Blame - charts/postgresql/templates/read/statefulset.yaml - pcloud

podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.readReplicas.podAntiAffinityPreset "component" "read" "context" $) | nindent 10 }}

69

nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.readReplicas.nodeAffinityPreset.type "key" .Values.readReplicas.nodeAffinityPreset.key "values" .Values.readReplicas.nodeAffinityPreset.values) | nindent 10 }}

70

71

72

nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.nodeSelector "context" $) | nindent 8 }}

73

74

75

tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.tolerations "context" $) | nindent 8 }}

76

77

78

topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.topologySpreadConstraints "context" $) | nindent 8 }}

79

80

81

priorityClassName: {{ .Values.readReplicas.priorityClassName }}

82

83

84

schedulerName: {{ .Values.readReplicas.schedulerName | quote }}

85

86

87

terminationGracePeriodSeconds: {{ .Values.readReplicas.terminationGracePeriodSeconds }}

88

89

90

securityContext: {{- omit .Values.readReplicas.podSecurityContext "enabled" | toYaml | nindent 8 }}

91

92

hostNetwork: {{ .Values.readReplicas.hostNetwork }}

93

hostIPC: {{ .Values.readReplicas.hostIPC }}

94

{{- if or (and .Values.tls.enabled (not .Values.volumePermissions.enabled)) (and .Values.volumePermissions.enabled (or .Values.readReplicas.persistence.enabled .Values.shmVolume.enabled)) .Values.readReplicas.initContainers }}

95

initContainers:

96

{{- if and .Values.tls.enabled (not .Values.volumePermissions.enabled) }}

97

- name: copy-certs

98

image: {{ include "postgresql.volumePermissions.image" . }}

99

imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}

100

101

resources: {{- toYaml .Values.readReplicas.resources | nindent 12 }}

102

103

# We don't require a privileged container in this case

104

105

securityContext: {{- omit .Values.readReplicas.containerSecurityContext "enabled" | toYaml | nindent 12 }}

command:

- /bin/sh

- -ec

- |

cp /tmp/certs/* /opt/bitnami/postgresql/certs/

112

chmod 600 {{ include "postgresql.tlsCertKey" . }}

113

volumeMounts:

114

- name: raw-certificates

115

mountPath: /tmp/certs

116

- name: postgresql-certificates

117

mountPath: /opt/bitnami/postgresql/certs

118

{{- else if and .Values.volumePermissions.enabled (or .Values.readReplicas.persistence.enabled .Values.shmVolume.enabled) }}

119

- name: init-chmod-data

120

image: {{ include "postgresql.volumePermissions.image" . }}

121

imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}

122

123

resources: {{- toYaml .Values.readReplicas.resources | nindent 12 }}

command:

- /bin/sh

- -ec

- |

{{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }}

131

chown `id -u`:`id -G | cut -d " " -f2` {{ .Values.readReplicas.persistence.mountPath }}

132

133

chown {{ .Values.readReplicas.containerSecurityContext.runAsUser }}:{{ .Values.readReplicas.podSecurityContext.fsGroup }} {{ .Values.readReplicas.persistence.mountPath }}

134

135

mkdir -p {{ .Values.readReplicas.persistence.mountPath }}/data {{- if (include "postgresql.mountConfigurationCM" .) }} {{ .Values.readReplicas.persistence.mountPath }}/conf {{- end }}

136

chmod 700 {{ .Values.readReplicas.persistence.mountPath }}/data {{- if (include "postgresql.mountConfigurationCM" .) }} {{ .Values.readReplicas.persistence.mountPath }}/conf {{- end }}

137

find {{ .Values.readReplicas.persistence.mountPath }} -mindepth 1 -maxdepth 1 {{- if not (include "postgresql.mountConfigurationCM" .) }} -not -name "conf" {{- end }} -not -name ".snapshot" -not -name "lost+found" | \

138

{{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }}

139

xargs -r chown -R `id -u`:`id -G | cut -d " " -f2`

140

141

xargs -r chown -R {{ .Values.readReplicas.containerSecurityContext.runAsUser }}:{{ .Values.readReplicas.podSecurityContext.fsGroup }}

chmod -R 777 /dev/shm

146

147

148

cp /tmp/certs/* /opt/bitnami/postgresql/certs/

149

{{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }}

150

chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/postgresql/certs/

151

152

chown -R {{ .Values.readReplicas.containerSecurityContext.runAsUser }}:{{ .Values.readReplicas.podSecurityContext.fsGroup }} /opt/bitnami/postgresql/certs/

153

154

chmod 600 {{ include "postgresql.tlsCertKey" . }}

155

156

{{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }}

157

securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "runAsUser" | toYaml | nindent 12 }}

158

159

securityContext: {{- .Values.volumePermissions.containerSecurityContext | toYaml | nindent 12 }}

volumeMounts:

- name: data

mountPath: {{ .Values.readReplicas.persistence.mountPath }}

165

166

subPath: {{ .Values.readReplicas.persistence.subPath }}

- name: dshm

mountPath: /dev/shm

- name: raw-certificates

175

mountPath: /tmp/certs

176

- name: postgresql-certificates

177

mountPath: /opt/bitnami/postgresql/certs

{{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.initContainers "context" $ ) | nindent 8 }}

containers:

- name: postgresql

image: {{ include "postgresql.image" . }}

187

imagePullPolicy: {{ .Values.image.pullPolicy | quote }}

188

189

securityContext: {{- omit .Values.readReplicas.containerSecurityContext "enabled" | toYaml | nindent 12 }}

190

191

192

command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}

193

194

command: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.command "context" $) | nindent 12 }}

195

196

197

args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}

198

199

args: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.args "context" $) | nindent 12 }}

200

201

env:

202

- name: BITNAMI_DEBUG

203

value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }}

204

- name: POSTGRESQL_PORT_NUMBER

205

value: {{ .Values.containerPorts.postgresql | quote }}

206

- name: POSTGRESQL_VOLUME_DIR

207

value: {{ .Values.readReplicas.persistence.mountPath | quote }}

208

209

- name: PGDATA

210

value: {{ .Values.postgresqlDataDir | quote }}

211

212

# Authentication

213

{{- if and (not (empty $customUser)) (ne $customUser "postgres") .Values.auth.enablePostgresUser }}

214

215

- name: POSTGRES_POSTGRES_PASSWORD_FILE

216

value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.adminPasswordKey" .) }}

217

218

- name: POSTGRES_POSTGRES_PASSWORD

valueFrom:

secretKeyRef:

key: {{ include "postgresql.adminPasswordKey" . }}

- name: POSTGRES_PASSWORD_FILE

227

value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.userPasswordKey" .) }}

228

229

- name: POSTGRES_PASSWORD

valueFrom:

secretKeyRef:

key: {{ include "postgresql.userPasswordKey" . }}

234

235

# Replication

236

- name: POSTGRES_REPLICATION_MODE

237

value: "slave"

238

- name: POSTGRES_REPLICATION_USER

239

value: {{ .Values.auth.replicationUsername | quote }}

240

241

- name: POSTGRES_REPLICATION_PASSWORD_FILE

242

value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.replicationPasswordKey" .) }}

243

244

- name: POSTGRES_REPLICATION_PASSWORD

valueFrom:

secretKeyRef:

key: {{ include "postgresql.replicationPasswