaa6877468569c6244b389f5ca7033ac2)) + +## 11.2.4 (2022-05-18) + +* [bitnami/postgresql] Release 11.2.4 updating components versions ([9ae8afb](https://github.com/bitnami/charts/commit/9ae8afb635b3daf610f7bcf5374d761d8e7210bc)) + +## 11.2.3 (2022-05-16) + +* [bitnami/postgresql] Release 11.2.3 updating components versions ([8a35afa](https://github.com/bitnami/charts/commit/8a35afaf2185cf6890a6aec1a0dcbd3abfee204c)) + +## 11.2.2 (2022-05-16) + +* [bitnami/postgresql] Fix path to entrypoint.sh (#10056) ([b92c842](https://github.com/bitnami/charts/commit/b92c842d9e616c630576fb7ac2ed065a0919a62e)), closes [#10056](https://github.com/bitnami/charts/issues/10056) +* Fix error 'Error: ConfigMap in version v1 cannot be handled as a ConfigMap' (#10222) ([905260a](https://github.com/bitnami/charts/commit/905260a6f76c7a12db4f75d4da474f21ec0a0e95)), closes [#10222](https://github.com/bitnami/charts/issues/10222) + +## 11.2.1 (2022-05-13) + +* [bitnami/postgresql] Release 11.2.1 updating components versions ([8b0d74c](https://github.com/bitnami/charts/commit/8b0d74c90503332e5767bcf2dcfc16600ef89197)) + +## 11.2.0 (2022-05-13) + +* [bitnami/postgresql] Add metrics support to read replica (#9881) ([50bcacc](https://github.com/bitnami/charts/commit/50bcacc7d5c1b68ef87280a3387ad5dfe1a40285)), closes [#9881](https://github.com/bitnami/charts/issues/9881) + +## 11.1.29 (2022-05-13) + +* [bitnami/*] Remove old 'ci' files (#10171) ([5df30c4](https://github.com/bitnami/charts/commit/5df30c44dbd1812da8786579ce4a94917d46a6ad)), closes [#10171](https://github.com/bitnami/charts/issues/10171) +* [bitnami/postgresql] Release 11.1.29 updating components versions ([b42600d](https://github.com/bitnami/charts/commit/b42600d139517314f4ad2c5db89b66f9b5689373)) + +## 11.1.28 (2022-05-05) + +* [bitnami/postgresql] Release 11.1.28 updating components versions ([b955e3c](https://github.com/bitnami/charts/commit/b955e3c51f97240eace588e35d05fe7f0b437d68)) + +## 11.1.27 (2022-05-04) + +* [bitnami/postgresql] Release 11.1.27 updating components versions ([4cab988](https://github.com/bitnami/charts/commit/4cab988496de59012efd6760a3c86a50f1128b84)) + +## 11.1.26 (2022-05-02) + +* [bitnami/postgresql] Release 11.1.26 updating components versions ([35bc32d](https://github.com/bitnami/charts/commit/35bc32d88866727a75da8fb31a7c3c46e1e0b091)) + +## 11.1.25 (2022-04-26) + +* [bitnami/postgresql] Remove unnecessary quotes (#9841) ([1d2fc06](https://github.com/bitnami/charts/commit/1d2fc06106847a8e102e0c1ffb2e15acc967eb34)), closes [#9841](https://github.com/bitnami/charts/issues/9841) + +## 11.1.24 (2022-04-24) + +* [bitnami/postgresql] Release 11.1.24 updating components versions ([2fb5f5a](https://github.com/bitnami/charts/commit/2fb5f5a336aa7f4b95733765fe9f21da1dae3e0d)) + +## 11.1.23 (2022-04-22) + +* [bitnami/postgresql] Release 11.1.23 updating components versions ([8d9c25b](https://github.com/bitnami/charts/commit/8d9c25b73354573238317934e9698719a1b1e04f)) + +## 11.1.22 (2022-04-20) + +* [bitnami/postgresql] Release 11.1.22 updating components versions ([7d36205](https://github.com/bitnami/charts/commit/7d3620537e8d9febce9bb90e2b5d148a24ef999a)) + +## 11.1.21 (2022-04-19) + +* [bitnami/postgresql] Release 11.1.21 updating components versions ([634995a](https://github.com/bitnami/charts/commit/634995ace9e20015ea89521716b7f0555204e31e)) +* [bitnami/postgresql] Update README with documentation of required keys for auth secrets (#9670) ([2ffbdff](https://github.com/bitnami/charts/commit/2ffbdfffc8a09af43ddc4be3742e10b7df8719d9)), closes [#9670](https://github.com/bitnami/charts/issues/9670) + +## 11.1.20 (2022-04-16) + +* [bitnami/postgresql] Release 11.1.20 updating components versions ([f98daf3](https://github.com/bitnami/charts/commit/f98daf31566ae0feaedc02b433866645bff6ecf3)) + +## 11.1.19 (2022-04-07) + +* [bitnami/postgresql] Release 11.1.19 updating components versions ([ea7531a](https://github.com/bitnami/charts/commit/ea7531a64417d23c036f46ac14815fd3f7b13b08)) + +## 11.1.18 (2022-04-07) + +* [bitnami/postgresql] Add quote to namespace (#9691) ([515833f](https://github.com/bitnami/charts/commit/515833f739792e8cb32429f1e745cc824ac2d2a5)), closes [#9691](https://github.com/bitnami/charts/issues/9691) + +## 11.1.17 (2022-04-06) + +* [bitnami/postgresql] Release 11.1.17 updating components versions ([b933e90](https://github.com/bitnami/charts/commit/b933e9096cd8b9f7308365ee5c5cda32dc16febc)) + +## 11.1.16 (2022-04-05) + +* [bitnami/postgresql] Release 11.1.16 updating components versions ([b091550](https://github.com/bitnami/charts/commit/b0915507f92181ff47461b9fdf4fb09b2e2bc8db)) + +## 11.1.15 (2022-04-03) + +* [bitnami/postgresql] Release 11.1.15 updating components versions ([a1c6668](https://github.com/bitnami/charts/commit/a1c6668feb628ee2ca711dbf3a6c3e762953d184)) + +## 11.1.14 (2022-04-02) + +* [bitnami/postgresql] Release 11.1.14 updating components versions ([6a32408](https://github.com/bitnami/charts/commit/6a324084ddd16dcca4abcb41b1e88ab668b71360)) + +## 11.1.13 (2022-04-01) + +* Add missing quote in postgresql RBAC Role manifest (#9651) ([b87abf3](https://github.com/bitnami/charts/commit/b87abf31902fd1d47fbfec8f529628c28f7a33ca)), closes [#9651](https://github.com/bitnami/charts/issues/9651) + +## 11.1.12 (2022-03-28) + +* [bitnami/postgresql] Release 11.1.12 updating components versions ([44c70b3](https://github.com/bitnami/charts/commit/44c70b3f63b0245f898a8e0a47ba80d844ae6844)) + +## 11.1.11 (2022-03-27) + +* [bitnami/postgresql] Release 11.1.11 updating components versions ([f288cf2](https://github.com/bitnami/charts/commit/f288cf20f54457caff538bf8471e8b91d0f0ecc8)) + +## 11.1.10 (2022-03-26) + +* [bitnami/postgresql] Release 11.1.10 updating components versions ([077c6b3](https://github.com/bitnami/charts/commit/077c6b3ff633a5312042865aad46df8675a7f3fd)) + +## 11.1.9 (2022-03-18) + +* [bitnami/postgresql] Quote POSTGRESQL_INITSCRIPTS_PASSWORD (#9453) ([dcc33b4](https://github.com/bitnami/charts/commit/dcc33b44504923e31ddc37ad63416b37fb42be89)), closes [#9453](https://github.com/bitnami/charts/issues/9453) [#9445](https://github.com/bitnami/charts/issues/9445) + +## 11.1.8 (2022-03-16) + +* [bitnami/postgresql] Release 11.1.8 updating components versions ([bcfe8d0](https://github.com/bitnami/charts/commit/bcfe8d0ddcbf5ce68a0970937636fded5558076d)) + +## 11.1.7 (2022-03-14) + +* [bitnami/postgresql] Release 11.1.7 updating components versions ([027d9a0](https://github.com/bitnami/charts/commit/027d9a0d9dabc3d81606c75ab33682128a677614)) + +## 11.1.6 (2022-03-10) + +* fix missing namespace in network policies (#9369) ([d7fb427](https://github.com/bitnami/charts/commit/d7fb42751ab1a8d297151615d65b52c1d0435bb6)), closes [#9369](https://github.com/bitnami/charts/issues/9369) + +## 11.1.5 (2022-03-09) + +* [bitnami/postgresql] Release 11.1.5 updating components versions ([2e9e8bb](https://github.com/bitnami/charts/commit/2e9e8bb0651ec21975c8485c4e4bc74f356fee68)) + +## 11.1.4 (2022-03-06) + +* [bitnami/postgresql] Release 11.1.4 updating components versions ([8d9ca8b](https://github.com/bitnami/charts/commit/8d9ca8b28ed6bfa720ac67046b0fa919ecb2f6c9)) + +## 11.1.3 (2022-02-27) + +* [bitnami/postgresql] Release 11.1.3 updating components versions ([63264c9](https://github.com/bitnami/charts/commit/63264c97c4f9ae4f4628a5f3fb6078b225460731)) + +## 11.1.2 (2022-02-26) + +* [bitnami/postgresql] docs: :memo: Add note about using the container entrypoint (#9160) ([f547c0a](https://github.com/bitnami/charts/commit/f547c0a0394cd4fe64669eeb154b8ea9987bd394)), closes [#9160](https://github.com/bitnami/charts/issues/9160) +* [bitnami/postgresql] Release 11.1.2 updating components versions ([61501b4](https://github.com/bitnami/charts/commit/61501b4ecfd97ce7e7e40e82aeb2f4c7608b9ee8)) + +## 11.1.1 (2022-02-22) + +* [bitnami/postgresql] Release 11.1.1 updating components versions ([60388c2](https://github.com/bitnami/charts/commit/60388c2b2b8c15459d0437facb7b8b61d66468ab)) + +## 11.1.0 (2022-02-22) + +* Add hostIPC option for PostgreSQL StatefulSets (#9148) ([2f7d7dc](https://github.com/bitnami/charts/commit/2f7d7dce791fc810149d1bffb9fab66408d31a00)), closes [#9148](https://github.com/bitnami/charts/issues/9148) + +## 11.0.8 (2022-02-21) + +* [bitnami/postgresql] Add flag '-r' to xargs in volumePermissions init-container (#9137) ([49fcd78](https://github.com/bitnami/charts/commit/49fcd78c73f1723122a508c696983a6985129f28)), closes [#9137](https://github.com/bitnami/charts/issues/9137) +* Add hostNetwork option for PostgreSQL StatefulSets (#9064) ([a71f525](https://github.com/bitnami/charts/commit/a71f52577ec75aa76639317b9948915d7be0c7b5)), closes [#9064](https://github.com/bitnami/charts/issues/9064) + +## 11.0.7 (2022-02-21) + +* Fix Typo in README (#9031) ([b0c3bfd](https://github.com/bitnami/charts/commit/b0c3bfdf2ecd2ea00a43e7bbae649bdceed6a457)), closes [#9031](https://github.com/bitnami/charts/issues/9031) + +## 11.0.6 (2022-02-17) + +* [bitnami/postgresql] fix init-chmod-data resources value rendering (#9053) ([1b4eac8](https://github.com/bitnami/charts/commit/1b4eac8d71a917cb0016079a0760b52dc81fea3e)), closes [#9053](https://github.com/bitnami/charts/issues/9053) + +## 11.0.5 (2022-02-17) + +* [bitnami/postgresql] Allow enabling TLS without volume-permissions (#9016) ([6cb95db](https://github.com/bitnami/charts/commit/6cb95dbe1632086be534df37d0ed707108921007)), closes [#9016](https://github.com/bitnami/charts/issues/9016) + +## 11.0.4 (2022-02-14) + +* [bitnami/postgresql] Fix init scripts cm reference (#9000) ([6fd13e2](https://github.com/bitnami/charts/commit/6fd13e208b3d89006fe53b9d6a0199cce3bacff6)), closes [#9000](https://github.com/bitnami/charts/issues/9000) + +## 11.0.3 (2022-02-11) + +* Non utf8 chars (#8923) ([6ffd18f](https://github.com/bitnami/charts/commit/6ffd18fbbdf10e94ea1a90cf5b84ef610ac2a72d)), closes [#8923](https://github.com/bitnami/charts/issues/8923) +* Postgresql .Values.global.postgresql.auth.username should overwrite .Values.auth.username, (#8966) ([c75fef7](https://github.com/bitnami/charts/commit/c75fef792fbf53799c74094db0ae1f14f05bb6c7)), closes [#8966](https://github.com/bitnami/charts/issues/8966) + +## 11.0.2 (2022-02-04) + +* [bitnami/postgresql] Fix PostgreSLQ password in metrics container (#8901) ([86646ba](https://github.com/bitnami/charts/commit/86646ba72950ce27a37f279af86181e27ebb1602)), closes [#8901](https://github.com/bitnami/charts/issues/8901) + +## 11.0.1 (2022-02-03) + +* [bitnami/postgresql] Fix "postgresql.primary.extendedConfigmapName" named template (#8885) ([8dc8906](https://github.com/bitnami/charts/commit/8dc89066cfa0c09dd3c40d9c1d04af6935290e71)), closes [#8885](https://github.com/bitnami/charts/issues/8885) +* Fix typo in values.yaml ([7e84425](https://github.com/bitnami/charts/commit/7e844257efb97c38342b0609a1dfa22e4b425681)) + +## 11.0.0 (2022-02-02) + +* [bitnami/postgresql] Chart standardization (#8827) ([50946fd](https://github.com/bitnami/charts/commit/50946fdff3d90522d0b87012f8b9bb73c4b6f12c)), closes [#8827](https://github.com/bitnami/charts/issues/8827) + +## 10.16.3 (2022-02-02) + +* [bitnami/postgresql] Release 10.16.3 updating components versions ([2710bae](https://github.com/bitnami/charts/commit/2710baea1eb548209e9f97627f632987be5f5daf)) + +## 10.16.2 (2022-01-20) + +* [bitnami/*] Readme automation (#8579) ([78d1938](https://github.com/bitnami/charts/commit/78d193831c900d178198491ffd08fa2217a64ecd)), closes [#8579](https://github.com/bitnami/charts/issues/8579) +* [bitnami/*] Update READMEs (#8716) ([b9a9533](https://github.com/bitnami/charts/commit/b9a953337590eb2979453385874a267bacf50936)), closes [#8716](https://github.com/bitnami/charts/issues/8716) +* [bitnami/several] Change prerequisites (#8725) ([8d740c5](https://github.com/bitnami/charts/commit/8d740c566cfdb7e2d933c40128b4e919fce953a5)), closes [#8725](https://github.com/bitnami/charts/issues/8725) + +## 10.16.1 (2022-01-12) + +* [bitnami/postgresql]: Fix typo (#8632) ([c7ad959](https://github.com/bitnami/charts/commit/c7ad959e30d5408d6bffb1f7d910fcf9ad7bbf5c)), closes [#8632](https://github.com/bitnami/charts/issues/8632) + +## 10.16.0 (2022-01-11) + +* [bitnami/postgresql]: add snapshot recovery (#8618) ([e73f9a7](https://github.com/bitnami/charts/commit/e73f9a7fecd24cf1a3e729ae08dc84bf45a1c1b8)), closes [#8618](https://github.com/bitnami/charts/issues/8618) + +## 10.15.2 (2022-01-11) + +* [bitnami/postgresql] Release 10.15.2 updating components versions ([f5c23f6](https://github.com/bitnami/charts/commit/f5c23f6a5379f3e3932c8cdc2c93a73505b41bc9)) +* [bitnami/postgresql]: fix unique services template render (#8581) ([66f657d](https://github.com/bitnami/charts/commit/66f657dc3b707183265411e0014c823c7bd29a6a)), closes [#8581](https://github.com/bitnami/charts/issues/8581) + +## 10.15.1 (2022-01-06) + +* [bitnami/postgresql] Release 10.15.1 updating components versions ([2efb970](https://github.com/bitnami/charts/commit/2efb970db54f5beb2c3b7872b2a8120823bb94d8)) + +## 10.15.0 (2022-01-05) + +* [bitnami/several] Adapt templating format (#8562) ([8cad18a](https://github.com/bitnami/charts/commit/8cad18aed9966a6f0208e5ad6cee46cb217f47ab)), closes [#8562](https://github.com/bitnami/charts/issues/8562) + +## 10.14.4 (2022-01-04) + +* [bitnami/postgresql] Release 10.14.4 updating components versions ([ad7ac95](https://github.com/bitnami/charts/commit/ad7ac9598a7530aef274eafbd0e6215a8035d8bb)) + +## 10.14.3 (2022-01-04) + +* [bitnami/postgresql] Release 10.14.3 updating components versions ([9f7ac81](https://github.com/bitnami/charts/commit/9f7ac81da075932c057a406970154f73bbdd33cd)) +* [bitnami/several] Add license to the README ([05f7633](https://github.com/bitnami/charts/commit/05f763372501d596e57db713dd53ff4ff3027cc4)) +* [bitnami/several] Add license to the README ([32fb238](https://github.com/bitnami/charts/commit/32fb238e60a0affc6debd3142eaa3c3d9089ec2a)) +* [bitnami/several] Add license to the README ([b87c2f7](https://github.com/bitnami/charts/commit/b87c2f7899d48a8b02c506765e6ae82937e9ba3f)) + +## 10.14.2 (2021-12-31) + +* [bitnami/postgresql] Release 10.14.2 updating components versions ([4b05bb5](https://github.com/bitnami/charts/commit/4b05bb59f3f3bbd3d43cf24fee30669a1e839633)) + +## 10.14.1 (2021-12-31) + +* remove password empty validation (#8534) ([a6a4cd1](https://github.com/bitnami/charts/commit/a6a4cd17acc32cb27ba562b0b6da273e33e454db)), closes [#8534](https://github.com/bitnami/charts/issues/8534) + +## 10.14.0 (2021-12-28) + +* [bitnami/postgresql] feat: :sparkles: Allow separate container port and service port (#8506) ([9d6fbea](https://github.com/bitnami/charts/commit/9d6fbea190ce1e49a9f846485f73ca8f533d4a1e)), closes [#8506](https://github.com/bitnami/charts/issues/8506) + +## 10.13.15 (2021-12-22) + +* [bitnami/postgresql] lookup existing secrets before generating random secrets (#8320) ([00fbcf1](https://github.com/bitnami/charts/commit/00fbcf147124654d452de42235ac407830903f7e)), closes [#8320](https://github.com/bitnami/charts/issues/8320) + +## 10.13.14 (2021-12-10) + +* Render template values inside initDbScripts (#8368) ([73ae007](https://github.com/bitnami/charts/commit/73ae0077e72ed97fb3cb2d56a70cf79d3246d840)), closes [#8368](https://github.com/bitnami/charts/issues/8368) + +## 10.13.13 (2021-12-10) + +* [bitnami/postgresql] Add template render for extraVolumeMounts (#8355) ([b547831](https://github.com/bitnami/charts/commit/b547831b784a0ad6eff71113381eadcb3e3feada)), closes [#8355](https://github.com/bitnami/charts/issues/8355) + +## 10.13.12 (2021-12-09) + +* [bitnami/cassandra,etcd,influxdb,metallb,mysql,postgresql,postgresql-ha,redis] Align networkpolicy ([0404b1a](https://github.com/bitnami/charts/commit/0404b1aa52a4514eee06143a7ce85307f16af6d3)), closes [#8336](https://github.com/bitnami/charts/issues/8336) + +## 10.13.11 (2021-12-02) + +* [bitnami/*] Fix parameters for schema generation (#8297) ([d7d52ac](https://github.com/bitnami/charts/commit/d7d52acdbd1b0629e4e5295652fa6f5830daf2af)), closes [#8297](https://github.com/bitnami/charts/issues/8297) +* [bitnami/several] Regenerate README tables ([a7b2fde](https://github.com/bitnami/charts/commit/a7b2fde18677dc56ba5f88947d1356df448fb929)) + +## 10.13.10 (2021-11-30) + +* [bitnami/postgresql] Release 10.13.10 updating components versions ([197a5ba](https://github.com/bitnami/charts/commit/197a5ba6c8a24e3e55442fdeb2b0015820567887)) + +## 10.13.9 (2021-11-29) + +* [bitnami/several] Regenerate README tables ([e6f742c](https://github.com/bitnami/charts/commit/e6f742cb88c330952cb52da038db61537ec921e5)) +* [bitnami/several] Replace HTTP by HTTPS when possible (#8259) ([eafb5bd](https://github.com/bitnami/charts/commit/eafb5bd5a2cc3aaf04fc1e8ebedd73f420d76864)), closes [#8259](https://github.com/bitnami/charts/issues/8259) + +## 10.13.8 (2021-11-11) + +* [bitnami/postgresql] Release 10.13.8 updating components versions ([e732946](https://github.com/bitnami/charts/commit/e732946e9eb36b559a34b0e743b00428f787efa4)) +* [bitnami/several] Regenerate README tables ([14b89ea](https://github.com/bitnami/charts/commit/14b89eadad5eaf515b99c0392eb9461fff50f4a1)) + +## 10.13.7 (2021-11-09) + +* [bitnami/postgresql] Release 10.13.7 updating components versions ([2e175bd](https://github.com/bitnami/charts/commit/2e175bdba278bf66cc6289775bf99f1c0cbe5fd9)) +* [bitnami/several] Regenerate README tables ([94d0553](https://github.com/bitnami/charts/commit/94d0553d3c1bc1b75dfeba75860f9a89af08e1c3)) + +## 10.13.6 (2021-11-09) + +* [bitnami/postgresql] Release 10.13.6 updating components versions ([eec1fd2](https://github.com/bitnami/charts/commit/eec1fd278735575a08cec46b3d6e413600ee698a)) +* [bitnami/several] Regenerate README tables ([ef52074](https://github.com/bitnami/charts/commit/ef52074d5f3dd00218322cd201f83ee55f9dd1e6)) + +## 10.13.5 (2021-11-06) + +* [bitnami/postgresql] Release 10.13.5 updating components versions ([1829119](https://github.com/bitnami/charts/commit/1829119eceba799634b1a8fdf8ff1d204aeec6ac)) +* [bitnami/several] Regenerate README tables ([3cefed3](https://github.com/bitnami/charts/commit/3cefed3ef961fbd7596242b1165bcfa229a9cadb)) + +## 10.13.4 (2021-11-01) + +* [bitnami/postgresql] Release 10.13.4 updating components versions ([43ecac9](https://github.com/bitnami/charts/commit/43ecac9bd6181c9660dbc46d64ae4b29e1fd3fd3)) + +## 10.13.3 (2021-11-01) + +* [bitnami/postgresql] Release 10.13.3 updating components versions ([bae6820](https://github.com/bitnami/charts/commit/bae6820f1a8f66db0d4b3db41f9780d2559b5ef5)) + +## 10.13.2 (2021-10-30) + +* [bitnami/postgresql] Release 10.13.2 updating components versions ([dc5ec05](https://github.com/bitnami/charts/commit/dc5ec0562060f78a4235cacb0cc6a4836176cc1b)) + +## 10.13.1 (2021-10-29) + +* [bitnami/postgresql] Release 10.13.1 updating components versions ([b6fd8cd](https://github.com/bitnami/charts/commit/b6fd8cdd69feba13f6ab597a77ede336c71d0c6e)) + +## 10.13.0 (2021-10-28) + +* [bitnami/postgresql] add common labels (#7952) ([e2404c6](https://github.com/bitnami/charts/commit/e2404c63cc5e72d5dee91e50b4597fd9e0b1ab0c)), closes [#7952](https://github.com/bitnami/charts/issues/7952) + +## 10.12.9 (2021-10-28) + +* [bitnami/*] Mark PodSecurityPolicy resources as deprecated (#7951) ([035d926](https://github.com/bitnami/charts/commit/035d926d45526472dbf703ea285ebf491c442c8e)), closes [#7951](https://github.com/bitnami/charts/issues/7951) +* [bitnami/postgresql] Add template render for labels on primary and readreplicas (#7908) ([9a5a9f3](https://github.com/bitnami/charts/commit/9a5a9f3e1cbdf3dbe8579bd646f064dd13bca683)), closes [#7908](https://github.com/bitnami/charts/issues/7908) +* [bitnami/several] Regenerate README tables ([412cf6a](https://github.com/bitnami/charts/commit/412cf6a513cb0c03444a6e7811c6f27193239a10)) + +## 10.12.8 (2021-10-26) + +* [bitnami/postgresql] Release 10.12.8 updating components versions ([e2ce1a5](https://github.com/bitnami/charts/commit/e2ce1a5dde81b95aec31b4064ccc157a6317a53e)) + +## 10.12.7 (2021-10-22) + +* [bitnami/several] Add chart info to NOTES.txt (#7889) ([a6751cd](https://github.com/bitnami/charts/commit/a6751cdd33c461fabbc459fbea6f219ec64ab6b2)), closes [#7889](https://github.com/bitnami/charts/issues/7889) +* [bitnami/several] Regenerate README tables ([73cabea](https://github.com/bitnami/charts/commit/73cabea54a941d2239accd98e8df6cbfc9fa8d3c)) + +## 10.12.6 (2021-10-21) + +* [bitnami/postgresql] Release 10.12.6 updating components versions ([0c8b19d](https://github.com/bitnami/charts/commit/0c8b19d37f77555672d689fc661cb6a6a869b33c)) + +## 10.12.5 (2021-10-19) + +* [bitnami/several] Change pullPolicy for bitnami-shell image (#7852) ([9711a33](https://github.com/bitnami/charts/commit/9711a33c6eec72ea79143c4b7574dbe6a148d6b2)), closes [#7852](https://github.com/bitnami/charts/issues/7852) +* [bitnami/several] Regenerate README tables ([dd25873](https://github.com/bitnami/charts/commit/dd2587368d006bcca6149be74d846752a15344b9)) + +## 10.12.4 (2021-10-13) + +* [bitnami/postgresql] Release 10.12.4 updating components versions ([b30ed79](https://github.com/bitnami/charts/commit/b30ed79c67750b9d74de1fcb30ba0b51508d5035)) +* [bitnami/several] Regenerate README tables ([194a909](https://github.com/bitnami/charts/commit/194a909268377a6820d91f788c0380f427637ce6)) + +## 10.12.3 (2021-10-11) + +* [bitnami/postgresql] Release 10.12.3 updating components versions ([7671c64](https://github.com/bitnami/charts/commit/7671c64ad9e7553b5ec8ce5383e0d2c153e2692d)) + +## 10.12.2 (2021-10-05) + +* [bitnami/*] Revert changes in values.schemas.json (#7699) ([aaa314f](https://github.com/bitnami/charts/commit/aaa314fd3a7b8c7c94dc51fc96292b283cad084a)), closes [#7699](https://github.com/bitnami/charts/issues/7699) + +## 10.12.1 (2021-10-05) + +* [bitnami/postgresql] Fix README format (#7698) ([76ceb2c](https://github.com/bitnami/charts/commit/76ceb2c61edd1ba8f6531f8470a5a6ef5763b952)), closes [#7698](https://github.com/bitnami/charts/issues/7698) + +## 10.12.0 (2021-09-29) + +* [bitnami/apache,tomcat] add extraPodSpec (#7580) ([e3a8529](https://github.com/bitnami/charts/commit/e3a8529be0fb7b3269e0105f2571d3b850891aa5)), closes [#7580](https://github.com/bitnami/charts/issues/7580) + +## 10.11.0 (2021-09-27) + +* [bitnami/apache,postgresql,tomcat] add topologySpreadConstraints (#7598) ([557bfe9](https://github.com/bitnami/charts/commit/557bfe931aedaa14944c1a7805f76f83683ad448)), closes [#7598](https://github.com/bitnami/charts/issues/7598) + +## 10.10.3 (2021-09-24) + +* [bitnami/*] Generate READMEs with new generator version (#7614) ([e5ab2e6](https://github.com/bitnami/charts/commit/e5ab2e6ecdd6bce800863f154cda524ff9f6c117)), closes [#7614](https://github.com/bitnami/charts/issues/7614) +* [bitnami/postgresql, zookeeper] Modify extravolumes and integrate sidecars (#7555) ([c4c4082](https://github.com/bitnami/charts/commit/c4c408257cfad5bdfb394cb97d86ca23b02c04ec)), closes [#7555](https://github.com/bitnami/charts/issues/7555) +* [bitnami/several] Regenerate README tables ([79eac44](https://github.com/bitnami/charts/commit/79eac4490bf5d0abe582920d9662a892c9666870)) + +## 10.10.2 (2021-09-22) + +* [bitnami/postgresql] Release 10.10.2 updating components versions ([edba74c](https://github.com/bitnami/charts/commit/edba74c8eea45afef180aa513d220880d7646229)) +* [bitnami/several] Regenerate README tables ([003a0fb](https://github.com/bitnami/charts/commit/003a0fbaedeb775c546b8d8452b7a5ab0a63af52)) + +## 10.10.1 (2021-09-16) + +* Fix linting issue from PR7490 (#7506) ([ede16d7](https://github.com/bitnami/charts/commit/ede16d7ad0f6a797027eba3e2bf8a33e243c7451)), closes [#7506](https://github.com/bitnami/charts/issues/7506) + +## 10.10.0 (2021-09-16) + +* [bitnami/postgresql] add `externalTrafficPolicy` to service type `LoadBalancer` (#7490) ([553182e](https://github.com/bitnami/charts/commit/553182ee27e2a3c8eb20b1ebd641746ba1b4718f)), closes [#7490](https://github.com/bitnami/charts/issues/7490) + +## 10.9.6 (2021-09-15) + +* [bitnami/postgresql] Release 10.9.6 updating components versions ([c8142cd](https://github.com/bitnami/charts/commit/c8142cdfe0c2ff82344560572c69c894b51877ec)) +* [bitnami/several] Regenerate README tables ([c01cbe5](https://github.com/bitnami/charts/commit/c01cbe5e3bfe8a5f8545107f9c8d99a58d0e6832)) + +## 10.9.5 (2021-09-07) + +* [bitnami/postgresql] Release 10.9.5 updating components versions ([94b8fdc](https://github.com/bitnami/charts/commit/94b8fdceddb2eb89e7321c650b67bcb7e44bf31e)) +* [bitnami/several] Regenerate README tables ([da2513b](https://github.com/bitnami/charts/commit/da2513bf0a33819f3b1151d387c631a9ffdb03e2)) + +## 10.9.4 (2021-08-25) + +* [bitnami/postgresql] Release 10.9.4 updating components versions ([7cbc202](https://github.com/bitnami/charts/commit/7cbc202ea0e6be502fc3694aa9877c0ae5acef69)) +* [bitnami/several] Regenerate README tables ([6c9124f](https://github.com/bitnami/charts/commit/6c9124f79491aa65f53a87c1ed598b47ffa8b411)) + +## 10.9.3 (2021-08-18) + +* [multiple] Updated image.tag section (#7257) ([a133bed](https://github.com/bitnami/charts/commit/a133bed2b4524e3b0cdec19413e089e4fbb12013)), closes [#7257](https://github.com/bitnami/charts/issues/7257) + +## 10.9.2 (2021-08-12) + +* [bitnami/postgresql] Release 10.9.2 updating components versions ([c0cf478](https://github.com/bitnami/charts/commit/c0cf4780b0c7105bcc434cf8434c37f46aa79368)) +* [bitnami/several] Regenerate README tables ([6c107e8](https://github.com/bitnami/charts/commit/6c107e835d6caf8db2e8b17dcd48c5971637e013)) + +## 10.9.1 (2021-08-04) + +* [bitnami/postgresql] Release 10.9.1 updating components versions ([95fa5ae](https://github.com/bitnami/charts/commit/95fa5aecd4b9563ceffb4e360ff9ac317f7b3957)) + +## 10.9.0 (2021-08-02) + +* [bitnami/postgresql] Add relabelings / metricRelabelings to ServiceMonitor (#7082) ([481cc7e](https://github.com/bitnami/charts/commit/481cc7edf7b3f1fe9f1c6ccd8c83ee38fe72423a)), closes [#7082](https://github.com/bitnami/charts/issues/7082) +* [bitnami/several] Add diagnostic mode (#7012) ([f1344b0](https://github.com/bitnami/charts/commit/f1344b0361c5a93bf971d08f0fc64d3c8588cbf9)), closes [#7012](https://github.com/bitnami/charts/issues/7012) +* [bitnami/several] Upadte READMEs ([eb3c291](https://github.com/bitnami/charts/commit/eb3c2916be233280f2226d9cdceb57b08ab4a23b)) + +## 10.8.0 (2021-07-27) + +* [bitnami/postgresql] Add lifecycleHooks value to the postgresql chart (#7055) ([e631584](https://github.com/bitnami/charts/commit/e631584fe4bdb86682c758055935ff54960ea362)), closes [#7055](https://github.com/bitnami/charts/issues/7055) + +## 10.7.1 (2021-07-23) + +* [bitnami/postgresql] Change postgresqlExtendedConf default value from string to object (#7038) ([c55ff60](https://github.com/bitnami/charts/commit/c55ff60edaa98c170afa3c4d13cf766c42b4b27f)), closes [#7038](https://github.com/bitnami/charts/issues/7038) + +## 10.7.0 (2021-07-21) + +* [bitnami/postgresql] Add option to create services for each read replica (#6990) ([3d76ba7](https://github.com/bitnami/charts/commit/3d76ba751a693961a1054ffcecfa1ebe24e63927)), closes [#6990](https://github.com/bitnami/charts/issues/6990) [bitnami/charts#6954](https://github.com/bitnami/charts/issues/6954) + +## 10.6.1 (2021-07-20) + +* [bitnami/several] Fix default values and regenerate README (II) (#6994) ([d095793](https://github.com/bitnami/charts/commit/d0957937c764187307b924f600247c2b7afaf536)), closes [#6994](https://github.com/bitnami/charts/issues/6994) + +## 10.6.0 (2021-07-19) + +* [bitnami/postgresql] disable automounting of service account token (#6967) ([3a60437](https://github.com/bitnami/charts/commit/3a6043706e2a2bf0cd4101aac2b84392a221a910)), closes [#6967](https://github.com/bitnami/charts/issues/6967) + +## 10.5.3 (2021-07-14) + +* [bitnami/*] Adapt values.yaml of phpMyAdmin, PostgreSQL and PostgreSQL HA charts (#6933) ([49f0bed](https://github.com/bitnami/charts/commit/49f0bed317d6ed15dd2115327d74565ec6344b87)), closes [#6933](https://github.com/bitnami/charts/issues/6933) + +## 10.5.2 (2021-07-06) + +* [bitnami/postgresql] Release 10.5.2 updating components versions ([d7e126c](https://github.com/bitnami/charts/commit/d7e126c4531a880a1cbc69e408c02ef5774ed127)) + +## 10.5.1 (2021-06-29) + +* [bitnami/postgresql] Release 10.5.1 updating components versions ([859c5bf](https://github.com/bitnami/charts/commit/859c5bfbf1895d13604b12af9bd31f1190316b95)) + +## 10.5.0 (2021-06-14) + +* [bitnami/postgresql] Add support for autogenerated certs (#6609) ([112db1c](https://github.com/bitnami/charts/commit/112db1c509fcd74623fd8f25c61c660a5918564d)), closes [#6609](https://github.com/bitnami/charts/issues/6609) + +## 10.4.10 (2021-06-09) + +* [bitnami/postgresql] Release 10.4.10 updating components versions ([8671e25](https://github.com/bitnami/charts/commit/8671e25bde8a63aa8b940fa582a1d8bc7fc0a69c)) + +## 10.4.9 (2021-06-03) + +* [bitnami/postgresql] Release 10.4.9 updating components versions ([36ab336](https://github.com/bitnami/charts/commit/36ab336cfd41c5c9e240c9b0d4a762e805dacdbf)) + +## 10.4.8 (2021-05-27) + +* [bitnami/postgresql] Release 10.4.8 updating components versions ([bd13ba8](https://github.com/bitnami/charts/commit/bd13ba8ae4be246afe91fe20271fc870309cbd39)) + +## 10.4.7 (2021-05-25) + +* [bitnami/postgresql] Release 10.4.7 updating components versions ([86aeb2c](https://github.com/bitnami/charts/commit/86aeb2c8991b3d38d01ec8463c15d44140ba48d2)) + +## 10.4.6 (2021-05-19) + +* [bitnami/postgresql] Release 10.4.6 updating components versions ([14c777e](https://github.com/bitnami/charts/commit/14c777ec1cb990b73236584fb81f502fc6e7fc11)) + +## 10.4.5 (2021-05-14) + +* [bitnami/postgresql] Release 10.4.5 updating components versions ([091d4c9](https://github.com/bitnami/charts/commit/091d4c927a0cfa2d24a79096c0ec92165d348661)) + +## 10.4.4 (2021-05-14) + +* [bitnami/postgresql] Release 10.4.4 updating components versions ([ff6296d](https://github.com/bitnami/charts/commit/ff6296dd46149df3e8fe9373f8a827ee56ba4b8b)) + +## 10.4.3 (2021-05-07) + +* [bitnami/postgresql] Release 10.4.3 updating components versions ([03f8228](https://github.com/bitnami/charts/commit/03f82282ab4e85218b91773601f53b10643c6740)) + +## 10.4.2 (2021-05-04) + +* [bitnami/postgresql] Release 10.4.2 updating components versions ([b23c573](https://github.com/bitnami/charts/commit/b23c573bf9ae0a486378dbb96b6b0b0ac6765588)) + +## 10.4.1 (2021-05-02) + +* [bitnami/postgresql] Release 10.4.1 updating components versions ([157448a](https://github.com/bitnami/charts/commit/157448a146eacd26af48ace16142c5b13626f258)) + +## 10.4.0 (2021-04-29) + +* [bitnami/postgresql] SHM: remove size limit on the emptyDir. (#6232) ([1dbd2a2](https://github.com/bitnami/charts/commit/1dbd2a203831610986e4998f34e8149cc069bf9b)), closes [#6232](https://github.com/bitnami/charts/issues/6232) + +## 10.3.18 (2021-04-20) + +* [bitnami/postgresql] Release 10.3.18 updating components versions ([31a3bef](https://github.com/bitnami/charts/commit/31a3beff085d30c227bfce42b015446fc723dc3b)) + +## 10.3.17 (2021-04-11) + +* [bitnami/postgresql] Release 10.3.17 updating components versions ([4c72712](https://github.com/bitnami/charts/commit/4c72712f8d0c79ca3b573c87b993bfe80fc99b01)) + +## 10.3.16 (2021-04-09) + +* [bitnami/postgresql] Release 10.3.16 updating components versions ([0c80da7](https://github.com/bitnami/charts/commit/0c80da716f6bc1d8f849429fc79302d71bb70e93)) + +## 10.3.15 (2021-04-03) + +* [bitnami/postgresql] Fix postgresql.conf generation from values (#5865) ([c572e0b](https://github.com/bitnami/charts/commit/c572e0be84818e5949b8ab4f17839fb2c5b77818)), closes [#5865](https://github.com/bitnami/charts/issues/5865) +* [bitnami/postgresql] Release 10.3.15 updating components versions ([4085304](https://github.com/bitnami/charts/commit/4085304b25c78ac2d715a58245aa13be598915ac)) + +## 10.3.14 (2021-03-30) + +* [bitnami/postgresql] Release 10.3.14 updating components versions ([40075c7](https://github.com/bitnami/charts/commit/40075c7cee5651b2b845386e42cd2306ae625294)) + +## 10.3.13 (2021-03-12) + +* [bitnami/postgresql] Release 10.3.13 updating components versions ([0391090](https://github.com/bitnami/charts/commit/0391090fe16c1c9b80300bd5c24c76b52bcfc169)) + +## 10.3.12 (2021-03-11) + +* [bitnami/postgresql] Release 10.3.12 updating components versions ([daa0007](https://github.com/bitnami/charts/commit/daa0007ab28793e26cf52ca031a219d3eb0a27ad)) + +## 10.3.11 (2021-03-05) + +* [bitnami/postgresql] Release 10.3.11 updating components versions ([cb37a0e](https://github.com/bitnami/charts/commit/cb37a0ec21dc56a32fb7929b1a793a5047e4dc9c)) + +## 10.3.10 (2021-03-04) + +* [bitnami/*] Remove minideb mentions (#5677) ([870bc4d](https://github.com/bitnami/charts/commit/870bc4dba1fc3aa55dd157da6687b25e8d352206)), closes [#5677](https://github.com/bitnami/charts/issues/5677) + +## 10.3.9 (2021-03-04) + +* [bitnami/postgresql] Release 10.3.9 updating components versions ([99d7551](https://github.com/bitnami/charts/commit/99d7551caf71404931f5a2f56632d4ed98556528)) + +## 10.3.8 (2021-03-03) + +* [bitnami/postgresql] Don't put postgresql-postgres-password in secret when not needed (#5635) ([db08f68](https://github.com/bitnami/charts/commit/db08f68c1b39bb5cad3175ca99d9629c8d257541)), closes [#5635](https://github.com/bitnami/charts/issues/5635) [#4380](https://github.com/bitnami/charts/issues/4380) + +## 10.3.7 (2021-02-26) + +* [bitnami/postgresql] Release 10.3.7 updating components versions ([a69d08a](https://github.com/bitnami/charts/commit/a69d08a310d84d0fd7a2987147061f21aaf3a383)) + +## 10.3.6 (2021-02-24) + +* [bitnami/postgresql] Release 10.3.6 updating components versions ([078cc97](https://github.com/bitnami/charts/commit/078cc977304997a848e51cbc0b71140047e43dae)) + +## 10.3.5 (2021-02-22) + +* [bitnami/*] Use common macro to define RBAC apiVersion (#5585) ([71fb99f](https://github.com/bitnami/charts/commit/71fb99f541e971b1daafaa20ffb7d18b153b8d60)), closes [#5585](https://github.com/bitnami/charts/issues/5585) + +## 10.3.4 (2021-02-20) + +* [bitnami/postgresql] Release 10.3.4 updating components versions ([02d06a0](https://github.com/bitnami/charts/commit/02d06a07cd14368661fde88eecf54670c13860ae)) + +## 10.3.3 (2021-02-19) + +* [bitnami/postgresql] Release 10.3.3 updating components versions ([b10f2aa](https://github.com/bitnami/charts/commit/b10f2aa22c5bc495644a9ee33d61c43f08ffec41)) + +## 10.3.2 (2021-02-15) + +* add template postgresql.name (#5489) ([a334a13](https://github.com/bitnami/charts/commit/a334a133ba60a3536d33b2de1ecc3df466be07f4)), closes [#5489](https://github.com/bitnami/charts/issues/5489) + +## 10.3.1 (2021-02-11) + +* [bitnami/postgresql] Release 10.3.1 updating components versions ([c2bb81e](https://github.com/bitnami/charts/commit/c2bb81e86ad47c19c817f6c3d1102fd8e1712ac0)) +* Fix typo "sed" => "used" (#5461) ([4373a9a](https://github.com/bitnami/charts/commit/4373a9a42a16885b0057027055ba218d3519f92b)), closes [#5461](https://github.com/bitnami/charts/issues/5461) + +## 10.3.0 (2021-02-11) + +* [bitnami/*] Add notice regarding parameters immutability after chart installation (#4853) ([5f09573](https://github.com/bitnami/charts/commit/5f095734f92555dec7cd0e3ee961f315eac170ff)), closes [#4853](https://github.com/bitnami/charts/issues/4853) +* [bitnami/postgresql] add optional startup probe to postgresql (#5445) ([bc9ad41](https://github.com/bitnami/charts/commit/bc9ad41dfc5cf864c2f3d90a206c54c4268f0311)), closes [#5445](https://github.com/bitnami/charts/issues/5445) + +## 10.2.8 (2021-02-08) + +* [bitnami/postgresql] Release 10.2.8 updating components versions ([bc4c881](https://github.com/bitnami/charts/commit/bc4c881832c1bc4554bd50eac71c19653a77755b)) + +## 10.2.7 (2021-02-04) + +* [bitnami/postgresql] Release 10.2.7 updating components versions ([4383712](https://github.com/bitnami/charts/commit/43837127490b64aebde833fcc9f32854c0280195)) + +## 10.2.6 (2021-01-29) + +* [bitnami/Postgresql] Add explicit namespace field on resources (#5333) ([fc694c5](https://github.com/bitnami/charts/commit/fc694c50956582881cf176c1b9bbd733257d51b1)), closes [#5333](https://github.com/bitnami/charts/issues/5333) + +## 10.2.5 (2021-01-25) + +* [bitnami/*] Unify icons in Chart.yaml and add missing fields (#5206) ([0462921](https://github.com/bitnami/charts/commit/0462921418ca8d54308b7466197a6d53ffae4628)), closes [#5206](https://github.com/bitnami/charts/issues/5206) + +## 10.2.4 (2021-01-22) + +* [bitnami/postgresql] Fix value KeepalivesCount typo (#5171) ([09249d3](https://github.com/bitnami/charts/commit/09249d3ebf1ca5cd469c1a4e6bc638b0bd972669)), closes [#5171](https://github.com/bitnami/charts/issues/5171) + +## 10.2.3 (2021-01-19) + +* [bitnami/*] Change helm version in the prerequisites (#5090) ([c5e67a3](https://github.com/bitnami/charts/commit/c5e67a388743cbee28439d2cabca27884b9daf97)), closes [#5090](https://github.com/bitnami/charts/issues/5090) +* [bitnami/postgresql] Drop values-production.yaml support (#5125) ([131711c](https://github.com/bitnami/charts/commit/131711cfbe51c6f5e5458bcf48d6016580fa45c1)), closes [#5125](https://github.com/bitnami/charts/issues/5125) + +## 10.2.2 (2021-01-12) + +* [bitnami/postgresql] Release 10.2.2 updating components versions ([49f9f9f](https://github.com/bitnami/charts/commit/49f9f9f8599b9538eb6e10b6b094a33147ef5400)) +* Clarify sharedBuffers example in postgresql README (#4883) ([38c8044](https://github.com/bitnami/charts/commit/38c8044cbb9d0f018dbc387ea5a5c1db767fe5b6)), closes [#4883](https://github.com/bitnami/charts/issues/4883) + +## 10.2.1 (2021-01-04) + +* [bitnami/postgresql] Release 10.2.1 updating components versions ([ed749c0](https://github.com/bitnami/charts/commit/ed749c08894dd3bb76c3465a9e2c0d331c8f878d)) +* Fix REAMDE (#4816) ([2fe0b09](https://github.com/bitnami/charts/commit/2fe0b09089575626076f3c576107e4e647c5cdc5)), closes [#4816](https://github.com/bitnami/charts/issues/4816) +* Fixes some spacing in README.md (#4742) ([2c96f0c](https://github.com/bitnami/charts/commit/2c96f0c948ea540805c73d1c546962bbb332b41b)), closes [#4742](https://github.com/bitnami/charts/issues/4742) + +## 10.2.0 (2020-12-14) + +* [bitnami/*] Affinity based on common presets (vii) (#4701) ([52a2c99](https://github.com/bitnami/charts/commit/52a2c99a89018659f18b774585bb10954625a215)), closes [#4701](https://github.com/bitnami/charts/issues/4701) +* [bitnami/*] fix typos (#4699) ([49adc63](https://github.com/bitnami/charts/commit/49adc63b672da976c55af2e077aa5648a357b77f)), closes [#4699](https://github.com/bitnami/charts/issues/4699) + +## 10.1.4 (2020-12-11) + +* [bitnami/*] Update dependencies (#4694) ([2826c12](https://github.com/bitnami/charts/commit/2826c125b42505f28431301e3c1bbe5366e47a01)), closes [#4694](https://github.com/bitnami/charts/issues/4694) + +## 10.1.3 (2020-12-07) + +* [bitnami/postgresql] Release 10.1.3 updating components versions ([94676b3](https://github.com/bitnami/charts/commit/94676b392f4e69bde9035c96813b46c94519edcd)) + +## 10.1.2 (2020-12-04) + +* [bitnami/*] Add upgrade details to README (#4480) ([10bd8e1](https://github.com/bitnami/charts/commit/10bd8e1fbbe69461a5d90ba61562f72b526c9caf)), closes [#4480](https://github.com/bitnami/charts/issues/4480) +* [bitnami/postgresql] Release 10.1.2 updating components versions ([494e84e](https://github.com/bitnami/charts/commit/494e84ed462576b56b403c46895fdad0f7c49f3e)) + +## 10.1.1 (2020-11-25) + +* [bitnami/postgresql] `postgresql-postgres-password` doesn't work with `global.postgresqlUsername` an ([e0c026c](https://github.com/bitnami/charts/commit/e0c026c74b1efa60fa7b142be5e877e5b200c869)), closes [#3130](https://github.com/bitnami/charts/issues/3130) [#4380](https://github.com/bitnami/charts/issues/4380) [#3130](https://github.com/bitnami/charts/issues/3130) [#3130](https://github.com/bitnami/charts/issues/3130) + +## 10.1.0 (2020-11-20) + +* [bitnami/postgresql] Implement persistence selector (#4437) ([e383a6e](https://github.com/bitnami/charts/commit/e383a6e3286c6202f3a09618fb5584b69a8ee98d)), closes [#4437](https://github.com/bitnami/charts/issues/4437) + +## 10.0.2 (2020-11-18) + +* [bitnami/postgresql] Fix typo in values.yaml (#4399) ([cf49c8a](https://github.com/bitnami/charts/commit/cf49c8a184ef299e2b6b4587c2d6982a0c0aa9f3)), closes [#4399](https://github.com/bitnami/charts/issues/4399) +* Update README.md ([2006fdf](https://github.com/bitnami/charts/commit/2006fdf85007818b571f59271751b0b8ac2dab9c)) + +## 10.0.1 (2020-11-17) + +* [bitnami/postgresql] Release 10.0.1 updating components versions ([323a092](https://github.com/bitnami/charts/commit/323a092de78916e92cf3350439388f9efd5907b9)) + +## 10.0.0 (2020-11-17) + +* [bitnami/postgresql] Adapt to Helm v3 and change nomenclature (#4385) ([7eabc85](https://github.com/bitnami/charts/commit/7eabc85fd4fae43127228a22829c7ce3fe85c389)), closes [#4385](https://github.com/bitnami/charts/issues/4385) + +### Breaking change + +* removal of Master/Slave +* Some additional clean up post merge of terms +* [bitnami/postgresql] Major version. Adapt Chart to apiVersion: v2 +* Update Chart.yaml +* Delete empty section from README +Co-authored-by: W. Kavanaugh Latiolais +Co-authored-by: Carlos Rodríguez Hernández + +## 9.8.13 (2020-11-14) + +* [bitnami/postgresql] Release 9.8.13 updating components versions ([fd890aa](https://github.com/bitnami/charts/commit/fd890aad247b7ad54b4c2c29534c3d8565b0b7cf)) + +## 9.8.12 (2020-11-12) + +* [bitnami/postgresql] Release 9.8.12 updating components versions ([a13c592](https://github.com/bitnami/charts/commit/a13c592efc0a33ba2339668d5b262fa27d50754f)) + +## 9.8.11 (2020-11-04) + +* [bitnami/postgresql] fix: update values to avoid warnings (#4212) ([2eec409](https://github.com/bitnami/charts/commit/2eec409666ce1f855442931618386ab01bc6825e)), closes [#4212](https://github.com/bitnami/charts/issues/4212) + +## 9.8.10 (2020-11-04) + +* [bitnami/postgresql] Release 9.8.10 updating components versions ([3c992aa](https://github.com/bitnami/charts/commit/3c992aa1e4c7fb43d9cead2f35c69fe6cb4fbee0)) + +## 9.8.9 (2020-10-30) + +* [bitnami/postgresql] Fix secret logic for passwords (#4123) ([ea13243](https://github.com/bitnami/charts/commit/ea13243ea6c7f714573f3b3699851c8a648b964d)), closes [#4123](https://github.com/bitnami/charts/issues/4123) + +## 9.8.8 (2020-10-30) + +* [bitnami/*] Extra manifests should be top-level (#4161) ([b3a95b7](https://github.com/bitnami/charts/commit/b3a95b701b611ab51924ae5665bcc8cd5ac56898)), closes [#4161](https://github.com/bitnami/charts/issues/4161) +* [bitnami/*] Include link to Troubleshootin guide on README.md (#4136) ([c08a20e](https://github.com/bitnami/charts/commit/c08a20e3db004215383004ff023a73fcc2522e72)), closes [#4136](https://github.com/bitnami/charts/issues/4136) + +## 9.8.7 (2020-10-27) + +* [bitnami/postgresql] Fix slave.extraInitContainers value (#4124) ([a92fbbe](https://github.com/bitnami/charts/commit/a92fbbe145af870c421fb58b7d592453a215f075)), closes [#4124](https://github.com/bitnami/charts/issues/4124) + +## 9.8.6 (2020-10-23) + +* [bitnami/postgresql] Fix extraDeploy, customLivenessProbe and customReadinessProbe values (#4090) ([05eae06](https://github.com/bitnami/charts/commit/05eae0696de0032b2a8de103240044deec556367)), closes [#4090](https://github.com/bitnami/charts/issues/4090) + +## 9.8.5 (2020-10-22) + +* [bitnami/postgresql] Permit init-container start with root user. (#4072) ([6b8c191](https://github.com/bitnami/charts/commit/6b8c1910bf5ee28af62733a66f9940c518ff5599)), closes [#4072](https://github.com/bitnami/charts/issues/4072) + +## 9.8.4 (2020-10-13) + +* [bitnami/postgresql] Added `publishNotReadyAddresses: true` to svc-headless.yaml (#3990) ([46039b3](https://github.com/bitnami/charts/commit/46039b39746bbcb6703210e7d0a911fb00349403)), closes [#3990](https://github.com/bitnami/charts/issues/3990) + +## 9.8.3 (2020-10-08) + +* [bitnami/postgresql] Allow exporter port in network-policy if metrics enabled (#3944) ([b5c34a1](https://github.com/bitnami/charts/commit/b5c34a1ed8e223ddb2ce5cd8fb7a0a0a02a9bf11)), closes [#3944](https://github.com/bitnami/charts/issues/3944) + +## 9.8.2 (2020-10-06) + +* [bitnami/postgresql] Release 9.8.2 updating components versions ([64cb5fd](https://github.com/bitnami/charts/commit/64cb5fd8d5b6ca66e1e9e16e0463af4a1ace65c6)) + +## 9.8.1 (2020-09-29) + +* [bitnami/postgresql] Release 9.8.1 updating components versions ([cc9375d](https://github.com/bitnami/charts/commit/cc9375d7ff64a2e39504bd27aecc7c5ce86171dd)) + +## 9.8.0 (2020-09-29) + +* [bitnami/postgresql] Allow specifying different resource requests/limits on slaves (#3800) ([204d41d](https://github.com/bitnami/charts/commit/204d41df2b0afca494b7cc88bbcb5ba82c0772a8)), closes [#3800](https://github.com/bitnami/charts/issues/3800) + +## 9.7.4 (2020-09-29) + +* [bitnami/postgresql] Revert #3768 due to being a breaking change (#3808) ([a933a38](https://github.com/bitnami/charts/commit/a933a38ec1c6fe5e3d019037e1bc7a33566774de)), closes [#3768](https://github.com/bitnami/charts/issues/3768) [#3808](https://github.com/bitnami/charts/issues/3808) [#3768](https://github.com/bitnami/charts/issues/3768) + +## 9.7.3 (2020-09-25) + +* [bitnami/postgresql] Added labels for volumeClaimTemplates (#3768) ([03f324b](https://github.com/bitnami/charts/commit/03f324b9f565f779bb1519c1562c9a0cca546bc1)), closes [#3768](https://github.com/bitnami/charts/issues/3768) + +## 9.7.2 (2020-09-24) + +* [bitnami/postgresql] Release 9.7.2 updating components versions ([c45bc6f](https://github.com/bitnami/charts/commit/c45bc6fb26f348fd0a0530c13e4d9fb6d4ac0cc8)) +* [bitnami/postgresql] Use common functions for tplValues (#3730) ([af4ae62](https://github.com/bitnami/charts/commit/af4ae62ab7f8d0ce1c0380cdd86a0933265c1de0)), closes [#3730](https://github.com/bitnami/charts/issues/3730) + +## 9.7.1 (2020-09-23) + +* [bitnami/chart] postgre #3722: In exsistingSecret: Switched password keys (#3744) ([1517668](https://github.com/bitnami/charts/commit/15176687345d93632a1e16753b0cd2fb52c35868)), closes [#3722](https://github.com/bitnami/charts/issues/3722) [#3744](https://github.com/bitnami/charts/issues/3744) + +## 9.7.0 (2020-09-21) + +* [bitnami/postgresql] Add customLivenessProbe and customReadinessProbe (#3728) ([a729b97](https://github.com/bitnami/charts/commit/a729b97926033bb3efabd7094d7daf4af2f0caea)), closes [#3728](https://github.com/bitnami/charts/issues/3728) + +## 9.6.0 (2020-09-18) + +* [bitnami/postgresql] Add improvements to comply with STIG (#3712) ([f193e43](https://github.com/bitnami/charts/commit/f193e43f1e78ab3a161aacbda57cb329ff2b2d2e)), closes [#3712](https://github.com/bitnami/charts/issues/3712) + +## 9.5.0 (2020-09-17) + +* [bitnami/postgresql] Add arbitrary securityContext configuration to improve security (#3687) ([49a39d6](https://github.com/bitnami/charts/commit/49a39d6c6a051cfc13f92ee01980e25925b98207)), closes [#3687](https://github.com/bitnami/charts/issues/3687) + +## 9.4.1 (2020-09-08) + +* [bitnami/metrics-server] Add source repo (#3577) ([1ed12f9](https://github.com/bitnami/charts/commit/1ed12f96af75322b46afdb2b3d9907c11b13f765)), closes [#3577](https://github.com/bitnami/charts/issues/3577) +* [bitnami/postgresql] Release 9.4.1 updating components versions ([730e66f](https://github.com/bitnami/charts/commit/730e66f789ad7b05c856bbbab623bd4867c39c28)) + +## 9.4.0 (2020-09-02) + +* [bitnami/postgresql] - Add PostgreSQL cross cluster replication ability (#3574) ([b481f63](https://github.com/bitnami/charts/commit/b481f633efc8c879eacaf2b31b4136719f58baf1)), closes [#3574](https://github.com/bitnami/charts/issues/3574) + +## 9.3.4 (2020-09-01) + +* [bitnami/postgres] Add chown on .Values.persistence.mountPath (#3348) ([e7c2b1d](https://github.com/bitnami/charts/commit/e7c2b1d6238613de9d8e3c65863a2fb1b726db30)), closes [#3348](https://github.com/bitnami/charts/issues/3348) + +## 9.3.3 (2020-08-27) + +* [bitnami/postgresql] Fix slave' statefulset when persistence is disabled (#3527) ([3910de7](https://github.com/bitnami/charts/commit/3910de7325317b752e1c2e46456fbdaa765cb50b)), closes [#3527](https://github.com/bitnami/charts/issues/3527) + +## 9.3.2 (2020-08-18) + +* [bitnami/postgresql] Release 9.3.2 updating components versions ([4f8c352](https://github.com/bitnami/charts/commit/4f8c352b05cd73315d859563d496c13f9a636a3c)) + +## 9.3.1 (2020-08-18) + +* [bitnami/postgresql] Fix Postgres password with externalSecret (#3408) ([e64df12](https://github.com/bitnami/charts/commit/e64df12d1fdce559915900c1699f0ea6fbe51cf1)), closes [#3408](https://github.com/bitnami/charts/issues/3408) + +## 9.3.0 (2020-08-18) + +* [bitnami/postgresql] feat: add new value to enabled slave persistence (#3438) ([b27b99d](https://github.com/bitnami/charts/commit/b27b99d1f605720e14ac1daac429f42d84266cca)), closes [#3438](https://github.com/bitnami/charts/issues/3438) + +## 9.2.1 (2020-08-14) + +* [bitnami/postgresql] Release 9.2.1 updating components versions ([61e3273](https://github.com/bitnami/charts/commit/61e3273b0e0c1b69c32ae3080d209ecadeb4704b)) + +## 9.2.0 (2020-08-13) + +* [bitnami/*] Use common helps for upgrade password errors (#3335) ([079f5bd](https://github.com/bitnami/charts/commit/079f5bd6ec59bb058216d6a931449b895517c789)), closes [#3335](https://github.com/bitnami/charts/issues/3335) + +## 9.1.4 (2020-08-06) + +* [bitnami/postgresql] Release 9.1.4 updating components versions ([47b3f22](https://github.com/bitnami/charts/commit/47b3f22873a2e622442ae7962d19a07b74b5de91)) + +## 9.1.3 (2020-08-05) + +* [bitnami/*] Fix TL;DR typo in READMEs (#3280) ([3d7ab40](https://github.com/bitnami/charts/commit/3d7ab406fecd64f1af25f53e7d27f03ec95b29a4)), closes [#3280](https://github.com/bitnami/charts/issues/3280) +* [bitnami/postgresql] Add upgrade notes for 9.X.X (#3322) ([c093a61](https://github.com/bitnami/charts/commit/c093a61d8c9052aa8709c2172047768e41a1816d)), closes [#3322](https://github.com/bitnami/charts/issues/3322) +* [bitnami/postgresql] Release 9.1.3 updating components versions ([ffb6263](https://github.com/bitnami/charts/commit/ffb62639f26467adea44db70ca5d87f950079b00)) + +## 9.1.2 (2020-07-29) + +* [bitnami/postgresql] Release 9.1.2 updating components versions ([0f4eab3](https://github.com/bitnami/charts/commit/0f4eab37927f187cafee8cff85f23df250bdd9bf)) + +## 9.1.1 (2020-07-15) + +* [bitnami/postgresql] Release 9.1.1 updating components versions ([92ad3e7](https://github.com/bitnami/charts/commit/92ad3e746e1ff844c7e6fdd688ad08d13aeeb88a)) + +## 9.1.0 (2020-07-14) + +* [bitnami/postgresql] Postgresql TLS Support (#3057) ([6c855ff](https://github.com/bitnami/charts/commit/6c855ffb409f36c114f8ee680e10a130efc55906)), closes [#3057](https://github.com/bitnami/charts/issues/3057) + +## 9.0.0 (2020-07-14) + +* [bitnami/all] Add categories (#3075) ([63bde06](https://github.com/bitnami/charts/commit/63bde066b87a140fab52264d0522401ab3d63509)), closes [#3075](https://github.com/bitnami/charts/issues/3075) +* [bitnami/postgresql] Helm label best practices (#3021) ([693e765](https://github.com/bitnami/charts/commit/693e7656d1d204789f4b7dcf8b76bb13908a6d95)), closes [#3021](https://github.com/bitnami/charts/issues/3021) + +## 8.10.14 (2020-07-07) + +* [bitnami/postgresql] Release 8.10.14 updating components versions ([18f8014](https://github.com/bitnami/charts/commit/18f80142d0eb5783d8cbe38010bdc10ec9b3c77d)) + +## 8.10.13 (2020-07-02) + +* [bitnami/postgresql] Release 8.10.13 updating components versions ([8d6dcd5](https://github.com/bitnami/charts/commit/8d6dcd5cbd43c1cc8f338df14cbe2dc6da7c456d)) + +## 8.10.12 (2020-07-02) + +* [bitnami/postgresql] Fix typo on README.md (#2999) ([0d46f5d](https://github.com/bitnami/charts/commit/0d46f5d893e9f4b7cc358247de8b8ffd92c1815a)), closes [#2999](https://github.com/bitnami/charts/issues/2999) + +## 8.10.11 (2020-06-29) + +* [bitnami/postgresql] Release 8.10.11 updating components versions ([5c5bcf9](https://github.com/bitnami/charts/commit/5c5bcf9b5e05e3184d7db0a7c2d7ee8a8d81b091)) + +## 8.10.10 (2020-06-26) + +* [bitnami/postgresql] Release 8.10.10 updating components versions ([cbde80c](https://github.com/bitnami/charts/commit/cbde80c9146aedacbced192e51d702867965c3df)) + +## 8.10.9 (2020-06-26) + +* [bitnami/postgresql] Update readme with delete PVC details (#2926) ([d133baf](https://github.com/bitnami/charts/commit/d133baf1eee5a12518d8b1bf35c3ed1461d1cd47)), closes [#2926](https://github.com/bitnami/charts/issues/2926) + +## 8.10.8 (2020-06-24) + +* [bitnami/postgresql] Release 8.10.8 updating components versions ([a36d455](https://github.com/bitnami/charts/commit/a36d4559153e37acede590ec6d4edf82088714f2)) + +## 8.10.7 (2020-06-23) + +* Master StatefulSet annotations fix (#2899) ([abc14b5](https://github.com/bitnami/charts/commit/abc14b569ad564ff871b7a949a6e5d9857f51c7d)), closes [#2899](https://github.com/bitnami/charts/issues/2899) + +## 8.10.6 (2020-06-19) + +* [bitnami/postgresql] Release 8.10.6 updating components versions ([f9cb010](https://github.com/bitnami/charts/commit/f9cb0102f1e03d9ee7f09dbb65e9d7cdc25f84fe)) +* [bitnami/several] Add instructions about how to use different branches (#2785) ([c315cb0](https://github.com/bitnami/charts/commit/c315cb078a4cef97ff53cf2066b34add3f2926ba)), closes [#2785](https://github.com/bitnami/charts/issues/2785) +* [multiple charts] Update hidden properties in the different JSON schemas (#2871) ([4cff6ba](https://github.com/bitnami/charts/commit/4cff6ba8b0013b6dc368a1e7986c393e8447e75b)), closes [#2871](https://github.com/bitnami/charts/issues/2871) + +## 8.10.5 (2020-06-03) + +* [bitnami/postgresql] Release 8.10.5 updating components versions ([dac5aab](https://github.com/bitnami/charts/commit/dac5aab0c3fda86f54d43011a6b4df045c774406)) + +## 8.10.4 (2020-05-29) + +* [bitnami/postgresql] update readme regarding postgres username and password (#2661) ([1ca7dd4](https://github.com/bitnami/charts/commit/1ca7dd4cd044e13596a61e4b755d64c6579031e3)), closes [#2661](https://github.com/bitnami/charts/issues/2661) + +## 8.10.3 (2020-05-28) + +* [bitnami/postgresql] Fix extraInitContainers usage (#2689) ([56b036c](https://github.com/bitnami/charts/commit/56b036c389918d59ee046c5470aef3115043884d)), closes [#2689](https://github.com/bitnami/charts/issues/2689) + +## 8.10.2 (2020-05-27) + +* [bitnami/postgresql] Release 8.10.2 updating components versions ([b476dcd](https://github.com/bitnami/charts/commit/b476dcdb0c36e3f4add4e9056598c52f2ae54366)) + +## 8.10.1 (2020-05-26) + +* [bitnami/postgresql] Fix customMetrics example (#2552) ([97038a4](https://github.com/bitnami/charts/commit/97038a44b71dbc59b676d2c298275f4d5ce5d614)), closes [#2552](https://github.com/bitnami/charts/issues/2552) +* [bitnami/postgresql] fixed a typo in values files (#2649) ([98fb584](https://github.com/bitnami/charts/commit/98fb5841594bb1cc081d2b86de97bf36fd445e12)), closes [#2649](https://github.com/bitnami/charts/issues/2649) [#2649](https://github.com/bitnami/charts/issues/2649) + +## 8.10.0 (2020-05-21) + +* [bitnami/postgresql] Support all metrics env vars (#2620) ([0351483](https://github.com/bitnami/charts/commit/035148374bc9ed4df64cad0d5536fba14082caa1)), closes [#2620](https://github.com/bitnami/charts/issues/2620) + +## 8.9.9 (2020-05-21) + +* [bitnami/postgresql] Release 8.9.9 updating components versions ([90a6422](https://github.com/bitnami/charts/commit/90a6422006aee423dd765a27b2640b082d4648af)) +* update bitnami/common to be compatible with helm v2.12+ (#2615) ([c7751eb](https://github.com/bitnami/charts/commit/c7751eb5764e468e1854b58a1b8491d2b13e0a4a)), closes [#2615](https://github.com/bitnami/charts/issues/2615) + +## 8.9.8 (2020-05-18) + +* [bitnami/postgresql] Release 8.9.8 updating components versions ([33517f8](https://github.com/bitnami/charts/commit/33517f8cdd410b46a17d18810d79fdcfd7998ac7)) + +## 8.9.7 (2020-05-14) + +* [bitnami/postgresql] Release 8.9.7 updating components versions ([a78d819](https://github.com/bitnami/charts/commit/a78d81910a07a95bfd217c835afc0cf6f8b45842)) + +## 8.9.6 (2020-05-08) + +* [bitnami/postgresql] Release 8.9.6 updating components versions ([5888685](https://github.com/bitnami/charts/commit/588868581ccd4cfcbf988b15a37dc475625859ac)) + +## 8.9.5 (2020-05-08) + +* [bitnami/postgresql] Release 8.9.5 updating components versions ([3cfdf68](https://github.com/bitnami/charts/commit/3cfdf688400451e6b5b7b4e26d2368f0630f8a18)) + +## 8.9.4 (2020-05-01) + +* [bitnami/postgresql] Release 8.9.4 updating components versions ([09ba156](https://github.com/bitnami/charts/commit/09ba1564fed3df4f1d94518edcb58aab1f75c827)) + +## 8.9.3 (2020-04-28) + +* [bitnami/postgresql] Fix conf.d permissions with postgresqlextendedConf (#2383) ([d88de83](https://github.com/bitnami/charts/commit/d88de83e04f7dd3a1d1c99df54208439d9cc7913)), closes [#2383](https://github.com/bitnami/charts/issues/2383) +* [bitnami/postgresql] Release 8.9.3 updating components versions ([21f231d](https://github.com/bitnami/charts/commit/21f231dde5d27f6d4a5c554975a1da23c79e5dd6)) +* Update README.md ([3fa18e5](https://github.com/bitnami/charts/commit/3fa18e51e06028fe7e9d4d4298348993fb86a327)) + +## 8.9.2 (2020-04-23) + +* [bitnami/postgresql] Fix pod labels in master statefulservice (#2392) ([67e1008](https://github.com/bitnami/charts/commit/67e100899cd2bbad2c43d8aeede3129f853b71d9)), closes [#2392](https://github.com/bitnami/charts/issues/2392) + +## 8.9.1 (2020-04-22) + +* [bitnami/postgresql] Release 8.9.1 updating components versions ([3bec415](https://github.com/bitnami/charts/commit/3bec415f3b35b303e9dff4f0c634d164c2e55eb3)) + +## 8.9.0 (2020-04-20) + +* [bitnami/postgresql] Add option to add annotations to all generated resources (#2368) ([1765929](https://github.com/bitnami/charts/commit/1765929fa8cf37819309ff975ebf0a8dfcf7824d)), closes [#2368](https://github.com/bitnami/charts/issues/2368) + +## 8.8.0 (2020-04-17) + +* [bitnami/postgresql] Add PSP, Role and RoleBinding to chart (#2313) ([c60c746](https://github.com/bitnami/charts/commit/c60c74667980efe54672e4bbfd97bf5b081dde21)), closes [#2313](https://github.com/bitnami/charts/issues/2313) + +## 8.7.4 (2020-04-15) + +* [bitnami/postgresql] Release 8.7.4 updating components versions ([734e060](https://github.com/bitnami/charts/commit/734e060a346febea516fd815624b7dd852963e23)) + +## 8.7.3 (2020-04-09) + +* [bitnami/postgresql] Avoid using 'deepCopy' since it's not supported in Helm old versions (#2275) ([d128498](https://github.com/bitnami/charts/commit/d12849859960468f274290a3af10a57e6262754d)), closes [#2275](https://github.com/bitnami/charts/issues/2275) + +## 8.7.2 (2020-04-07) + +* [bitnami/postgresql] Fix svc-read.yaml error (#2241) ([25de34c](https://github.com/bitnami/charts/commit/25de34c95a3ba0c88ead7af9f4609f0c3f8cfc10)), closes [#2241](https://github.com/bitnami/charts/issues/2241) + +## 8.7.1 (2020-04-06) + +* [bitnami/postgresql] Release 8.7.1 updating components versions ([102f747](https://github.com/bitnami/charts/commit/102f747100ad8c789bd828937739738e5b9f355c)) + +## 8.7.0 (2020-04-06) + +* [bitnami/postgresql] fix replication with nodePort service type #2063 (#2192) ([fa546fc](https://github.com/bitnami/charts/commit/fa546fc21cde9a349b3729935265f59229af32e6)), closes [#2063](https://github.com/bitnami/charts/issues/2063) [#2192](https://github.com/bitnami/charts/issues/2192) + +## 8.6.13 (2020-04-03) + +* [bitnami/postgresql] Tpl usage in existing secret (#2211) ([27bf542](https://github.com/bitnami/charts/commit/27bf542764c9186195c117aa21d297f2d9bd85e7)), closes [#2211](https://github.com/bitnami/charts/issues/2211) + +## 8.6.12 (2020-03-31) + +* [bitnami/postgresql] Release 8.6.12 updating components versions ([1d9296f](https://github.com/bitnami/charts/commit/1d9296fe56cbccea315e4f39b529bfb7d2250ded)) + +## 8.6.11 (2020-03-30) + +* [bitnami/postgresql] Fix conf permissions with postgresql.extendedConf (#2141) ([8fce43b](https://github.com/bitnami/charts/commit/8fce43be843d06ffe1bd79471aa3a93c7ac6f0be)), closes [#2141](https://github.com/bitnami/charts/issues/2141) + +## 8.6.10 (2020-03-26) + +* [bitnami/postgresql] Release 8.6.10 updating components versions ([3306f53](https://github.com/bitnami/charts/commit/3306f535514a7476087a891b632c7047275f75cc)) + +## 8.6.9 (2020-03-23) + +* [bitnami/postgresql] Fix loadBalancerSourceRanges in svc-read (#2117) ([429df27](https://github.com/bitnami/charts/commit/429df27997fe2916f90463cbaa97484a7f5d7968)), closes [#2117](https://github.com/bitnami/charts/issues/2117) + +## 8.6.8 (2020-03-20) + +* [bitnami/postgresql] Release 8.6.8 updating components versions ([590c6b0](https://github.com/bitnami/charts/commit/590c6b0f4e07161614453b12efe71f22e0c00a46)) + +## 8.6.7 (2020-03-20) + +* [bitnami/postgresql] Update README.md + yamllint (#2097) ([0587893](https://github.com/bitnami/charts/commit/0587893a5b71805158f340b0134c2540ff90a4b6)), closes [#2097](https://github.com/bitnami/charts/issues/2097) + +## 8.6.6 (2020-03-20) + +* [bitnami/postgresql]fix credetials for initdbScripts (#2083) ([dc4a34b](https://github.com/bitnami/charts/commit/dc4a34bae5a3e04082799591b510e8cf635329b1)), closes [#2083](https://github.com/bitnami/charts/issues/2083) + +## 8.6.5 (2020-03-18) + +* [bitnami/postgresql] Evaluate extraEnvVarsCM as a template (#2059) ([730ef6c](https://github.com/bitnami/charts/commit/730ef6c3099c13cb88d3a1b2b66161a62cb02715)), closes [#2059](https://github.com/bitnami/charts/issues/2059) + +## 8.6.4 (2020-03-11) + +* [bitnami/postgresql] Release 8.6.4 updating components versions ([a4df45b](https://github.com/bitnami/charts/commit/a4df45b81a9d0a7862f043765bc13bc875bdad96)) + +## 8.6.3 (2020-03-11) + +* Move charts from upstreamed folder to bitnami (#2032) ([a0e44f7](https://github.com/bitnami/charts/commit/a0e44f7d6a10b8b5643186130ea420887cb72c7c)), closes [#2032](https://github.com/bitnami/charts/issues/2032) +* Remove PostgreSQL chart from Bitnami ([5e80f54](https://github.com/bitnami/charts/commit/5e80f54d4e0dc48d2e88e4d0edfc7a6e63af5fbb)) + +## 3.1.1 (2018-10-17) + +* Apply some suggestions ([24706a6](https://github.com/bitnami/charts/commit/24706a6163b75700c705f3021bb37790f95423c9)) +* Bump versions ([0cfd3f4](https://github.com/bitnami/charts/commit/0cfd3f421533a532c90438afa287bf46aa10413e)) +* Change logic to determine registry ([9ead294](https://github.com/bitnami/charts/commit/9ead294d5705f2646e8d3b70e14129d23c07bf8a)) +* Check if global is set ([dec26e5](https://github.com/bitnami/charts/commit/dec26e5d0b982905dde2a55fdf2285a7781a64cc)) +* Fix typo ([93170ac](https://github.com/bitnami/charts/commit/93170acc16e842e55aff7b7d944f7fbe025eee91)) +* Remove distro tags in charts ([427ac51](https://github.com/bitnami/charts/commit/427ac51cdf4de70f786563e1971a5d491d32ad54)) +* Reword and update kafka dependencies ([be6cbed](https://github.com/bitnami/charts/commit/be6cbedd27cea4c5c0e30ce70c9790c27ca1a0ec)) + +## 3.1.0 (2018-10-11) + +* Add global registry option to Bitnami charts ([395ba08](https://github.com/bitnami/charts/commit/395ba08e2bc14ef28a0cae1fada97ed6cf2e777d)) +* Bump chart version ([4010d13](https://github.com/bitnami/charts/commit/4010d13f5fb69c191e34fbfcbe3a6f57e3486236)) +* Change name truncation to 63 instead of 24 ([e42a923](https://github.com/bitnami/charts/commit/e42a9233eb18139d09d9f5fb0a010a10a29c4a1b)) + +## 3.0.2 (2018-10-05) + +* Add ) ([728466a](https://github.com/bitnami/charts/commit/728466ac178560c67f2ede913140f50dc5136fd3)) +* Add kubeapps text to charts READMEs ([2f6dc51](https://github.com/bitnami/charts/commit/2f6dc51ce6307d57bd8c20e929da23dd2adf22d5)) +* Fix go template inside go template ([a140313](https://github.com/bitnami/charts/commit/a140313f4910d1366170415f0300729c22eda073)) + +## 3.0.1 (2018-09-27) + +* Improve getting LoadBalancer address in Bitnami charts NOTES.txt ([a641728](https://github.com/bitnami/charts/commit/a64172812af8b11fac23be2fe7a66b1edb14c71f)) + +## 3.0.0 (2018-09-21) + +* [bitnami/postgresql] Fix chart not being upgradable ([65a1e5e](https://github.com/bitnami/charts/commit/65a1e5eaa7040c37ff4ad5dff28a3bb4ca216ff9)) + +## 2.1.3 (2018-08-13) + +* postgresql: bump chart appVersion to `10.5.0` ([7d98698](https://github.com/bitnami/charts/commit/7d986988626d57d5f91b9c4cb983a2cedf7b1071)) +* postgresql: bump chart version to `2.1.3` ([3192d7c](https://github.com/bitnami/charts/commit/3192d7c54e6b1f689d3f5bcfa61cb2428812f955)) +* postgresql: update to `10.5.0-debian-9` ([422a538](https://github.com/bitnami/charts/commit/422a53866afbeaf6f23eaca6dab1a5df8518e0dd)) + +## 2.1.2 (2018-08-06) + +* Improve notes to access deployed services ([0071eb5](https://github.com/bitnami/charts/commit/0071eb5545f7774eeab9ea335c660df644ad3e4c)) + +## 2.1.1 (2018-07-30) + +* Add missing release and charts labels in pods ([dfd13a2](https://github.com/bitnami/charts/commit/dfd13a2b76b83f558d9dbb1d942c66ecaa93c221)) + +## 2.1.0 (2018-07-27) + +* Allow using custom scripts to initialize PostgreSQL ([b92ea0d](https://github.com/bitnami/charts/commit/b92ea0d2c9075c79184d7658de12bc4ead0d96fc)) + +## 2.0.1 (2018-07-26) + +* Add documentation for custom postgresql.conf files ([58800b3](https://github.com/bitnami/charts/commit/58800b381eab45136afbc945c24fe38b2a7b1cca)) +* Update chart version. Use the main tag for the image ([2b0272b](https://github.com/bitnami/charts/commit/2b0272b9bbd519fc9764b9000b74d0c337b6f3d6)) + +## 2.0.0 (2018-07-25) + +* [Postgresql] add non-root support ([130f090](https://github.com/bitnami/charts/commit/130f0904b9bca9766de65a9b8ebffa18a03a14f2)) + +## 1.0.5 (2018-07-23) + +* Use env var instead of showing the password for the cli ([0125d8b](https://github.com/bitnami/charts/commit/0125d8b36749147835dfcf0686e6ec690540364e)) + +## 1.0.4 (2018-07-23) + +* Fix svc type for values-production.yaml ([24cd97d](https://github.com/bitnami/charts/commit/24cd97d1949348a6f32599135ccea26762989a37)) +* Fix svc type for values-production.yaml ([29abeb2](https://github.com/bitnami/charts/commit/29abeb22b95d0f81bfc906fea90fa02d4e516e70)) + +## 1.0.3 (2018-07-06) + +* postgresql: bump chart appVersion to `10.4.0-debian-9` ([4a13616](https://github.com/bitnami/charts/commit/4a136162d73841cfbcfa4405dc9223100d4eaa0d)) +* postgresql: bump chart version to `1.0.3` ([a3b1015](https://github.com/bitnami/charts/commit/a3b1015a483f2074382dc862fe6604d4b22b3408)) +* postgresql: update to `10.4.0-debian-9` ([80b8bf4](https://github.com/bitnami/charts/commit/80b8bf4f6067856dbae4632041d0b0422293dd8b)) + +## 1.0.2 (2018-06-07) + +* Fix capitalization of clusterIP parameter ([2d0656f](https://github.com/bitnami/charts/commit/2d0656f6ab19a4819fea68bae1a2710ee96e1807)) +* Fix consul, mysql and postgre helm chart testing issue using tag ([6f37eb7](https://github.com/bitnami/charts/commit/6f37eb71b1b7168517f0bb9d64252bd57548a4fc)) + +## 1.0.1 (2018-06-04) + +* Apply Juan comments ([7425941](https://github.com/bitnami/charts/commit/74259415261cd15cf6e2bde6d5ef7eb6e0d4d43b)) +* Delete unnecessaty file ([fbafc63](https://github.com/bitnami/charts/commit/fbafc631e35851b5cbad2d050df361a0790fb764)) +* Fix ES helm chart testing issue using tag ([657025b](https://github.com/bitnami/charts/commit/657025be216d5cccf4b46e225bcc0a45e9f0e9e1)) + +## 1.0.0 (2018-05-29) + +* Support replication for PostgreSQL chart ([7527ab5](https://github.com/bitnami/charts/commit/7527ab5b4c1c2af5ac219c4fb4a5c7dbf61dd63f)) + +## 0.4.25 (2018-05-15) + +* postgresql: bump chart appVersion to `10.4.0` ([70178ef](https://github.com/bitnami/charts/commit/70178efd2ca8becdb3b05371eccada273690a0bb)) +* postgresql: bump chart version to `0.4.25` ([7f48795](https://github.com/bitnami/charts/commit/7f48795b1d96a24f4a1e8617b9bae841b3b0d177)) +* postgresql: update to `10.4.0` ([590549a](https://github.com/bitnami/charts/commit/590549a15f8e676fc348313f4a11308029e6ab43)) + +## 0.4.24 (2018-04-13) + +* Documentation fixes ([fdbcc57](https://github.com/bitnami/charts/commit/fdbcc57a95af97bfa63c873432f7dc070c37f8c3)) + +## 0.4.23 (2018-04-13) + +* Rename charts folders ([5413120](https://github.com/bitnami/charts/commit/5413120bb281c0c531ed2cf431cb316dc356e977)) diff --git a/postgresql/Chart.lock b/postgresql/Chart.lock new file mode 100644 index 0000000..40b1a5b --- /dev/null +++ b/postgresql/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: common + repository: oci://registry-1.docker.io/bitnamicharts + version: 2.31.3 +digest: sha256:f9c314553215490ea1b94c70082cb152d6ff5916ce185b4e00f5287f81545b4c +generated: "2025-06-26T09:30:36.196209+02:00" diff --git a/postgresql/Chart.yaml b/postgresql/Chart.yaml new file mode 100644 index 0000000..230e637 --- /dev/null +++ b/postgresql/Chart.yaml @@ -0,0 +1,41 @@ +# Copyright Broadcom, Inc. All Rights Reserved. +# SPDX-License-Identifier: APACHE-2.0 + +annotations: + category: Database + images: | + - name: os-shell + image: docker.io/bitnami/os-shell:12-debian-12-r50 + - name: postgres-exporter + image: docker.io/bitnami/postgres-exporter:0.17.1-debian-12-r14 + - name: postgresql + image: docker.io/bitnami/postgresql:17.5.0-debian-12-r20 + licenses: Apache-2.0 + tanzuCategory: service +apiVersion: v2 +appVersion: 17.5.0 +dependencies: +- name: common + repository: oci://registry-1.docker.io/bitnamicharts + tags: + - bitnami-common + version: 2.x.x +description: PostgreSQL (Postgres) is an open source object-relational database known + for reliability and data integrity. ACID-compliant, it supports foreign keys, joins, + views, triggers and stored procedures. +home: https://bitnami.com +icon: https://dyltqmyl993wv.cloudfront.net/assets/stacks/postgresql/img/postgresql-stack-220x234.png +keywords: +- postgresql +- postgres +- database +- sql +- replication +- cluster +maintainers: +- name: Broadcom, Inc. All Rights Reserved. + url: https://github.com/bitnami/charts +name: postgresql +sources: +- https://github.com/bitnami/charts/tree/main/bitnami/postgresql +version: 16.7.24 diff --git a/postgresql/README.md b/postgresql/README.md new file mode 100644 index 0000000..045e410 --- /dev/null +++ b/postgresql/README.md @@ -0,0 +1,1154 @@ + + +# Bitnami package for PostgreSQL + +PostgreSQL (Postgres) is an open source object-relational database known for reliability and data integrity. ACID-compliant, it supports foreign keys, joins, views, triggers and stored procedures. + +[Overview of PostgreSQL](http://www.postgresql.org) + +Trademarks: This software listing is packaged by Bitnami. The respective trademarks mentioned in the offering are owned by the respective companies, and use of them does not imply any affiliation or endorsement. + +## TL;DR + +```console +helm install my-release oci://registry-1.docker.io/bitnamicharts/postgresql +``` + +> Tip: Did you know that this app is also available as a Kubernetes App on the Azure Marketplace? Kubernetes Apps are the easiest way to deploy Bitnami on AKS. Click [here](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/bitnami.postgresql-cnab) to see the listing on Azure Marketplace. + +Looking to use PostgreSQL in production? Try [VMware Tanzu Application Catalog](https://bitnami.com/enterprise), the commercial edition of the Bitnami catalog. + +## ⚠️ Important Notice: Upcoming changes to the Bitnami Catalog + +Beginning August 28th, 2025, Bitnami will evolve its public catalog to offer a curated set of hardened, security-focused images under the new [Bitnami Secure Images initiative](https://news.broadcom.com/app-dev/broadcom-introduces-bitnami-secure-images-for-production-ready-containerized-applications). As part of this transition: + +- Granting community users access for the first time to security-optimized versions of popular container images. +- Bitnami will begin deprecating support for non-hardened, Debian-based software images in its free tier and will gradually remove non-latest tags from the public catalog. As a result, community users will have access to a reduced number of hardened images. These images are published only under the “latest” tag and are intended for development purposes +- Starting August 28th, over two weeks, all existing container images, including older or versioned tags (e.g., 2.50.0, 10.6), will be migrated from the public catalog (docker.io/bitnami) to the “Bitnami Legacy” repository (docker.io/bitnamilegacy), where they will no longer receive updates. +- For production workloads and long-term support, users are encouraged to adopt Bitnami Secure Images, which include hardened containers, smaller attack surfaces, CVE transparency (via VEX/KEV), SBOMs, and enterprise support. + +These changes aim to improve the security posture of all Bitnami users by promoting best practices for software supply chain integrity and up-to-date deployments. For more details, visit the [Bitnami Secure Images announcement](https://github.com/bitnami/containers/issues/83267). + +## Introduction + +This chart bootstraps a [PostgreSQL](https://github.com/bitnami/containers/tree/main/bitnami/postgresql) deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +For HA, please see [this repo](https://github.com/bitnami/charts/tree/main/bitnami/postgresql-ha) + +## Prerequisites + +- Kubernetes 1.23+ +- Helm 3.8.0+ +- PV provisioner support in the underlying infrastructure + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +helm install my-release oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql +``` + +> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. + +The command deploys PostgreSQL on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation. + +> **Tip**: List all releases using `helm list` + +## Configuration and installation details + +### Resource requests and limits + +Bitnami charts allow setting resource requests and limits for all containers inside the chart deployment. These are inside the `resources` value (check parameter table). Setting requests is essential for production workloads and these should be adapted to your specific use case. + +To make this process easier, the chart contains the `resourcesPreset` values, which automatically sets the `resources` section according to different presets. Check these presets in [the bitnami/common chart](https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15). However, in production workloads using `resourcesPreset` is discouraged as it may not fully adapt to your specific needs. Find more information on container resource management in the [official Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/). + +### Prometheus metrics + +This chart can be integrated with Prometheus by setting `metrics.enabled` to `true`. This will deploy a sidecar container with [postgres_exporter](https://github.com/prometheus-community/postgres_exporter) in all pods. It will also create `metrics` services that can be configured under the `metrics.service` section. These services will be have the necessary annotations to be automatically scraped by Prometheus. + +#### Prometheus requirements + +It is necessary to have a working installation of Prometheus or Prometheus Operator for the integration to work. Install the [Bitnami Prometheus helm chart](https://github.com/bitnami/charts/tree/main/bitnami/prometheus) or the [Bitnami Kube Prometheus helm chart](https://github.com/bitnami/charts/tree/main/bitnami/kube-prometheus) to easily have a working Prometheus in your cluster. + +#### Integration with Prometheus Operator + +The chart can deploy `ServiceMonitor` objects for integration with Prometheus Operator installations. To do so, set the value `metrics.serviceMonitor.enabled=true`. Ensure that the Prometheus Operator `CustomResourceDefinitions` are installed in the cluster or it will fail with the following error: + +```text +no matches for kind "ServiceMonitor" in version "monitoring.coreos.com/v1" +``` + +Install the [Bitnami Kube Prometheus helm chart](https://github.com/bitnami/charts/tree/main/bitnami/kube-prometheus) for having the necessary CRDs and the Prometheus Operator. + +### [Rolling VS Immutable tags](https://techdocs.broadcom.com/us/en/vmware-tanzu/application-catalog/tanzu-application-catalog/services/tac-doc/apps-tutorials-understand-rolling-tags-containers-index.html) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + +### Customizing primary and read replica services in a replicated configuration + +At the top level, there is a service object which defines the services for both primary and readReplicas. For deeper customization, there are service objects for both the primary and read types individually. This allows you to override the values in the top level service object so that the primary and read can be of different service types and with different clusterIPs / nodePorts. Also in the case you want the primary and read to be of type nodePort, you will need to set the nodePorts to different values to prevent a collision. The values that are deeper in the primary.service or readReplicas.service objects will take precedence over the top level service object. + +### Use a different PostgreSQL version + +To modify the application version used in this chart, specify a different version of the image using the `image.tag` parameter and/or a different repository using the `image.repository` parameter. + +### LDAP + +LDAP support can be enabled in the chart by specifying the `ldap.` parameters while creating a release. The following parameters should be configured to properly enable the LDAP support in the chart. + +- **ldap.enabled**: Enable LDAP support. Defaults to `false`. +- **ldap.uri**: LDAP URL beginning in the form `ldap[s]://:`. No defaults. +- **ldap.base**: LDAP base DN. No defaults. +- **ldap.binddn**: LDAP bind DN. No defaults. +- **ldap.bindpw**: LDAP bind password. No defaults. +- **ldap.bslookup**: LDAP base lookup. No defaults. +- **ldap.nss_initgroups_ignoreusers**: LDAP ignored users. `root,nslcd`. +- **ldap.scope**: LDAP search scope. No defaults. +- **ldap.tls_reqcert**: LDAP TLS check on server certificates. No defaults. + +For example: + +```text +ldap.enabled="true" +ldap.uri="ldap://my_ldap_server" +ldap.base="dc=example\,dc=org" +ldap.binddn="cn=admin\,dc=example\,dc=org" +ldap.bindpw="admin" +ldap.bslookup="ou=group-ok\,dc=example\,dc=org" +ldap.nss_initgroups_ignoreusers="root\,nslcd" +ldap.scope="sub" +ldap.tls_reqcert="demand" +``` + +Next, login to the PostgreSQL server using the `psql` client and add the PAM authenticated LDAP users. + +> Note: Parameters including commas must be escaped as shown in the above example. + +### Update credentials + +Bitnami charts, with its default settings, configure credentials at first boot. Any further change in the secrets or credentials can be done using one of the following methods: + +### Manual update of the passwords and secrets + +- Update the user password following [the upstream documentation](https://www.postgresql.org/docs/current/sql-alteruser.html) +- Update the password secret with the new values (replace the SECRET_NAME, PASSWORD and POSTGRES_PASSWORD placeholders) + +```shell +kubectl create secret generic SECRET_NAME --from-literal=password=PASSWORD --from-literal=postgres-password=POSTGRES_PASSWORD --dry-run -o yaml | kubectl apply -f - +``` + +### Automated update using a password update job + +The Bitnami PostgreSQL provides a password update job that will automatically change the PostgreSQL passwords when running helm upgrade. To enable the job set `passwordUpdateJob.enabled=true`. This job requires: + +- The new passwords: this is configured using either `auth.postgresPassword`, `auth.password` and `auth.replicationPassword` (if applicable) or setting `auth.existingSecret`. +- The previous passwords: This value is taken automatically from already deployed secret object. If you are using `auth.existingSecret` or `helm template` instead of `helm upgrade`, then set either `passwordUpdateJob.previousPasswords.postgresPassword`, `passwordUpdateJob.previousPasswords.password`, `passwordUpdateJob.previousPasswords.replicationPassword` (when applicable), or setting `passwordUpdateJob.previousPasswords.existingSecret`. + +In the following example we update the password via values.yaml in a PostgreSQL installation with replication + +```yaml +architecture: "replication" + +auth: + user: "user" + postgresPassword: "newPostgresPassword123" + password: "newUserPassword123" + replicationPassword: "newReplicationPassword123" + +passwordUpdateJob: + enabled: true +``` + +In this example we use two existing secrets (`new-password-secret` and `previous-password-secret`) to update the passwords: + +```yaml +auth: + existingSecret: new-password-secret + +passwordUpdateJob: + enabled: true + previousPasswords: + existingSecret: previous-password-secret +``` + +You can add extra update commands using the `passwordUpdateJob.extraCommands` value. + +### postgresql.conf / pg_hba.conf files as configMap + +This helm chart also supports to customize the PostgreSQL configuration file. You can add additional PostgreSQL configuration parameters using the `primary.extendedConfiguration`/`readReplicas.extendedConfiguration` parameters as a string. Alternatively, to replace the entire default configuration use `primary.configuration`. + +You can also add a custom pg_hba.conf using the `primary.pgHbaConfiguration` parameter. + +In addition to these options, you can also set an external ConfigMap with all the configuration files. This is done by setting the `primary.existingConfigmap` parameter. Note that this will override the two previous options. + +### Initialize a fresh instance + +The [Bitnami PostgreSQL](https://github.com/bitnami/containers/tree/main/bitnami/postgresql) image allows you to use your custom scripts to initialize a fresh instance. In order to execute the scripts, you can specify custom scripts using the `primary.initdb.scripts` parameter as a string. + +In addition, you can also set an external ConfigMap with all the initialization scripts. This is done by setting the `primary.initdb.scriptsConfigMap` parameter. Note that this will override the two previous options. If your initialization scripts contain sensitive information such as credentials or passwords, you can use the `primary.initdb.scriptsSecret` parameter. + +The allowed extensions are `.sh`, `.sql` and `.sql.gz`. + +### Securing traffic using TLS + +TLS support can be enabled in the chart by specifying the `tls.` parameters while creating a release. The following parameters should be configured to properly enable the TLS support in the chart: + +- `tls.enabled`: Enable TLS support. Defaults to `false` +- `tls.certificatesSecret`: Name of an existing secret that contains the certificates. No defaults. +- `tls.certFilename`: Certificate filename. No defaults. +- `tls.certKeyFilename`: Certificate key filename. No defaults. + +For example: + +- First, create the secret with the cetificates files: + + ```console + kubectl create secret generic certificates-tls-secret --from-file=./cert.crt --from-file=./cert.key --from-file=./ca.crt + ``` + +- Then, use the following parameters: + + ```console + volumePermissions.enabled=true + tls.enabled=true + tls.certificatesSecret="certificates-tls-secret" + tls.certFilename="cert.crt" + tls.certKeyFilename="cert.key" + ``` + + > Note TLS and VolumePermissions: PostgreSQL requires certain permissions on sensitive files (such as certificate keys) to start up. Due to an on-going [issue](https://github.com/kubernetes/kubernetes/issues/57923) regarding kubernetes permissions and the use of `containerSecurityContext.runAsUser`, you must enable `volumePermissions` to ensure everything works as expected. + +### Sidecars + +If you need additional containers to run within the same pod as PostgreSQL (e.g. an additional metrics or logging exporter), you can do so via the `sidecars` config parameter. Simply define your container according to the Kubernetes container spec. + +```yaml +# For the PostgreSQL primary +primary: + sidecars: + - name: your-image-name + image: your-image + imagePullPolicy: Always + ports: + - name: portname + containerPort: 1234 +# For the PostgreSQL replicas +readReplicas: + sidecars: + - name: your-image-name + image: your-image + imagePullPolicy: Always + ports: + - name: portname + containerPort: 1234 +``` + +### Metrics + +The chart optionally can start a metrics exporter for [prometheus](https://prometheus.io). The metrics endpoint (port 9187) is not exposed and it is expected that the metrics are collected from inside the k8s cluster using something similar as the described in the [example Prometheus scrape configuration](https://github.com/prometheus/prometheus/blob/master/documentation/examples/prometheus-kubernetes.yml). + +The exporter allows to create custom metrics from additional SQL queries. See the Chart's `values.yaml` for an example and consult the [exporters documentation](https://github.com/wrouesnel/postgres_exporter#adding-new-metrics-via-a-config-file) for more details. + +### Use of global variables + +In more complex scenarios, we may have the following tree of dependencies + +```text + +--------------+ + | | + +------------+ Chart 1 +-----------+ + | | | | + | --------+------+ | + | | | + | | | + | | | + | | | + v v v ++-------+------+ +--------+------+ +--------+------+ +| | | | | | +| PostgreSQL | | Sub-chart 1 | | Sub-chart 2 | +| | | | | | ++--------------+ +---------------+ +---------------+ +``` + +The three charts below depend on the parent chart Chart 1. However, subcharts 1 and 2 may need to connect to PostgreSQL as well. In order to do so, subcharts 1 and 2 need to know the PostgreSQL credentials, so one option for deploying could be deploy Chart 1 with the following parameters: + +```text +postgresql.auth.username=testuser +subchart1.postgresql.auth.username=testuser +subchart2.postgresql.auth.username=testuser +postgresql.auth.password=testpass +subchart1.postgresql.auth.password=testpass +subchart2.postgresql.auth.password=testpass +postgresql.auth.database=testdb +subchart1.postgresql.auth.database=testdb +subchart2.postgresql.auth.database=testdb +``` + +If the number of dependent sub-charts increases, installing the chart with parameters can become increasingly difficult. An alternative would be to set the credentials using global variables as follows: + +```text +global.postgresql.auth.username=testuser +global.postgresql.auth.password=testpass +global.postgresql.auth.database=testdb +``` + +This way, the credentials will be available in all of the subcharts. + +### Backup and restore + +To back up and restore Bitnami PostgreSQL Helm chart deployments on Kubernetes, you need to back up the persistent volumes from the source deployment and attach them to a new deployment using [Velero](https://velero.io/), a Kubernetes backup/restore tool. + +These are the steps you will usually follow to back up and restore your PostgreSQL cluster data: + +- Install Velero on the source and destination clusters. +- Use Velero to back up the PersistentVolumes (PVs) used by the deployment on the source cluster. +- Use Velero to restore the backed-up PVs on the destination cluster. +- Create a new deployment on the destination cluster with the same chart, deployment name, credentials and other parameters as the original. This new deployment will use the restored PVs and hence the original data. + +Refer to our detailed [tutorial on backing up and restoring PostgreSQL deployments on Kubernetes](https://techdocs.broadcom.com/us/en/vmware-tanzu/application-catalog/tanzu-application-catalog/services/tac-doc/apps-tutorials-migrate-data-tac-velero-index.html) for more information. + +### NetworkPolicy + +To enable network policy for PostgreSQL, install [a networking plugin that implements the Kubernetes NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), and set `networkPolicy.enabled` to `true`. + +For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting the DefaultDeny namespace annotation. Note: this will enforce policy for _all_ pods in the namespace: + +```console +kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" +``` + +With NetworkPolicy enabled, traffic will be limited to just port 5432. + +For more precise policy, set `networkPolicy.allowExternal=false`. This will only allow pods with the generated client label to connect to PostgreSQL. +This label will be displayed in the output of a successful install. + +### Differences between Bitnami PostgreSQL image and [Docker Official](https://hub.docker.com/_/postgres) image + +- The Docker Official PostgreSQL image does not support replication. If you pass any replication environment variable, this would be ignored. The only environment variables supported by the Docker Official image are POSTGRES_USER, POSTGRES_DB, POSTGRES_PASSWORD, POSTGRES_INITDB_ARGS, POSTGRES_INITDB_WALDIR and PGDATA. All the remaining environment variables are specific to the Bitnami PostgreSQL image. +- The Bitnami PostgreSQL image is non-root by default. This requires that you run the pod with `securityContext` and updates the permissions of the volume with an `initContainer`. A key benefit of this configuration is that the pod follows security best practices and is prepared to run on Kubernetes distributions with hard security constraints like OpenShift. +- For OpenShift up to 4.10, let set the volume permissions, security context, runAsUser and fsGroup automatically by OpenShift and disable the predefined settings of the helm chart: primary.securityContext.enabled=false,primary.containerSecurityContext.enabled=false,volumePermissions.enabled=false,shmVolume.enabled=false +- For OpenShift 4.11 and higher, let set OpenShift the runAsUser and fsGroup automatically. Configure the pod and container security context to restrictive defaults and disable the volume permissions setup: primary. + podSecurityContext.fsGroup=null,primary.podSecurityContext.seccompProfile.type=RuntimeDefault,primary.containerSecurityContext.runAsUser=null,primary.containerSecurityContext.allowPrivilegeEscalation=false,primary.containerSecurityContext.runAsNonRoot=true,primary.containerSecurityContext.seccompProfile.type=RuntimeDefault,primary.containerSecurityContext.capabilities.drop=['ALL'],volumePermissions.enabled=false,shmVolume.enabled=false + +### Setting Pod's affinity + +This chart allows you to set your custom affinity using the `XXX.affinity` parameter(s). Find more information about Pod's affinity in the [kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity). + +As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/main/bitnami/common#affinities) chart. To do so, set the `XXX.podAffinityPreset`, `XXX.podAntiAffinityPreset`, or `XXX.nodeAffinityPreset` parameters. + +## Persistence + +The [Bitnami PostgreSQL](https://github.com/bitnami/containers/tree/main/bitnami/postgresql) image stores the PostgreSQL data and configurations at the `/bitnami/postgresql` path of the container. + +Persistent Volume Claims are used to keep the data across deployments. This is known to work in GCE, AWS, and minikube. +See the [Parameters](#parameters) section to configure the PVC or to disable persistence. + +If you already have data in it, you will fail to sync to standby nodes for all commits, details can refer to the [code present in the container repository](https://github.com/bitnami/containers/tree/main/bitnami/postgresql). If you need to use those data, please covert them to sql and import after `helm install` finished. + +## Parameters + +### Global parameters + +| Name | Description | Value | +| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | +| `global.imageRegistry` | Global Docker image registry | `""` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | +| `global.defaultStorageClass` | Global default StorageClass for Persistent Volume(s) | `""` | +| `global.storageClass` | DEPRECATED: use global.defaultStorageClass instead | `""` | +| `global.security.allowInsecureImages` | Allows skipping image verification | `false` | +| `global.postgresql.fullnameOverride` | Full chart name (overrides `fullnameOverride`) | `""` | +| `global.postgresql.auth.postgresPassword` | Password for the "postgres" admin user (overrides `auth.postgresPassword`) | `""` | +| `global.postgresql.auth.username` | Name for a custom user to create (overrides `auth.username`) | `""` | +| `global.postgresql.auth.password` | Password for the custom user to create (overrides `auth.password`) | `""` | +| `global.postgresql.auth.database` | Name for a custom database to create (overrides `auth.database`) | `""` | +| `global.postgresql.auth.existingSecret` | Name of existing secret to use for PostgreSQL credentials (overrides `auth.existingSecret`). | `""` | +| `global.postgresql.auth.secretKeys.adminPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.adminPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. | `""` | +| `global.postgresql.auth.secretKeys.userPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.userPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. | `""` | +| `global.postgresql.auth.secretKeys.replicationPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.replicationPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. | `""` | +| `global.postgresql.service.ports.postgresql` | PostgreSQL service port (overrides `service.ports.postgresql`) | `""` | +| `global.compatibility.openshift.adaptSecurityContext` | Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) | `auto` | + +### Common parameters + +| Name | Description | Value | +| ------------------------ | -------------------------------------------------------------------------------------------- | --------------- | +| `kubeVersion` | Override Kubernetes version | `""` | +| `nameOverride` | String to partially override common.names.fullname template (will maintain the release name) | `""` | +| `fullnameOverride` | String to fully override common.names.fullname template | `""` | +| `namespaceOverride` | String to fully override common.names.namespace | `""` | +| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` | +| `extraDeploy` | Array of extra objects to deploy with the release (evaluated as a template) | `[]` | +| `commonLabels` | Add labels to all the deployed resources | `{}` | +| `commonAnnotations` | Add annotations to all the deployed resources | `{}` | +| `secretAnnotations` | Add annotations to the secrets | `{}` | +| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | +| `diagnosticMode.command` | Command to override all containers in the statefulset | `["sleep"]` | +| `diagnosticMode.args` | Args to override all containers in the statefulset | `["infinity"]` | + +### PostgreSQL common parameters + +| Name | Description | Value | +| ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | +| `image.registry` | PostgreSQL image registry | `REGISTRY_NAME` | +| `image.repository` | PostgreSQL image repository | `REPOSITORY_NAME/postgresql` | +| `image.digest` | PostgreSQL image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `image.pullPolicy` | PostgreSQL image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify image pull secrets | `[]` | +| `image.debug` | Specify if debug values should be set | `false` | +| `auth.enablePostgresUser` | Assign a password to the "postgres" admin user. Otherwise, remote access will be blocked for this user | `true` | +| `auth.postgresPassword` | Password for the "postgres" admin user. Ignored if `auth.existingSecret` is provided | `""` | +| `auth.username` | Name for a custom user to create | `""` | +| `auth.password` | Password for the custom user to create. Ignored if `auth.existingSecret` is provided | `""` | +| `auth.database` | Name for a custom database to create | `""` | +| `auth.replicationUsername` | Name of the replication user | `repl_user` | +| `auth.replicationPassword` | Password for the replication user. Ignored if `auth.existingSecret` is provided | `""` | +| `auth.existingSecret` | Name of existing secret to use for PostgreSQL credentials. `auth.postgresPassword`, `auth.password`, and `auth.replicationPassword` will be ignored and picked up from this secret. The secret might also contains the key `ldap-password` if LDAP is enabled. `ldap.bind_password` will be ignored and picked from this secret in this case. | `""` | +| `auth.secretKeys.adminPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. | `postgres-password` | +| `auth.secretKeys.userPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. | `password` | +| `auth.secretKeys.replicationPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. | `replication-password` | +| `auth.usePasswordFiles` | Mount credentials as a files instead of using an environment variable | `true` | +| `architecture` | PostgreSQL architecture (`standalone` or `replication`) | `standalone` | +| `replication.synchronousCommit` | Set synchronous commit mode. Allowed values: `on`, `remote_apply`, `remote_write`, `local` and `off` | `off` | +| `replication.numSynchronousReplicas` | Number of replicas that will have synchronous replication. Note: Cannot be greater than `readReplicas.replicaCount`. | `0` | +| `replication.applicationName` | Cluster application name. Useful for advanced replication settings | `my_application` | +| `containerPorts.postgresql` | PostgreSQL container port | `5432` | +| `audit.logHostname` | Log client hostnames | `false` | +| `audit.logConnections` | Add client log-in operations to the log file | `false` | +| `audit.logDisconnections` | Add client log-outs operations to the log file | `false` | +| `audit.pgAuditLog` | Add operations to log using the pgAudit extension | `""` | +| `audit.pgAuditLogCatalog` | Log catalog using pgAudit | `off` | +| `audit.clientMinMessages` | Message log level to share with the user | `error` | +| `audit.logLinePrefix` | Template for log line prefix (default if not set) | `""` | +| `audit.logTimezone` | Timezone for the log timestamps | `""` | +| `ldap.enabled` | Enable LDAP support | `false` | +| `ldap.server` | IP address or name of the LDAP server. | `""` | +| `ldap.port` | Port number on the LDAP server to connect to | `""` | +| `ldap.prefix` | String to prepend to the user name when forming the DN to bind | `""` | +| `ldap.suffix` | String to append to the user name when forming the DN to bind | `""` | +| `ldap.basedn` | Root DN to begin the search for the user in | `""` | +| `ldap.binddn` | DN of user to bind to LDAP | `""` | +| `ldap.bindpw` | Password for the user to bind to LDAP | `""` | +| `ldap.searchAttribute` | Attribute to match against the user name in the search | `""` | +| `ldap.searchFilter` | The search filter to use when doing search+bind authentication | `""` | +| `ldap.scheme` | Set to `ldaps` to use LDAPS | `""` | +| `ldap.tls.enabled` | Se to true to enable TLS encryption | `false` | +| `ldap.uri` | LDAP URL beginning in the form `ldap[s]://host[:port]/basedn`. If provided, all the other LDAP parameters will be ignored. | `""` | +| `postgresqlDataDir` | PostgreSQL data dir folder | `/bitnami/postgresql/data` | +| `postgresqlSharedPreloadLibraries` | Shared preload libraries (comma-separated list) | `pgaudit` | +| `shmVolume.enabled` | Enable emptyDir volume for /dev/shm for PostgreSQL pod(s) | `true` | +| `shmVolume.sizeLimit` | Set this to enable a size limit on the shm tmpfs | `""` | +| `tls.enabled` | Enable TLS traffic support | `false` | +| `tls.autoGenerated` | Generate automatically self-signed TLS certificates | `false` | +| `tls.preferServerCiphers` | Whether to use the server's TLS cipher preferences rather than the client's | `true` | +| `tls.certificatesSecret` | Name of an existing secret that contains the certificates | `""` | +| `tls.certFilename` | Certificate filename | `""` | +| `tls.certKeyFilename` | Certificate key filename | `""` | +| `tls.certCAFilename` | CA Certificate filename | `""` | +| `tls.crlFilename` | File containing a Certificate Revocation List | `""` | + +### PostgreSQL Primary parameters + +| Name | Description | Value | +| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- | +| `primary.name` | Name of the primary database (eg primary, master, leader, ...) | `primary` | +| `primary.configuration` | PostgreSQL Primary main configuration to be injected as ConfigMap | `""` | +| `primary.pgHbaConfiguration` | PostgreSQL Primary client authentication configuration | `""` | +| `primary.existingConfigmap` | Name of an existing ConfigMap with PostgreSQL Primary configuration | `""` | +| `primary.extendedConfiguration` | Extended PostgreSQL Primary configuration (appended to main or default configuration) | `""` | +| `primary.existingExtendedConfigmap` | Name of an existing ConfigMap with PostgreSQL Primary extended configuration | `""` | +| `primary.initdb.args` | PostgreSQL initdb extra arguments | `""` | +| `primary.initdb.postgresqlWalDir` | Specify a custom location for the PostgreSQL transaction log | `""` | +| `primary.initdb.scripts` | Dictionary of initdb scripts | `{}` | +| `primary.initdb.scriptsConfigMap` | ConfigMap with scripts to be run at first boot | `""` | +| `primary.initdb.scriptsSecret` | Secret with scripts to be run at first boot (in case it contains sensitive information) | `""` | +| `primary.initdb.user` | Specify the PostgreSQL username to execute the initdb scripts | `""` | +| `primary.initdb.password` | Specify the PostgreSQL password to execute the initdb scripts | `""` | +| `primary.preInitDb.scripts` | Dictionary of pre-init scripts | `{}` | +| `primary.preInitDb.scriptsConfigMap` | ConfigMap with pre-init scripts to be run | `""` | +| `primary.preInitDb.scriptsSecret` | Secret with pre-init scripts to be run | `""` | +| `primary.standby.enabled` | Whether to enable current cluster's primary as standby server of another cluster or not | `false` | +| `primary.standby.primaryHost` | The Host of replication primary in the other cluster | `""` | +| `primary.standby.primaryPort` | The Port of replication primary in the other cluster | `""` | +| `primary.extraEnvVars` | Array with extra environment variables to add to PostgreSQL Primary nodes | `[]` | +| `primary.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for PostgreSQL Primary nodes | `""` | +| `primary.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for PostgreSQL Primary nodes | `""` | +| `primary.command` | Override default container command (useful when using custom images) | `[]` | +| `primary.args` | Override default container args (useful when using custom images) | `[]` | +| `primary.livenessProbe.enabled` | Enable livenessProbe on PostgreSQL Primary containers | `true` | +| `primary.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | +| `primary.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `primary.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `primary.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `primary.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `primary.readinessProbe.enabled` | Enable readinessProbe on PostgreSQL Primary containers | `true` | +| `primary.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `primary.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `primary.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `primary.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `primary.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `primary.startupProbe.enabled` | Enable startupProbe on PostgreSQL Primary containers | `false` | +| `primary.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `30` | +| `primary.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `primary.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `primary.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `primary.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `primary.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `primary.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `primary.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `primary.lifecycleHooks` | for the PostgreSQL Primary container to automate configuration before or after startup | `{}` | +| `primary.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if primary.resources is set (primary.resources is recommended for production). | `nano` | +| `primary.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `primary.podSecurityContext.enabled` | Enable security context | `true` | +| `primary.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | +| `primary.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | +| `primary.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | +| `primary.podSecurityContext.fsGroup` | Group ID for the pod | `1001` | +| `primary.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | +| `primary.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `primary.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | +| `primary.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | +| `primary.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | +| `primary.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | +| `primary.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | +| `primary.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | +| `primary.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | +| `primary.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `primary.automountServiceAccountToken` | Mount Service Account token in pod | `false` | +| `primary.hostAliases` | PostgreSQL primary pods host aliases | `[]` | +| `primary.hostNetwork` | Specify if host network should be enabled for PostgreSQL pod (postgresql primary) | `false` | +| `primary.hostIPC` | Specify if host IPC should be enabled for PostgreSQL pod (postgresql primary) | `false` | +| `primary.labels` | Map of labels to add to the statefulset (postgresql primary) | `{}` | +| `primary.annotations` | Annotations for PostgreSQL primary pods | `{}` | +| `primary.podLabels` | Map of labels to add to the pods (postgresql primary) | `{}` | +| `primary.podAnnotations` | Map of annotations to add to the pods (postgresql primary) | `{}` | +| `primary.podAffinityPreset` | PostgreSQL primary pod affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `primary.podAntiAffinityPreset` | PostgreSQL primary pod anti-affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `primary.nodeAffinityPreset.type` | PostgreSQL primary node affinity preset type. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `primary.nodeAffinityPreset.key` | PostgreSQL primary node label key to match Ignored if `primary.affinity` is set. | `""` | +| `primary.nodeAffinityPreset.values` | PostgreSQL primary node label values to match. Ignored if `primary.affinity` is set. | `[]` | +| `primary.affinity` | Affinity for PostgreSQL primary pods assignment | `{}` | +| `primary.nodeSelector` | Node labels for PostgreSQL primary pods assignment | `{}` | +| `primary.tolerations` | Tolerations for PostgreSQL primary pods assignment | `[]` | +| `primary.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `[]` | +| `primary.priorityClassName` | Priority Class to use for each pod (postgresql primary) | `""` | +| `primary.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | +| `primary.terminationGracePeriodSeconds` | Seconds PostgreSQL primary pod needs to terminate gracefully | `""` | +| `primary.updateStrategy.type` | PostgreSQL Primary statefulset strategy type | `RollingUpdate` | +| `primary.updateStrategy.rollingUpdate` | PostgreSQL Primary statefulset rolling update configuration parameters | `{}` | +| `primary.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the PostgreSQL Primary container(s) | `[]` | +| `primary.extraVolumes` | Optionally specify extra list of additional volumes for the PostgreSQL Primary pod(s) | `[]` | +| `primary.sidecars` | Add additional sidecar containers to the PostgreSQL Primary pod(s) | `[]` | +| `primary.initContainers` | Add additional init containers to the PostgreSQL Primary pod(s) | `[]` | +| `primary.pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` | +| `primary.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` | +| `primary.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `primary.pdb.minAvailable` and `primary.pdb.maxUnavailable` are empty. | `""` | +| `primary.extraPodSpec` | Optionally specify extra PodSpec for the PostgreSQL Primary pod(s) | `{}` | +| `primary.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | +| `primary.networkPolicy.allowExternal` | Don't require server label for connections | `true` | +| `primary.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | +| `primary.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `primary.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `primary.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` | +| `primary.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` | +| `primary.service.type` | Kubernetes Service type | `ClusterIP` | +| `primary.service.ports.postgresql` | PostgreSQL service port | `5432` | +| `primary.service.nodePorts.postgresql` | Node port for PostgreSQL | `""` | +| `primary.service.clusterIP` | Static clusterIP or None for headless services | `""` | +| `primary.service.labels` | Map of labels to add to the primary service | `{}` | +| `primary.service.annotations` | Annotations for PostgreSQL primary service | `{}` | +| `primary.service.loadBalancerClass` | Load balancer class if service type is `LoadBalancer` | `""` | +| `primary.service.loadBalancerIP` | Load balancer IP if service type is `LoadBalancer` | `""` | +| `primary.service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | +| `primary.service.loadBalancerSourceRanges` | Addresses that are allowed when service is LoadBalancer | `[]` | +| `primary.service.extraPorts` | Extra ports to expose in the PostgreSQL primary service | `[]` | +| `primary.service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | +| `primary.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | +| `primary.service.headless.annotations` | Additional custom annotations for headless PostgreSQL primary service | `{}` | +| `primary.persistence.enabled` | Enable PostgreSQL Primary data persistence using PVC | `true` | +| `primary.persistence.volumeName` | Name to assign the volume | `data` | +| `primary.persistence.existingClaim` | Name of an existing PVC to use | `""` | +| `primary.persistence.mountPath` | The path the volume will be mounted at | `/bitnami/postgresql` | +| `primary.persistence.subPath` | The subdirectory of the volume to mount to | `""` | +| `primary.persistence.storageClass` | PVC Storage Class for PostgreSQL Primary data volume | `""` | +| `primary.persistence.accessModes` | PVC Access Mode for PostgreSQL volume | `["ReadWriteOnce"]` | +| `primary.persistence.size` | PVC Storage Request for PostgreSQL volume | `8Gi` | +| `primary.persistence.annotations` | Annotations for the PVC | `{}` | +| `primary.persistence.labels` | Labels for the PVC | `{}` | +| `primary.persistence.selector` | Selector to match an existing Persistent Volume (this value is evaluated as a template) | `{}` | +| `primary.persistence.dataSource` | Custom PVC data source | `{}` | +| `primary.persistentVolumeClaimRetentionPolicy.enabled` | Enable Persistent volume retention policy for Primary Statefulset | `false` | +| `primary.persistentVolumeClaimRetentionPolicy.whenScaled` | Volume retention behavior when the replica count of the StatefulSet is reduced | `Retain` | +| `primary.persistentVolumeClaimRetentionPolicy.whenDeleted` | Volume retention behavior that applies when the StatefulSet is deleted | `Retain` | + +### PostgreSQL read only replica parameters (only used when `architecture` is set to `replication`) + +| Name | Description | Value | +| ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- | +| `readReplicas.name` | Name of the read replicas database (eg secondary, slave, ...) | `read` | +| `readReplicas.replicaCount` | Number of PostgreSQL read only replicas | `1` | +| `readReplicas.extendedConfiguration` | Extended PostgreSQL read only replicas configuration (appended to main or default configuration) | `""` | +| `readReplicas.extraEnvVars` | Array with extra environment variables to add to PostgreSQL read only nodes | `[]` | +| `readReplicas.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for PostgreSQL read only nodes | `""` | +| `readReplicas.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for PostgreSQL read only nodes | `""` | +| `readReplicas.command` | Override default container command (useful when using custom images) | `[]` | +| `readReplicas.args` | Override default container args (useful when using custom images) | `[]` | +| `readReplicas.livenessProbe.enabled` | Enable livenessProbe on PostgreSQL read only containers | `true` | +| `readReplicas.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | +| `readReplicas.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `readReplicas.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `readReplicas.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `readReplicas.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `readReplicas.readinessProbe.enabled` | Enable readinessProbe on PostgreSQL read only containers | `true` | +| `readReplicas.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `readReplicas.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `readReplicas.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `readReplicas.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `readReplicas.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `readReplicas.startupProbe.enabled` | Enable startupProbe on PostgreSQL read only containers | `false` | +| `readReplicas.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `30` | +| `readReplicas.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `readReplicas.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `readReplicas.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `readReplicas.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `readReplicas.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `readReplicas.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `readReplicas.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `readReplicas.lifecycleHooks` | for the PostgreSQL read only container to automate configuration before or after startup | `{}` | +| `readReplicas.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if readReplicas.resources is set (readReplicas.resources is recommended for production). | `nano` | +| `readReplicas.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `readReplicas.podSecurityContext.enabled` | Enable security context | `true` | +| `readReplicas.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | +| `readReplicas.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | +| `readReplicas.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | +| `readReplicas.podSecurityContext.fsGroup` | Group ID for the pod | `1001` | +| `readReplicas.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | +| `readReplicas.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `readReplicas.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | +| `readReplicas.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | +| `readReplicas.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | +| `readReplicas.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | +| `readReplicas.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | +| `readReplicas.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | +| `readReplicas.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | +| `readReplicas.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `readReplicas.automountServiceAccountToken` | Mount Service Account token in pod | `false` | +| `readReplicas.hostAliases` | PostgreSQL read only pods host aliases | `[]` | +| `readReplicas.hostNetwork` | Specify if host network should be enabled for PostgreSQL pod (PostgreSQL read only) | `false` | +| `readReplicas.hostIPC` | Specify if host IPC should be enabled for PostgreSQL pod (postgresql primary) | `false` | +| `readReplicas.labels` | Map of labels to add to the statefulset (PostgreSQL read only) | `{}` | +| `readReplicas.annotations` | Annotations for PostgreSQL read only pods | `{}` | +| `readReplicas.podLabels` | Map of labels to add to the pods (PostgreSQL read only) | `{}` | +| `readReplicas.podAnnotations` | Map of annotations to add to the pods (PostgreSQL read only) | `{}` | +| `readReplicas.podAffinityPreset` | PostgreSQL read only pod affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `readReplicas.podAntiAffinityPreset` | PostgreSQL read only pod anti-affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `readReplicas.nodeAffinityPreset.type` | PostgreSQL read only node affinity preset type. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `readReplicas.nodeAffinityPreset.key` | PostgreSQL read only node label key to match Ignored if `primary.affinity` is set. | `""` | +| `readReplicas.nodeAffinityPreset.values` | PostgreSQL read only node label values to match. Ignored if `primary.affinity` is set. | `[]` | +| `readReplicas.affinity` | Affinity for PostgreSQL read only pods assignment | `{}` | +| `readReplicas.nodeSelector` | Node labels for PostgreSQL read only pods assignment | `{}` | +| `readReplicas.tolerations` | Tolerations for PostgreSQL read only pods assignment | `[]` | +| `readReplicas.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `[]` | +| `readReplicas.priorityClassName` | Priority Class to use for each pod (PostgreSQL read only) | `""` | +| `readReplicas.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | +| `readReplicas.terminationGracePeriodSeconds` | Seconds PostgreSQL read only pod needs to terminate gracefully | `""` | +| `readReplicas.updateStrategy.type` | PostgreSQL read only statefulset strategy type | `RollingUpdate` | +| `readReplicas.updateStrategy.rollingUpdate` | PostgreSQL read only statefulset rolling update configuration parameters | `{}` | +| `readReplicas.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the PostgreSQL read only container(s) | `[]` | +| `readReplicas.extraVolumes` | Optionally specify extra list of additional volumes for the PostgreSQL read only pod(s) | `[]` | +| `readReplicas.sidecars` | Add additional sidecar containers to the PostgreSQL read only pod(s) | `[]` | +| `readReplicas.initContainers` | Add additional init containers to the PostgreSQL read only pod(s) | `[]` | +| `readReplicas.pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` | +| `readReplicas.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` | +| `readReplicas.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `readReplicas.pdb.minAvailable` and `readReplicas.pdb.maxUnavailable` are empty. | `""` | +| `readReplicas.extraPodSpec` | Optionally specify extra PodSpec for the PostgreSQL read only pod(s) | `{}` | +| `readReplicas.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | +| `readReplicas.networkPolicy.allowExternal` | Don't require server label for connections | `true` | +| `readReplicas.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | +| `readReplicas.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `readReplicas.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `readReplicas.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` | +| `readReplicas.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` | +| `readReplicas.service.type` | Kubernetes Service type | `ClusterIP` | +| `readReplicas.service.ports.postgresql` | PostgreSQL service port | `5432` | +| `readReplicas.service.nodePorts.postgresql` | Node port for PostgreSQL | `""` | +| `readReplicas.service.clusterIP` | Static clusterIP or None for headless services | `""` | +| `readReplicas.service.labels` | Map of labels to add to the read service | `{}` | +| `readReplicas.service.annotations` | Annotations for PostgreSQL read only service | `{}` | +| `readReplicas.service.loadBalancerClass` | Load balancer class if service type is `LoadBalancer` | `""` | +| `readReplicas.service.loadBalancerIP` | Load balancer IP if service type is `LoadBalancer` | `""` | +| `readReplicas.service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | +| `readReplicas.service.loadBalancerSourceRanges` | Addresses that are allowed when service is LoadBalancer | `[]` | +| `readReplicas.service.extraPorts` | Extra ports to expose in the PostgreSQL read only service | `[]` | +| `readReplicas.service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | +| `readReplicas.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | +| `readReplicas.service.headless.annotations` | Additional custom annotations for headless PostgreSQL read only service | `{}` | +| `readReplicas.persistence.enabled` | Enable PostgreSQL read only data persistence using PVC | `true` | +| `readReplicas.persistence.existingClaim` | Name of an existing PVC to use | `""` | +| `readReplicas.persistence.mountPath` | The path the volume will be mounted at | `/bitnami/postgresql` | +| `readReplicas.persistence.subPath` | The subdirectory of the volume to mount to | `""` | +| `readReplicas.persistence.storageClass` | PVC Storage Class for PostgreSQL read only data volume | `""` | +| `readReplicas.persistence.accessModes` | PVC Access Mode for PostgreSQL volume | `["ReadWriteOnce"]` | +| `readReplicas.persistence.size` | PVC Storage Request for PostgreSQL volume | `8Gi` | +| `readReplicas.persistence.annotations` | Annotations for the PVC | `{}` | +| `readReplicas.persistence.labels` | Labels for the PVC | `{}` | +| `readReplicas.persistence.selector` | Selector to match an existing Persistent Volume (this value is evaluated as a template) | `{}` | +| `readReplicas.persistence.dataSource` | Custom PVC data source | `{}` | +| `readReplicas.persistentVolumeClaimRetentionPolicy.enabled` | Enable Persistent volume retention policy for read only Statefulset | `false` | +| `readReplicas.persistentVolumeClaimRetentionPolicy.whenScaled` | Volume retention behavior when the replica count of the StatefulSet is reduced | `Retain` | +| `readReplicas.persistentVolumeClaimRetentionPolicy.whenDeleted` | Volume retention behavior that applies when the StatefulSet is deleted | `Retain` | + +### Backup parameters + +| Name | Description | Value | +| ------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `backup.enabled` | Enable the logical dump of the database "regularly" | `false` | +| `backup.cronjob.schedule` | Set the cronjob parameter schedule | `@daily` | +| `backup.cronjob.timeZone` | Set the cronjob parameter timeZone | `""` | +| `backup.cronjob.concurrencyPolicy` | Set the cronjob parameter concurrencyPolicy | `Allow` | +| `backup.cronjob.failedJobsHistoryLimit` | Set the cronjob parameter failedJobsHistoryLimit | `1` | +| `backup.cronjob.successfulJobsHistoryLimit` | Set the cronjob parameter successfulJobsHistoryLimit | `3` | +| `backup.cronjob.startingDeadlineSeconds` | Set the cronjob parameter startingDeadlineSeconds | `""` | +| `backup.cronjob.ttlSecondsAfterFinished` | Set the cronjob parameter ttlSecondsAfterFinished | `""` | +| `backup.cronjob.restartPolicy` | Set the cronjob parameter restartPolicy | `OnFailure` | +| `backup.cronjob.podSecurityContext.enabled` | Enable PodSecurityContext for CronJob/Backup | `true` | +| `backup.cronjob.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | +| `backup.cronjob.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | +| `backup.cronjob.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | +| `backup.cronjob.podSecurityContext.fsGroup` | Group ID for the CronJob | `1001` | +| `backup.cronjob.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | +| `backup.cronjob.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `backup.cronjob.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | +| `backup.cronjob.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | +| `backup.cronjob.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | +| `backup.cronjob.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | +| `backup.cronjob.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | +| `backup.cronjob.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | +| `backup.cronjob.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | +| `backup.cronjob.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `backup.cronjob.command` | Set backup container's command to run | `["/bin/bash","-c","PGPASSWORD=\"${PGPASSWORD:-$(< \"$PGPASSWORD_FILE\")}\" pg_dumpall --clean --if-exists --load-via-partition-root --quote-all-identifiers --no-password --file=\"${PGDUMP_DIR}/pg_dumpall-$(date '+%Y-%m-%d-%H-%M').pgdump\""]` | +| `backup.cronjob.labels` | Set the cronjob labels | `{}` | +| `backup.cronjob.annotations` | Set the cronjob annotations | `{}` | +| `backup.cronjob.nodeSelector` | Node labels for PostgreSQL backup CronJob pod assignment | `{}` | +| `backup.cronjob.tolerations` | Tolerations for PostgreSQL backup CronJob pods assignment | `[]` | +| `backup.cronjob.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if backup.cronjob.resources is set (backup.cronjob.resources is recommended for production). | `nano` | +| `backup.cronjob.resources` | Set container requests and limits for different resources like CPU or memory | `{}` | +| `backup.cronjob.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | +| `backup.cronjob.storage.enabled` | Enable using a `PersistentVolumeClaim` as backup data volume | `true` | +| `backup.cronjob.storage.existingClaim` | Provide an existing `PersistentVolumeClaim` (only when `architecture=standalone`) | `""` | +| `backup.cronjob.storage.resourcePolicy` | Setting it to "keep" to avoid removing PVCs during a helm delete operation. Leaving it empty will delete PVCs after the chart deleted | `""` | +| `backup.cronjob.storage.storageClass` | PVC Storage Class for the backup data volume | `""` | +| `backup.cronjob.storage.accessModes` | PV Access Mode | `["ReadWriteOnce"]` | +| `backup.cronjob.storage.size` | PVC Storage Request for the backup data volume | `8Gi` | +| `backup.cronjob.storage.annotations` | PVC annotations | `{}` | +| `backup.cronjob.storage.mountPath` | Path to mount the volume at | `/backup/pgdump` | +| `backup.cronjob.storage.subPath` | Subdirectory of the volume to mount at | `""` | +| `backup.cronjob.storage.volumeClaimTemplates.selector` | A label query over volumes to consider for binding (e.g. when using local volumes) | `{}` | +| `backup.cronjob.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the backup container | `[]` | +| `backup.cronjob.extraVolumes` | Optionally specify extra list of additional volumes for the backup container | `[]` | + +### Password update job + +| Name | Description | Value | +| --------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- | +| `passwordUpdateJob.enabled` | Enable password update job | `false` | +| `passwordUpdateJob.backoffLimit` | set backoff limit of the job | `10` | +| `passwordUpdateJob.command` | Override default container command on mysql Primary container(s) (useful when using custom images) | `[]` | +| `passwordUpdateJob.args` | Override default container args on mysql Primary container(s) (useful when using custom images) | `[]` | +| `passwordUpdateJob.extraCommands` | Extra commands to pass to the generation job | `""` | +| `passwordUpdateJob.previousPasswords.postgresPassword` | Previous postgres password (set if the password secret was already changed) | `""` | +| `passwordUpdateJob.previousPasswords.password` | Previous password (set if the password secret was already changed) | `""` | +| `passwordUpdateJob.previousPasswords.replicationPassword` | Previous replication password (set if the password secret was already changed) | `""` | +| `passwordUpdateJob.previousPasswords.existingSecret` | Name of a secret containing the previous passwords (set if the password secret was already changed) | `""` | +| `passwordUpdateJob.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | +| `passwordUpdateJob.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `passwordUpdateJob.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | +| `passwordUpdateJob.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | +| `passwordUpdateJob.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | +| `passwordUpdateJob.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | +| `passwordUpdateJob.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | +| `passwordUpdateJob.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | +| `passwordUpdateJob.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | +| `passwordUpdateJob.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `passwordUpdateJob.podSecurityContext.enabled` | Enabled credential init job pods' Security Context | `true` | +| `passwordUpdateJob.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | +| `passwordUpdateJob.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | +| `passwordUpdateJob.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | +| `passwordUpdateJob.podSecurityContext.fsGroup` | Set credential init job pod's Security Context fsGroup | `1001` | +| `passwordUpdateJob.extraEnvVars` | Array containing extra env vars to configure the credential init job | `[]` | +| `passwordUpdateJob.extraEnvVarsCM` | ConfigMap containing extra env vars to configure the credential init job | `""` | +| `passwordUpdateJob.extraEnvVarsSecret` | Secret containing extra env vars to configure the credential init job (in case of sensitive data) | `""` | +| `passwordUpdateJob.extraVolumes` | Optionally specify extra list of additional volumes for the credential init job | `[]` | +| `passwordUpdateJob.extraVolumeMounts` | Array of extra volume mounts to be added to the jwt Container (evaluated as template). Normally used with `extraVolumes`. | `[]` | +| `passwordUpdateJob.initContainers` | Add additional init containers for the mysql Primary pod(s) | `[]` | +| `passwordUpdateJob.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if passwordUpdateJob.resources is set (passwordUpdateJob.resources is recommended for production). | `micro` | +| `passwordUpdateJob.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `passwordUpdateJob.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `passwordUpdateJob.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `passwordUpdateJob.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `passwordUpdateJob.automountServiceAccountToken` | Mount Service Account token in pod | `false` | +| `passwordUpdateJob.hostAliases` | Add deployment host aliases | `[]` | +| `passwordUpdateJob.annotations` | Add annotations to the job | `{}` | +| `passwordUpdateJob.podLabels` | Additional pod labels | `{}` | +| `passwordUpdateJob.podAnnotations` | Additional pod annotations | `{}` | + +### Volume Permissions parameters + +| Name | Description | Value | +| ---------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | +| `volumePermissions.enabled` | Enable init container that changes the owner and group of the persistent volume | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `REGISTRY_NAME` | +| `volumePermissions.image.repository` | Init container volume-permissions image repository | `REPOSITORY_NAME/os-shell` | +| `volumePermissions.image.digest` | Init container volume-permissions image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` | +| `volumePermissions.image.pullSecrets` | Init container volume-permissions image pull secrets | `[]` | +| `volumePermissions.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). | `nano` | +| `volumePermissions.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `volumePermissions.containerSecurityContext.runAsUser` | User ID for the init container | `0` | +| `volumePermissions.containerSecurityContext.runAsGroup` | Group ID for the init container | `0` | +| `volumePermissions.containerSecurityContext.runAsNonRoot` | runAsNonRoot for the init container | `false` | +| `volumePermissions.containerSecurityContext.seccompProfile.type` | seccompProfile.type for the init container | `RuntimeDefault` | + +### Other Parameters + +| Name | Description | Value | +| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ------- | +| `serviceBindings.enabled` | Create secret for service binding (Experimental) | `false` | +| `serviceAccount.create` | Enable creation of ServiceAccount for PostgreSQL pod | `true` | +| `serviceAccount.name` | The name of the ServiceAccount to use. | `""` | +| `serviceAccount.automountServiceAccountToken` | Allows auto mount of ServiceAccountToken on the serviceAccount created | `false` | +| `serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` | +| `rbac.create` | Create Role and RoleBinding (required for PSP to work) | `false` | +| `rbac.rules` | Custom RBAC rules to set | `[]` | +| `psp.create` | Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later | `false` | + +### Metrics Parameters + +| Name | Description | Value | +| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- | +| `metrics.enabled` | Start a prometheus exporter | `false` | +| `metrics.image.registry` | PostgreSQL Prometheus Exporter image registry | `REGISTRY_NAME` | +| `metrics.image.repository` | PostgreSQL Prometheus Exporter image repository | `REPOSITORY_NAME/postgres-exporter` | +| `metrics.image.digest` | PostgreSQL image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `metrics.image.pullPolicy` | PostgreSQL Prometheus Exporter image pull policy | `IfNotPresent` | +| `metrics.image.pullSecrets` | Specify image pull secrets | `[]` | +| `metrics.collectors` | Control enabled collectors | `{}` | +| `metrics.customMetrics` | Define additional custom metrics | `{}` | +| `metrics.extraEnvVars` | Extra environment variables to add to PostgreSQL Prometheus exporter | `[]` | +| `metrics.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | +| `metrics.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `metrics.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | +| `metrics.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | +| `metrics.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | +| `metrics.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | +| `metrics.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | +| `metrics.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | +| `metrics.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | +| `metrics.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `metrics.livenessProbe.enabled` | Enable livenessProbe on PostgreSQL Prometheus exporter containers | `true` | +| `metrics.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | +| `metrics.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `metrics.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `metrics.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `metrics.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `metrics.readinessProbe.enabled` | Enable readinessProbe on PostgreSQL Prometheus exporter containers | `true` | +| `metrics.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `metrics.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `metrics.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `metrics.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `metrics.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `metrics.startupProbe.enabled` | Enable startupProbe on PostgreSQL Prometheus exporter containers | `false` | +| `metrics.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `10` | +| `metrics.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `metrics.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `metrics.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `metrics.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `metrics.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `metrics.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `metrics.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `metrics.containerPorts.metrics` | PostgreSQL Prometheus exporter metrics container port | `9187` | +| `metrics.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production). | `nano` | +| `metrics.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `metrics.service.ports.metrics` | PostgreSQL Prometheus Exporter service port | `9187` | +| `metrics.service.clusterIP` | Static clusterIP or None for headless services | `""` | +| `metrics.service.sessionAffinity` | Control where client requests go, to the same pod or round-robin | `None` | +| `metrics.service.annotations` | Annotations for Prometheus to auto-discover the metrics endpoint | `{}` | +| `metrics.serviceMonitor.enabled` | Create ServiceMonitor Resource for scraping metrics using Prometheus Operator | `false` | +| `metrics.serviceMonitor.namespace` | Namespace for the ServiceMonitor Resource (defaults to the Release Namespace) | `""` | +| `metrics.serviceMonitor.interval` | Interval at which metrics should be scraped. | `""` | +| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` | +| `metrics.serviceMonitor.labels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | `{}` | +| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `{}` | +| `metrics.serviceMonitor.relabelings` | RelabelConfigs to apply to samples before scraping | `[]` | +| `metrics.serviceMonitor.metricRelabelings` | MetricRelabelConfigs to apply to samples before ingestion | `[]` | +| `metrics.serviceMonitor.honorLabels` | Specify honorLabels parameter to add the scrape endpoint | `false` | +| `metrics.serviceMonitor.jobLabel` | The name of the label on the target service to use as the job name in prometheus. | `""` | +| `metrics.prometheusRule.enabled` | Create a PrometheusRule for Prometheus Operator | `false` | +| `metrics.prometheusRule.namespace` | Namespace for the PrometheusRule Resource (defaults to the Release Namespace) | `""` | +| `metrics.prometheusRule.labels` | Additional labels that can be used so PrometheusRule will be discovered by Prometheus | `{}` | +| `metrics.prometheusRule.rules` | PrometheusRule definitions | `[]` | + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```console +helm install my-release \ + --set auth.postgresPassword=secretpassword + oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql +``` + +> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. + +The above command sets the PostgreSQL `postgres` account password to `secretpassword`. + +> NOTE: Once this chart is deployed, it is not possible to change the application's access credentials, such as usernames or passwords, using Helm. To change these application credentials after deployment, delete any persistent volumes (PVs) used by the chart and re-deploy it, or use the application's built-in administrative tools if available. +> **Warning** Setting a password will be ignored on new installation in case when previous PostgreSQL release was deleted through the helm command. In that case, old PVC will have an old password, and setting it through helm won't take effect. Deleting persistent volumes (PVs) will solve the issue. Refer to [issue 2061](https://github.com/bitnami/charts/issues/2061) for more details + +Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, + +```console +helm install my-release -f values.yaml oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql +``` + +> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. +> **Tip**: You can use the default [values.yaml](https://github.com/bitnami/charts/tree/main/bitnami/postgresql/values.yaml) + +## Troubleshooting + +Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). + +## Upgrading + +### To 16.3.0 + +This version introduces image verification for security purposes. To disable it, set `global.security.allowInsecureImages` to `true`. More details at [GitHub issue](https://github.com/bitnami/charts/issues/30850). + +### To 15.0.0 + +This major bump changes the following security defaults: + +- `runAsGroup` is changed from `0` to `1001` +- `readOnlyRootFilesystem` is set to `true` +- `resourcesPreset` is changed from `none` to the minimum size working in our test suites (NOTE: `resourcesPreset` is not meant for production usage, but `resources` adapted to your use case). +- `global.compatibility.openshift.adaptSecurityContext` is changed from `disabled` to `auto`. + +This could potentially break any customization or init scripts used in your deployment. If this is the case, change the default values to the previous ones. + +### To 14.0.0 + +This major version adapts the NetworkPolicy objects to the most recent Bitnami standards. Now there is a separate object for `primary` and for `readReplicas`, being located in their corresponding sections. It is also enabled by default in other to comply with the best security standards. + +Check the parameter section for the new value structure. + +### To 13.0.0 + +This major version changes the default PostgreSQL image from 15.x to 16.x. Follow the [official instructions](https://www.postgresql.org/docs/16/upgrading.html) to upgrade to 16.x. + +### To 12.0.0 + +This major version changes the default PostgreSQL image from 14.x to 15.x. Follow the [official instructions](https://www.postgresql.org/docs/15/upgrading.html) to upgrade to 15.x. + +### To 11.0.0 + +In this version the application version was bumped to _14.x_ series. Also, this major release renames several values in this chart and adds missing features, in order to be inline with the rest of assets in the Bitnami charts repository. + +- _replication.enabled_ parameter is deprecated in favor of _architecture_ parameter that accepts two values: _standalone_ and _replication_. +- _replication.singleService_ and _replication.uniqueServices_ parameters are deprecated. When using replication, each statefulset (primary and read-only) has its own headless service & service allowing to connect to read-only replicas through the service (round-robin) or individually. +- _postgresqlPostgresPassword_, _postgresqlUsername_, _postgresqlPassword_, _postgresqlDatabase_, _replication.user_, _replication.password_, and _existingSecret_ parameters have been regrouped under the _auth_ map. The _auth_ map uses a new perspective to configure authentication, so please read carefully each sub-parameter description. +- _extraEnv_ has been deprecated in favor of _primary.extraEnvVars_ and _readReplicas.extraEnvVars_. +- _postgresqlConfiguration_, _pgHbaConfiguration_, _configurationConfigMap_, _postgresqlExtendedConf_, and _extendedConfConfigMap_ have been deprecated in favor of _primary.configuration_, _primary.pgHbaConfiguration_, _primary.existingConfigmap_, _primary.extendedConfiguration_, and _primary.existingExtendedConfigmap_. +- _postgresqlInitdbArgs_, _postgresqlInitdbWalDir_, _initdbScripts_, _initdbScriptsConfigMap_, _initdbScriptsSecret_, _initdbUser_ and _initdbPassword_ have been regrouped under the _primary.initdb_ map. +- _postgresqlMaxConnections_, _postgresqlPostgresConnectionLimit_, _postgresqlDbUserConnectionLimit_, _postgresqlTcpKeepalivesInterval_, _postgresqlTcpKeepalivesIdle_, _postgresqlTcpKeepalivesCount_, _postgresqlStatementTimeout_ and _postgresqlPghbaRemoveFilters_ parameters are deprecated. Use _XXX.extraEnvVars_ instead. +- _primaryAsStandBy_ has been deprecated in favor of _primary.standby_. +- _securityContext_ and _containerSecurityContext_ have been deprecated in favor of _primary.podSecurityContext_, _primary.containerSecurityContext_, _readReplicas.podSecurityContext_, and _readReplicas.containerSecurityContext_. +- _livenessProbe_ and _readinessProbe_ maps have been deprecated in favor of _primary.livenessProbe_, _primary.readinessProbe_, _readReplicas.livenessProbe_ and _readReplicas.readinessProbe_ maps. +- _persistence_ map has been deprecated in favor of _primary.persistence_ and _readReplicas.persistence_ maps. +- _networkPolicy_ map has been completely refactored. +- _service_ map has been deprecated in favor of _primary.service_ and _readReplicas.service_ maps. +- _metrics.service.port_ has been regrouped under the _metrics.service.ports_ map. +- _serviceAccount.enabled_ and _serviceAccount.autoMount_ have been deprecated in favor of _serviceAccount.create_ and _serviceAccount.automountServiceAccountToken_. + +#### How to upgrade to version 11.0.0 + +To upgrade to _11.0.0_ from _10.x_, it should be done reusing the PVC(s) used to hold the PostgreSQL data on your previous release. To do so, follow the instructions below (the following example assumes that the release name is _postgresql_): + +> NOTE: Please, create a backup of your database before running any of these actions. + +1. Obtain the credentials and the names of the PVCs used to hold the PostgreSQL data on your current release: + +```console +export POSTGRESQL_PASSWORD=$(kubectl get secret --namespace default postgresql -o jsonpath="{.data.postgresql-password}" | base64 --decode) +export POSTGRESQL_PVC=$(kubectl get pvc -l app.kubernetes.io/instance=postgresql,role=primary -o jsonpath="{.items[0].metadata.name}") +``` + +1. Delete the PostgreSQL statefulset (notice the option _--cascade=false_) and secret: + +```console +kubectl delete statefulsets.apps postgresql-postgresql --namespace default --cascade=false +kubectl delete secret postgresql --namespace default +``` + +1. Upgrade your release using the same PostgreSQL version: + +```console +CURRENT_VERSION=$(kubectl exec postgresql-postgresql-0 -- bash -c 'echo $BITNAMI_IMAGE_VERSION') +helm upgrade postgresql bitnami/postgresql \ + --set auth.postgresPassword=$POSTGRESQL_PASSWORD \ + --set primary.persistence.existingClaim=$POSTGRESQL_PVC \ + --set image.tag=$CURRENT_VERSION +``` + +1. You will have to delete the existing PostgreSQL pod and the new statefulset is going to create a new one + +```console +kubectl delete pod postgresql-postgresql-0 +``` + +1. Finally, you should see the lines below in PostgreSQL container logs: + +```text +$ kubectl logs $(kubectl get pods -l app.kubernetes.io/instance=postgresql,app.kubernetes.io/name=postgresql,app.kubernetes.io/component=primary -o jsonpath="{.items[0].metadata.name}") +... +postgresql 08:05:12.59 INFO ==> Deploying PostgreSQL with persisted data... +... +``` + +> NOTE: the instructions above reuse the same PostgreSQL version you were using in your chart release. Otherwise, you will find an error such as the one below when upgrading since the new chart major version also bumps the application version. To workaround this issue you need to upgrade database, please refer to the [official PostgreSQL documentation](https://www.postgresql.org/docs/current/upgrading.html) for more information about this. + +```console +$ kubectl logs $(kubectl get pods -l app.kubernetes.io/instance=postgresql,app.kubernetes.io/name=postgresql,app.kubernetes.io/component=primary -o jsonpath="{.items[0].metadata.name}") + ... +postgresql 08:10:14.72 INFO ==> ** Starting PostgreSQL ** +2022-02-01 08:10:14.734 GMT [1] FATAL: database files are incompatible with server +2022-02-01 08:10:14.734 GMT [1] DETAIL: The data directory was initialized by PostgreSQL version 11, which is not compatible with this version 14.1. +``` + +### To 10.0.0 + +[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. + +- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. +- Move dependency information from the _requirements.yaml_ to the _Chart.yaml_ +- After running _helm dependency update_, a _Chart.lock_ file is generated containing the same structure used in the previous _requirements.lock_ +- The different fields present in the _Chart.yaml_ file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Chart. +- The term _master_ has been replaced with _primary_ and _slave_ with _readReplicas_ throughout the chart. Role names have changed from _master_ and _slave_ to _primary_ and _read_. + +#### Considerations when upgrading to this version + +- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version does not support Helm v2 anymore. +- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3. + +#### Useful links + +- [Bitnami Tutorial](https://techdocs.broadcom.com/us/en/vmware-tanzu/application-catalog/tanzu-application-catalog/services/tac-doc/apps-tutorials-resolve-helm2-helm3-post-migration-issues-index.html) +- [Helm docs](https://helm.sh/docs/topics/v2_v3_migration) +- [Helm Blog](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3) + +#### How to upgrade to version 10.0.0 + +To upgrade to _10.0.0_ from _9.x_, it should be done reusing the PVC(s) used to hold the PostgreSQL data on your previous release. To do so, follow the instructions below (the following example assumes that the release name is _postgresql_): + +> NOTE: Please, create a backup of your database before running any of those actions. + +1. Obtain the credentials and the names of the PVCs used to hold the PostgreSQL data on your current release: + +```console +export POSTGRESQL_PASSWORD=$(kubectl get secret --namespace default postgresql -o jsonpath="{.data.postgresql-password}" | base64 --decode) +export POSTGRESQL_PVC=$(kubectl get pvc -l app.kubernetes.io/instance=postgresql,role=primary -o jsonpath="{.items[0].metadata.name}") +``` + +1. Delete the PostgreSQL statefulset (notice the option _--cascade=false_): + +```console +kubectl delete statefulsets.apps postgresql-postgresql --namespace default --cascade=false +``` + +1. Upgrade your release using the same PostgreSQL version: + +```console +helm upgrade postgresql bitnami/postgresql \ + --set postgresqlPassword=$POSTGRESQL_PASSWORD \ + --set persistence.existingClaim=$POSTGRESQL_PVC +``` + +1. Delete the existing PostgreSQL pod and the new statefulset will create a new one: + +```console +kubectl delete pod postgresql-postgresql-0 +``` + +1. Finally, you should see the lines below in PostgreSQL container logs: + +```text +$ kubectl logs $(kubectl get pods -l app.kubernetes.io/instance=postgresql,app.kubernetes.io/name=postgresql,role=primary -o jsonpath="{.items[0].metadata.name}") +... +postgresql 08:05:12.59 INFO ==> Deploying PostgreSQL with persisted data... +... +``` + +### To 9.0.0 + +In this version the chart was adapted to follow the [Helm standard labels](https://helm.sh/docs/chart_best_practices/labels/#standard-labels). + +- Some inmutable objects were modified to adopt Helm standard labels introducing backward incompatibilities. + +#### How to upgrade to version 9.0.0 + +To upgrade to _9.0.0_ from _8.x_, it should be done reusing the PVC(s) used to hold the PostgreSQL data on your previous release. To do so, follow the instructions below (the following example assumes that the release name is _postgresql_): + +> NOTE: Please, create a backup of your database before running any of those actions. + +1. Obtain the credentials and the names of the PVCs used to hold the PostgreSQL data on your current release: + +```console +export POSTGRESQL_PASSWORD=$(kubectl get secret --namespace default postgresql -o jsonpath="{.data.postgresql-password}" | base64 --decode) +export POSTGRESQL_PVC=$(kubectl get pvc -l app=postgresql,role=master -o jsonpath="{.items[0].metadata.name}") +``` + +1. Delete the PostgreSQL statefulset (notice the option _--cascade=false_): + +```console +kubectl delete statefulsets.apps postgresql-postgresql --namespace default --cascade=false +``` + +1. Upgrade your release using the same PostgreSQL version: + +```console +helm upgrade postgresql bitnami/postgresql \ + --set postgresqlPassword=$POSTGRESQL_PASSWORD \ + --set persistence.existingClaim=$POSTGRESQL_PVC +``` + +1. Delete the existing PostgreSQL pod and the new statefulset will create a new one: + +```console +kubectl delete pod postgresql-postgresql-0 +``` + +1. Finally, you should see the lines below in PostgreSQL container logs: + +```text +$ kubectl logs $(kubectl get pods -l app.kubernetes.io/instance=postgresql,app.kubernetes.io/name=postgresql,role=master -o jsonpath="{.items[0].metadata.name}") +... +postgresql 08:05:12.59 INFO ==> Deploying PostgreSQL with persisted data... +... +``` + +## License + +Copyright © 2025 Broadcom. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/postgresql/templates/NOTES.txt b/postgresql/templates/NOTES.txt new file mode 100644 index 0000000..1a086d2 --- /dev/null +++ b/postgresql/templates/NOTES.txt @@ -0,0 +1,123 @@ +{{- $releaseNamespace := include "common.names.namespace" . }} +CHART NAME: {{ .Chart.Name }} +CHART VERSION: {{ .Chart.Version }} +APP VERSION: {{ .Chart.AppVersion }} + +⚠ WARNING: Since August 28th, 2025, only a limited subset of images/charts are available for free. + Subscribe to Bitnami Secure Images to receive continued support and security updates. + More info at https://bitnami.com and https://github.com/bitnami/containers/issues/83267 + +** Please be patient while the chart is being deployed ** + +{{- if .Values.diagnosticMode.enabled }} +The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with: + + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }} + +Get the list of pods by executing: + + kubectl get pods --namespace {{ $releaseNamespace }} -l app.kubernetes.io/instance={{ .Release.Name }} + +Access the pod you want to debug by executing + + kubectl exec --namespace {{ $releaseNamespace }} -ti -- /opt/bitnami/scripts/postgresql/entrypoint.sh /bin/bash + +In order to replicate the container startup scripts execute this command: + + /opt/bitnami/scripts/postgresql/entrypoint.sh /opt/bitnami/scripts/postgresql/run.sh + +{{- else }} + +{{- $customUser := include "postgresql.v1.username" . }} +{{- $postgresPassword := include "common.secrets.lookup" (dict "secret" (include "postgresql.v1.chart.fullname" .) "key" .Values.auth.secretKeys.adminPasswordKey "defaultValue" (ternary .Values.auth.postgresPassword .Values.auth.password (eq $customUser "postgres")) "context" $) -}} +{{- $authEnabled := and (not (or .Values.global.postgresql.auth.existingSecret .Values.auth.existingSecret)) (or $postgresPassword .Values.auth.enablePostgresUser (and (not (empty $customUser)) (ne $customUser "postgres"))) }} +{{- if not $authEnabled }} + +WARNING: PostgreSQL has been configured without authentication, this is not recommended for production environments. +{{- end }} + +PostgreSQL can be accessed via port {{ include "postgresql.v1.service.port" . }} on the following DNS names from within your cluster: + + {{ include "postgresql.v1.primary.fullname" . }}.{{ $releaseNamespace }}.svc.cluster.local - Read/Write connection + +{{- if eq .Values.architecture "replication" }} + + {{ include "postgresql.v1.readReplica.fullname" . }}.{{ $releaseNamespace }}.svc.cluster.local - Read only connection + +{{- end }} + +{{- if and (not (empty $customUser)) (ne $customUser "postgres") }} +{{- if .Values.auth.enablePostgresUser }} + +To get the password for "postgres" run: + + export POSTGRES_ADMIN_PASSWORD=$(kubectl get secret --namespace {{ $releaseNamespace }} {{ include "postgresql.v1.secretName" . }} -o jsonpath="{.data.{{include "postgresql.v1.adminPasswordKey" .}}}" | base64 -d) +{{- end }} + +To get the password for "{{ $customUser }}" run: + + export POSTGRES_PASSWORD=$(kubectl get secret --namespace {{ $releaseNamespace }} {{ include "postgresql.v1.secretName" . }} -o jsonpath="{.data.{{include "postgresql.v1.userPasswordKey" .}}}" | base64 -d) +{{- else }} +{{- if .Values.auth.enablePostgresUser }} + +To get the password for "{{ default "postgres" $customUser }}" run: + + export POSTGRES_PASSWORD=$(kubectl get secret --namespace {{ $releaseNamespace }} {{ include "postgresql.v1.secretName" . }} -o jsonpath="{.data.{{ ternary "password" (include "postgresql.v1.adminPasswordKey" .) (and (not (empty $customUser)) (ne $customUser "postgres")) }}}" | base64 -d) +{{- end }} +{{- end }} + +To connect to your database run the following command: + {{- if $authEnabled }} + + kubectl run {{ include "postgresql.v1.chart.fullname" . }}-client --rm --tty -i --restart='Never' --namespace {{ $releaseNamespace }} --image {{ include "postgresql.v1.image" . }} --env="PGPASSWORD=$POSTGRES_PASSWORD" \ + --command -- psql --host {{ include "postgresql.v1.primary.fullname" . }} -U {{ default "postgres" $customUser }} -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} -p {{ include "postgresql.v1.service.port" . }} + {{- else }} + + kubectl run {{ include "postgresql.v1.chart.fullname" . }}-client --rm --tty -i --restart='Never' --namespace {{ $releaseNamespace }} --image {{ include "postgresql.v1.image" . }} \ + --command -- psql --host {{ include "postgresql.v1.primary.fullname" . }} -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} -p {{ include "postgresql.v1.service.port" . }} + {{- end }} + + > NOTE: If you access the container using bash, make sure that you execute "/opt/bitnami/scripts/postgresql/entrypoint.sh /bin/bash" in order to avoid the error "psql: local user with ID {{ .Values.primary.containerSecurityContext.runAsUser }}} does not exist" + +To connect to your database from outside the cluster execute the following commands: + +{{- if contains "NodePort" .Values.primary.service.type }} + + export NODE_IP=$(kubectl get nodes --namespace {{ $releaseNamespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + export NODE_PORT=$(kubectl get --namespace {{ $releaseNamespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "postgresql.v1.primary.fullname" . }}) + {{- if $authEnabled }} + PGPASSWORD="$POSTGRES_PASSWORD" psql --host $NODE_IP --port $NODE_PORT -U {{ default "postgres" $customUser }} -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} + {{- else }} + psql --host $NODE_IP --port $NODE_PORT -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} + {{- end }} +{{- else if contains "LoadBalancer" .Values.primary.service.type }} + + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + Watch the status with: 'kubectl get svc --namespace {{ $releaseNamespace }} -w {{ include "postgresql.v1.primary.fullname" . }}' + + export SERVICE_IP=$(kubectl get svc --namespace {{ $releaseNamespace }} {{ include "postgresql.v1.primary.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}") + {{- if $authEnabled }} + PGPASSWORD="$POSTGRES_PASSWORD" psql --host $SERVICE_IP --port {{ include "postgresql.v1.service.port" . }} -U {{ default "postgres" $customUser }} -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} + {{- else }} + psql --host $SERVICE_IP --port {{ include "postgresql.v1.service.port" . }} -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} + {{- end }} +{{- else if contains "ClusterIP" .Values.primary.service.type }} + + kubectl port-forward --namespace {{ $releaseNamespace }} svc/{{ include "postgresql.v1.primary.fullname" . }} {{ include "postgresql.v1.service.port" . }}:{{ include "postgresql.v1.service.port" . }} & + {{- if $authEnabled }} + PGPASSWORD="$POSTGRES_PASSWORD" psql --host 127.0.0.1 -U {{ default "postgres" $customUser }} -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} -p {{ include "postgresql.v1.service.port" . }} + {{- else }} + psql --host 127.0.0.1 -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} -p {{ include "postgresql.v1.service.port" . }} + {{- end }} +{{- end }} +{{- end }} + +WARNING: The configured password will be ignored on new installation in case when previous PostgreSQL release was deleted through the helm command. In that case, old PVC will have an old password, and setting it through helm won't take effect. Deleting persistent volumes (PVs) will solve the issue. + +{{- include "postgresql.v1.validateValues" . -}} +{{- include "common.warnings.rollingTag" .Values.image -}} +{{- include "common.warnings.rollingTag" .Values.volumePermissions.image }} +{{- include "common.warnings.resources" (dict "sections" (list "metrics" "primary" "readReplicas" "volumePermissions") "context" $) }} +{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.volumePermissions.image .Values.metrics.image) "context" $) }} +{{- include "common.errors.insecureImages" (dict "images" (list .Values.image .Values.volumePermissions.image .Values.metrics.image) "context" $) }} diff --git a/postgresql/templates/_helpers.tpl b/postgresql/templates/_helpers.tpl new file mode 100644 index 0000000..c582fc1 --- /dev/null +++ b/postgresql/templates/_helpers.tpl @@ -0,0 +1,458 @@ +{{/* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} + +{{/* +Create a global name for the chart to use and parse with other naming functions +Please use instead of "common.names.fullname" to preserve support for .Values.global.postgresql.fullnameOverride +*/}} +{{- define "postgresql.v1.chart.fullname" -}} +{{- default (include "common.names.fullname" .) .Values.global.postgresql.fullnameOverride -}} +{{- end -}} + +{{/* +Create a default fully qualified app name for PostgreSQL Primary objects +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "postgresql.v1.primary.fullname" -}} +{{- $fullname := include "postgresql.v1.chart.fullname" . -}} +{{- ternary (printf "%s-%s" $fullname .Values.primary.name | trunc 63 | trimSuffix "-") $fullname (eq .Values.architecture "replication") -}} +{{- end -}} + +{{/* +Create a default fully qualified app name for PostgreSQL read-only replicas objects +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "postgresql.v1.readReplica.fullname" -}} +{{- printf "%s-%s" (include "postgresql.v1.chart.fullname" .) .Values.readReplicas.name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create the default FQDN for PostgreSQL primary headless service +We truncate at 63 chars because of the DNS naming spec. +*/}} +{{- define "postgresql.v1.primary.svc.headless" -}} +{{- printf "%s-hl" (include "postgresql.v1.primary.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create the default FQDN for PostgreSQL read-only replicas headless service +We truncate at 63 chars because of the DNS naming spec. +*/}} +{{- define "postgresql.v1.readReplica.svc.headless" -}} +{{- printf "%s-hl" (include "postgresql.v1.readReplica.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Return the proper PostgreSQL image name +*/}} +{{- define "postgresql.v1.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }} +{{- end -}} + +{{/* +Return the proper PostgreSQL metrics image name +*/}} +{{- define "postgresql.v1.metrics.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.metrics.image "global" .Values.global) }} +{{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "postgresql.v1.volumePermissions.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.volumePermissions.image "global" .Values.global) }} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names +*/}} +{{- define "postgresql.v1.imagePullSecrets" -}} +{{ include "common.images.renderPullSecrets" (dict "images" (list .Values.image .Values.metrics.image .Values.volumePermissions.image) "context" $) }} +{{- end -}} + +{{/* +Return the name for a custom user to create +*/}} +{{- define "postgresql.v1.username" -}} +{{- if .Values.global.postgresql.auth.username -}} + {{- .Values.global.postgresql.auth.username -}} +{{- else -}} + {{- .Values.auth.username -}} +{{- end -}} +{{- end -}} + +{{/* +Return the name for a custom database to create +*/}} +{{- define "postgresql.v1.database" -}} +{{- if .Values.global.postgresql.auth.database -}} + {{- printf "%s" (tpl .Values.global.postgresql.auth.database $) -}} +{{- else if .Values.auth.database -}} + {{- printf "%s" (tpl .Values.auth.database $) -}} +{{- end -}} +{{- end -}} + +{{/* +Get the password secret. +*/}} +{{- define "postgresql.v1.secretName" -}} +{{- if .Values.global.postgresql.auth.existingSecret -}} + {{- printf "%s" (tpl .Values.global.postgresql.auth.existingSecret $) -}} +{{- else if .Values.auth.existingSecret -}} + {{- printf "%s" (tpl .Values.auth.existingSecret $) -}} +{{- else -}} + {{- printf "%s" (include "postgresql.v1.chart.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Get the replication-password key. +*/}} +{{- define "postgresql.v1.replicationPasswordKey" -}} +{{- if or .Values.global.postgresql.auth.existingSecret .Values.auth.existingSecret -}} + {{- if .Values.global.postgresql.auth.secretKeys.replicationPasswordKey -}} + {{- printf "%s" (tpl .Values.global.postgresql.auth.secretKeys.replicationPasswordKey $) -}} + {{- else if .Values.auth.secretKeys.replicationPasswordKey -}} + {{- printf "%s" (tpl .Values.auth.secretKeys.replicationPasswordKey $) -}} + {{- else -}} + {{- "replication-password" -}} + {{- end -}} +{{- else -}} + {{- "replication-password" -}} +{{- end -}} +{{- end -}} + +{{/* +Get the admin-password key. +*/}} +{{- define "postgresql.v1.adminPasswordKey" -}} +{{- if or .Values.global.postgresql.auth.existingSecret .Values.auth.existingSecret -}} + {{- if .Values.global.postgresql.auth.secretKeys.adminPasswordKey -}} + {{- printf "%s" (tpl .Values.global.postgresql.auth.secretKeys.adminPasswordKey $) -}} + {{- else if .Values.auth.secretKeys.adminPasswordKey -}} + {{- printf "%s" (tpl .Values.auth.secretKeys.adminPasswordKey $) -}} + {{- end -}} +{{- else -}} + {{- "postgres-password" -}} +{{- end -}} +{{- end -}} + +{{/* +Get the user-password key. +*/}} +{{- define "postgresql.v1.userPasswordKey" -}} +{{- if or .Values.global.postgresql.auth.existingSecret .Values.auth.existingSecret -}} + {{- if or (empty (include "postgresql.v1.username" .)) (eq (include "postgresql.v1.username" .) "postgres") -}} + {{- printf "%s" (include "postgresql.v1.adminPasswordKey" .) -}} + {{- else -}} + {{- if .Values.global.postgresql.auth.secretKeys.userPasswordKey -}} + {{- printf "%s" (tpl .Values.global.postgresql.auth.secretKeys.userPasswordKey $) -}} + {{- else if .Values.auth.secretKeys.userPasswordKey -}} + {{- printf "%s" (tpl .Values.auth.secretKeys.userPasswordKey $) -}} + {{- end -}} + {{- end -}} +{{- else -}} + {{- "password" -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if a secret object should be created +*/}} +{{- define "postgresql.v1.createSecret" -}} +{{- $customUser := include "postgresql.v1.username" . -}} +{{- $postgresPassword := include "common.secrets.lookup" (dict "secret" (include "postgresql.v1.chart.fullname" .) "key" .Values.auth.secretKeys.adminPasswordKey "defaultValue" (ternary (coalesce .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword .Values.global.postgresql.auth.password .Values.auth.password) (coalesce .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword) (or (empty $customUser) (eq $customUser "postgres"))) "context" $) -}} +{{- if and (not (or .Values.global.postgresql.auth.existingSecret .Values.auth.existingSecret)) (or $postgresPassword .Values.auth.enablePostgresUser (and (not (empty $customUser)) (ne $customUser "postgres")) (eq .Values.architecture "replication") (and .Values.ldap.enabled (or .Values.ldap.bind_password .Values.ldap.bindpw))) -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if a secret object should be created for PostgreSQL +*/}} +{{- define "postgresql.v1.createPreviousSecret" -}} +{{- if and .Values.passwordUpdateJob.previousPasswords.postgresPassword (not .Values.passwordUpdateJob.previousPasswords.existingSecret) }} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Return the secret with previous PostgreSQL credentials +*/}} +{{- define "postgresql.v1.update-job.previousSecretName" -}} + {{- if .Values.passwordUpdateJob.previousPasswords.existingSecret -}} + {{- /* The secret with the new password is managed externally */ -}} + {{- tpl .Values.passwordUpdateJob.previousPasswords.existingSecret $ -}} + {{- else if .Values.passwordUpdateJob.previousPasswords.postgresPassword -}} + {{- /* The secret with the new password is managed externally */ -}} + {{- printf "%s-previous-secret" (include "postgresql.v1.chart.fullname" .) | trunc 63 | trimSuffix "-" -}} + {{- else -}} + {{- /* The secret with the new password is managed by the helm chart. We use the current secret name as it has the old password */ -}} + {{- include "postgresql.v1.chart.fullname" . -}} + {{- end -}} +{{- end -}} + +{{/* +Return the secret with new PostgreSQL credentials +*/}} +{{- define "postgresql.v1.update-job.newSecretName" -}} + {{- if and (not .Values.passwordUpdateJob.previousPasswords.existingSecret) (not .Values.passwordUpdateJob.previousPasswords.postgresPassword) -}} + {{- /* The secret with the new password is managed by the helm chart. We create a new secret as the current one has the old password */ -}} + {{- printf "%s-new-secret" (include "postgresql.v1.chart.fullname" .) | trunc 63 | trimSuffix "-" -}} + {{- else -}} + {{- /* The secret with the new password is managed externally */ -}} + {{- include "postgresql.v1.secretName" . -}} + {{- end -}} +{{- end -}} + +{{/* +Return PostgreSQL service port +*/}} +{{- define "postgresql.v1.service.port" -}} +{{- if .Values.global.postgresql.service.ports.postgresql -}} + {{- .Values.global.postgresql.service.ports.postgresql -}} +{{- else -}} + {{- .Values.primary.service.ports.postgresql -}} +{{- end -}} +{{- end -}} + +{{/* +Return PostgreSQL service port +*/}} +{{- define "postgresql.v1.readReplica.service.port" -}} +{{- if .Values.global.postgresql.service.ports.postgresql -}} + {{- .Values.global.postgresql.service.ports.postgresql -}} +{{- else -}} + {{- .Values.readReplicas.service.ports.postgresql -}} +{{- end -}} +{{- end -}} + +{{/* +Get the PostgreSQL primary configuration ConfigMap name. +*/}} +{{- define "postgresql.v1.primary.configmapName" -}} +{{- if .Values.primary.existingConfigmap -}} + {{- printf "%s" (tpl .Values.primary.existingConfigmap $) -}} +{{- else -}} + {{- printf "%s-configuration" (include "postgresql.v1.primary.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if a configmap object should be created for PostgreSQL primary with the configuration +*/}} +{{- define "postgresql.v1.primary.createConfigmap" -}} +{{- if and (or .Values.primary.configuration .Values.primary.pgHbaConfiguration) (not .Values.primary.existingConfigmap) -}} + {{- true -}} +{{- else -}} +{{- end -}} +{{- end -}} + +{{/* +Get the PostgreSQL primary extended configuration ConfigMap name. +*/}} +{{- define "postgresql.v1.primary.extendedConfigmapName" -}} +{{- if .Values.primary.existingExtendedConfigmap -}} + {{- printf "%s" (tpl .Values.primary.existingExtendedConfigmap $) -}} +{{- else -}} + {{- printf "%s-extended-configuration" (include "postgresql.v1.primary.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Get the PostgreSQL read replica extended configuration ConfigMap name. +*/}} +{{- define "postgresql.v1.readReplicas.extendedConfigmapName" -}} + {{- printf "%s-extended-configuration" (include "postgresql.v1.readReplica.fullname" .) -}} +{{- end -}} + +{{/* +Return true if a configmap object should be created for PostgreSQL primary with the extended configuration +*/}} +{{- define "postgresql.v1.primary.createExtendedConfigmap" -}} +{{- if and .Values.primary.extendedConfiguration (not .Values.primary.existingExtendedConfigmap) -}} + {{- true -}} +{{- else -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if a configmap object should be created for PostgreSQL read replica with the extended configuration +*/}} +{{- define "postgresql.v1.readReplicas.createExtendedConfigmap" -}} +{{- if .Values.readReplicas.extendedConfiguration -}} + {{- true -}} +{{- else -}} +{{- end -}} +{{- end -}} + +{{/* + Create the name of the service account to use + */}} +{{- define "postgresql.v1.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "postgresql.v1.chart.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return true if a configmap should be mounted with PostgreSQL configuration +*/}} +{{- define "postgresql.v1.mountConfigurationCM" -}} +{{- if or .Values.primary.configuration .Values.primary.pgHbaConfiguration .Values.primary.existingConfigmap -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Get the pre-initialization scripts ConfigMap name. +*/}} +{{- define "postgresql.v1.preInitDb.scriptsCM" -}} +{{- if .Values.primary.preInitDb.scriptsConfigMap -}} + {{- printf "%s" (tpl .Values.primary.preInitDb.scriptsConfigMap $) -}} +{{- else -}} + {{- printf "%s-preinit-scripts" (include "postgresql.v1.primary.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Get the initialization scripts ConfigMap name. +*/}} +{{- define "postgresql.v1.initdb.scriptsCM" -}} +{{- if .Values.primary.initdb.scriptsConfigMap -}} + {{- printf "%s" (tpl .Values.primary.initdb.scriptsConfigMap $) -}} +{{- else -}} + {{- printf "%s-init-scripts" (include "postgresql.v1.primary.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if TLS is enabled for LDAP connection +*/}} +{{- define "postgresql.v1.ldap.tls.enabled" -}} +{{- if and (kindIs "string" .Values.ldap.tls) (not (empty .Values.ldap.tls)) -}} + {{- true -}} +{{- else if and (kindIs "map" .Values.ldap.tls) .Values.ldap.tls.enabled -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Get the readiness probe command +*/}} +{{- define "postgresql.v1.readinessProbeCommand" -}} +{{- $customUser := include "postgresql.v1.username" . -}} +- | +{{- if (include "postgresql.v1.database" .) }} + exec pg_isready -U {{ default "postgres" $customUser | quote }} -d "dbname={{ include "postgresql.v1.database" . }} {{- if .Values.tls.enabled }} sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} +{{- else }} + exec pg_isready -U {{ default "postgres" $customUser | quote }} {{- if .Values.tls.enabled }} -d "sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} +{{- end }} + [ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ] +{{- end -}} + +{{/* +Compile all warnings into a single message, and call fail. +*/}} +{{- define "postgresql.v1.validateValues" -}} +{{- $messages := list -}} +{{- $messages := append $messages (include "postgresql.v1.validateValues.ldapConfigurationMethod" .) -}} +{{- $messages := append $messages (include "postgresql.v1.validateValues.psp" .) -}} +{{- $messages := without $messages "" -}} +{{- $message := join "\n" $messages -}} + +{{- if $message -}} +{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}} +{{- end -}} +{{- end -}} + +{{/* +Validate values of Postgresql - If ldap.url is used then you don't need the other settings for ldap +*/}} +{{- define "postgresql.v1.validateValues.ldapConfigurationMethod" -}} +{{- if and .Values.ldap.enabled (and (not (empty .Values.ldap.url)) (not (empty .Values.ldap.server))) -}} +postgresql: ldap.url, ldap.server + You cannot set both `ldap.url` and `ldap.server` at the same time. + Please provide a unique way to configure LDAP. + More info at https://www.postgresql.org/docs/current/auth-ldap.html +{{- end -}} +{{- end -}} + +{{/* +Validate values of Postgresql - If PSP is enabled RBAC should be enabled too +*/}} +{{- define "postgresql.v1.validateValues.psp" -}} +{{- if and .Values.psp.create (not .Values.rbac.create) -}} +postgresql: psp.create, rbac.create + RBAC should be enabled if PSP is enabled in order for PSP to work. + More info at https://kubernetes.io/docs/concepts/policy/pod-security-policy/#authorizing-policies +{{- end -}} +{{- end -}} + +{{/* +Return the path to the cert file. +*/}} +{{- define "postgresql.v1.tlsCert" -}} +{{- if .Values.tls.autoGenerated -}} + {{- printf "/opt/bitnami/postgresql/certs/tls.crt" -}} +{{- else -}} + {{- required "Certificate filename is required when TLS in enabled" .Values.tls.certFilename | printf "/opt/bitnami/postgresql/certs/%s" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the path to the cert key file. +*/}} +{{- define "postgresql.v1.tlsCertKey" -}} +{{- if .Values.tls.autoGenerated -}} + {{- printf "/opt/bitnami/postgresql/certs/tls.key" -}} +{{- else -}} +{{- required "Certificate Key filename is required when TLS in enabled" .Values.tls.certKeyFilename | printf "/opt/bitnami/postgresql/certs/%s" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the path to the CA cert file. +*/}} +{{- define "postgresql.v1.tlsCACert" -}} +{{- if .Values.tls.autoGenerated -}} + {{- printf "/opt/bitnami/postgresql/certs/ca.crt" -}} +{{- else -}} + {{- printf "/opt/bitnami/postgresql/certs/%s" .Values.tls.certCAFilename -}} +{{- end -}} +{{- end -}} + +{{/* +Return the path to the CRL file. +*/}} +{{- define "postgresql.v1.tlsCRL" -}} +{{- if .Values.tls.crlFilename -}} +{{- printf "/opt/bitnami/postgresql/certs/%s" .Values.tls.crlFilename -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if a TLS credentials secret object should be created +*/}} +{{- define "postgresql.v1.createTlsSecret" -}} +{{- if and .Values.tls.autoGenerated (not .Values.tls.certificatesSecret) -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Return the path to the CA cert file. +*/}} +{{- define "postgresql.v1.tlsSecretName" -}} +{{- if .Values.tls.autoGenerated -}} + {{- printf "%s-crt" (include "postgresql.v1.chart.fullname" .) -}} +{{- else -}} + {{ tpl (required "A secret containing TLS certificates is required when TLS is enabled" .Values.tls.certificatesSecret) . }} +{{- end -}} +{{- end -}} diff --git a/postgresql-ha/templates/backup/cronjob.yaml b/postgresql/templates/backup/cronjob.yaml similarity index 54% rename from postgresql-ha/templates/backup/cronjob.yaml rename to postgresql/templates/backup/cronjob.yaml index 297360a..d3afb07 100644 --- a/postgresql-ha/templates/backup/cronjob.yaml +++ b/postgresql/templates/backup/cronjob.yaml @@ -4,12 +4,12 @@ SPDX-License-Identifier: APACHE-2.0 */}} {{- if .Values.backup.enabled }} -{{- $pgUser := include "postgresql-ha.postgresqlUsername" . }} +{{- $customUser := include "postgresql.v1.username" . }} apiVersion: batch/v1 kind: CronJob metadata: - name: {{ include "postgresql-ha.postgresql" . }}-pgdumpall - namespace: {{ .Release.Namespace | quote }} + name: {{ include "postgresql.v1.primary.fullname" . }}-pgdumpall + namespace: {{ include "common.names.namespace" . | quote }} {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.labels .Values.commonLabels ) "context" . ) }} labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} app.kubernetes.io/component: pg_dumpall @@ -18,9 +18,9 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} {{- end }} spec: - schedule: {{ .Values.backup.cronjob.schedule | quote }} - {{- if .Values.backup.cronjob.timezone }} - timeZone: {{ .Values.backup.cronjob.timezone | quote }} + schedule: {{ quote .Values.backup.cronjob.schedule }} + {{- if .Values.backup.cronjob.timeZone }} + timeZone: {{ .Values.backup.cronjob.timeZone | quote }} {{- end }} concurrencyPolicy: {{ .Values.backup.cronjob.concurrencyPolicy }} failedJobsHistoryLimit: {{ .Values.backup.cronjob.failedJobsHistoryLimit }} @@ -41,7 +41,7 @@ spec: annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 12 }} {{- end }} spec: - {{- include "postgresql-ha.image.pullSecrets" . | nindent 10 }} + {{- include "postgresql.v1.imagePullSecrets" . | nindent 10 }} {{- if .Values.backup.cronjob.nodeSelector }} nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.nodeSelector "context" $) | nindent 12 }} {{- end }} @@ -49,63 +49,81 @@ spec: tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.tolerations "context" $) | nindent 12 }} {{- end }} containers: - - name: {{ include "postgresql-ha.postgresql" . }}-pgdumpall - image: {{ include "postgresql-ha.postgresql.image" . }} - imagePullPolicy: {{ .Values.postgresql.image.pullPolicy | quote }} + - name: {{ include "postgresql.v1.primary.fullname" . }}-pgdumpall + image: {{ include "postgresql.v1.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} env: - name: PGUSER - value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }} - {{- if .Values.postgresql.usePasswordFile }} - - name: PGPASSFILE - value: "/opt/bitnami/postgresql/secrets/postgres-password" + {{- if .Values.auth.enablePostgresUser }} + value: postgres + {{- else }} + value: {{ $customUser | quote }} + {{- end }} + {{- if .Values.auth.usePasswordFiles }} + - name: PGPASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.adminPasswordKey" .) }} {{- else }} - name: PGPASSWORD valueFrom: secretKeyRef: - name: {{ include "postgresql-ha.postgresqlSecretName" . }} - {{- if (include "postgresql-ha.postgresqlCreateSecret" .) }} - key: password - {{- else }} - {{- if ( index ( lookup "v1" "Secret" (include "common.names.namespace" .) (include "postgresql-ha.postgresqlSecretName" .) ) ".data.postgres-password" ) }} - key: postgres-password - {{- else }} - key: password - {{- end }} - {{- end }} + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} {{- end }} - name: PGHOST - value: {{ include "postgresql-ha.postgresql" . }} + value: {{ include "postgresql.v1.primary.fullname" . }} - name: PGPORT - value: {{ .Values.service.ports.postgresql | quote }} + value: {{ include "postgresql.v1.service.port" . | quote }} - name: PGDUMP_DIR value: {{ .Values.backup.cronjob.storage.mountPath }} - {{- if .Values.postgresql.tls.enabled }} + {{- if .Values.tls.enabled }} - name: PGSSLROOTCERT - values: {{ include "postgresql-ha.pgpool.tlsCACert" . }} + {{- if .Values.tls.autoGenerated }} + value: /tmp/certs/ca.crt + {{- else }} + value: {{ printf "/tmp/certs/%s" .Values.tls.certCAFilename }} + {{- end }} {{- end }} command: {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.command "context" $) | nindent 14 }} volumeMounts: - - name: empty-dir - mountPath: /tmp - subPath: tmp-dir - {{- if .Values.postgresql.tls.enabled }} - - name: certs - mountPath: /certs + {{- if .Values.tls.enabled }} + - name: raw-certificates + mountPath: /tmp/certs {{- end }} + {{- if .Values.backup.cronjob.storage.enabled }} - name: datadir mountPath: {{ .Values.backup.cronjob.storage.mountPath }} subPath: {{ .Values.backup.cronjob.storage.subPath }} + {{- end }} + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + {{- if .Values.auth.usePasswordFiles }} + - name: postgresql-password + mountPath: /opt/bitnami/postgresql/secrets/ + {{- end }} + {{- if .Values.backup.cronjob.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.extraVolumeMounts "context" $) | nindent 14 }} + {{- end }} {{- if .Values.backup.cronjob.containerSecurityContext.enabled }} securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.backup.cronjob.containerSecurityContext "context" $) | nindent 14 }} {{- end }} + {{- if .Values.backup.cronjob.resources }} + resources: {{- toYaml .Values.backup.cronjob.resources | nindent 14 }} + {{- else if ne .Values.backup.cronjob.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.backup.cronjob.resourcesPreset) | nindent 14 }} + {{- end }} restartPolicy: {{ .Values.backup.cronjob.restartPolicy }} {{- if .Values.backup.cronjob.podSecurityContext.enabled }} securityContext: fsGroup: {{ .Values.backup.cronjob.podSecurityContext.fsGroup }} {{- end }} volumes: - - name: empty-dir - emptyDir: {} + {{- if .Values.tls.enabled }} + - name: raw-certificates + secret: + secretName: {{ include "postgresql.v1.tlsSecretName" . }} + {{- end }} + {{- if .Values.backup.cronjob.storage.enabled }} {{- if .Values.backup.cronjob.storage.existingClaim }} - name: datadir persistentVolumeClaim: @@ -113,6 +131,17 @@ spec: {{- else }} - name: datadir persistentVolumeClaim: - claimName: {{ include "postgresql-ha.postgresql" . }}-pgdumpall + claimName: {{ include "postgresql.v1.primary.fullname" . }}-pgdumpall + {{- end }} + {{- end }} + - name: empty-dir + emptyDir: {} + {{- if .Values.auth.usePasswordFiles }} + - name: postgresql-password + secret: + secretName: {{ include "postgresql.v1.secretName" . }} + {{- end }} + {{- if .Values.backup.cronjob.extraVolumes }} + {{- include "common.tplvalues.render" ( dict "value" .Values.backup.cronjob.extraVolumes "context" $ ) | nindent 12 }} {{- end }} {{- end }} diff --git a/postgresql/templates/backup/networkpolicy.yaml b/postgresql/templates/backup/networkpolicy.yaml new file mode 100644 index 0000000..21e1add --- /dev/null +++ b/postgresql/templates/backup/networkpolicy.yaml @@ -0,0 +1,32 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.backup.enabled .Values.backup.cronjob.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +metadata: + name: {{ include "postgresql.v1.primary.fullname" . }}-pgdumpall + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: pg_dumpall + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.podLabels .Values.commonLabels ) "context" . ) }} + podSelector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: pg_dumpall + policyTypes: + - Egress + egress: + - ports: + - port: 5432 + protocol: TCP + - port: 53 + protocol: TCP + - port: 53 + protocol: UDP +{{- end }} diff --git a/postgresql-ha/templates/backup/pvc.yaml b/postgresql/templates/backup/pvc.yaml similarity index 84% rename from postgresql-ha/templates/backup/pvc.yaml rename to postgresql/templates/backup/pvc.yaml index 50e9b1d..674ac3d 100644 --- a/postgresql-ha/templates/backup/pvc.yaml +++ b/postgresql/templates/backup/pvc.yaml @@ -3,12 +3,12 @@ Copyright Broadcom, Inc. All Rights Reserved. SPDX-License-Identifier: APACHE-2.0 */}} -{{- if and .Values.backup.enabled (not .Values.backup.cronjob.storage.existingClaim) -}} +{{- if and .Values.backup.enabled .Values.backup.cronjob.storage.enabled (not .Values.backup.cronjob.storage.existingClaim) -}} apiVersion: v1 kind: PersistentVolumeClaim metadata: - name: {{ include "postgresql-ha.postgresql" . }}-pgdumpall - namespace: {{ .Release.Namespace | quote }} + name: {{ include "postgresql.v1.primary.fullname" . }}-pgdumpall + namespace: {{ include "common.names.namespace" . | quote }} {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.labels .Values.commonLabels ) "context" . ) }} labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} app.kubernetes.io/component: pg_dumpall diff --git a/postgresql-ha/templates/extra-list.yaml b/postgresql/templates/extra-list.yaml similarity index 100% rename from postgresql-ha/templates/extra-list.yaml rename to postgresql/templates/extra-list.yaml diff --git a/postgresql/templates/primary/configmap.yaml b/postgresql/templates/primary/configmap.yaml new file mode 100644 index 0000000..ad231e5 --- /dev/null +++ b/postgresql/templates/primary/configmap.yaml @@ -0,0 +1,26 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if (include "postgresql.v1.primary.createConfigmap" .) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-configuration" (include "postgresql.v1.primary.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + {{- if .Values.primary.configuration }} + postgresql.conf: | + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.configuration "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.primary.pgHbaConfiguration }} + pg_hba.conf: | + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.pgHbaConfiguration "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/postgresql-ha/templates/postgresql/extended-configmap.yaml b/postgresql/templates/primary/extended-configmap.yaml similarity index 75% rename from postgresql-ha/templates/postgresql/extended-configmap.yaml rename to postgresql/templates/primary/extended-configmap.yaml index 66655df..2d228e4 100644 --- a/postgresql-ha/templates/postgresql/extended-configmap.yaml +++ b/postgresql/templates/primary/extended-configmap.yaml @@ -3,18 +3,18 @@ Copyright Broadcom, Inc. All Rights Reserved. SPDX-License-Identifier: APACHE-2.0 */}} -{{- if and .Values.postgresql.extendedConf (not .Values.postgresql.extendedConfCM) }} +{{- if (include "postgresql.v1.primary.createExtendedConfigmap" .) }} apiVersion: v1 kind: ConfigMap metadata: - name: {{ printf "%s-extended-configuration" (include "postgresql-ha.postgresql" .) }} + name: {{ printf "%s-extended-configuration" (include "postgresql.v1.primary.fullname" .) }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: postgresql + app.kubernetes.io/component: primary {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} data: override.conf: |- - {{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.extendedConf "context" $ ) | nindent 4 }} + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.extendedConfiguration "context" $ ) | nindent 4 }} {{- end }} diff --git a/postgresql-ha/templates/postgresql/initdb-scripts-configmap.yaml b/postgresql/templates/primary/initialization-configmap.yaml similarity index 60% rename from postgresql-ha/templates/postgresql/initdb-scripts-configmap.yaml rename to postgresql/templates/primary/initialization-configmap.yaml index e379b4e..450812a 100644 --- a/postgresql-ha/templates/postgresql/initdb-scripts-configmap.yaml +++ b/postgresql/templates/primary/initialization-configmap.yaml @@ -3,17 +3,15 @@ Copyright Broadcom, Inc. All Rights Reserved. SPDX-License-Identifier: APACHE-2.0 */}} -{{- if and .Values.postgresql.initdbScripts (not .Values.postgresql.initdbScriptsCM) }} +{{- if and .Values.primary.initdb.scripts (not .Values.primary.initdb.scriptsConfigMap) }} apiVersion: v1 kind: ConfigMap metadata: - name: {{ printf "%s-initdb-scripts" (include "postgresql-ha.postgresql" .) }} + name: {{ printf "%s-init-scripts" (include "postgresql.v1.primary.fullname" .) }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: postgresql {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} -data: - {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.initdbScripts "context" $) | nindent 4 }} +data: {{- include "common.tplvalues.render" (dict "value" .Values.primary.initdb.scripts "context" .) | nindent 2 }} {{- end }} diff --git a/postgresql-ha/templates/metrics-configmap.yaml b/postgresql/templates/primary/metrics-configmap.yaml similarity index 89% rename from postgresql-ha/templates/metrics-configmap.yaml rename to postgresql/templates/primary/metrics-configmap.yaml index b79d676..9bf889a 100644 --- a/postgresql-ha/templates/metrics-configmap.yaml +++ b/postgresql/templates/primary/metrics-configmap.yaml @@ -7,7 +7,7 @@ SPDX-License-Identifier: APACHE-2.0 apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "postgresql.metricsCM" . }} + name: {{ printf "%s-metrics" (include "postgresql.v1.primary.fullname" .) }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if .Values.commonAnnotations }} diff --git a/postgresql-ha/templates/postgresql/service-witness.yaml b/postgresql/templates/primary/metrics-svc.yaml similarity index 50% rename from postgresql-ha/templates/postgresql/service-witness.yaml rename to postgresql/templates/primary/metrics-svc.yaml index cc2524c..2e77c5b 100644 --- a/postgresql-ha/templates/postgresql/service-witness.yaml +++ b/postgresql/templates/primary/metrics-svc.yaml @@ -3,27 +3,29 @@ Copyright Broadcom, Inc. All Rights Reserved. SPDX-License-Identifier: APACHE-2.0 */}} -{{- if .Values.witness.create }} +{{- if .Values.metrics.enabled }} apiVersion: v1 kind: Service metadata: - name: {{ printf "%s-witness" (include "postgresql-ha.postgresql" .) }} + name: {{ printf "%s-metrics" (include "postgresql.v1.primary.fullname" .) }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- if or .Values.commonAnnotations .Values.service.headless.annotations }} - {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.serviceAnnotations .Values.service.annotations .Values.commonAnnotations ) "context" . ) }} + app.kubernetes.io/component: metrics + {{- if or .Values.commonAnnotations .Values.metrics.service.annotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.service.annotations .Values.commonAnnotations ) "context" . ) }} annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} {{- end }} spec: type: ClusterIP - clusterIP: None + sessionAffinity: {{ .Values.metrics.service.sessionAffinity }} + {{- if .Values.metrics.service.clusterIP }} + clusterIP: {{ .Values.metrics.service.clusterIP }} + {{- end }} ports: - - name: {{ .Values.service.portName | quote }} - port: {{ .Values.postgresql.containerPorts.postgresql }} - targetPort: postgresql - protocol: TCP - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.witness.podLabels .Values.commonLabels ) "context" . ) }} + - name: http-metrics + port: {{ .Values.metrics.service.ports.metrics }} + targetPort: http-metrics + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.podLabels .Values.commonLabels ) "context" . ) }} selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: postgresql - role: witness + app.kubernetes.io/component: primary {{- end }} diff --git a/postgresql-ha/templates/pgpool/networkpolicy.yaml b/postgresql/templates/primary/networkpolicy.yaml similarity index 52% rename from postgresql-ha/templates/pgpool/networkpolicy.yaml rename to postgresql/templates/primary/networkpolicy.yaml index 85e959e..6e5e28f 100644 --- a/postgresql-ha/templates/pgpool/networkpolicy.yaml +++ b/postgresql/templates/primary/networkpolicy.yaml @@ -3,27 +3,26 @@ Copyright Broadcom, Inc. All Rights Reserved. SPDX-License-Identifier: APACHE-2.0 */}} -{{- if .Values.pgpool.networkPolicy.enabled }} +{{- if .Values.primary.networkPolicy.enabled }} kind: NetworkPolicy apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} metadata: - name: {{ include "postgresql-ha.pgpool" . }} + name: {{ include "postgresql.v1.primary.fullname" . }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: pgpool - role: data + app.kubernetes.io/component: primary {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.podLabels .Values.commonLabels ) "context" . ) }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.podLabels .Values.commonLabels ) "context" . ) }} podSelector: matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} - app.kubernetes.io/component: pgpool + app.kubernetes.io/component: primary policyTypes: - Ingress - Egress - {{- if .Values.pgpool.networkPolicy.allowExternalEgress }} + {{- if .Values.primary.networkPolicy.allowExternalEgress }} egress: - {} {{- else }} @@ -34,55 +33,46 @@ spec: protocol: UDP - port: 53 protocol: TCP - # Allow outbound connections to other cluster pods + # Allow outbound connections to read-replicas - ports: - - port: {{ .Values.service.ports.postgresql }} - - port: {{ .Values.pgpool.containerPorts.postgresql }} + - port: {{ .Values.containerPorts.postgresql }} to: - podSelector: matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }} - app.kubernetes.io/component: pgpool - # Allow outbound connections to other postgresql pods - - ports: - - port: {{ .Values.service.ports.postgresql }} - - port: {{ .Values.postgresql.containerPorts.postgresql }} - to: - - podSelector: - matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }} - app.kubernetes.io/component: postgresql - {{- if .Values.pgpool.networkPolicy.extraEgress }} - {{- include "common.tplvalues.render" ( dict "value" .Values.pgpool.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read + {{- if .Values.primary.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.networkPolicy.extraEgress "context" $ ) | nindent 4 }} {{- end }} {{- end }} ingress: - ports: - - port: {{ .Values.pgpool.containerPorts.postgresql }} + - port: {{ .Values.containerPorts.postgresql }} {{- if .Values.metrics.enabled }} - - port: {{ .Values.metrics.containerPorts.http }} + - port: {{ .Values.metrics.containerPorts.metrics }} {{- end }} - {{- if not .Values.pgpool.networkPolicy.allowExternal }} + {{- if not .Values.primary.networkPolicy.allowExternal }} from: - podSelector: matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }} - podSelector: matchLabels: - {{ template "postgresql-ha.pgpool" . }}-client: "true" - {{- if .Values.pgpool.networkPolicy.ingressNSMatchLabels }} + {{ template "postgresql.v1.primary.fullname" . }}-client: "true" + {{- if .Values.primary.networkPolicy.ingressNSMatchLabels }} - namespaceSelector: matchLabels: - {{- range $key, $value := .Values.pgpool.networkPolicy.ingressNSMatchLabels }} + {{- range $key, $value := .Values.primary.networkPolicy.ingressNSMatchLabels }} {{ $key | quote }}: {{ $value | quote }} {{- end }} - {{- if .Values.pgpool.networkPolicy.ingressNSPodMatchLabels }} + {{- if .Values.primary.networkPolicy.ingressNSPodMatchLabels }} podSelector: matchLabels: - {{- range $key, $value := .Values.pgpool.networkPolicy.ingressNSPodMatchLabels }} + {{- range $key, $value := .Values.primary.networkPolicy.ingressNSPodMatchLabels }} {{ $key | quote }}: {{ $value | quote }} {{- end }} {{- end }} {{- end }} {{- end }} - {{- if .Values.pgpool.networkPolicy.extraIngress }} - {{- include "common.tplvalues.render" ( dict "value" .Values.pgpool.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- if .Values.primary.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.networkPolicy.extraIngress "context" $ ) | nindent 4 }} {{- end }} {{- end }} diff --git a/postgresql-ha/templates/postgresql/witness-pdb.yaml b/postgresql/templates/primary/pdb.yaml similarity index 50% rename from postgresql-ha/templates/postgresql/witness-pdb.yaml rename to postgresql/templates/primary/pdb.yaml index e74873a..a03fb20 100644 --- a/postgresql-ha/templates/postgresql/witness-pdb.yaml +++ b/postgresql/templates/primary/pdb.yaml @@ -3,28 +3,27 @@ Copyright Broadcom, Inc. All Rights Reserved. SPDX-License-Identifier: APACHE-2.0 */}} -{{- if .Values.witness.pdb.create }} +{{- if .Values.primary.pdb.create }} apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} kind: PodDisruptionBudget metadata: - name: {{ printf "%s-witness" (include "postgresql-ha.postgresql" .) }} + name: {{ include "postgresql.v1.primary.fullname" . }} namespace: {{ include "common.names.namespace" . | quote }} - labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: postgresql - role: witness + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - {{- if .Values.witness.pdb.minAvailable }} - minAvailable: {{ .Values.witness.pdb.minAvailable }} - {{- end }} - {{- if or .Values.witness.pdb.maxUnavailable (not .Values.witness.pdb.minAvailable) }} - maxUnavailable: {{ .Values.witness.pdb.maxUnavailable | default 1 }} - {{- end }} - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }} + {{- if .Values.primary.pdb.minAvailable }} + minAvailable: {{ .Values.primary.pdb.minAvailable }} + {{- end }} + {{- if or .Values.primary.pdb.maxUnavailable ( not .Values.primary.pdb.minAvailable ) }} + maxUnavailable: {{ .Values.primary.pdb.maxUnavailable | default 1 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.podLabels .Values.commonLabels ) "context" . ) }} selector: matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} - app.kubernetes.io/component: postgresql - role: witness + app.kubernetes.io/component: primary {{- end }} diff --git a/postgresql/templates/primary/preinitialization-configmap.yaml b/postgresql/templates/primary/preinitialization-configmap.yaml new file mode 100644 index 0000000..ae6d188 --- /dev/null +++ b/postgresql/templates/primary/preinitialization-configmap.yaml @@ -0,0 +1,17 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.primary.preInitDb.scripts (not .Values.primary.preInitDb.scriptsConfigMap) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-preinit-scripts" (include "postgresql.v1.primary.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: {{- include "common.tplvalues.render" (dict "value" .Values.primary.preInitDb.scripts "context" .) | nindent 2 }} +{{- end }} diff --git a/postgresql-ha/templates/postgresql/servicemonitor.yaml b/postgresql/templates/primary/servicemonitor.yaml similarity index 70% rename from postgresql-ha/templates/postgresql/servicemonitor.yaml rename to postgresql/templates/primary/servicemonitor.yaml index 11e9817..b17d7f5 100644 --- a/postgresql-ha/templates/postgresql/servicemonitor.yaml +++ b/postgresql/templates/primary/servicemonitor.yaml @@ -7,41 +7,38 @@ SPDX-License-Identifier: APACHE-2.0 apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: - name: {{ include "postgresql-ha.postgresql" . }} + name: {{ include "postgresql.v1.primary.fullname" . }} namespace: {{ coalesce .Values.metrics.serviceMonitor.namespace (include "common.names.namespace" .) | quote }} {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }} labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: postgresql - {{- if or .Values.commonAnnotations .Values.metrics.serviceMonitor.annotations }} - {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.annotations .Values.commonAnnotations ) "context" . ) }} - annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + app.kubernetes.io/component: metrics + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: {{- if .Values.metrics.serviceMonitor.jobLabel }} jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }} {{- end }} selector: - matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }} - {{- if .Values.metrics.serviceMonitor.selector }} - {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }} - {{- end }} - app.kubernetes.io/component: postgresql + {{- $svcLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.selector .Values.commonLabels ) "context" . ) }} + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $svcLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: metrics endpoints: - - port: metrics + - port: http-metrics {{- if .Values.metrics.serviceMonitor.interval }} interval: {{ .Values.metrics.serviceMonitor.interval }} {{- end }} {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} {{- end }} - {{- if .Values.metrics.serviceMonitor.honorLabels }} - honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }} + {{- if .Values.metrics.serviceMonitor.relabelings }} + relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 6 }} {{- end }} {{- if .Values.metrics.serviceMonitor.metricRelabelings }} - metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 8 }} + metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 6 }} {{- end }} - {{- if .Values.metrics.serviceMonitor.relabelings }} - relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 8 }} + {{- if .Values.metrics.serviceMonitor.honorLabels }} + honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }} {{- end }} namespaceSelector: matchNames: diff --git a/postgresql/templates/primary/statefulset.yaml b/postgresql/templates/primary/statefulset.yaml new file mode 100644 index 0000000..d45d617 --- /dev/null +++ b/postgresql/templates/primary/statefulset.yaml @@ -0,0 +1,705 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- $customUser := include "postgresql.v1.username" . }} +apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} +kind: StatefulSet +metadata: + name: {{ include "postgresql.v1.primary.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary + {{- if or .Values.commonAnnotations .Values.primary.annotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + replicas: 1 + serviceName: {{ include "postgresql.v1.primary.svc.headless" . }} + {{- if .Values.primary.updateStrategy }} + updateStrategy: {{- toYaml .Values.primary.updateStrategy | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.podLabels .Values.commonLabels ) "context" . ) }} + selector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: primary + template: + metadata: + name: {{ include "postgresql.v1.primary.fullname" . }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} + app.kubernetes.io/component: primary + {{- if or .Values.passwordUpdateJob.enabled (include "postgresql.v1.primary.createConfigmap" .) (include "postgresql.v1.primary.createExtendedConfigmap" .) .Values.primary.podAnnotations }} + annotations: + {{- if (include "postgresql.v1.primary.createConfigmap" .) }} + checksum/configuration: {{ pick (include (print $.Template.BasePath "/primary/configmap.yaml") . | fromYaml) "data" | toYaml | sha256sum }} + {{- end }} + {{- if (include "postgresql.v1.primary.createExtendedConfigmap" .) }} + checksum/extended-configuration: {{ pick (include (print $.Template.BasePath "/primary/extended-configmap.yaml") . | fromYaml) "data" | toYaml | sha256sum }} + {{- end }} + {{- if .Values.passwordUpdateJob.enabled }} + charts.bitnami.com/password-last-update: {{ now | date "20060102150405" | quote }} + {{- end }} + {{- if .Values.primary.podAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.podAnnotations "context" $ ) | nindent 8 }} + {{- end }} + {{- end }} + spec: + {{- if .Values.primary.extraPodSpec }} + {{- include "common.tplvalues.render" (dict "value" .Values.primary.extraPodSpec "context" $) | nindent 6 }} + {{- end }} + serviceAccountName: {{ include "postgresql.v1.serviceAccountName" . }} + {{- include "postgresql.v1.imagePullSecrets" . | nindent 6 }} + automountServiceAccountToken: {{ .Values.primary.automountServiceAccountToken }} + {{- if .Values.primary.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.primary.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.primary.affinity }} + affinity: {{- include "common.tplvalues.render" (dict "value" .Values.primary.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.primary.podAffinityPreset "component" "primary" "customLabels" $podLabels "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.primary.podAntiAffinityPreset "component" "primary" "customLabels" $podLabels "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.primary.nodeAffinityPreset.type "key" .Values.primary.nodeAffinityPreset.key "values" .Values.primary.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.primary.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.primary.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.primary.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.primary.tolerations "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.primary.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.primary.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.primary.priorityClassName }} + priorityClassName: {{ .Values.primary.priorityClassName }} + {{- end }} + {{- if .Values.primary.schedulerName }} + schedulerName: {{ .Values.primary.schedulerName | quote }} + {{- end }} + {{- if .Values.primary.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.primary.terminationGracePeriodSeconds }} + {{- end }} + {{- if .Values.primary.podSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.primary.podSecurityContext "context" $) | nindent 8 }} + {{- end }} + hostNetwork: {{ .Values.primary.hostNetwork }} + hostIPC: {{ .Values.primary.hostIPC }} + {{- if or (and .Values.tls.enabled (not .Values.volumePermissions.enabled)) (and .Values.volumePermissions.enabled (or .Values.primary.persistence.enabled .Values.shmVolume.enabled)) .Values.primary.initContainers }} + initContainers: + {{- if and .Values.tls.enabled (not .Values.volumePermissions.enabled) }} + - name: copy-certs + image: {{ include "postgresql.v1.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + {{- if .Values.primary.resources }} + resources: {{- toYaml .Values.primary.resources | nindent 12 }} + {{- else if ne .Values.primary.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.primary.resourcesPreset) | nindent 12 }} + {{- end }} + # We don't require a privileged container in this case + {{- if .Values.primary.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.primary.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + command: + - /bin/sh + - -ec + - | + cp /tmp/certs/* /opt/bitnami/postgresql/certs/ + chmod 600 {{ include "postgresql.v1.tlsCertKey" . }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + - name: raw-certificates + mountPath: /tmp/certs + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + {{- else if and .Values.volumePermissions.enabled (or .Values.primary.persistence.enabled .Values.shmVolume.enabled) }} + - name: init-chmod-data + image: {{ include "postgresql.v1.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + {{- if .Values.volumePermissions.resources }} + resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} + {{- else if ne .Values.volumePermissions.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }} + {{- end }} + command: + - /bin/sh + - -ec + - | + {{- if .Values.primary.persistence.enabled }} + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + chown `id -u`:`id -G | cut -d " " -f2` {{ .Values.primary.persistence.mountPath }} + {{- else }} + chown {{ .Values.primary.containerSecurityContext.runAsUser }}:{{ .Values.primary.podSecurityContext.fsGroup }} {{ .Values.primary.persistence.mountPath }} + {{- end }} + mkdir -p {{ .Values.primary.persistence.mountPath }}/data {{- if (include "postgresql.v1.mountConfigurationCM" .) }} {{ .Values.primary.persistence.mountPath }}/conf {{- end }} + chmod 700 {{ .Values.primary.persistence.mountPath }}/data {{- if (include "postgresql.v1.mountConfigurationCM" .) }} {{ .Values.primary.persistence.mountPath }}/conf {{- end }} + find {{ .Values.primary.persistence.mountPath }} -mindepth 1 -maxdepth 1 {{- if not (include "postgresql.v1.mountConfigurationCM" .) }} -not -name "conf" {{- end }} -not -name ".snapshot" -not -name "lost+found" | \ + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + xargs -r chown -R `id -u`:`id -G | cut -d " " -f2` + {{- else }} + xargs -r chown -R {{ .Values.primary.containerSecurityContext.runAsUser }}:{{ .Values.primary.podSecurityContext.fsGroup }} + {{- end }} + {{- end }} + {{- if .Values.shmVolume.enabled }} + chmod -R 777 /dev/shm + {{- end }} + {{- if .Values.tls.enabled }} + cp /tmp/certs/* /opt/bitnami/postgresql/certs/ + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/postgresql/certs/ + {{- else }} + chown -R {{ .Values.primary.containerSecurityContext.runAsUser }}:{{ .Values.primary.podSecurityContext.fsGroup }} /opt/bitnami/postgresql/certs/ + {{- end }} + chmod 600 {{ include "postgresql.v1.tlsCertKey" . }} + {{- end }} + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "runAsUser" | toYaml | nindent 12 }} + {{- else }} + securityContext: {{- .Values.volumePermissions.containerSecurityContext | toYaml | nindent 12 }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + - name: {{ .Values.primary.persistence.volumeName }} + mountPath: {{ .Values.primary.persistence.mountPath }} + {{- if .Values.primary.persistence.subPath }} + subPath: {{ .Values.primary.persistence.subPath }} + {{- end }} + {{- if .Values.shmVolume.enabled }} + - name: dshm + mountPath: /dev/shm + {{- end }} + {{- if .Values.tls.enabled }} + - name: raw-certificates + mountPath: /tmp/certs + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + {{- end }} + {{- end }} + {{- if .Values.primary.initContainers }} + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.initContainers "context" $ ) | nindent 8 }} + {{- end }} + {{- end }} + containers: + - name: postgresql + image: {{ include "postgresql.v1.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + {{- if .Values.primary.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.primary.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.primary.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.primary.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.primary.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.primary.args "context" $) | nindent 12 }} + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }} + - name: POSTGRESQL_PORT_NUMBER + value: {{ .Values.containerPorts.postgresql | quote }} + - name: POSTGRESQL_VOLUME_DIR + value: {{ .Values.primary.persistence.mountPath | quote }} + {{- if .Values.primary.persistence.mountPath }} + - name: PGDATA + value: {{ .Values.postgresqlDataDir | quote }} + {{- end }} + # Authentication + {{- if or (eq $customUser "postgres") (empty $customUser) }} + {{- if .Values.auth.enablePostgresUser }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.adminPasswordKey" .) }} + {{- else }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} + {{- end }} + {{- else }} + - name: ALLOW_EMPTY_PASSWORD + value: "true" + {{- end }} + {{- else }} + - name: POSTGRES_USER + value: {{ $customUser | quote }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.userPasswordKey" .) }} + {{- else }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.userPasswordKey" . }} + {{- end }} + {{- if .Values.auth.enablePostgresUser }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_POSTGRES_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.adminPasswordKey" .) }} + {{- else }} + - name: POSTGRES_POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} + {{- end }} + {{- end }} + {{- end }} + {{- if (include "postgresql.v1.database" .) }} + - name: POSTGRES_DATABASE + value: {{ (include "postgresql.v1.database" .) | quote }} + {{- end }} + {{- if or (eq .Values.architecture "replication") .Values.primary.standby.enabled }} + # Replication + - name: POSTGRES_REPLICATION_MODE + value: {{ ternary "slave" "master" .Values.primary.standby.enabled | quote }} + - name: POSTGRES_REPLICATION_USER + value: {{ .Values.auth.replicationUsername | quote }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_REPLICATION_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.replicationPasswordKey" .) }} + {{- else }} + - name: POSTGRES_REPLICATION_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.replicationPasswordKey" . }} + {{- end }} + {{- if ne .Values.replication.synchronousCommit "off" }} + - name: POSTGRES_SYNCHRONOUS_COMMIT_MODE + value: {{ .Values.replication.synchronousCommit | quote }} + - name: POSTGRES_NUM_SYNCHRONOUS_REPLICAS + value: {{ .Values.replication.numSynchronousReplicas | quote }} + {{- end }} + - name: POSTGRES_CLUSTER_APP_NAME + value: {{ .Values.replication.applicationName }} + {{- end }} + {{- if .Values.primary.initdb.args }} + # Initdb + - name: POSTGRES_INITDB_ARGS + value: {{ .Values.primary.initdb.args | quote }} + {{- end }} + {{- if .Values.primary.initdb.postgresqlWalDir }} + - name: POSTGRES_INITDB_WALDIR + value: {{ .Values.primary.initdb.postgresqlWalDir | quote }} + {{- end }} + {{- if .Values.primary.initdb.user }} + - name: POSTGRES_INITSCRIPTS_USERNAME + value: {{ .Values.primary.initdb.user }} + {{- end }} + {{- if .Values.primary.initdb.password }} + - name: POSTGRES_INITSCRIPTS_PASSWORD + value: {{ .Values.primary.initdb.password | quote }} + {{- end }} + {{- if .Values.primary.standby.enabled }} + # Standby + - name: POSTGRES_MASTER_HOST + value: {{ .Values.primary.standby.primaryHost }} + - name: POSTGRES_MASTER_PORT_NUMBER + value: {{ .Values.primary.standby.primaryPort | quote }} + {{- end }} + # LDAP + - name: POSTGRESQL_ENABLE_LDAP + value: {{ ternary "yes" "no" .Values.ldap.enabled | quote }} + {{- if .Values.ldap.enabled }} + {{- if or .Values.ldap.url .Values.ldap.uri }} + - name: POSTGRESQL_LDAP_URL + value: {{ coalesce .Values.ldap.url .Values.ldap.uri }} + {{- else }} + - name: POSTGRESQL_LDAP_SERVER + value: {{ .Values.ldap.server }} + - name: POSTGRESQL_LDAP_PORT + value: {{ .Values.ldap.port | quote }} + - name: POSTGRESQL_LDAP_SCHEME + value: {{ .Values.ldap.scheme }} + {{- if (include "postgresql.v1.ldap.tls.enabled" .) }} + - name: POSTGRESQL_LDAP_TLS + value: "1" + {{- end }} + - name: POSTGRESQL_LDAP_PREFIX + value: {{ .Values.ldap.prefix | quote }} + - name: POSTGRESQL_LDAP_SUFFIX + value: {{ .Values.ldap.suffix | quote }} + - name: POSTGRESQL_LDAP_BASE_DN + value: {{ coalesce .Values.ldap.baseDN .Values.ldap.basedn }} + - name: POSTGRESQL_LDAP_BIND_DN + value: {{ coalesce .Values.ldap.bindDN .Values.ldap.binddn}} + {{- if or (not (empty .Values.ldap.bind_password)) (not (empty .Values.ldap.bindpw)) }} + - name: POSTGRESQL_LDAP_BIND_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: ldap-password + {{- end }} + - name: POSTGRESQL_LDAP_SEARCH_ATTR + value: {{ coalesce .Values.ldap.search_attr .Values.ldap.searchAttribute }} + - name: POSTGRESQL_LDAP_SEARCH_FILTER + value: {{ coalesce .Values.ldap.search_filter .Values.ldap.searchFilter }} + {{- end }} + {{- end }} + # TLS + - name: POSTGRESQL_ENABLE_TLS + value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} + {{- if .Values.tls.enabled }} + - name: POSTGRESQL_TLS_PREFER_SERVER_CIPHERS + value: {{ ternary "yes" "no" .Values.tls.preferServerCiphers | quote }} + - name: POSTGRESQL_TLS_CERT_FILE + value: {{ include "postgresql.v1.tlsCert" . }} + - name: POSTGRESQL_TLS_KEY_FILE + value: {{ include "postgresql.v1.tlsCertKey" . }} + {{- if .Values.tls.certCAFilename }} + - name: POSTGRESQL_TLS_CA_FILE + value: {{ include "postgresql.v1.tlsCACert" . }} + {{- end }} + {{- if .Values.tls.crlFilename }} + - name: POSTGRESQL_TLS_CRL_FILE + value: {{ include "postgresql.v1.tlsCRL" . }} + {{- end }} + {{- end }} + # Audit + - name: POSTGRESQL_LOG_HOSTNAME + value: {{ .Values.audit.logHostname | quote }} + - name: POSTGRESQL_LOG_CONNECTIONS + value: {{ .Values.audit.logConnections | quote }} + - name: POSTGRESQL_LOG_DISCONNECTIONS + value: {{ .Values.audit.logDisconnections | quote }} + {{- if .Values.audit.logLinePrefix }} + - name: POSTGRESQL_LOG_LINE_PREFIX + value: {{ .Values.audit.logLinePrefix | quote }} + {{- end }} + {{- if .Values.audit.logTimezone }} + - name: POSTGRESQL_LOG_TIMEZONE + value: {{ .Values.audit.logTimezone | quote }} + {{- end }} + {{- if .Values.audit.pgAuditLog }} + - name: POSTGRESQL_PGAUDIT_LOG + value: {{ .Values.audit.pgAuditLog | quote }} + {{- end }} + - name: POSTGRESQL_PGAUDIT_LOG_CATALOG + value: {{ .Values.audit.pgAuditLogCatalog | quote }} + # Others + - name: POSTGRESQL_CLIENT_MIN_MESSAGES + value: {{ .Values.audit.clientMinMessages | quote }} + - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES + value: {{ .Values.postgresqlSharedPreloadLibraries | quote }} + {{- if .Values.primary.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.primary.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + {{- if or .Values.primary.extraEnvVarsCM .Values.primary.extraEnvVarsSecret }} + envFrom: + {{- if .Values.primary.extraEnvVarsCM }} + - configMapRef: + name: {{ .Values.primary.extraEnvVarsCM }} + {{- end }} + {{- if .Values.primary.extraEnvVarsSecret }} + - secretRef: + name: {{ .Values.primary.extraEnvVarsSecret }} + {{- end }} + {{- end }} + ports: + - name: tcp-postgresql + containerPort: {{ .Values.containerPorts.postgresql }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.primary.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.primary.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.primary.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.primary.startupProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /bin/sh + - -c + {{- if (include "postgresql.v1.database" .) }} + - exec pg_isready -U {{ default "postgres" $customUser | quote }} -d "dbname={{ include "postgresql.v1.database" . }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- else }} + - exec pg_isready -U {{ default "postgres" $customUser | quote }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} -d "sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- end }} + {{- end }} + {{- if .Values.primary.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.primary.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.primary.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.primary.livenessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /bin/sh + - -c + {{- if (include "postgresql.v1.database" .) }} + - exec pg_isready -U {{ default "postgres" $customUser | quote }} -d "dbname={{ include "postgresql.v1.database" . }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- else }} + - exec pg_isready -U {{ default "postgres" $customUser | quote }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} -d "sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- end }} + {{- end }} + {{- if .Values.primary.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.primary.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.primary.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.primary.readinessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /bin/sh + - -c + - -e + {{- include "postgresql.v1.readinessProbeCommand" . | nindent 16 }} + {{- end }} + {{- end }} + {{- if .Values.primary.resources }} + resources: {{- toYaml .Values.primary.resources | nindent 12 }} + {{- else if ne .Values.primary.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.primary.resourcesPreset) | nindent 12 }} + {{- end }} + {{- if .Values.primary.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.primary.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + - name: empty-dir + mountPath: /opt/bitnami/postgresql/conf + subPath: app-conf-dir + - name: empty-dir + mountPath: /opt/bitnami/postgresql/tmp + subPath: app-tmp-dir + {{- if or .Values.primary.preInitDb.scriptsConfigMap .Values.primary.preInitDb.scripts }} + - name: custom-preinit-scripts + mountPath: /docker-entrypoint-preinitdb.d/ + {{- end }} + {{- if .Values.primary.preInitDb.scriptsSecret }} + - name: custom-preinit-scripts-secret + mountPath: /docker-entrypoint-preinitdb.d/secret + {{- end }} + {{- if or .Values.primary.initdb.scriptsConfigMap .Values.primary.initdb.scripts }} + - name: custom-init-scripts + mountPath: /docker-entrypoint-initdb.d/ + {{- end }} + {{- if .Values.primary.initdb.scriptsSecret }} + - name: custom-init-scripts-secret + mountPath: /docker-entrypoint-initdb.d/secret + {{- end }} + {{- if or .Values.primary.extendedConfiguration .Values.primary.existingExtendedConfigmap }} + - name: postgresql-extended-config + mountPath: {{ .Values.primary.persistence.mountPath }}/conf/conf.d/ + {{- end }} + {{- if and .Values.auth.usePasswordFiles (or .Values.auth.enablePostgresUser $customUser) }} + - name: postgresql-password + mountPath: /opt/bitnami/postgresql/secrets/ + {{- end }} + {{- if .Values.tls.enabled }} + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + readOnly: true + {{- end }} + {{- if .Values.shmVolume.enabled }} + - name: dshm + mountPath: /dev/shm + {{- end }} + - name: {{ .Values.primary.persistence.volumeName }} + mountPath: {{ .Values.primary.persistence.mountPath }} + {{- if .Values.primary.persistence.subPath }} + subPath: {{ .Values.primary.persistence.subPath }} + {{- end }} + {{- if or .Values.primary.configuration .Values.primary.pgHbaConfiguration .Values.primary.existingConfigmap }} + - name: postgresql-config + mountPath: {{ .Values.primary.persistence.mountPath }}/conf + {{- end }} + {{- if .Values.primary.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.primary.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.metrics.enabled }} + - name: metrics + image: {{ include "postgresql.v1.metrics.image" . }} + imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} + {{- if .Values.metrics.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.metrics.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if or .Values.metrics.customMetrics .Values.metrics.collectors }} + args: + {{- if .Values.metrics.customMetrics }} + - --extend.query-path + - /conf/custom-metrics.yaml + {{- end }} + {{- range $name, $enabled := .Values.metrics.collectors }} + - --{{ if not $enabled }}no-{{ end }}collector.{{ $name }} + {{- end }} + {{- end }} + env: + - name: DATA_SOURCE_URI + value: {{ printf "127.0.0.1:%d/postgres?sslmode=disable" (int (include "postgresql.v1.service.port" .)) }} + {{- if .Values.auth.usePasswordFiles }} + - name: DATA_SOURCE_PASS_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include (ternary "postgresql.v1.adminPasswordKey" "postgresql.v1.userPasswordKey" (empty $customUser)) .) }} + {{- else }} + - name: DATA_SOURCE_PASS + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include (ternary "postgresql.v1.adminPasswordKey" "postgresql.v1.userPasswordKey" (empty $customUser)) . }} + {{- end }} + - name: DATA_SOURCE_USER + value: {{ default "postgres" $customUser | quote }} + {{- if .Values.metrics.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + ports: + - name: http-metrics + containerPort: {{ .Values.metrics.containerPorts.metrics }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.metrics.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: http-metrics + {{- end }} + {{- if .Values.metrics.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: http-metrics + {{- end }} + {{- if .Values.metrics.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: http-metrics + {{- end }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + {{- if and .Values.auth.usePasswordFiles (or .Values.auth.enablePostgresUser $customUser) }} + - name: postgresql-password + mountPath: /opt/bitnami/postgresql/secrets/ + {{- end }} + {{- if .Values.metrics.customMetrics }} + - name: custom-metrics + mountPath: /conf + readOnly: true + {{- end }} + {{- if .Values.metrics.resources }} + resources: {{- toYaml .Values.metrics.resources | nindent 12 }} + {{- else if ne .Values.metrics.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.primary.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.sidecars "context" $ ) | nindent 8 }} + {{- end }} + volumes: + - name: empty-dir + emptyDir: {} + {{- if or .Values.primary.configuration .Values.primary.pgHbaConfiguration .Values.primary.existingConfigmap }} + - name: postgresql-config + configMap: + name: {{ include "postgresql.v1.primary.configmapName" . }} + {{- end }} + {{- if or .Values.primary.extendedConfiguration .Values.primary.existingExtendedConfigmap }} + - name: postgresql-extended-config + configMap: + name: {{ include "postgresql.v1.primary.extendedConfigmapName" . }} + {{- end }} + {{- if and .Values.auth.usePasswordFiles (or .Values.auth.enablePostgresUser $customUser) }} + - name: postgresql-password + secret: + secretName: {{ include "postgresql.v1.secretName" . }} + {{- end }} + {{- if or .Values.primary.preInitDb.scriptsConfigMap .Values.primary.preInitDb.scripts }} + - name: custom-preinit-scripts + configMap: + name: {{ include "postgresql.v1.preInitDb.scriptsCM" . }} + {{- end }} + {{- if .Values.primary.preInitDb.scriptsSecret }} + - name: custom-preinit-scripts-secret + secret: + secretName: {{ tpl .Values.primary.preInitDb.scriptsSecret $ }} + {{- end }} + {{- if or .Values.primary.initdb.scriptsConfigMap .Values.primary.initdb.scripts }} + - name: custom-init-scripts + configMap: + name: {{ include "postgresql.v1.initdb.scriptsCM" . }} + {{- end }} + {{- if .Values.primary.initdb.scriptsSecret }} + - name: custom-init-scripts-secret + secret: + secretName: {{ tpl .Values.primary.initdb.scriptsSecret $ }} + {{- end }} + {{- if .Values.tls.enabled }} + - name: raw-certificates + secret: + secretName: {{ include "postgresql.v1.tlsSecretName" . }} + - name: postgresql-certificates + emptyDir: {} + {{- end }} + {{- if .Values.primary.extraVolumes }} + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.extraVolumes "context" $ ) | nindent 8 }} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.customMetrics }} + - name: custom-metrics + configMap: + name: {{ printf "%s-metrics" (include "postgresql.v1.primary.fullname" .) }} + {{- end }} + {{- if .Values.shmVolume.enabled }} + - name: dshm + emptyDir: + medium: Memory + {{- if .Values.shmVolume.sizeLimit }} + sizeLimit: {{ .Values.shmVolume.sizeLimit }} + {{- end }} + {{- end }} + {{- if and .Values.primary.persistence.enabled .Values.primary.persistence.existingClaim }} + - name: {{ .Values.primary.persistence.volumeName }} + persistentVolumeClaim: + claimName: {{ tpl .Values.primary.persistence.existingClaim $ }} + {{- else if not .Values.primary.persistence.enabled }} + - name: {{ .Values.primary.persistence.volumeName }} + emptyDir: {} + {{- else }} + {{- if .Values.primary.persistentVolumeClaimRetentionPolicy.enabled }} + persistentVolumeClaimRetentionPolicy: + whenDeleted: {{ .Values.primary.persistentVolumeClaimRetentionPolicy.whenDeleted }} + whenScaled: {{ .Values.primary.persistentVolumeClaimRetentionPolicy.whenScaled }} + {{- end }} + volumeClaimTemplates: + - apiVersion: v1 + kind: PersistentVolumeClaim + metadata: + name: {{ .Values.primary.persistence.volumeName }} + {{- if .Values.primary.persistence.annotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.primary.persistence.annotations "context" $) | nindent 10 }} + {{- end }} + {{- if .Values.primary.persistence.labels }} + labels: {{- include "common.tplvalues.render" (dict "value" .Values.primary.persistence.labels "context" $) | nindent 10 }} + {{- end }} + spec: + accessModes: + {{- range .Values.primary.persistence.accessModes }} + - {{ . | quote }} + {{- end }} + {{- if .Values.primary.persistence.dataSource }} + dataSource: {{- include "common.tplvalues.render" (dict "value" .Values.primary.persistence.dataSource "context" $) | nindent 10 }} + {{- end }} + resources: + requests: + storage: {{ .Values.primary.persistence.size | quote }} + {{- if .Values.primary.persistence.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.primary.persistence.selector "context" $) | nindent 10 }} + {{- end }} + {{- include "common.storage.class" (dict "persistence" .Values.primary.persistence "global" .Values.global) | nindent 8 }} + {{- end }} diff --git a/postgresql/templates/primary/svc-headless.yaml b/postgresql/templates/primary/svc-headless.yaml new file mode 100644 index 0000000..180cfcb --- /dev/null +++ b/postgresql/templates/primary/svc-headless.yaml @@ -0,0 +1,31 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +apiVersion: v1 +kind: Service +metadata: + name: {{ include "postgresql.v1.primary.svc.headless" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary + annotations: + {{- if or .Values.primary.service.headless.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.service.headless.annotations .Values.commonAnnotations ) "context" . ) }} + {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + clusterIP: None + # We want all pods in the StatefulSet to have their addresses published for + # the sake of the other Postgresql pods even before they're ready, since they + # have to be able to talk to each other in order to become ready. + publishNotReadyAddresses: true + ports: + - name: tcp-postgresql + port: {{ template "postgresql.v1.service.port" . }} + targetPort: tcp-postgresql + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.podLabels .Values.commonLabels ) "context" . ) }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary diff --git a/postgresql/templates/primary/svc.yaml b/postgresql/templates/primary/svc.yaml new file mode 100644 index 0000000..2eeaea1 --- /dev/null +++ b/postgresql/templates/primary/svc.yaml @@ -0,0 +1,58 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +apiVersion: v1 +kind: Service +metadata: + name: {{ include "postgresql.v1.primary.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + {{- $labels := .Values.commonLabels }} + {{- if .Values.primary.service.labels }} + {{- $labels = include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.service.labels $labels ) "context" . ) }} + {{- end }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary + {{- if or .Values.commonAnnotations .Values.primary.service.annotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.service.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.primary.service.type }} + {{- if or (eq .Values.primary.service.type "LoadBalancer") (eq .Values.primary.service.type "NodePort") }} + externalTrafficPolicy: {{ .Values.primary.service.externalTrafficPolicy | quote }} + {{- end }} + {{- if and (eq .Values.primary.service.type "LoadBalancer") (not (empty .Values.primary.service.loadBalancerSourceRanges)) }} + loadBalancerSourceRanges: {{ .Values.primary.service.loadBalancerSourceRanges | toJson}} + {{- end }} + {{- if and (eq .Values.primary.service.type "LoadBalancer") (not (empty .Values.primary.service.loadBalancerClass)) }} + loadBalancerClass: {{ .Values.primary.service.loadBalancerClass }} + {{- end }} + {{- if and (eq .Values.primary.service.type "LoadBalancer") (not (empty .Values.primary.service.loadBalancerIP)) }} + loadBalancerIP: {{ .Values.primary.service.loadBalancerIP }} + {{- end }} + {{- if and .Values.primary.service.clusterIP (eq .Values.primary.service.type "ClusterIP") }} + clusterIP: {{ .Values.primary.service.clusterIP }} + {{- end }} + {{- if .Values.primary.service.sessionAffinity }} + sessionAffinity: {{ .Values.primary.service.sessionAffinity }} + {{- end }} + {{- if .Values.primary.service.sessionAffinityConfig }} + sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.primary.service.sessionAffinityConfig "context" $) | nindent 4 }} + {{- end }} + ports: + - name: tcp-postgresql + port: {{ template "postgresql.v1.service.port" . }} + targetPort: tcp-postgresql + {{- if and (or (eq .Values.primary.service.type "NodePort") (eq .Values.primary.service.type "LoadBalancer")) (not (empty .Values.primary.service.nodePorts.postgresql)) }} + nodePort: {{ .Values.primary.service.nodePorts.postgresql }} + {{- else if eq .Values.primary.service.type "ClusterIP" }} + nodePort: null + {{- end }} + {{- if .Values.primary.service.extraPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.primary.service.extraPorts "context" $) | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.podLabels .Values.commonLabels ) "context" . ) }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary diff --git a/postgresql/templates/prometheusrule.yaml b/postgresql/templates/prometheusrule.yaml new file mode 100644 index 0000000..fadcd32 --- /dev/null +++ b/postgresql/templates/prometheusrule.yaml @@ -0,0 +1,22 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule +metadata: + name: {{ include "postgresql.v1.chart.fullname" . }} + namespace: {{ coalesce .Values.metrics.prometheusRule.namespace (include "common.names.namespace" .) | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.prometheusRule.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: metrics + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + groups: + - name: {{ include "postgresql.v1.chart.fullname" . }} + rules: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.prometheusRule.rules "context" $ ) | nindent 8 }} +{{- end }} diff --git a/postgresql-ha/templates/podsecuritypolicy.yaml b/postgresql/templates/psp.yaml similarity index 92% rename from postgresql-ha/templates/podsecuritypolicy.yaml rename to postgresql/templates/psp.yaml index bba0041..b15efa3 100644 --- a/postgresql-ha/templates/podsecuritypolicy.yaml +++ b/postgresql/templates/psp.yaml @@ -7,7 +7,7 @@ SPDX-License-Identifier: APACHE-2.0 apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: - name: {{ template "common.names.fullname" . }} + name: {{ include "postgresql.v1.chart.fullname" . }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if .Values.commonAnnotations }} @@ -15,8 +15,6 @@ metadata: {{- end }} spec: privileged: false - allowedCapabilities: - - CHOWN volumes: - 'configMap' - 'secret' diff --git a/postgresql/templates/read/extended-configmap.yaml b/postgresql/templates/read/extended-configmap.yaml new file mode 100644 index 0000000..6ffc93c --- /dev/null +++ b/postgresql/templates/read/extended-configmap.yaml @@ -0,0 +1,20 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if (include "postgresql.v1.readReplicas.createExtendedConfigmap" .) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-extended-configuration" (include "postgresql.v1.readReplica.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + override.conf: |- + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.extendedConfiguration "context" $ ) | nindent 4 }} +{{- end }} diff --git a/postgresql-ha/templates/ldap-secrets.yaml b/postgresql/templates/read/metrics-configmap.yaml similarity index 62% rename from postgresql-ha/templates/ldap-secrets.yaml rename to postgresql/templates/read/metrics-configmap.yaml index 51f4418..a4ed6b7 100644 --- a/postgresql-ha/templates/ldap-secrets.yaml +++ b/postgresql/templates/read/metrics-configmap.yaml @@ -3,17 +3,16 @@ Copyright Broadcom, Inc. All Rights Reserved. SPDX-License-Identifier: APACHE-2.0 */}} -{{- if .Values.ldap.enabled }} +{{- if and .Values.metrics.enabled .Values.metrics.customMetrics (eq .Values.architecture "replication") }} apiVersion: v1 -kind: Secret +kind: ConfigMap metadata: - name: {{ include "postgresql-ha.ldap" . }} + name: {{ printf "%s-metrics" (include "postgresql.v1.readReplica.fullname" .) }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} -type: Opaque data: - bind-password: {{ (include "postgresql-ha.ldapPassword" .) | b64enc | quote }} -{{- end -}} + custom-metrics.yaml: {{ toYaml .Values.metrics.customMetrics | quote }} +{{- end }} diff --git a/postgresql/templates/read/metrics-svc.yaml b/postgresql/templates/read/metrics-svc.yaml new file mode 100644 index 0000000..fccd1b9 --- /dev/null +++ b/postgresql/templates/read/metrics-svc.yaml @@ -0,0 +1,31 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.metrics.enabled (eq .Values.architecture "replication") }} +apiVersion: v1 +kind: Service +metadata: + name: {{ printf "%s-metrics" (include "postgresql.v1.readReplica.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: metrics-read + {{- if or .Values.commonAnnotations .Values.metrics.service.annotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.service.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + sessionAffinity: {{ .Values.metrics.service.sessionAffinity }} + {{- if .Values.metrics.service.clusterIP }} + clusterIP: {{ .Values.metrics.service.clusterIP }} + {{- end }} + ports: + - name: http-metrics + port: {{ .Values.metrics.service.ports.metrics }} + targetPort: http-metrics + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.podLabels .Values.commonLabels ) "context" . ) }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read +{{- end }} diff --git a/postgresql-ha/templates/postgresql/networkpolicy.yaml b/postgresql/templates/read/networkpolicy.yaml similarity index 57% rename from postgresql-ha/templates/postgresql/networkpolicy.yaml rename to postgresql/templates/read/networkpolicy.yaml index 971212d..9c730d8 100644 --- a/postgresql-ha/templates/postgresql/networkpolicy.yaml +++ b/postgresql/templates/read/networkpolicy.yaml @@ -3,27 +3,27 @@ Copyright Broadcom, Inc. All Rights Reserved. SPDX-License-Identifier: APACHE-2.0 */}} -{{- if .Values.postgresql.networkPolicy.enabled }} +{{- if eq .Values.architecture "replication" }} +{{- if .Values.readReplicas.networkPolicy.enabled }} kind: NetworkPolicy apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} metadata: - name: {{ include "postgresql-ha.postgresql" . }} + name: {{ include "postgresql.v1.readReplica.fullname" . }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: postgresql - role: data + app.kubernetes.io/component: read {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.podLabels .Values.commonLabels ) "context" . ) }} podSelector: matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} - app.kubernetes.io/component: postgresql + app.kubernetes.io/component: read policyTypes: - Ingress - Egress - {{- if .Values.postgresql.networkPolicy.allowExternalEgress }} + {{- if .Values.readReplicas.networkPolicy.allowExternalEgress }} egress: - {} {{- else }} @@ -34,47 +34,47 @@ spec: protocol: UDP - port: 53 protocol: TCP - # Allow outbound connections to other cluster pods + # Allow outbound connections to primary - ports: - - port: {{ .Values.service.ports.postgresql }} - - port: {{ .Values.postgresql.containerPorts.postgresql }} + - port: {{ .Values.containerPorts.postgresql }} to: - podSelector: matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }} - app.kubernetes.io/component: postgresql - {{- if .Values.postgresql.networkPolicy.extraEgress }} - {{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary + {{- if .Values.readReplicas.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.networkPolicy.extraEgress "context" $ ) | nindent 4 }} {{- end }} {{- end }} ingress: - ports: - - port: {{ .Values.postgresql.containerPorts.postgresql }} + - port: {{ .Values.containerPorts.postgresql }} {{- if .Values.metrics.enabled }} - - port: {{ .Values.metrics.containerPorts.http }} + - port: {{ .Values.metrics.containerPorts.metrics }} {{- end }} - {{- if not .Values.postgresql.networkPolicy.allowExternal }} + {{- if not .Values.readReplicas.networkPolicy.allowExternal }} from: - podSelector: matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }} - podSelector: matchLabels: - {{ template "postgresql-ha.postgresql" . }}-client: "true" - {{- if .Values.postgresql.networkPolicy.ingressNSMatchLabels }} + {{ template "postgresql.v1.readReplica.fullname" . }}-client: "true" + {{- if .Values.readReplicas.networkPolicy.ingressNSMatchLabels }} - namespaceSelector: matchLabels: - {{- range $key, $value := .Values.postgresql.networkPolicy.ingressNSMatchLabels }} + {{- range $key, $value := .Values.readReplicas.networkPolicy.ingressNSMatchLabels }} {{ $key | quote }}: {{ $value | quote }} {{- end }} - {{- if .Values.postgresql.networkPolicy.ingressNSPodMatchLabels }} + {{- if .Values.readReplicas.networkPolicy.ingressNSPodMatchLabels }} podSelector: matchLabels: - {{- range $key, $value := .Values.postgresql.networkPolicy.ingressNSPodMatchLabels }} + {{- range $key, $value := .Values.readReplicas.networkPolicy.ingressNSPodMatchLabels }} {{ $key | quote }}: {{ $value | quote }} {{- end }} {{- end }} {{- end }} {{- end }} - {{- if .Values.postgresql.networkPolicy.extraIngress }} - {{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- if .Values.readReplicas.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.networkPolicy.extraIngress "context" $ ) | nindent 4 }} {{- end }} {{- end }} +{{- end }} diff --git a/postgresql-ha/templates/pgpool/pdb.yaml b/postgresql/templates/read/pdb.yaml similarity index 53% rename from postgresql-ha/templates/pgpool/pdb.yaml rename to postgresql/templates/read/pdb.yaml index 39e6096..bd2eaad 100644 --- a/postgresql-ha/templates/pgpool/pdb.yaml +++ b/postgresql/templates/read/pdb.yaml @@ -3,28 +3,27 @@ Copyright Broadcom, Inc. All Rights Reserved. SPDX-License-Identifier: APACHE-2.0 */}} -{{- if .Values.pgpool.pdb.create }} +{{- if and ( eq .Values.architecture "replication" ) .Values.readReplicas.pdb.create }} apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} kind: PodDisruptionBudget metadata: - name: {{ include "postgresql-ha.pgpool" . }} + name: {{ include "postgresql.v1.readReplica.fullname" . }} namespace: {{ include "common.names.namespace" . | quote }} - {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }} - {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.labels .Values.commonLabels ) "context" . ) }} labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} - app.kubernetes.io/component: pgpool + app.kubernetes.io/component: read {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - {{- if .Values.pgpool.pdb.minAvailable }} - minAvailable: {{ .Values.pgpool.pdb.minAvailable }} - {{- end }} - {{- if or .Values.pgpool.pdb.maxUnavailable (not .Values.pgpool.pdb.minAvailable) }} - maxUnavailable: {{ .Values.pgpool.pdb.maxUnavailable | default 1 }} - {{- end }} - {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.podLabels .Values.commonLabels ) "context" . ) }} + {{- if .Values.readReplicas.pdb.minAvailable }} + minAvailable: {{ .Values.readReplicas.pdb.minAvailable }} + {{- end }} + {{- if or .Values.readReplicas.pdb.maxUnavailable ( not .Values.readReplicas.pdb.minAvailable ) }} + maxUnavailable: {{ .Values.readReplicas.pdb.maxUnavailable | default 1 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.podLabels .Values.commonLabels ) "context" . ) }} selector: matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} - app.kubernetes.io/component: pgpool + app.kubernetes.io/component: read {{- end }} diff --git a/postgresql/templates/read/servicemonitor.yaml b/postgresql/templates/read/servicemonitor.yaml new file mode 100644 index 0000000..b1536a6 --- /dev/null +++ b/postgresql/templates/read/servicemonitor.yaml @@ -0,0 +1,46 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled (eq .Values.architecture "replication") }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "postgresql.v1.readReplica.fullname" . }} + namespace: {{ coalesce .Values.metrics.serviceMonitor.namespace (include "common.names.namespace" .) | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: metrics-read + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.metrics.serviceMonitor.jobLabel }} + jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }} + {{- end }} + selector: + {{- $svcLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.selector .Values.commonLabels ) "context" . ) }} + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $svcLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: metrics-read + endpoints: + - port: http-metrics + {{- if .Values.metrics.serviceMonitor.interval }} + interval: {{ .Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.relabelings }} + relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 6 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.metricRelabelings }} + metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 6 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.honorLabels }} + honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }} + {{- end }} + namespaceSelector: + matchNames: + - {{ include "common.names.namespace" . | quote }} +{{- end }} diff --git a/postgresql/templates/read/statefulset.yaml b/postgresql/templates/read/statefulset.yaml new file mode 100644 index 0000000..f7376b5 --- /dev/null +++ b/postgresql/templates/read/statefulset.yaml @@ -0,0 +1,588 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if eq .Values.architecture "replication" }} +{{- $customUser := include "postgresql.v1.username" . }} +apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} +kind: StatefulSet +metadata: + name: {{ include "postgresql.v1.readReplica.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read + {{- if or .Values.commonAnnotations .Values.readReplicas.annotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + replicas: {{ .Values.readReplicas.replicaCount }} + serviceName: {{ include "postgresql.v1.readReplica.svc.headless" . }} + {{- if .Values.readReplicas.updateStrategy }} + updateStrategy: {{- toYaml .Values.readReplicas.updateStrategy | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.podLabels .Values.commonLabels ) "context" . ) }} + selector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: read + template: + metadata: + name: {{ include "postgresql.v1.readReplica.fullname" . }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} + app.kubernetes.io/component: read + {{- if or .Values.passwordUpdateJob.enabled (include "postgresql.v1.readReplicas.createExtendedConfigmap" .) .Values.readReplicas.podAnnotations }} + annotations: + {{- if (include "postgresql.v1.readReplicas.createExtendedConfigmap" .) }} + checksum/extended-configuration: {{ pick (include (print $.Template.BasePath "/primary/extended-configmap.yaml") . | fromYaml) "data" | toYaml | sha256sum }} + {{- end }} + {{- if .Values.passwordUpdateJob.enabled }} + charts.bitnami.com/password-last-update: {{ now | date "20060102150405" | quote }} + {{- end }} + {{- if .Values.readReplicas.podAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.podAnnotations "context" $ ) | nindent 8 }} + {{- end }} + {{- end }} + spec: + {{- if .Values.readReplicas.extraPodSpec }} + {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.extraPodSpec "context" $) | nindent 6 }} + {{- end }} + serviceAccountName: {{ include "postgresql.v1.serviceAccountName" . }} + {{- include "postgresql.v1.imagePullSecrets" . | nindent 6 }} + automountServiceAccountToken: {{ .Values.readReplicas.automountServiceAccountToken }} + {{- if .Values.readReplicas.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.readReplicas.affinity }} + affinity: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.readReplicas.podAffinityPreset "component" "read" "customLabels" $podLabels "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.readReplicas.podAntiAffinityPreset "component" "read" "customLabels" $podLabels "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.readReplicas.nodeAffinityPreset.type "key" .Values.readReplicas.nodeAffinityPreset.key "values" .Values.readReplicas.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.readReplicas.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.readReplicas.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.tolerations "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.readReplicas.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.topologySpreadConstraints "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.readReplicas.priorityClassName }} + priorityClassName: {{ .Values.readReplicas.priorityClassName }} + {{- end }} + {{- if .Values.readReplicas.schedulerName }} + schedulerName: {{ .Values.readReplicas.schedulerName | quote }} + {{- end }} + {{- if .Values.readReplicas.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.readReplicas.terminationGracePeriodSeconds }} + {{- end }} + {{- if .Values.readReplicas.podSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.readReplicas.podSecurityContext "context" $) | nindent 8 }} + {{- end }} + hostNetwork: {{ .Values.readReplicas.hostNetwork }} + hostIPC: {{ .Values.readReplicas.hostIPC }} + {{- if or (and .Values.tls.enabled (not .Values.volumePermissions.enabled)) (and .Values.volumePermissions.enabled (or .Values.readReplicas.persistence.enabled .Values.shmVolume.enabled)) .Values.readReplicas.initContainers }} + initContainers: + {{- if and .Values.tls.enabled (not .Values.volumePermissions.enabled) }} + - name: copy-certs + image: {{ include "postgresql.v1.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + {{- if .Values.readReplicas.resources }} + resources: {{- toYaml .Values.readReplicas.resources | nindent 12 }} + {{- else if ne .Values.readReplicas.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.readReplicas.resourcesPreset) | nindent 12 }} + {{- end }} + # We don't require a privileged container in this case + {{- if .Values.readReplicas.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.readReplicas.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + command: + - /bin/sh + - -ec + - | + cp /tmp/certs/* /opt/bitnami/postgresql/certs/ + chmod 600 {{ include "postgresql.v1.tlsCertKey" . }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + - name: raw-certificates + mountPath: /tmp/certs + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + {{- else if and .Values.volumePermissions.enabled (or .Values.readReplicas.persistence.enabled .Values.shmVolume.enabled) }} + - name: init-chmod-data + image: {{ include "postgresql.v1.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + {{- if .Values.readReplicas.resources }} + resources: {{- toYaml .Values.readReplicas.resources | nindent 12 }} + {{- else if ne .Values.readReplicas.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.readReplicas.resourcesPreset) | nindent 12 }} + {{- end }} + command: + - /bin/sh + - -ec + - | + {{- if .Values.readReplicas.persistence.enabled }} + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + chown `id -u`:`id -G | cut -d " " -f2` {{ .Values.readReplicas.persistence.mountPath }} + {{- else }} + chown {{ .Values.readReplicas.containerSecurityContext.runAsUser }}:{{ .Values.readReplicas.podSecurityContext.fsGroup }} {{ .Values.readReplicas.persistence.mountPath }} + {{- end }} + mkdir -p {{ .Values.readReplicas.persistence.mountPath }}/data {{- if (include "postgresql.v1.mountConfigurationCM" .) }} {{ .Values.readReplicas.persistence.mountPath }}/conf {{- end }} + chmod 700 {{ .Values.readReplicas.persistence.mountPath }}/data {{- if (include "postgresql.v1.mountConfigurationCM" .) }} {{ .Values.readReplicas.persistence.mountPath }}/conf {{- end }} + find {{ .Values.readReplicas.persistence.mountPath }} -mindepth 1 -maxdepth 1 {{- if not (include "postgresql.v1.mountConfigurationCM" .) }} -not -name "conf" {{- end }} -not -name ".snapshot" -not -name "lost+found" | \ + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + xargs -r chown -R `id -u`:`id -G | cut -d " " -f2` + {{- else }} + xargs -r chown -R {{ .Values.readReplicas.containerSecurityContext.runAsUser }}:{{ .Values.readReplicas.podSecurityContext.fsGroup }} + {{- end }} + {{- end }} + {{- if .Values.shmVolume.enabled }} + chmod -R 777 /dev/shm + {{- end }} + {{- if .Values.tls.enabled }} + cp /tmp/certs/* /opt/bitnami/postgresql/certs/ + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/postgresql/certs/ + {{- else }} + chown -R {{ .Values.readReplicas.containerSecurityContext.runAsUser }}:{{ .Values.readReplicas.podSecurityContext.fsGroup }} /opt/bitnami/postgresql/certs/ + {{- end }} + chmod 600 {{ include "postgresql.v1.tlsCertKey" . }} + {{- end }} + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "runAsUser" | toYaml | nindent 12 }} + {{- else }} + securityContext: {{- .Values.volumePermissions.containerSecurityContext | toYaml | nindent 12 }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + - name: data + mountPath: {{ .Values.readReplicas.persistence.mountPath }} + {{- if .Values.readReplicas.persistence.subPath }} + subPath: {{ .Values.readReplicas.persistence.subPath }} + {{- end }} + {{- if .Values.shmVolume.enabled }} + - name: dshm + mountPath: /dev/shm + {{- end }} + {{- if .Values.tls.enabled }} + - name: raw-certificates + mountPath: /tmp/certs + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + {{- end }} + {{- end }} + {{- if .Values.readReplicas.initContainers }} + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.initContainers "context" $ ) | nindent 8 }} + {{- end }} + {{- end }} + containers: + - name: postgresql + image: {{ include "postgresql.v1.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + {{- if .Values.readReplicas.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.readReplicas.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.readReplicas.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.readReplicas.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.args "context" $) | nindent 12 }} + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }} + - name: POSTGRESQL_PORT_NUMBER + value: {{ .Values.containerPorts.postgresql | quote }} + - name: POSTGRESQL_VOLUME_DIR + value: {{ .Values.readReplicas.persistence.mountPath | quote }} + {{- if .Values.readReplicas.persistence.mountPath }} + - name: PGDATA + value: {{ .Values.postgresqlDataDir | quote }} + {{- end }} + # Authentication + {{- if or (eq $customUser "postgres") (empty $customUser) }} + {{- if .Values.auth.enablePostgresUser }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.adminPasswordKey" .) }} + {{- else }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} + {{- end }} + {{- else }} + - name: ALLOW_EMPTY_PASSWORD + value: "true" + {{- end }} + {{- else }} + - name: POSTGRES_USER + value: {{ $customUser | quote }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.userPasswordKey" .) }} + {{- else }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.userPasswordKey" . }} + {{- end }} + {{- if .Values.auth.enablePostgresUser }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_POSTGRES_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.adminPasswordKey" .) }} + {{- else }} + - name: POSTGRES_POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} + {{- end }} + {{- end }} + {{- end }} + # Replication + - name: POSTGRES_REPLICATION_MODE + value: "slave" + - name: POSTGRES_REPLICATION_USER + value: {{ .Values.auth.replicationUsername | quote }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_REPLICATION_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.replicationPasswordKey" .) }} + {{- else }} + - name: POSTGRES_REPLICATION_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.replicationPasswordKey" . }} + {{- end }} + - name: POSTGRES_CLUSTER_APP_NAME + value: {{ .Values.replication.applicationName }} + - name: POSTGRES_MASTER_HOST + value: {{ include "postgresql.v1.primary.fullname" . }} + - name: POSTGRES_MASTER_PORT_NUMBER + value: {{ include "postgresql.v1.service.port" . | quote }} + # TLS + - name: POSTGRESQL_ENABLE_TLS + value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} + {{- if .Values.tls.enabled }} + - name: POSTGRESQL_TLS_PREFER_SERVER_CIPHERS + value: {{ ternary "yes" "no" .Values.tls.preferServerCiphers | quote }} + - name: POSTGRESQL_TLS_CERT_FILE + value: {{ include "postgresql.v1.tlsCert" . }} + - name: POSTGRESQL_TLS_KEY_FILE + value: {{ include "postgresql.v1.tlsCertKey" . }} + {{- if .Values.tls.certCAFilename }} + - name: POSTGRESQL_TLS_CA_FILE + value: {{ include "postgresql.v1.tlsCACert" . }} + {{- end }} + {{- if .Values.tls.crlFilename }} + - name: POSTGRESQL_TLS_CRL_FILE + value: {{ include "postgresql.v1.tlsCRL" . }} + {{- end }} + {{- end }} + # Audit + - name: POSTGRESQL_LOG_HOSTNAME + value: {{ .Values.audit.logHostname | quote }} + - name: POSTGRESQL_LOG_CONNECTIONS + value: {{ .Values.audit.logConnections | quote }} + - name: POSTGRESQL_LOG_DISCONNECTIONS + value: {{ .Values.audit.logDisconnections | quote }} + {{- if .Values.audit.logLinePrefix }} + - name: POSTGRESQL_LOG_LINE_PREFIX + value: {{ .Values.audit.logLinePrefix | quote }} + {{- end }} + {{- if .Values.audit.logTimezone }} + - name: POSTGRESQL_LOG_TIMEZONE + value: {{ .Values.audit.logTimezone | quote }} + {{- end }} + {{- if .Values.audit.pgAuditLog }} + - name: POSTGRESQL_PGAUDIT_LOG + value: {{ .Values.audit.pgAuditLog | quote }} + {{- end }} + - name: POSTGRESQL_PGAUDIT_LOG_CATALOG + value: {{ .Values.audit.pgAuditLogCatalog | quote }} + # Others + - name: POSTGRESQL_CLIENT_MIN_MESSAGES + value: {{ .Values.audit.clientMinMessages | quote }} + - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES + value: {{ .Values.postgresqlSharedPreloadLibraries | quote }} + {{- if .Values.readReplicas.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + {{- if or .Values.readReplicas.extraEnvVarsCM .Values.readReplicas.extraEnvVarsSecret }} + envFrom: + {{- if .Values.readReplicas.extraEnvVarsCM }} + - configMapRef: + name: {{ .Values.readReplicas.extraEnvVarsCM }} + {{- end }} + {{- if .Values.readReplicas.extraEnvVarsSecret }} + - secretRef: + name: {{ .Values.readReplicas.extraEnvVarsSecret }} + {{- end }} + {{- end }} + ports: + - name: tcp-postgresql + containerPort: {{ .Values.containerPorts.postgresql }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.readReplicas.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.readReplicas.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readReplicas.startupProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /bin/sh + - -c + {{- if (include "postgresql.v1.database" .) }} + - exec pg_isready -U {{ default "postgres" $customUser| quote }} -d "dbname={{ include "postgresql.v1.database" . }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- else }} + - exec pg_isready -U {{ default "postgres" $customUser | quote }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} -d "sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- end }} + {{- end }} + {{- if .Values.readReplicas.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.readReplicas.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readReplicas.livenessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /bin/sh + - -c + {{- if (include "postgresql.v1.database" .) }} + - exec pg_isready -U {{ default "postgres" $customUser | quote }} -d "dbname={{ include "postgresql.v1.database" . }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- else }} + - exec pg_isready -U {{default "postgres" $customUser | quote }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} -d "sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- end }} + {{- end }} + {{- if .Values.readReplicas.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.readReplicas.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readReplicas.readinessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /bin/sh + - -c + - -e + {{- include "postgresql.v1.readinessProbeCommand" . | nindent 16 }} + {{- end }} + {{- end }} + {{- if .Values.readReplicas.resources }} + resources: {{- toYaml .Values.readReplicas.resources | nindent 12 }} + {{- else if ne .Values.readReplicas.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.readReplicas.resourcesPreset) | nindent 12 }} + {{- end }} + {{- if .Values.readReplicas.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + - name: empty-dir + mountPath: /opt/bitnami/postgresql/conf + subPath: app-conf-dir + - name: empty-dir + mountPath: /opt/bitnami/postgresql/tmp + subPath: app-tmp-dir + {{- if and .Values.auth.usePasswordFiles (or .Values.auth.enablePostgresUser $customUser) }} + - name: postgresql-password + mountPath: /opt/bitnami/postgresql/secrets/ + {{- end }} + {{- if .Values.readReplicas.extendedConfiguration }} + - name: postgresql-extended-config + mountPath: {{ .Values.readReplicas.persistence.mountPath }}/conf/conf.d/ + {{- end }} + {{- if .Values.tls.enabled }} + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + readOnly: true + {{- end }} + {{- if .Values.shmVolume.enabled }} + - name: dshm + mountPath: /dev/shm + {{- end }} + - name: data + mountPath: {{ .Values.readReplicas.persistence.mountPath }} + {{- if .Values.readReplicas.persistence.subPath }} + subPath: {{ .Values.readReplicas.persistence.subPath }} + {{- end }} + {{- if .Values.readReplicas.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.metrics.enabled }} + - name: metrics + image: {{ include "postgresql.v1.metrics.image" . }} + imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} + {{- if .Values.metrics.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.metrics.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if or .Values.metrics.customMetrics .Values.metrics.collectors }} + args: + {{- if .Values.metrics.customMetrics }} + - --extend.query-path + - /conf/custom-metrics.yaml + {{- end }} + {{- range $name, $enabled := .Values.metrics.collectors }} + - --{{ if not $enabled }}no-{{ end }}collector.{{ $name }} + {{- end }} + {{- end }} + env: + - name: DATA_SOURCE_URI + value: {{ printf "127.0.0.1:%d/postgres?sslmode=disable" (int (include "postgresql.v1.service.port" .)) }} + {{- if .Values.auth.usePasswordFiles }} + - name: DATA_SOURCE_PASS_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include (ternary "postgresql.v1.adminPasswordKey" "postgresql.v1.userPasswordKey" (empty $customUser)) .) }} + {{- else }} + - name: DATA_SOURCE_PASS + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include (ternary "postgresql.v1.adminPasswordKey" "postgresql.v1.userPasswordKey" (empty $customUser)) . }} + {{- end }} + - name: DATA_SOURCE_USER + value: {{ default "postgres" $customUser | quote }} + {{- if .Values.metrics.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + ports: + - name: http-metrics + containerPort: {{ .Values.metrics.containerPorts.metrics }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.metrics.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: http-metrics + {{- end }} + {{- if .Values.metrics.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: http-metrics + {{- end }} + {{- if .Values.metrics.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: http-metrics + {{- end }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + {{- if and .Values.auth.usePasswordFiles (or .Values.auth.enablePostgresUser $customUser) }} + - name: postgresql-password + mountPath: /opt/bitnami/postgresql/secrets/ + {{- end }} + {{- if .Values.metrics.customMetrics }} + - name: custom-metrics + mountPath: /conf + readOnly: true + {{- end }} + {{- if .Values.metrics.resources }} + resources: {{- toYaml .Values.metrics.resources | nindent 12 }} + {{- else if ne .Values.metrics.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.readReplicas.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.sidecars "context" $ ) | nindent 8 }} + {{- end }} + volumes: + {{- if .Values.readReplicas.extendedConfiguration }} + - name: postgresql-extended-config + configMap: + name: {{ include "postgresql.v1.readReplicas.extendedConfigmapName" . }} + {{- end }} + {{- if and .Values.auth.usePasswordFiles (or .Values.auth.enablePostgresUser $customUser) }} + - name: postgresql-password + secret: + secretName: {{ include "postgresql.v1.secretName" . }} + {{- end }} + {{- if .Values.tls.enabled }} + - name: raw-certificates + secret: + secretName: {{ include "postgresql.v1.tlsSecretName" . }} + - name: postgresql-certificates + emptyDir: {} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.customMetrics }} + - name: custom-metrics + configMap: + name: {{ printf "%s-metrics" (include "postgresql.v1.readReplica.fullname" .) }} + {{- end }} + {{- if .Values.shmVolume.enabled }} + - name: dshm + emptyDir: + medium: Memory + {{- if .Values.shmVolume.sizeLimit }} + sizeLimit: {{ .Values.shmVolume.sizeLimit }} + {{- end }} + {{- end }} + - name: empty-dir + emptyDir: {} + {{- if .Values.readReplicas.extraVolumes }} + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.extraVolumes "context" $ ) | nindent 8 }} + {{- end }} + {{- if and .Values.readReplicas.persistence.enabled .Values.readReplicas.persistence.existingClaim }} + - name: data + persistentVolumeClaim: + claimName: {{ tpl .Values.readReplicas.persistence.existingClaim $ }} + {{- else if not .Values.readReplicas.persistence.enabled }} + - name: data + emptyDir: {} + {{- else }} + {{- if .Values.readReplicas.persistentVolumeClaimRetentionPolicy.enabled }} + persistentVolumeClaimRetentionPolicy: + whenDeleted: {{ .Values.readReplicas.persistentVolumeClaimRetentionPolicy.whenDeleted }} + whenScaled: {{ .Values.readReplicas.persistentVolumeClaimRetentionPolicy.whenScaled }} + {{- end }} + volumeClaimTemplates: + - apiVersion: v1 + kind: PersistentVolumeClaim + metadata: + name: data + {{- if .Values.readReplicas.persistence.annotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.persistence.annotations "context" $) | nindent 10 }} + {{- end }} + {{- if .Values.readReplicas.persistence.labels }} + labels: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.persistence.labels "context" $) | nindent 10 }} + {{- end }} + spec: + accessModes: + {{- range .Values.readReplicas.persistence.accessModes }} + - {{ . | quote }} + {{- end }} + {{- if .Values.readReplicas.persistence.dataSource }} + dataSource: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.persistence.dataSource "context" $) | nindent 10 }} + {{- end }} + resources: + requests: + storage: {{ .Values.readReplicas.persistence.size | quote }} + {{- if .Values.readReplicas.persistence.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.persistence.selector "context" $) | nindent 10 }} + {{- end -}} + {{- include "common.storage.class" (dict "persistence" .Values.readReplicas.persistence "global" .Values.global) | nindent 8 }} + {{- end }} +{{- end }} diff --git a/postgresql/templates/read/svc-headless.yaml b/postgresql/templates/read/svc-headless.yaml new file mode 100644 index 0000000..15342a3 --- /dev/null +++ b/postgresql/templates/read/svc-headless.yaml @@ -0,0 +1,33 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if eq .Values.architecture "replication" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "postgresql.v1.readReplica.svc.headless" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read + annotations: + {{- if or .Values.readReplicas.service.headless.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.service.headless.annotations .Values.commonAnnotations ) "context" . ) }} + {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + clusterIP: None + # We want all pods in the StatefulSet to have their addresses published for + # the sake of the other Postgresql pods even before they're ready, since they + # have to be able to talk to each other in order to become ready. + publishNotReadyAddresses: true + ports: + - name: tcp-postgresql + port: {{ include "postgresql.v1.readReplica.service.port" . }} + targetPort: tcp-postgresql + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.podLabels .Values.commonLabels ) "context" . ) }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read +{{- end }} diff --git a/postgresql/templates/read/svc.yaml b/postgresql/templates/read/svc.yaml new file mode 100644 index 0000000..7ebace3 --- /dev/null +++ b/postgresql/templates/read/svc.yaml @@ -0,0 +1,60 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if eq .Values.architecture "replication" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "postgresql.v1.readReplica.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + {{- $labels := .Values.commonLabels }} + {{- if .Values.readReplicas.service.labels }} + {{- $labels = include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.service.labels $labels ) "context" . ) }} + {{- end }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read + {{- if or .Values.commonAnnotations .Values.readReplicas.service.annotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.service.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.readReplicas.service.type }} + {{- if or (eq .Values.readReplicas.service.type "LoadBalancer") (eq .Values.readReplicas.service.type "NodePort") }} + externalTrafficPolicy: {{ .Values.readReplicas.service.externalTrafficPolicy | quote }} + {{- end }} + {{- if and (eq .Values.readReplicas.service.type "LoadBalancer") (not (empty .Values.readReplicas.service.loadBalancerSourceRanges)) }} + loadBalancerSourceRanges: {{ .Values.readReplicas.service.loadBalancerSourceRanges }} + {{- end }} + {{- if and (eq .Values.readReplicas.service.type "LoadBalancer") (not (empty .Values.readReplicas.service.loadBalancerClass)) }} + loadBalancerClass: {{ .Values.readReplicas.service.loadBalancerClass }} + {{- end }} + {{- if and (eq .Values.readReplicas.service.type "LoadBalancer") (not (empty .Values.readReplicas.service.loadBalancerIP)) }} + loadBalancerIP: {{ .Values.readReplicas.service.loadBalancerIP }} + {{- end }} + {{- if and .Values.readReplicas.service.clusterIP (eq .Values.readReplicas.service.type "ClusterIP") }} + clusterIP: {{ .Values.readReplicas.service.clusterIP }} + {{- end }} + {{- if .Values.readReplicas.service.sessionAffinity }} + sessionAffinity: {{ .Values.readReplicas.service.sessionAffinity }} + {{- end }} + {{- if .Values.readReplicas.service.sessionAffinityConfig }} + sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.service.sessionAffinityConfig "context" $) | nindent 4 }} + {{- end }} + ports: + - name: tcp-postgresql + port: {{ include "postgresql.v1.readReplica.service.port" . }} + targetPort: tcp-postgresql + {{- if and (or (eq .Values.readReplicas.service.type "NodePort") (eq .Values.readReplicas.service.type "LoadBalancer")) (not (empty .Values.readReplicas.service.nodePorts.postgresql)) }} + nodePort: {{ .Values.readReplicas.service.nodePorts.postgresql }} + {{- else if eq .Values.readReplicas.service.type "ClusterIP" }} + nodePort: null + {{- end }} + {{- if .Values.readReplicas.service.extraPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.service.extraPorts "context" $) | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.podLabels .Values.commonLabels ) "context" . ) }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read +{{- end }} diff --git a/postgresql-ha/templates/role.yaml b/postgresql/templates/role.yaml similarity index 74% rename from postgresql-ha/templates/role.yaml rename to postgresql/templates/role.yaml index e196af0..ba906aa 100644 --- a/postgresql-ha/templates/role.yaml +++ b/postgresql/templates/role.yaml @@ -7,21 +7,26 @@ SPDX-License-Identifier: APACHE-2.0 kind: Role apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} metadata: - name: {{ template "common.names.fullname" . }} + name: {{ include "postgresql.v1.chart.fullname" . }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} +# yamllint disable rule:indentation rules: {{- if and (include "common.capabilities.psp.supported" .) .Values.psp.create }} - - apiGroups: ["extensions"] - resources: ["podsecuritypolicies"] - verbs: ["use"] + - apiGroups: + - 'policy' + resources: + - 'podsecuritypolicies' + verbs: + - 'use' resourceNames: - - {{ template "common.names.fullname" . }} + - {{ include "postgresql.v1.chart.fullname" . }} {{- end }} {{- if .Values.rbac.rules }} {{- include "common.tplvalues.render" ( dict "value" .Values.rbac.rules "context" $ ) | nindent 2 }} {{- end }} +# yamllint enable rule:indentation {{- end }} diff --git a/postgresql-ha/templates/rolebinding.yaml b/postgresql/templates/rolebinding.yaml similarity index 74% rename from postgresql-ha/templates/rolebinding.yaml rename to postgresql/templates/rolebinding.yaml index b7b40a7..974080a 100644 --- a/postgresql-ha/templates/rolebinding.yaml +++ b/postgresql/templates/rolebinding.yaml @@ -7,7 +7,7 @@ SPDX-License-Identifier: APACHE-2.0 kind: RoleBinding apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} metadata: - name: {{ template "common.names.fullname" . }} + name: {{ include "postgresql.v1.chart.fullname" . }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if .Values.commonAnnotations }} @@ -15,10 +15,10 @@ metadata: {{- end }} roleRef: kind: Role - name: {{ template "common.names.fullname" . }} + name: {{ include "postgresql.v1.chart.fullname" . }} apiGroup: rbac.authorization.k8s.io subjects: - kind: ServiceAccount - name: {{ default (include "common.names.fullname" . ) .Values.serviceAccount.name }} - namespace: {{ .Release.Namespace }} + name: {{ include "postgresql.v1.serviceAccountName" . }} + namespace: {{ include "common.names.namespace" . | quote }} {{- end }} diff --git a/postgresql/templates/secrets.yaml b/postgresql/templates/secrets.yaml new file mode 100644 index 0000000..82dfdd4 --- /dev/null +++ b/postgresql/templates/secrets.yaml @@ -0,0 +1,120 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- $host := include "postgresql.v1.primary.fullname" . }} +{{- $port := include "postgresql.v1.service.port" . }} +{{- $customUser := include "postgresql.v1.username" . }} +{{- $postgresPassword := (ternary (coalesce .Values.global.postgresql.auth.password .Values.auth.password .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword) (coalesce .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword) (or (empty $customUser) (eq $customUser "postgres"))) }} +{{- if (not $postgresPassword) }} +{{- $postgresPassword = include "common.secrets.lookup" (dict "secret" (include "postgresql.v1.secretName" .) "key" (coalesce .Values.global.postgresql.auth.secretKeys.adminPasswordKey .Values.auth.secretKeys.adminPasswordKey) "defaultValue" (ternary (coalesce .Values.global.postgresql.auth.password .Values.auth.password .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword) (coalesce .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword) (or (empty $customUser) (eq $customUser "postgres"))) "context" $) | trimAll "\"" | b64dec }} +{{- end }} +{{- if and (not $postgresPassword) .Values.auth.enablePostgresUser }} +{{- $postgresPassword = randAlphaNum 10 }} +{{- end }} +{{- $replicationPassword := "" }} +{{- if eq .Values.architecture "replication" }} +{{- $replicationPassword = include "common.secrets.passwords.manage" (dict "secret" (include "postgresql.v1.secretName" .) "key" (coalesce .Values.global.postgresql.auth.secretKeys.replicationPasswordKey .Values.auth.secretKeys.replicationPasswordKey) "providedValues" (list "auth.replicationPassword") "honorProvidedValues" true "context" $) | trimAll "\"" | b64dec }} +{{- end }} +{{- $ldapPassword := "" }} +{{- if and .Values.ldap.enabled (or .Values.ldap.bind_password .Values.ldap.bindpw) }} +{{- $ldapPassword = coalesce .Values.ldap.bind_password .Values.ldap.bindpw }} +{{- end }} +{{- $password := "" }} +{{- if and (not (empty $customUser)) (ne $customUser "postgres") }} +{{- $password = include "common.secrets.passwords.manage" (dict "secret" (include "postgresql.v1.secretName" .) "key" (coalesce .Values.global.postgresql.auth.secretKeys.userPasswordKey .Values.auth.secretKeys.userPasswordKey) "providedValues" (list "global.postgresql.auth.password" "auth.password") "honorProvidedValues" true "context" $) | trimAll "\"" | b64dec }} +{{- end }} +{{- $database := include "postgresql.v1.database" . }} +{{- if (include "postgresql.v1.createSecret" .) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "postgresql.v1.chart.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.secretAnnotations .Values.commonAnnotations }} + annotations: + {{- if .Values.secretAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.secretAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} +type: Opaque +data: + {{- if $postgresPassword }} + postgres-password: {{ $postgresPassword | b64enc | quote }} + {{- end }} + {{- if $password }} + password: {{ $password | b64enc | quote }} + {{- end }} + {{- if $replicationPassword }} + replication-password: {{ $replicationPassword | b64enc | quote }} + {{- end }} + # We don't auto-generate LDAP password when it's not provided as we do for other passwords + {{- if and .Values.ldap.enabled (or .Values.ldap.bind_password .Values.ldap.bindpw) }} + ldap-password: {{ $ldapPassword | b64enc | quote }} + {{- end }} +{{- end }} +{{- if .Values.serviceBindings.enabled }} +{{- if $postgresPassword }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "postgresql.v1.chart.fullname" . }}-svcbind-postgres + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.secretAnnotations .Values.commonAnnotations }} + annotations: + {{- if .Values.secretAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.secretAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} +type: servicebinding.io/postgresql +data: + provider: {{ print "bitnami" | b64enc | quote }} + type: {{ print "postgresql" | b64enc | quote }} + host: {{ $host | b64enc | quote }} + port: {{ $port | b64enc | quote }} + username: {{ print "postgres" | b64enc | quote }} + database: {{ print "postgres" | b64enc | quote }} + password: {{ $postgresPassword | b64enc | quote }} + uri: {{ printf "postgresql://postgres:%s@%s:%s/postgres" $postgresPassword $host $port | b64enc | quote }} +{{- end }} +{{- if $password }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "postgresql.v1.chart.fullname" . }}-svcbind-custom-user + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.secretAnnotations .Values.commonAnnotations }} + annotations: + {{- if .Values.secretAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.secretAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} +type: servicebinding.io/postgresql +data: + provider: {{ print "bitnami" | b64enc | quote }} + type: {{ print "postgresql" | b64enc | quote }} + host: {{ $host | b64enc | quote }} + port: {{ $port | b64enc | quote }} + username: {{ $customUser | b64enc | quote }} + password: {{ $password | b64enc | quote }} + {{- if $database }} + database: {{ $database | b64enc | quote }} + {{- end }} + uri: {{ printf "postgresql://%s:%s@%s:%s/%s" $customUser $password $host $port $database | b64enc | quote }} +{{- end }} +{{- end }} diff --git a/postgresql-ha/templates/serviceaccount.yaml b/postgresql/templates/serviceaccount.yaml similarity index 87% rename from postgresql-ha/templates/serviceaccount.yaml rename to postgresql/templates/serviceaccount.yaml index 505f6a2..3a0ccf0 100644 --- a/postgresql-ha/templates/serviceaccount.yaml +++ b/postgresql/templates/serviceaccount.yaml @@ -3,11 +3,11 @@ Copyright Broadcom, Inc. All Rights Reserved. SPDX-License-Identifier: APACHE-2.0 */}} -{{- if .Values.serviceAccount.create -}} +{{- if .Values.serviceAccount.create }} apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "postgresql-ha.serviceAccountName" . }} + name: {{ include "postgresql.v1.serviceAccountName" . }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }} @@ -15,4 +15,4 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} {{- end }} automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} -{{- end -}} +{{- end }} diff --git a/postgresql-ha/templates/tls-secrets.yaml b/postgresql/templates/tls-secrets.yaml similarity index 51% rename from postgresql-ha/templates/tls-secrets.yaml rename to postgresql/templates/tls-secrets.yaml index 1227240..350c86e 100644 --- a/postgresql-ha/templates/tls-secrets.yaml +++ b/postgresql/templates/tls-secrets.yaml @@ -3,14 +3,15 @@ Copyright Broadcom, Inc. All Rights Reserved. SPDX-License-Identifier: APACHE-2.0 */}} -{{- if (include "postgresql-ha.createTlsSecret" . ) }} -{{- $secretName := printf "%s-crt" (include "postgresql-ha.pgpool" .) }} -{{- $ca := genCA "postgresql-ha-internal-ca" 365 }} -{{- $fullname := include "postgresql-ha.pgpool" . }} -{{- $releaseNamespace := .Release.Namespace }} +{{- if (include "postgresql.v1.createTlsSecret" . ) }} +{{- $secretName := printf "%s-crt" (include "postgresql.v1.chart.fullname" .) }} +{{- $ca := genCA "postgresql-ca" 365 }} +{{- $fullname := include "postgresql.v1.chart.fullname" . }} +{{- $releaseNamespace := include "common.names.namespace" . }} {{- $clusterDomain := .Values.clusterDomain }} -{{- $serviceName := include "postgresql-ha.pgpool" . }} -{{- $altNames := list (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) $fullname }} +{{- $primaryHeadlessServiceName := include "postgresql.v1.primary.svc.headless" . }} +{{- $readHeadlessServiceName := include "postgresql.v1.readReplica.svc.headless" . }} +{{- $altNames := list (printf "*.%s.%s.svc.%s" $fullname $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $fullname $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $primaryHeadlessServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $primaryHeadlessServiceName $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $readHeadlessServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $readHeadlessServiceName $releaseNamespace $clusterDomain) $fullname }} {{- $cert := genSignedCert $fullname nil $altNames 365 $ca }} apiVersion: v1 kind: Secret diff --git a/postgresql/templates/update-password/job.yaml b/postgresql/templates/update-password/job.yaml new file mode 100644 index 0000000..6b587b6 --- /dev/null +++ b/postgresql/templates/update-password/job.yaml @@ -0,0 +1,235 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.passwordUpdateJob.enabled }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ printf "%s-password-update" (include "postgresql.v1.chart.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: postgresql + app.kubernetes.io/component: update-job + {{- $defaultAnnotations := dict "helm.sh/hook" "pre-upgrade" "helm.sh/hook-delete-policy" "hook-succeeded" }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.passwordUpdateJob.annotations .Values.commonAnnotations $defaultAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} +spec: + backoffLimit: {{ .Values.passwordUpdateJob.backoffLimit }} + template: + metadata: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.passwordUpdateJob.podLabels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} + app.kubernetes.io/part-of: postgresql + app.kubernetes.io/component: update-job + {{- if .Values.passwordUpdateJob.podAnnotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.podAnnotations "context" $) | nindent 8 }} + {{- end }} + spec: + {{- include "postgresql.v1.imagePullSecrets" . | nindent 6 }} + restartPolicy: OnFailure + {{- if .Values.passwordUpdateJob.podSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.passwordUpdateJob.podSecurityContext "context" $) | nindent 8 }} + {{- end }} + automountServiceAccountToken: {{ .Values.passwordUpdateJob.automountServiceAccountToken }} + {{- if .Values.passwordUpdateJob.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.hostAliases "context" $) | nindent 8 }} + {{- end }} + initContainers: + {{- if .Values.passwordUpdateJob.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.initContainers "context" $) | nindent 8 }} + {{- end }} + containers: + - name: update-credentials + image: {{ template "postgresql.v1.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + {{- if .Values.passwordUpdateJob.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.command "context" $) | nindent 12 }} + {{- else }} + command: + - /bin/bash + - -ec + {{- end }} + {{- if .Values.passwordUpdateJob.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.args "context" $) | nindent 12 }} + {{- else }} + args: + - | + {{- $customUser := include "postgresql.v1.username" . }} + {{- $customDatabase := include "postgresql.v1.database" . | default "postgres" }} + {{- if .Values.auth.usePasswordFiles }} + # We need to load all the secret env vars to the system + for file in $(find /bitnami/postgresql/secrets -type f); do + env_var_name="$(basename $file)" + echo "Exporting $env_var_name" + export $env_var_name="$(< $file)" + done + {{- end }} + + . /opt/bitnami/scripts/postgresql-env.sh + . /opt/bitnami/scripts/libpostgresql.sh + . /opt/bitnami/scripts/liblog.sh + + primary_host={{ include "postgresql.v1.primary.fullname" . }}-0.{{ include "postgresql.v1.primary.svc.headless" . }} + info "Starting password update job" + {{- if .Values.auth.enablePostgresUser }} + if [[ -f /job-status/postgres-password-changed ]]; then + info "Postgres password already updated. Skipping" + else + info "Updating postgres password" + echo "ALTER USER postgres WITH PASSWORD '$POSTGRESQL_NEW_POSTGRES_PASSWORD';" | postgresql_remote_execute $primary_host {{ .Values.containerPorts.postgresql }} "" postgres $POSTGRESQL_PREVIOUS_POSTGRES_PASSWORD + touch /job-status/postgres-password-changed + info "Postgres password successfully updated" + fi + {{- end }} + {{- if and (not (empty $customUser)) (ne $customUser "postgres") }} + if [[ -f /job-status/password-changed ]]; then + info "User password already updated. Skipping" + else + info "Updating user password" + echo "ALTER USER {{ $customUser }} WITH PASSWORD '$POSTGRESQL_NEW_PASSWORD';" | postgresql_remote_execute $primary_host {{ .Values.containerPorts.postgresql }} "{{ $customDatabase }}" $POSTGRESQL_USER $POSTGRESQL_PREVIOUS_PASSWORD + touch /job-status/password-changed + info "User password successfully updated" + fi + {{- end }} + {{- if or (eq .Values.architecture "replication") .Values.primary.standby.enabled }} + if [[ -f /job-status/replication-password-changed ]]; then + info "Replication password already updated. Skipping" + else + info "Updating replication password" + echo "ALTER USER $POSTGRESQL_REPLICATION_USER WITH PASSWORD '$POSTGRESQL_NEW_REPLICATION_PASSWORD';" | postgresql_remote_execute $primary_host {{ .Values.containerPorts.postgresql }} "{{ $customDatabase }}" $POSTGRESQL_REPLICATION_USER $POSTGRESQL_PREVIOUS_REPLICATION_PASSWORD + touch /job-status/replication-password-changed + info "Replication password successfully updated" + fi + {{- end }} + {{- if .Values.passwordUpdateJob.extraCommands }} + info "Running extra commmands" + {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.extraCommands "context" $) | nindent 14 }} + {{- end }} + info "Password update job finished successfully" + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" .Values.image.debug | quote }} + {{- if not .Values.auth.usePasswordFiles }} + - name: POSTGRESQL_PREVIOUS_POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "postgresql.v1.update-job.previousSecretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} + - name: POSTGRESQL_NEW_POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "postgresql.v1.update-job.newSecretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} + {{- end }} + {{- if not (empty .Values.auth.username) }} + - name: POSTGRESQL_USER + value: {{ .Values.auth.username | quote }} + {{- if not .Values.auth.usePasswordFiles }} + - name: POSTGRESQL_PREVIOUS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "postgresql.v1.update-job.previousSecretName" . }} + key: {{ include "postgresql.v1.userPasswordKey" . }} + - name: POSTGRESQL_NEW_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "postgresql.v1.update-job.newSecretName" . }} + key: {{ include "postgresql.v1.userPasswordKey" . }} + {{- end }} + {{- end }} + {{- if eq .Values.architecture "replication" }} + - name: POSTGRESQL_REPLICATION_USER + value: {{ .Values.auth.replicationUsername | quote }} + {{- if not .Values.auth.usePasswordFiles }} + - name: POSTGRESQL_PREVIOUS_REPLICATION_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "postgresql.v1.update-job.previousSecretName" . }} + key: {{ include "postgresql.v1.replicationPasswordKey" . }} + - name: POSTGRESQL_NEW_REPLICATION_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "postgresql.v1.update-job.newSecretName" . }} + key: {{ include "postgresql.v1.replicationPasswordKey" . }} + {{- end }} + {{- end }} + {{- if .Values.passwordUpdateJob.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + {{- if or .Values.passwordUpdateJob.extraEnvVarsCM .Values.passwordUpdateJob.extraEnvVarsSecret }} + envFrom: + {{- if .Values.passwordUpdateJob.extraEnvVarsCM }} + - configMapRef: + name: {{ .Values.passwordUpdateJob.extraEnvVarsCM }} + {{- end }} + {{- if .Values.passwordUpdateJob.extraEnvVarsSecret }} + - secretRef: + name: {{ .Values.passwordUpdateJob.extraEnvVarsSecret }} + {{- end }} + {{- end }} + {{- if .Values.passwordUpdateJob.containerSecurityContext.enabled }} + securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.passwordUpdateJob.containerSecurityContext "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.passwordUpdateJob.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.passwordUpdateJob.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.passwordUpdateJob.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + - name: empty-dir + mountPath: /job-status + subPath: job-dir + {{- if .Values.auth.usePasswordFiles }} + - name: postgresql-previous-credentials + mountPath: /bitnami/postgresql/secrets/previous + - name: postgresql-new-credentials + mountPath: /bitnami/postgresql/secrets/new + {{- end }} + {{- if .Values.passwordUpdateJob.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.passwordUpdateJob.resources }} + resources: {{- toYaml .Values.passwordUpdateJob.resources | nindent 12 }} + {{- else if ne .Values.passwordUpdateJob.resourcesPreset "none" }} + resources: {{- include "common.resources.preset" (dict "type" .Values.passwordUpdateJob.resourcesPreset) | nindent 12 }} + {{- end }} + volumes: + - name: empty-dir + emptyDir: {} + {{- if .Values.auth.usePasswordFiles }} + - name: postgresql-previous-credentials + secret: + secretName: {{ template "postgresql.v1.update-job.previousSecretName" . }} + items: + - key: {{ include "postgresql.v1.adminPasswordKey" . }} + path: POSTGRESQL_PREVIOUS_POSTGRES_PASSWORD + - key: {{ include "postgresql.v1.userPasswordKey" . }} + path: POSTGRESQL_PREVIOUS_PASSWORD + {{- if eq .Values.architecture "replication" }} + - key: {{ include "postgresql.v1.replicationPasswordKey" . }} + path: POSTGRESQL_PREVIOUS_REPLICATION_PASSWORD + {{- end }} + - name: postgresql-new-credentials + secret: + secretName: {{ template "postgresql.v1.update-job.newSecretName" . }} + items: + - key: {{ include "postgresql.v1.adminPasswordKey" . }} + path: POSTGRESQL_NEW_POSTGRES_PASSWORD + - key: {{ include "postgresql.v1.userPasswordKey" . }} + path: POSTGRESQL_NEW_PASSWORD + {{- if eq .Values.architecture "replication" }} + - key: {{ include "postgresql.v1.replicationPasswordKey" . }} + path: POSTGRESQL_NEW_REPLICATION_PASSWORD + {{- end }} + {{- end }} + {{- if .Values.passwordUpdateJob.extraVolumes }} + {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.extraVolumes "context" $) | nindent 8 }} + {{- end }} +{{- end }} diff --git a/postgresql/templates/update-password/new-secret.yaml b/postgresql/templates/update-password/new-secret.yaml new file mode 100644 index 0000000..c02f281 --- /dev/null +++ b/postgresql/templates/update-password/new-secret.yaml @@ -0,0 +1,32 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.passwordUpdateJob.enabled (include "postgresql.v1.createSecret" .) (not ( include "postgresql.v1.createPreviousSecret" . )) (not .Values.passwordUpdateJob.previousPasswords.existingSecret) }} +{{- $customUser := include "postgresql.v1.username" . }} +{{- $postgresPassword := (ternary (coalesce .Values.global.postgresql.auth.password .Values.auth.password .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword) (coalesce .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword) (or (empty $customUser) (eq $customUser "postgres"))) }} +{{- $password := coalesce .Values.global.postgresql.auth.password .Values.auth.password }} +{{- $replicationPassword := .Values.auth.replicationPassword }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ printf "%s-new-secret" (include "postgresql.v1.chart.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: postgresql + {{- $defaultAnnotations := dict "helm.sh/hook" "pre-upgrade" "helm.sh/hook-delete-policy" "hook-succeeded" }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonAnnotations $defaultAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} +type: Opaque +data: + {{- if .Values.auth.enablePostgresUser }} + postgres-password: {{ required "The new postgres password is required!" $postgresPassword | b64enc | quote }} + {{- end }} + {{- if and (not (empty $customUser)) (ne $customUser "postgres") }} + password: {{ required "The new user password is required!" $password | b64enc | quote }} + {{- end }} + {{- if or (eq .Values.architecture "replication") .Values.primary.standby.enabled }} + replication-password: {{ required "The new replication password is required!" $replicationPassword | b64enc | quote }} + {{- end }} +{{- end }} diff --git a/postgresql/templates/update-password/previous-secret.yaml b/postgresql/templates/update-password/previous-secret.yaml new file mode 100644 index 0000000..39087c4 --- /dev/null +++ b/postgresql/templates/update-password/previous-secret.yaml @@ -0,0 +1,32 @@ +{{- /* +Copyright Broadcom, Inc. All Rights Reserved. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.passwordUpdateJob.enabled (include "postgresql.v1.createPreviousSecret" .) }} +{{- $customUser := include "postgresql.v1.username" . }} +{{- $postgresPassword := .Values.passwordUpdateJob.previousPasswords.postgresPassword }} +{{- $password := .Values.passwordUpdateJob.previousPasswords.password }} +{{- $replicationPassword := .Values.passwordUpdateJob.previousPasswords.replicationPassword }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ printf "%s-previous-secret" (include "postgresql.v1.chart.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/part-of: postgresql + {{- $defaultAnnotations := dict "helm.sh/hook" "pre-upgrade" "helm.sh/hook-delete-policy" "hook-succeeded" }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonAnnotations $defaultAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} +type: Opaque +data: + {{- if .Values.auth.enablePostgresUser }} + postgres-password: {{ required "The previous postgres password is required!" $postgresPassword | b64enc | quote }} + {{- end }} + {{- if and (not (empty $customUser)) (ne $customUser "postgres") }} + password: {{ required "The previous user password is required!" $password | b64enc | quote }} + {{- end }} + {{- if or (eq .Values.architecture "replication") .Values.primary.standby.enabled }} + replication-password: {{ required "The previous replication password is required!" $replicationPassword | b64enc | quote }} + {{- end }} +{{- end }} diff --git a/postgresql/values.schema.json b/postgresql/values.schema.json new file mode 100644 index 0000000..fc41483 --- /dev/null +++ b/postgresql/values.schema.json @@ -0,0 +1,156 @@ +{ + "$schema": "http://json-schema.org/schema#", + "type": "object", + "properties": { + "architecture": { + "type": "string", + "title": "PostgreSQL architecture", + "form": true, + "description": "Allowed values: `standalone` or `replication`" + }, + "auth": { + "type": "object", + "title": "Authentication configuration", + "form": true, + "properties": { + "enablePostgresUser": { + "type": "boolean", + "title": "Enable \"postgres\" admin user", + "description": "Assign a password to the \"postgres\" admin user. Otherwise, remote access will be blocked for this user", + "form": true + }, + "postgresPassword": { + "type": "string", + "title": "Password for the \"postgres\" admin user", + "description": "Defaults to a random 10-character alphanumeric string if not set", + "form": true + }, + "database": { + "type": "string", + "title": "PostgreSQL custom database", + "description": "Name of the custom database to be created during the 1st initialization of PostgreSQL", + "form": true + }, + "username": { + "type": "string", + "title": "PostgreSQL custom user", + "description": "Name of the custom user to be created during the 1st initialization of PostgreSQL. This user only has permissions on the PostgreSQL custom database", + "form": true + }, + "password": { + "type": "string", + "title": "Password for the custom user to create", + "description": "Defaults to a random 10-character alphanumeric string if not set", + "form": true + }, + "replicationUsername": { + "type": "string", + "title": "PostgreSQL replication user", + "description": "Name of user used to manage replication.", + "form": true, + "hidden": { + "value": "standalone", + "path": "architecture" + } + }, + "replicationPassword": { + "type": "string", + "title": "Password for PostgreSQL replication user", + "description": "Defaults to a random 10-character alphanumeric string if not set", + "form": true, + "hidden": { + "value": "standalone", + "path": "architecture" + } + } + } + }, + "persistence": { + "type": "object", + "properties": { + "size": { + "type": "string", + "title": "Persistent Volume Size", + "form": true, + "render": "slider", + "sliderMin": 1, + "sliderMax": 100, + "sliderUnit": "Gi" + } + } + }, + "resources": { + "type": "object", + "title": "Required Resources", + "description": "Configure resource requests", + "form": true, + "properties": { + "requests": { + "type": "object", + "properties": { + "memory": { + "type": "string", + "form": true, + "render": "slider", + "title": "Memory Request", + "sliderMin": 10, + "sliderMax": 2048, + "sliderUnit": "Mi" + }, + "cpu": { + "type": "string", + "form": true, + "render": "slider", + "title": "CPU Request", + "sliderMin": 10, + "sliderMax": 2000, + "sliderUnit": "m" + } + } + } + } + }, + "replication": { + "type": "object", + "form": true, + "title": "Replication Details", + "properties": { + "enabled": { + "type": "boolean", + "title": "Enable Replication", + "form": true + }, + "readReplicas": { + "type": "integer", + "title": "read Replicas", + "form": true, + "hidden": { + "value": "standalone", + "path": "architecture" + } + } + } + }, + "volumePermissions": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "form": true, + "title": "Enable Init Containers", + "description": "Change the owner of the persist volume mountpoint to RunAsUser:fsGroup" + } + } + }, + "metrics": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "title": "Configure metrics exporter", + "form": true + } + } + } + } +} diff --git a/postgresql/values.yaml b/postgresql/values.yaml new file mode 100644 index 0000000..b2cb0ea --- /dev/null +++ b/postgresql/values.yaml @@ -0,0 +1,1970 @@ +# Copyright Broadcom, Inc. All Rights Reserved. +# SPDX-License-Identifier: APACHE-2.0 + +## @section Global parameters +## Please, note that this will override the parameters, including dependencies, configured to use the global value +## +global: + ## @param global.imageRegistry Global Docker image registry + ## + imageRegistry: "docker.ii-p001.local" + ## @param global.imagePullSecrets Global Docker registry secret names as an array + ## e.g. + ## imagePullSecrets: + ## - myRegistryKeySecretName + ## + imagePullSecrets: [] + ## @param global.defaultStorageClass Global default StorageClass for Persistent Volume(s) +## @param global.storageClass DEPRECATED: use global.defaultStorageClass instead + ## + defaultStorageClass: "" + storageClass: "ceph-rbd-fast-client1" + ## Security parameters + ## + security: + ## @param global.security.allowInsecureImages Allows skipping image verification + allowInsecureImages: true + postgresql: + ## @param global.postgresql.fullnameOverride Full chart name (overrides `fullnameOverride`) + ## @param global.postgresql.auth.postgresPassword Password for the "postgres" admin user (overrides `auth.postgresPassword`) + ## @param global.postgresql.auth.username Name for a custom user to create (overrides `auth.username`) + ## @param global.postgresql.auth.password Password for the custom user to create (overrides `auth.password`) + ## @param global.postgresql.auth.database Name for a custom database to create (overrides `auth.database`) + ## @param global.postgresql.auth.existingSecret Name of existing secret to use for PostgreSQL credentials (overrides `auth.existingSecret`). + ## @param global.postgresql.auth.secretKeys.adminPasswordKey Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.adminPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. + ## @param global.postgresql.auth.secretKeys.userPasswordKey Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.userPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. + ## @param global.postgresql.auth.secretKeys.replicationPasswordKey Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.replicationPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. + ## + fullnameOverride: "" + + auth: + postgresPassword: "" + username: "" + password: "" + database: "" + existingSecret: "pg-ha-creds" + secretKeys: + adminPasswordKey: "password" + userPasswordKey: "postgresql-password" + replicationPasswordKey: "repmgr-password" + ## @param global.postgresql.service.ports.postgresql PostgreSQL service port (overrides `service.ports.postgresql`) + ## + service: + ports: + postgresql: "" + ## Compatibility adaptations for Kubernetes platforms + ## + compatibility: + ## Compatibility adaptations for Openshift + ## + openshift: + ## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) + ## + adaptSecurityContext: auto +## @section Common parameters +## + +## @param kubeVersion Override Kubernetes version +## +kubeVersion: "" +## @param nameOverride String to partially override common.names.fullname template (will maintain the release name) +## +nameOverride: "" +## @param fullnameOverride String to fully override common.names.fullname template +## +fullnameOverride: "" +## @param namespaceOverride String to fully override common.names.namespace +## +namespaceOverride: "" +## @param clusterDomain Kubernetes Cluster Domain +## +clusterDomain: cluster.local +## @param extraDeploy Array of extra objects to deploy with the release (evaluated as a template) +## +extraDeploy: [] +## @param commonLabels Add labels to all the deployed resources +## +commonLabels: {} +## @param commonAnnotations Add annotations to all the deployed resources +## +commonAnnotations: {} +## @param secretAnnotations Add annotations to the secrets +## +secretAnnotations: {} +## Enable diagnostic mode in the statefulset +## +diagnosticMode: + ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) + ## + enabled: false + ## @param diagnosticMode.command Command to override all containers in the statefulset + ## + command: + - sleep + ## @param diagnosticMode.args Args to override all containers in the statefulset + ## + args: + - infinity +## @section PostgreSQL common parameters +## + +## Bitnami PostgreSQL image version +## ref: https://hub.docker.com/r/bitnami/postgresql/tags/ +## @param image.registry [default: REGISTRY_NAME] PostgreSQL image registry +## @param image.repository [default: REPOSITORY_NAME/postgresql] PostgreSQL image repository +## @skip image.tag PostgreSQL image tag (immutable tags are recommended) +## @param image.digest PostgreSQL image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag +## @param image.pullPolicy PostgreSQL image pull policy +## @param image.pullSecrets Specify image pull secrets +## @param image.debug Specify if debug values should be set +## +image: + registry: docker.io + repository: bitnami/postgresql + tag: 17.5.0-debian-12-r20 + digest: "" + ## Specify a imagePullPolicy + ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## Example: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Set to true if you would like to see extra information on logs + ## + debug: false +## Authentication parameters +## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#setting-the-root-password-on-first-run +## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#creating-a-database-on-first-run +## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#creating-a-database-user-on-first-run +## +auth: + ## @param auth.enablePostgresUser Assign a password to the "postgres" admin user. Otherwise, remote access will be blocked for this user + ## + enablePostgresUser: true + ## @param auth.postgresPassword Password for the "postgres" admin user. Ignored if `auth.existingSecret` is provided + ## + postgresPassword: "" + ## @param auth.username Name for a custom user to create + ## + username: "" + ## @param auth.password Password for the custom user to create. Ignored if `auth.existingSecret` is provided + ## + password: "" + ## @param auth.database Name for a custom database to create + ## + database: "" + ## @param auth.replicationUsername Name of the replication user + ## + replicationUsername: repl_user + ## @param auth.replicationPassword Password for the replication user. Ignored if `auth.existingSecret` is provided + ## + replicationPassword: "" + ## @param auth.existingSecret Name of existing secret to use for PostgreSQL credentials. `auth.postgresPassword`, `auth.password`, and `auth.replicationPassword` will be ignored and picked up from this secret. The secret might also contains the key `ldap-password` if LDAP is enabled. `ldap.bind_password` will be ignored and picked from this secret in this case. + ## + existingSecret: "" + ## @param auth.secretKeys.adminPasswordKey Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. + ## @param auth.secretKeys.userPasswordKey Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. + ## @param auth.secretKeys.replicationPasswordKey Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. + ## + secretKeys: + adminPasswordKey: postgres-password + userPasswordKey: password + replicationPasswordKey: replication-password + ## @param auth.usePasswordFiles Mount credentials as a files instead of using an environment variable + ## + usePasswordFiles: true +## @param architecture PostgreSQL architecture (`standalone` or `replication`) +## +architecture: standalone +## Replication configuration +## Ignored if `architecture` is `standalone` +## +replication: + ## @param replication.synchronousCommit Set synchronous commit mode. Allowed values: `on`, `remote_apply`, `remote_write`, `local` and `off` + ## @param replication.numSynchronousReplicas Number of replicas that will have synchronous replication. Note: Cannot be greater than `readReplicas.replicaCount`. + ## ref: https://www.postgresql.org/docs/current/runtime-config-wal.html#GUC-SYNCHRONOUS-COMMIT + ## + synchronousCommit: "off" + numSynchronousReplicas: 0 + ## @param replication.applicationName Cluster application name. Useful for advanced replication settings + ## + applicationName: my_application +## @param containerPorts.postgresql PostgreSQL container port +## +containerPorts: + postgresql: 5432 +## Audit settings +## https://github.com/bitnami/containers/tree/main/bitnami/postgresql#auditing +## @param audit.logHostname Log client hostnames +## @param audit.logConnections Add client log-in operations to the log file +## @param audit.logDisconnections Add client log-outs operations to the log file +## @param audit.pgAuditLog Add operations to log using the pgAudit extension +## @param audit.pgAuditLogCatalog Log catalog using pgAudit +## @param audit.clientMinMessages Message log level to share with the user +## @param audit.logLinePrefix Template for log line prefix (default if not set) +## @param audit.logTimezone Timezone for the log timestamps +## +audit: + logHostname: false + logConnections: false + logDisconnections: false + pgAuditLog: "" + pgAuditLogCatalog: "off" + clientMinMessages: error + logLinePrefix: "" + logTimezone: "" +## LDAP configuration +## @param ldap.enabled Enable LDAP support +## @param ldap.server IP address or name of the LDAP server. +## @param ldap.port Port number on the LDAP server to connect to +## @param ldap.prefix String to prepend to the user name when forming the DN to bind +## @param ldap.suffix String to append to the user name when forming the DN to bind +## DEPRECATED ldap.baseDN It will removed in a future, please use 'ldap.basedn' instead +## DEPRECATED ldap.bindDN It will removed in a future, please use 'ldap.binddn' instead +## DEPRECATED ldap.bind_password It will removed in a future, please use 'ldap.bindpw' instead +## @param ldap.basedn Root DN to begin the search for the user in +## @param ldap.binddn DN of user to bind to LDAP +## @param ldap.bindpw Password for the user to bind to LDAP +## DEPRECATED ldap.search_attr It will removed in a future, please use 'ldap.searchAttribute' instead +## DEPRECATED ldap.search_filter It will removed in a future, please use 'ldap.searchFilter' instead +## @param ldap.searchAttribute Attribute to match against the user name in the search +## @param ldap.searchFilter The search filter to use when doing search+bind authentication +## @param ldap.scheme Set to `ldaps` to use LDAPS +## DEPRECATED ldap.tls as string is deprecated, please use 'ldap.tls.enabled' instead +## @param ldap.tls.enabled Se to true to enable TLS encryption +## +ldap: + enabled: false + server: "" + port: "" + prefix: "" + suffix: "" + basedn: "" + binddn: "" + bindpw: "" + searchAttribute: "" + searchFilter: "" + scheme: "" + tls: + enabled: false + ## @param ldap.uri LDAP URL beginning in the form `ldap[s]://host[:port]/basedn`. If provided, all the other LDAP parameters will be ignored. + ## Ref: https://www.postgresql.org/docs/current/auth-ldap.html + ## + uri: "" +## @param postgresqlDataDir PostgreSQL data dir folder +## +postgresqlDataDir: /bitnami/postgresql/data +## @param postgresqlSharedPreloadLibraries Shared preload libraries (comma-separated list) +## +postgresqlSharedPreloadLibraries: "pgaudit" +## Start PostgreSQL pod(s) without limitations on shm memory. +## By default docker and containerd (and possibly other container runtimes) limit `/dev/shm` to `64M` +## ref: https://github.com/docker-library/postgres/issues/416 +## ref: https://github.com/containerd/containerd/issues/3654 +## +shmVolume: + ## @param shmVolume.enabled Enable emptyDir volume for /dev/shm for PostgreSQL pod(s) + ## + enabled: true + ## @param shmVolume.sizeLimit Set this to enable a size limit on the shm tmpfs + ## Note: the size of the tmpfs counts against container's memory limit + ## e.g: + ## sizeLimit: 1Gi + ## + sizeLimit: "" +## TLS configuration +## +tls: + ## @param tls.enabled Enable TLS traffic support + ## + enabled: false + ## @param tls.autoGenerated Generate automatically self-signed TLS certificates + ## + autoGenerated: false + ## @param tls.preferServerCiphers Whether to use the server's TLS cipher preferences rather than the client's + ## + preferServerCiphers: true + ## @param tls.certificatesSecret Name of an existing secret that contains the certificates + ## + certificatesSecret: "" + ## @param tls.certFilename Certificate filename + ## + certFilename: "" + ## @param tls.certKeyFilename Certificate key filename + ## + certKeyFilename: "" + ## @param tls.certCAFilename CA Certificate filename + ## If provided, PostgreSQL will authenticate TLS/SSL clients by requesting them a certificate + ## ref: https://www.postgresql.org/docs/9.6/auth-methods.html + ## + certCAFilename: "" + ## @param tls.crlFilename File containing a Certificate Revocation List + ## + crlFilename: "" +## @section PostgreSQL Primary parameters +## +primary: + ## @param primary.name Name of the primary database (eg primary, master, leader, ...) + ## + name: primary + ## @param primary.configuration PostgreSQL Primary main configuration to be injected as ConfigMap + ## ref: https://www.postgresql.org/docs/current/static/runtime-config.html + ## + ## @param primary.pgHbaConfiguration PostgreSQL Primary client authentication configuration + ## ref: https://www.postgresql.org/docs/current/static/auth-pg-hba-conf.html + ## e.g:# + ## pgHbaConfiguration: |- + ## local all all trust + ## host all all localhost trust + ## host mydatabase mysuser 192.168.0.0/24 md5 + ## + pgHbaConfiguration: |- + host all all 0.0.0.0/0 md5 + host all all ::/0 md5 + + ## @param primary.existingConfigmap Name of an existing ConfigMap with PostgreSQL Primary configuration + ## NOTE: `primary.configuration` and `primary.pgHbaConfiguration` will be ignored + ## + existingConfigmap: "" + ## @param primary.extendedConfiguration Extended PostgreSQL Primary configuration (appended to main or default configuration) + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#allow-settings-to-be-loaded-from-files-other-than-the-default-postgresqlconf + ## + extendedConfiguration: |- + listen_addresses = '*' + max_connections = 300 + superuser_reserved_connections = 10 + idle_in_transaction_session_timeout = '5min' + idle_session_timeout = 0 + statement_timeout = 0 + lock_timeout = '15s' + tcp_keepalives_idle = 60 + tcp_keepalives_interval = 15 + tcp_keepalives_count = 4 + authentication_timeout = '1min' + + ## @param primary.existingExtendedConfigmap Name of an existing ConfigMap with PostgreSQL Primary extended configuration + ## NOTE: `primary.extendedConfiguration` will be ignored + ## + existingExtendedConfigmap: "" + ## Initdb configuration + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#specifying-initdb-arguments + ## + initdb: + ## @param primary.initdb.args PostgreSQL initdb extra arguments + ## + args: "" + ## @param primary.initdb.postgresqlWalDir Specify a custom location for the PostgreSQL transaction log + ## + postgresqlWalDir: "" + ## @param primary.initdb.scripts Dictionary of initdb scripts + ## Specify dictionary of scripts to be run at first boot + ## e.g: + ## scripts: + ## my_init_script.sh: | + ## #!/bin/sh + ## echo "Do something." + ## + scripts: + init.sql: | + CREATE DATABASE calendar; + CREATE DATABASE search_db; + CREATE TABLE IF NOT EXISTS users ( + id BIGINT NOT NULL, + user_name VARCHAR(255), + nick_name VARCHAR(255), + phone VARCHAR(255), + email VARCHAR(255), + title VARCHAR(255), + PRIMARY KEY (id) + ); + + CREATE TABLE IF NOT EXISTS users_chats ( + id VARCHAR(50), + user_id BIGINT NOT NULL, + chat_id BIGINT NOT NULL, + PRIMARY KEY (id) + ); + + CREATE INDEX idx_users_chats_chat_id ON users_chats(chat_id); + CREATE EXTENSION IF NOT EXISTS pg_trgm; + + ## @param primary.initdb.scriptsConfigMap ConfigMap with scripts to be run at first boot + ## NOTE: This will override `primary.initdb.scripts` + ## + scriptsConfigMap: "" + ## @param primary.initdb.scriptsSecret Secret with scripts to be run at first boot (in case it contains sensitive information) + ## NOTE: This can work along `primary.initdb.scripts` or `primary.initdb.scriptsConfigMap` + ## + scriptsSecret: "" + ## @param primary.initdb.user Specify the PostgreSQL username to execute the initdb scripts + ## + user: "" + ## @param primary.initdb.password Specify the PostgreSQL password to execute the initdb scripts + ## + password: "" + ## Pre-init configuration + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql/#on-container-start + preInitDb: + ## @param primary.preInitDb.scripts Dictionary of pre-init scripts + ## Specify dictionary of shell scripts to be run before db boot + ## e.g: + ## scripts: + ## my_pre_init_script.sh: | + ## #!/bin/sh + ## echo "Do something." + scripts: {} + ## @param primary.preInitDb.scriptsConfigMap ConfigMap with pre-init scripts to be run + ## NOTE: This will override `primary.preInitDb.scripts` + scriptsConfigMap: "" + ## @param primary.preInitDb.scriptsSecret Secret with pre-init scripts to be run + ## NOTE: This can work along `primary.preInitDb.scripts` or `primary.preInitDb.scriptsConfigMap` + scriptsSecret: "" + ## Configure current cluster's primary server to be the standby server in other cluster. + ## This will allow cross cluster replication and provide cross cluster high availability. + ## You will need to configure pgHbaConfiguration if you want to enable this feature with local cluster replication enabled. + ## @param primary.standby.enabled Whether to enable current cluster's primary as standby server of another cluster or not + ## @param primary.standby.primaryHost The Host of replication primary in the other cluster + ## @param primary.standby.primaryPort The Port of replication primary in the other cluster + ## + standby: + enabled: false + primaryHost: "" + primaryPort: "" + ## @param primary.extraEnvVars Array with extra environment variables to add to PostgreSQL Primary nodes + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + extraEnvVars: [] + ## @param primary.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for PostgreSQL Primary nodes + ## + extraEnvVarsCM: "" + ## @param primary.extraEnvVarsSecret Name of existing Secret containing extra env vars for PostgreSQL Primary nodes + ## + extraEnvVarsSecret: "" + ## @param primary.command Override default container command (useful when using custom images) + ## + command: [] + ## @param primary.args Override default container args (useful when using custom images) + ## + args: [] + ## Configure extra options for PostgreSQL Primary containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param primary.livenessProbe.enabled Enable livenessProbe on PostgreSQL Primary containers + ## @param primary.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param primary.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param primary.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param primary.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param primary.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 30 + periodSeconds: 15 + timeoutSeconds: 15 + failureThreshold: 6 + successThreshold: 1 + ## @param primary.readinessProbe.enabled Enable readinessProbe on PostgreSQL Primary containers + ## @param primary.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param primary.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param primary.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param primary.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param primary.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 30 + periodSeconds: 15 + timeoutSeconds: 15 + failureThreshold: 6 + successThreshold: 1 + ## @param primary.startupProbe.enabled Enable startupProbe on PostgreSQL Primary containers + ## @param primary.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param primary.startupProbe.periodSeconds Period seconds for startupProbe + ## @param primary.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param primary.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param primary.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param primary.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param primary.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param primary.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## @param primary.lifecycleHooks for the PostgreSQL Primary container to automate configuration before or after startup + ## + lifecycleHooks: {} + ## PostgreSQL Primary resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param primary.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if primary.resources is set (primary.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "small" + ## @param primary.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Pod Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## @param primary.podSecurityContext.enabled Enable security context + ## @param primary.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy + ## @param primary.podSecurityContext.sysctls Set kernel settings using the sysctl interface + ## @param primary.podSecurityContext.supplementalGroups Set filesystem extra groups + ## @param primary.podSecurityContext.fsGroup Group ID for the pod + ## + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## @param primary.containerSecurityContext.enabled Enabled containers' Security Context + ## @param primary.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container + ## @param primary.containerSecurityContext.runAsUser Set containers' Security Context runAsUser + ## @param primary.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup + ## @param primary.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot + ## @param primary.containerSecurityContext.privileged Set container's Security Context privileged + ## @param primary.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem + ## @param primary.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation + ## @param primary.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param primary.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsGroup: 1001 + runAsNonRoot: true + privileged: false + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + ## @param primary.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: false + ## @param primary.hostAliases PostgreSQL primary pods host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param primary.hostNetwork Specify if host network should be enabled for PostgreSQL pod (postgresql primary) + ## + hostNetwork: false + ## @param primary.hostIPC Specify if host IPC should be enabled for PostgreSQL pod (postgresql primary) + ## + hostIPC: false + ## @param primary.labels Map of labels to add to the statefulset (postgresql primary) + ## + labels: {} + ## @param primary.annotations Annotations for PostgreSQL primary pods + ## + annotations: {} + ## @param primary.podLabels Map of labels to add to the pods (postgresql primary) + ## + podLabels: {} + ## @param primary.podAnnotations Map of annotations to add to the pods (postgresql primary) + ## + podAnnotations: {} + ## @param primary.podAffinityPreset PostgreSQL primary pod affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param primary.podAntiAffinityPreset PostgreSQL primary pod anti-affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## PostgreSQL Primary node affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param primary.nodeAffinityPreset.type PostgreSQL primary node affinity preset type. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param primary.nodeAffinityPreset.key PostgreSQL primary node label key to match Ignored if `primary.affinity` is set. + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## @param primary.nodeAffinityPreset.values PostgreSQL primary node label values to match. Ignored if `primary.affinity` is set. + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param primary.affinity Affinity for PostgreSQL primary pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## Note: primary.podAffinityPreset, primary.podAntiAffinityPreset, and primary.nodeAffinityPreset will be ignored when it's set + ## + affinity: {} + ## @param primary.nodeSelector Node labels for PostgreSQL primary pods assignment + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param primary.tolerations Tolerations for PostgreSQL primary pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param primary.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: [] + ## @param primary.priorityClassName Priority Class to use for each pod (postgresql primary) + ## + priorityClassName: "" + ## @param primary.schedulerName Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param primary.terminationGracePeriodSeconds Seconds PostgreSQL primary pod needs to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## @param primary.updateStrategy.type PostgreSQL Primary statefulset strategy type + ## @param primary.updateStrategy.rollingUpdate PostgreSQL Primary statefulset rolling update configuration parameters + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## + updateStrategy: + type: RollingUpdate + rollingUpdate: {} + ## @param primary.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the PostgreSQL Primary container(s) + ## + extraVolumeMounts: [] + ## @param primary.extraVolumes Optionally specify extra list of additional volumes for the PostgreSQL Primary pod(s) + ## + extraVolumes: [] + ## @param primary.sidecars Add additional sidecar containers to the PostgreSQL Primary pod(s) + ## For example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param primary.initContainers Add additional init containers to the PostgreSQL Primary pod(s) + ## Example + ## + ## initContainers: + ## - name: do-something + ## image: busybox + ## command: ['do', 'something'] + ## + initContainers: [] + ## Pod Disruption Budget configuration + ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb + ## @param primary.pdb.create Enable/disable a Pod Disruption Budget creation + ## @param primary.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled + ## @param primary.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `primary.pdb.minAvailable` and `primary.pdb.maxUnavailable` are empty. + ## + pdb: + create: true + minAvailable: "" + maxUnavailable: "" + ## @param primary.extraPodSpec Optionally specify extra PodSpec for the PostgreSQL Primary pod(s) + ## + extraPodSpec: {} + ## Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param primary.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + ## @param primary.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param primary.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param primary.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraIngress: + ## - ports: + ## - port: 1234 + ## from: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + extraIngress: [] + ## @param primary.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraEgress: + ## - ports: + ## - port: 1234 + ## to: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + ## + extraEgress: [] + ## @param primary.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces + ## @param primary.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces + ## + ingressNSMatchLabels: {} + ingressNSPodMatchLabels: {} + ## PostgreSQL Primary service configuration + ## + service: + ## @param primary.service.type Kubernetes Service type + ## + type: ClusterIP + ## @param primary.service.ports.postgresql PostgreSQL service port + ## + ports: + postgresql: 5432 + ## Node ports to expose + ## NOTE: choose port between <30000-32767> + ## @param primary.service.nodePorts.postgresql Node port for PostgreSQL + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## + nodePorts: + postgresql: "" + ## @param primary.service.clusterIP Static clusterIP or None for headless services + ## e.g: + ## clusterIP: None + ## + clusterIP: "" + ## @param primary.service.labels Map of labels to add to the primary service + ## + labels: {} + ## @param primary.service.annotations Annotations for PostgreSQL primary service + ## + annotations: {} + ## @param primary.service.loadBalancerClass Load balancer class if service type is `LoadBalancer` + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class + ## + loadBalancerClass: "" + ## @param primary.service.loadBalancerIP Load balancer IP if service type is `LoadBalancer` + ## Set the LoadBalancer service type to internal only + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + loadBalancerIP: "" + ## @param primary.service.externalTrafficPolicy Enable client source IP preservation + ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + ## @param primary.service.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer + ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## + ## loadBalancerSourceRanges: + ## - 10.10.10.0/24 + ## + loadBalancerSourceRanges: [] + ## @param primary.service.extraPorts Extra ports to expose in the PostgreSQL primary service + ## + extraPorts: [] + ## @param primary.service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP" + ## If "ClientIP", consecutive client requests will be directed to the same Pod + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + ## + sessionAffinity: None + ## @param primary.service.sessionAffinityConfig Additional settings for the sessionAffinity + ## sessionAffinityConfig: + ## clientIP: + ## timeoutSeconds: 300 + ## + sessionAffinityConfig: {} + ## Headless service properties + ## + headless: + ## @param primary.service.headless.annotations Additional custom annotations for headless PostgreSQL primary service + ## + annotations: {} + ## PostgreSQL Primary persistence configuration + ## + persistence: + ## @param primary.persistence.enabled Enable PostgreSQL Primary data persistence using PVC + ## + enabled: true + ## @param primary.persistence.volumeName Name to assign the volume + ## + volumeName: "data" + ## @param primary.persistence.existingClaim Name of an existing PVC to use + ## + existingClaim: "" + ## @param primary.persistence.mountPath The path the volume will be mounted at + ## Note: useful when using custom PostgreSQL images + ## + mountPath: /bitnami/postgresql + ## @param primary.persistence.subPath The subdirectory of the volume to mount to + ## Useful in dev environments and one PV for multiple services + ## + subPath: "" + ## @param primary.persistence.storageClass PVC Storage Class for PostgreSQL Primary data volume + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + storageClass: "ceph-rbd-fast-client1" + ## @param primary.persistence.accessModes PVC Access Mode for PostgreSQL volume + ## + accessModes: + - ReadWriteOnce + ## @param primary.persistence.size PVC Storage Request for PostgreSQL volume + ## + size: 8Gi + ## @param primary.persistence.annotations Annotations for the PVC + ## + annotations: {} + ## @param primary.persistence.labels Labels for the PVC + ## + labels: {} + ## @param primary.persistence.selector Selector to match an existing Persistent Volume (this value is evaluated as a template) + ## selector: + ## matchLabels: + ## app: my-app + ## + selector: {} + ## @param primary.persistence.dataSource Custom PVC data source + ## + dataSource: {} + ## PostgreSQL Primary Persistent Volume Claim Retention Policy + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention + ## + persistentVolumeClaimRetentionPolicy: + ## @param primary.persistentVolumeClaimRetentionPolicy.enabled Enable Persistent volume retention policy for Primary Statefulset + ## + enabled: false + ## @param primary.persistentVolumeClaimRetentionPolicy.whenScaled Volume retention behavior when the replica count of the StatefulSet is reduced + ## + whenScaled: Retain + ## @param primary.persistentVolumeClaimRetentionPolicy.whenDeleted Volume retention behavior that applies when the StatefulSet is deleted + ## + whenDeleted: Retain +## @section PostgreSQL read only replica parameters (only used when `architecture` is set to `replication`) +## +readReplicas: + ## @param readReplicas.name Name of the read replicas database (eg secondary, slave, ...) + ## + name: read + ## @param readReplicas.replicaCount Number of PostgreSQL read only replicas + ## + replicaCount: 1 + ## @param readReplicas.extendedConfiguration Extended PostgreSQL read only replicas configuration (appended to main or default configuration) + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#allow-settings-to-be-loaded-from-files-other-than-the-default-postgresqlconf + ## + extendedConfiguration: "" + ## @param readReplicas.extraEnvVars Array with extra environment variables to add to PostgreSQL read only nodes + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + extraEnvVars: [] + ## @param readReplicas.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for PostgreSQL read only nodes + ## + extraEnvVarsCM: "" + ## @param readReplicas.extraEnvVarsSecret Name of existing Secret containing extra env vars for PostgreSQL read only nodes + ## + extraEnvVarsSecret: "" + ## @param readReplicas.command Override default container command (useful when using custom images) + ## + command: [] + ## @param readReplicas.args Override default container args (useful when using custom images) + ## + args: [] + ## Configure extra options for PostgreSQL read only containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param readReplicas.livenessProbe.enabled Enable livenessProbe on PostgreSQL read only containers + ## @param readReplicas.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param readReplicas.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param readReplicas.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param readReplicas.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param readReplicas.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param readReplicas.readinessProbe.enabled Enable readinessProbe on PostgreSQL read only containers + ## @param readReplicas.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param readReplicas.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param readReplicas.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param readReplicas.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param readReplicas.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param readReplicas.startupProbe.enabled Enable startupProbe on PostgreSQL read only containers + ## @param readReplicas.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param readReplicas.startupProbe.periodSeconds Period seconds for startupProbe + ## @param readReplicas.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param readReplicas.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param readReplicas.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param readReplicas.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param readReplicas.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param readReplicas.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## @param readReplicas.lifecycleHooks for the PostgreSQL read only container to automate configuration before or after startup + ## + lifecycleHooks: {} + ## PostgreSQL read only resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param readReplicas.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if readReplicas.resources is set (readReplicas.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param readReplicas.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Pod Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## @param readReplicas.podSecurityContext.enabled Enable security context + ## @param readReplicas.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy + ## @param readReplicas.podSecurityContext.sysctls Set kernel settings using the sysctl interface + ## @param readReplicas.podSecurityContext.supplementalGroups Set filesystem extra groups + ## @param readReplicas.podSecurityContext.fsGroup Group ID for the pod + ## + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## @param readReplicas.containerSecurityContext.enabled Enabled containers' Security Context + ## @param readReplicas.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container + ## @param readReplicas.containerSecurityContext.runAsUser Set containers' Security Context runAsUser + ## @param readReplicas.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup + ## @param readReplicas.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot + ## @param readReplicas.containerSecurityContext.privileged Set container's Security Context privileged + ## @param readReplicas.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem + ## @param readReplicas.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation + ## @param readReplicas.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param readReplicas.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsGroup: 1001 + runAsNonRoot: true + privileged: false + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + ## @param readReplicas.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: false + ## @param readReplicas.hostAliases PostgreSQL read only pods host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param readReplicas.hostNetwork Specify if host network should be enabled for PostgreSQL pod (PostgreSQL read only) + ## + hostNetwork: false + ## @param readReplicas.hostIPC Specify if host IPC should be enabled for PostgreSQL pod (postgresql primary) + ## + hostIPC: false + ## @param readReplicas.labels Map of labels to add to the statefulset (PostgreSQL read only) + ## + labels: {} + ## @param readReplicas.annotations Annotations for PostgreSQL read only pods + ## + annotations: {} + ## @param readReplicas.podLabels Map of labels to add to the pods (PostgreSQL read only) + ## + podLabels: {} + ## @param readReplicas.podAnnotations Map of annotations to add to the pods (PostgreSQL read only) + ## + podAnnotations: {} + ## @param readReplicas.podAffinityPreset PostgreSQL read only pod affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param readReplicas.podAntiAffinityPreset PostgreSQL read only pod anti-affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## PostgreSQL read only node affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param readReplicas.nodeAffinityPreset.type PostgreSQL read only node affinity preset type. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param readReplicas.nodeAffinityPreset.key PostgreSQL read only node label key to match Ignored if `primary.affinity` is set. + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## @param readReplicas.nodeAffinityPreset.values PostgreSQL read only node label values to match. Ignored if `primary.affinity` is set. + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param readReplicas.affinity Affinity for PostgreSQL read only pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## Note: primary.podAffinityPreset, primary.podAntiAffinityPreset, and primary.nodeAffinityPreset will be ignored when it's set + ## + affinity: {} + ## @param readReplicas.nodeSelector Node labels for PostgreSQL read only pods assignment + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param readReplicas.tolerations Tolerations for PostgreSQL read only pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param readReplicas.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: [] + ## @param readReplicas.priorityClassName Priority Class to use for each pod (PostgreSQL read only) + ## + priorityClassName: "" + ## @param readReplicas.schedulerName Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param readReplicas.terminationGracePeriodSeconds Seconds PostgreSQL read only pod needs to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## @param readReplicas.updateStrategy.type PostgreSQL read only statefulset strategy type + ## @param readReplicas.updateStrategy.rollingUpdate PostgreSQL read only statefulset rolling update configuration parameters + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## + updateStrategy: + type: RollingUpdate + rollingUpdate: {} + ## @param readReplicas.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the PostgreSQL read only container(s) + ## + extraVolumeMounts: [] + ## @param readReplicas.extraVolumes Optionally specify extra list of additional volumes for the PostgreSQL read only pod(s) + ## + extraVolumes: [] + ## @param readReplicas.sidecars Add additional sidecar containers to the PostgreSQL read only pod(s) + ## For example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param readReplicas.initContainers Add additional init containers to the PostgreSQL read only pod(s) + ## Example + ## + ## initContainers: + ## - name: do-something + ## image: busybox + ## command: ['do', 'something'] + ## + initContainers: [] + ## Pod Disruption Budget configuration + ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb + ## @param readReplicas.pdb.create Enable/disable a Pod Disruption Budget creation + ## @param readReplicas.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled + ## @param readReplicas.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `readReplicas.pdb.minAvailable` and `readReplicas.pdb.maxUnavailable` are empty. + ## + pdb: + create: true + minAvailable: "" + maxUnavailable: "" + ## @param readReplicas.extraPodSpec Optionally specify extra PodSpec for the PostgreSQL read only pod(s) + ## + extraPodSpec: {} + ## Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param readReplicas.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + ## @param readReplicas.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param readReplicas.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param readReplicas.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraIngress: + ## - ports: + ## - port: 1234 + ## from: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + extraIngress: [] + ## @param readReplicas.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraEgress: + ## - ports: + ## - port: 1234 + ## to: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + ## + extraEgress: [] + ## @param readReplicas.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces + ## @param readReplicas.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces + ## + ingressNSMatchLabels: {} + ingressNSPodMatchLabels: {} + ## PostgreSQL read only service configuration + ## + service: + ## @param readReplicas.service.type Kubernetes Service type + ## + type: ClusterIP + ## @param readReplicas.service.ports.postgresql PostgreSQL service port + ## + ports: + postgresql: 5432 + ## Node ports to expose + ## NOTE: choose port between <30000-32767> + ## @param readReplicas.service.nodePorts.postgresql Node port for PostgreSQL + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## + nodePorts: + postgresql: "" + ## @param readReplicas.service.clusterIP Static clusterIP or None for headless services + ## e.g: + ## clusterIP: None + ## + clusterIP: "" + ## @param readReplicas.service.labels Map of labels to add to the read service + ## + labels: {} + ## @param readReplicas.service.annotations Annotations for PostgreSQL read only service + ## + annotations: {} + ## @param readReplicas.service.loadBalancerClass Load balancer class if service type is `LoadBalancer` + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class + ## + loadBalancerClass: "" + ## @param readReplicas.service.loadBalancerIP Load balancer IP if service type is `LoadBalancer` + ## Set the LoadBalancer service type to internal only + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + loadBalancerIP: "" + ## @param readReplicas.service.externalTrafficPolicy Enable client source IP preservation + ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + ## @param readReplicas.service.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer + ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## + ## loadBalancerSourceRanges: + ## - 10.10.10.0/24 + ## + loadBalancerSourceRanges: [] + ## @param readReplicas.service.extraPorts Extra ports to expose in the PostgreSQL read only service + ## + extraPorts: [] + ## @param readReplicas.service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP" + ## If "ClientIP", consecutive client requests will be directed to the same Pod + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + ## + sessionAffinity: None + ## @param readReplicas.service.sessionAffinityConfig Additional settings for the sessionAffinity + ## sessionAffinityConfig: + ## clientIP: + ## timeoutSeconds: 300 + ## + sessionAffinityConfig: {} + ## Headless service properties + ## + headless: + ## @param readReplicas.service.headless.annotations Additional custom annotations for headless PostgreSQL read only service + ## + annotations: {} + ## PostgreSQL read only persistence configuration + ## + persistence: + ## @param readReplicas.persistence.enabled Enable PostgreSQL read only data persistence using PVC + ## + enabled: true + ## @param readReplicas.persistence.existingClaim Name of an existing PVC to use + ## + existingClaim: "" + ## @param readReplicas.persistence.mountPath The path the volume will be mounted at + ## Note: useful when using custom PostgreSQL images + ## + mountPath: /bitnami/postgresql + ## @param readReplicas.persistence.subPath The subdirectory of the volume to mount to + ## Useful in dev environments and one PV for multiple services + ## + subPath: "" + ## @param readReplicas.persistence.storageClass PVC Storage Class for PostgreSQL read only data volume + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + storageClass: "" + ## @param readReplicas.persistence.accessModes PVC Access Mode for PostgreSQL volume + ## + accessModes: + - ReadWriteOnce + ## @param readReplicas.persistence.size PVC Storage Request for PostgreSQL volume + ## + size: 8Gi + ## @param readReplicas.persistence.annotations Annotations for the PVC + ## + annotations: {} + ## @param readReplicas.persistence.labels Labels for the PVC + ## + labels: {} + ## @param readReplicas.persistence.selector Selector to match an existing Persistent Volume (this value is evaluated as a template) + ## selector: + ## matchLabels: + ## app: my-app + ## + selector: {} + ## @param readReplicas.persistence.dataSource Custom PVC data source + ## + dataSource: {} + ## PostgreSQL Read only Persistent Volume Claim Retention Policy + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention + ## + persistentVolumeClaimRetentionPolicy: + ## @param readReplicas.persistentVolumeClaimRetentionPolicy.enabled Enable Persistent volume retention policy for read only Statefulset + ## + enabled: false + ## @param readReplicas.persistentVolumeClaimRetentionPolicy.whenScaled Volume retention behavior when the replica count of the StatefulSet is reduced + ## + whenScaled: Retain + ## @param readReplicas.persistentVolumeClaimRetentionPolicy.whenDeleted Volume retention behavior that applies when the StatefulSet is deleted + ## + whenDeleted: Retain +## @section Backup parameters +## This section implements a trivial logical dump cronjob of the database. +## This only comes with the consistency guarantees of the dump program. +## This is not a snapshot based roll forward/backward recovery backup. +## ref: https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/ +backup: + ## @param backup.enabled Enable the logical dump of the database "regularly" + enabled: false + cronjob: + ## @param backup.cronjob.schedule Set the cronjob parameter schedule + schedule: "@daily" + ## @param backup.cronjob.timeZone Set the cronjob parameter timeZone + timeZone: "" + ## @param backup.cronjob.concurrencyPolicy Set the cronjob parameter concurrencyPolicy + concurrencyPolicy: Allow + ## @param backup.cronjob.failedJobsHistoryLimit Set the cronjob parameter failedJobsHistoryLimit + failedJobsHistoryLimit: 1 + ## @param backup.cronjob.successfulJobsHistoryLimit Set the cronjob parameter successfulJobsHistoryLimit + successfulJobsHistoryLimit: 3 + ## @param backup.cronjob.startingDeadlineSeconds Set the cronjob parameter startingDeadlineSeconds + startingDeadlineSeconds: "" + ## @param backup.cronjob.ttlSecondsAfterFinished Set the cronjob parameter ttlSecondsAfterFinished + ttlSecondsAfterFinished: "" + ## @param backup.cronjob.restartPolicy Set the cronjob parameter restartPolicy + restartPolicy: OnFailure + ## @param backup.cronjob.podSecurityContext.enabled Enable PodSecurityContext for CronJob/Backup + ## @param backup.cronjob.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy + ## @param backup.cronjob.podSecurityContext.sysctls Set kernel settings using the sysctl interface + ## @param backup.cronjob.podSecurityContext.supplementalGroups Set filesystem extra groups + ## @param backup.cronjob.podSecurityContext.fsGroup Group ID for the CronJob + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## backup container's Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param backup.cronjob.containerSecurityContext.enabled Enabled containers' Security Context + ## @param backup.cronjob.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container + ## @param backup.cronjob.containerSecurityContext.runAsUser Set containers' Security Context runAsUser + ## @param backup.cronjob.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup + ## @param backup.cronjob.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot + ## @param backup.cronjob.containerSecurityContext.privileged Set container's Security Context privileged + ## @param backup.cronjob.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem + ## @param backup.cronjob.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation + ## @param backup.cronjob.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param backup.cronjob.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsGroup: 1001 + runAsNonRoot: true + privileged: false + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + ## @param backup.cronjob.command Set backup container's command to run + command: + - /bin/bash + - -c + - PGPASSWORD="${PGPASSWORD:-$(< "$PGPASSWORD_FILE")}" pg_dumpall --clean --if-exists --load-via-partition-root --quote-all-identifiers --no-password --file="${PGDUMP_DIR}/pg_dumpall-$(date '+%Y-%m-%d-%H-%M').pgdump" + ## @param backup.cronjob.labels Set the cronjob labels + labels: {} + ## @param backup.cronjob.annotations Set the cronjob annotations + annotations: {} + ## @param backup.cronjob.nodeSelector Node labels for PostgreSQL backup CronJob pod assignment + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/ + ## + nodeSelector: {} + ## @param backup.cronjob.tolerations Tolerations for PostgreSQL backup CronJob pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## backup cronjob container resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param backup.cronjob.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if backup.cronjob.resources is set (backup.cronjob.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param backup.cronjob.resources Set container requests and limits for different resources like CPU or memory + ## Example: + resources: {} + ## resources: + ## requests: + ## cpu: 1 + ## memory: 512Mi + ## limits: + ## cpu: 2 + ## memory: 1024Mi + networkPolicy: + ## @param backup.cronjob.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + storage: + ## @param backup.cronjob.storage.enabled Enable using a `PersistentVolumeClaim` as backup data volume + ## + enabled: true + ## @param backup.cronjob.storage.existingClaim Provide an existing `PersistentVolumeClaim` (only when `architecture=standalone`) + ## If defined, PVC must be created manually before volume will be bound + ## + existingClaim: "" + ## @param backup.cronjob.storage.resourcePolicy Setting it to "keep" to avoid removing PVCs during a helm delete operation. Leaving it empty will delete PVCs after the chart deleted + ## + resourcePolicy: "" + ## @param backup.cronjob.storage.storageClass PVC Storage Class for the backup data volume + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. + ## + storageClass: "" + ## @param backup.cronjob.storage.accessModes PV Access Mode + ## + accessModes: + - ReadWriteOnce + ## @param backup.cronjob.storage.size PVC Storage Request for the backup data volume + ## + size: 8Gi + ## @param backup.cronjob.storage.annotations PVC annotations + ## + annotations: {} + ## @param backup.cronjob.storage.mountPath Path to mount the volume at + ## + mountPath: /backup/pgdump + ## @param backup.cronjob.storage.subPath Subdirectory of the volume to mount at + ## and one PV for multiple services. + ## + subPath: "" + ## Fine tuning for volumeClaimTemplates + ## + volumeClaimTemplates: + ## @param backup.cronjob.storage.volumeClaimTemplates.selector A label query over volumes to consider for binding (e.g. when using local volumes) + ## A label query over volumes to consider for binding (e.g. when using local volumes) + ## See https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#labelselector-v1-meta for more details + ## + selector: {} + ## @param backup.cronjob.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the backup container + ## + extraVolumeMounts: [] + ## @param backup.cronjob.extraVolumes Optionally specify extra list of additional volumes for the backup container + ## + extraVolumes: [] + +## @section Password update job +## +passwordUpdateJob: + ## @param passwordUpdateJob.enabled Enable password update job + ## + enabled: false + ## @param passwordUpdateJob.backoffLimit set backoff limit of the job + ## + backoffLimit: 10 + ## @param passwordUpdateJob.command Override default container command on mysql Primary container(s) (useful when using custom images) + ## + command: [] + ## @param passwordUpdateJob.args Override default container args on mysql Primary container(s) (useful when using custom images) + ## + args: [] + ## @param passwordUpdateJob.extraCommands Extra commands to pass to the generation job + ## + extraCommands: "" + ## @param passwordUpdateJob.previousPasswords.postgresPassword Previous postgres password (set if the password secret was already changed) + ## @param passwordUpdateJob.previousPasswords.password Previous password (set if the password secret was already changed) + ## @param passwordUpdateJob.previousPasswords.replicationPassword Previous replication password (set if the password secret was already changed) + ## @param passwordUpdateJob.previousPasswords.existingSecret Name of a secret containing the previous passwords (set if the password secret was already changed) + previousPasswords: + postgresPassword: "" + password: "" + replicationPassword: "" + existingSecret: "" + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param passwordUpdateJob.containerSecurityContext.enabled Enabled containers' Security Context + ## @param passwordUpdateJob.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container + ## @param passwordUpdateJob.containerSecurityContext.runAsUser Set containers' Security Context runAsUser + ## @param passwordUpdateJob.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup + ## @param passwordUpdateJob.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot + ## @param passwordUpdateJob.containerSecurityContext.privileged Set container's Security Context privileged + ## @param passwordUpdateJob.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem + ## @param passwordUpdateJob.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation + ## @param passwordUpdateJob.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param passwordUpdateJob.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsGroup: 1001 + runAsNonRoot: true + privileged: false + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + ## Configure Pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param passwordUpdateJob.podSecurityContext.enabled Enabled credential init job pods' Security Context + ## @param passwordUpdateJob.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy + ## @param passwordUpdateJob.podSecurityContext.sysctls Set kernel settings using the sysctl interface + ## @param passwordUpdateJob.podSecurityContext.supplementalGroups Set filesystem extra groups + ## @param passwordUpdateJob.podSecurityContext.fsGroup Set credential init job pod's Security Context fsGroup + ## + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## @param passwordUpdateJob.extraEnvVars Array containing extra env vars to configure the credential init job + ## For example: + ## extraEnvVars: + ## - name: GF_DEFAULT_INSTANCE_NAME + ## value: my-instance + ## + extraEnvVars: [] + ## @param passwordUpdateJob.extraEnvVarsCM ConfigMap containing extra env vars to configure the credential init job + ## + extraEnvVarsCM: "" + ## @param passwordUpdateJob.extraEnvVarsSecret Secret containing extra env vars to configure the credential init job (in case of sensitive data) + ## + extraEnvVarsSecret: "" + ## @param passwordUpdateJob.extraVolumes Optionally specify extra list of additional volumes for the credential init job + ## + extraVolumes: [] + ## @param passwordUpdateJob.extraVolumeMounts Array of extra volume mounts to be added to the jwt Container (evaluated as template). Normally used with `extraVolumes`. + ## + extraVolumeMounts: [] + ## @param passwordUpdateJob.initContainers Add additional init containers for the mysql Primary pod(s) + ## + initContainers: [] + ## Container resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param passwordUpdateJob.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if passwordUpdateJob.resources is set (passwordUpdateJob.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "micro" + ## @param passwordUpdateJob.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## @param passwordUpdateJob.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param passwordUpdateJob.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param passwordUpdateJob.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## @param passwordUpdateJob.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: false + ## @param passwordUpdateJob.hostAliases Add deployment host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param passwordUpdateJob.annotations [object] Add annotations to the job + ## + annotations: {} + ## @param passwordUpdateJob.podLabels Additional pod labels + ## Ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param passwordUpdateJob.podAnnotations Additional pod annotations + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + +## @section Volume Permissions parameters +## + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume(s) mountpoint(s) to 'runAsUser:fsGroup' on each node +## +volumePermissions: + ## @param volumePermissions.enabled Enable init container that changes the owner and group of the persistent volume + ## + enabled: false + ## @param volumePermissions.image.registry [default: REGISTRY_NAME] Init container volume-permissions image registry + ## @param volumePermissions.image.repository [default: REPOSITORY_NAME/os-shell] Init container volume-permissions image repository + ## @skip volumePermissions.image.tag Init container volume-permissions image tag (immutable tags are recommended) + ## @param volumePermissions.image.digest Init container volume-permissions image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag + ## @param volumePermissions.image.pullPolicy Init container volume-permissions image pull policy + ## @param volumePermissions.image.pullSecrets Init container volume-permissions image pull secrets + ## + image: + registry: docker.io + repository: bitnami/os-shell + tag: 12-debian-12-r50 + digest: "" + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## Example: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Init container resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param volumePermissions.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param volumePermissions.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Init container' Security Context + ## Note: the chown of the data folder is done to containerSecurityContext.runAsUser + ## and not the below volumePermissions.containerSecurityContext.runAsUser + ## @param volumePermissions.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container + ## @param volumePermissions.containerSecurityContext.runAsUser User ID for the init container + ## @param volumePermissions.containerSecurityContext.runAsGroup Group ID for the init container + ## @param volumePermissions.containerSecurityContext.runAsNonRoot runAsNonRoot for the init container + ## @param volumePermissions.containerSecurityContext.seccompProfile.type seccompProfile.type for the init container + ## + containerSecurityContext: + seLinuxOptions: {} + runAsUser: 0 + runAsGroup: 0 + runAsNonRoot: false + seccompProfile: + type: RuntimeDefault +## @section Other Parameters +## + +## @param serviceBindings.enabled Create secret for service binding (Experimental) +## Ref: https://servicebinding.io/service-provider/ +## +serviceBindings: + enabled: false +## Service account for PostgreSQL to use. +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ +## +serviceAccount: + ## @param serviceAccount.create Enable creation of ServiceAccount for PostgreSQL pod + ## + create: true + ## @param serviceAccount.name The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the common.names.fullname template + ## + name: "" + ## @param serviceAccount.automountServiceAccountToken Allows auto mount of ServiceAccountToken on the serviceAccount created + ## Can be set to false if pods using this serviceAccount do not need to use K8s API + ## + automountServiceAccountToken: false + ## @param serviceAccount.annotations Additional custom annotations for the ServiceAccount + ## + annotations: {} +## Creates role for ServiceAccount +## @param rbac.create Create Role and RoleBinding (required for PSP to work) +## +rbac: + create: false + ## @param rbac.rules Custom RBAC rules to set + ## e.g: + ## rules: + ## - apiGroups: + ## - "" + ## resources: + ## - pods + ## verbs: + ## - get + ## - list + ## + rules: [] +## Pod Security Policy +## ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/ +## @param psp.create Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later +## +psp: + create: false +## @section Metrics Parameters +## +metrics: + ## @param metrics.enabled Start a prometheus exporter + ## + enabled: false + ## @param metrics.image.registry [default: REGISTRY_NAME] PostgreSQL Prometheus Exporter image registry + ## @param metrics.image.repository [default: REPOSITORY_NAME/postgres-exporter] PostgreSQL Prometheus Exporter image repository + ## @skip metrics.image.tag PostgreSQL Prometheus Exporter image tag (immutable tags are recommended) + ## @param metrics.image.digest PostgreSQL image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag + ## @param metrics.image.pullPolicy PostgreSQL Prometheus Exporter image pull policy + ## @param metrics.image.pullSecrets Specify image pull secrets + ## + image: + registry: docker.io + repository: bitnami/postgres-exporter + tag: 0.17.1-debian-12-r14 + digest: "" + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## Example: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## @param metrics.collectors Control enabled collectors + ## ref: https://github.com/prometheus-community/postgres_exporter#flags + ## Example: + ## collectors: + ## wal: false + collectors: {} + ## @param metrics.customMetrics Define additional custom metrics + ## ref: https://github.com/prometheus-community/postgres_exporter#adding-new-metrics-via-a-config-file-deprecated + ## customMetrics: + ## pg_database: + ## query: "SELECT d.datname AS name, CASE WHEN pg_catalog.has_database_privilege(d.datname, 'CONNECT') THEN pg_catalog.pg_database_size(d.datname) ELSE 0 END AS size_bytes FROM pg_catalog.pg_database d where datname not in ('template0', 'template1', 'postgres')" + ## metrics: + ## - name: + ## usage: "LABEL" + ## description: "Name of the database" + ## - size_bytes: + ## usage: "GAUGE" + ## description: "Size of the database in bytes" + ## + customMetrics: {} + ## @param metrics.extraEnvVars Extra environment variables to add to PostgreSQL Prometheus exporter + ## see: https://github.com/prometheus-community/postgres_exporter#environment-variables + ## For example: + ## extraEnvVars: + ## - name: PG_EXPORTER_DISABLE_DEFAULT_METRICS + ## value: "true" + ## + extraEnvVars: [] + ## PostgreSQL Prometheus exporter containers' Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param metrics.containerSecurityContext.enabled Enabled containers' Security Context + ## @param metrics.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container + ## @param metrics.containerSecurityContext.runAsUser Set containers' Security Context runAsUser + ## @param metrics.containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup + ## @param metrics.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot + ## @param metrics.containerSecurityContext.privileged Set container's Security Context privileged + ## @param metrics.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem + ## @param metrics.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation + ## @param metrics.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param metrics.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsGroup: 1001 + runAsNonRoot: true + privileged: false + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + ## Configure extra options for PostgreSQL Prometheus exporter containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param metrics.livenessProbe.enabled Enable livenessProbe on PostgreSQL Prometheus exporter containers + ## @param metrics.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param metrics.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param metrics.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param metrics.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param metrics.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param metrics.readinessProbe.enabled Enable readinessProbe on PostgreSQL Prometheus exporter containers + ## @param metrics.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param metrics.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param metrics.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param metrics.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param metrics.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param metrics.startupProbe.enabled Enable startupProbe on PostgreSQL Prometheus exporter containers + ## @param metrics.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param metrics.startupProbe.periodSeconds Period seconds for startupProbe + ## @param metrics.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param metrics.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param metrics.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param metrics.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param metrics.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param metrics.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## @param metrics.containerPorts.metrics PostgreSQL Prometheus exporter metrics container port + ## + containerPorts: + metrics: 9187 + ## PostgreSQL Prometheus exporter resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param metrics.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param metrics.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Service configuration + ## + service: + ## @param metrics.service.ports.metrics PostgreSQL Prometheus Exporter service port + ## + ports: + metrics: 9187 + ## @param metrics.service.clusterIP Static clusterIP or None for headless services + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address + ## + clusterIP: "" + ## @param metrics.service.sessionAffinity Control where client requests go, to the same pod or round-robin + ## Values: ClientIP or None + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/ + ## + sessionAffinity: None + ## @param metrics.service.annotations [object] Annotations for Prometheus to auto-discover the metrics endpoint + ## + annotations: + prometheus.io/scrape: "true" + prometheus.io/port: "{{ .Values.metrics.service.ports.metrics }}" + ## Prometheus Operator ServiceMonitor configuration + ## + serviceMonitor: + ## @param metrics.serviceMonitor.enabled Create ServiceMonitor Resource for scraping metrics using Prometheus Operator + ## + enabled: false + ## @param metrics.serviceMonitor.namespace Namespace for the ServiceMonitor Resource (defaults to the Release Namespace) + ## + namespace: "" + ## @param metrics.serviceMonitor.interval Interval at which metrics should be scraped. + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint + ## + interval: "" + ## @param metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint + ## + scrapeTimeout: "" + ## @param metrics.serviceMonitor.labels Additional labels that can be used so ServiceMonitor will be discovered by Prometheus + ## + labels: {} + ## @param metrics.serviceMonitor.selector Prometheus instance selector labels + ## ref: https://github.com/bitnami/charts/tree/main/bitnami/prometheus-operator#prometheus-configuration + ## + selector: {} + ## @param metrics.serviceMonitor.relabelings RelabelConfigs to apply to samples before scraping + ## + relabelings: [] + ## @param metrics.serviceMonitor.metricRelabelings MetricRelabelConfigs to apply to samples before ingestion + ## + metricRelabelings: [] + ## @param metrics.serviceMonitor.honorLabels Specify honorLabels parameter to add the scrape endpoint + ## + honorLabels: false + ## @param metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in prometheus. + ## + jobLabel: "" + ## Custom PrometheusRule to be defined + ## The value is evaluated as a template, so, for example, the value can depend on .Release or .Chart + ## ref: https://github.com/coreos/prometheus-operator#customresourcedefinitions + ## + prometheusRule: + ## @param metrics.prometheusRule.enabled Create a PrometheusRule for Prometheus Operator + ## + enabled: false + ## @param metrics.prometheusRule.namespace Namespace for the PrometheusRule Resource (defaults to the Release Namespace) + ## + namespace: "" + ## @param metrics.prometheusRule.labels Additional labels that can be used so PrometheusRule will be discovered by Prometheus + ## + labels: {} + ## @param metrics.prometheusRule.rules PrometheusRule definitions + ## Make sure to constraint the rules to the current postgresql service. + ## rules: + ## - alert: HugeReplicationLag + ## expr: pg_replication_lag{service="{{ printf "%s-metrics" (include "postgresql.v1.chart.fullname" .) }}"} / 3600 > 1 + ## for: 1m + ## labels: + ## severity: critical + ## annotations: + ## description: replication for {{ include "postgresql.v1.chart.fullname" . }} PostgreSQL is lagging by {{ "{{ $value }}" }} hour(s). + ## summary: PostgreSQL replication is lagging by {{ "{{ $value }}" }} hour(s). + ## + rules: []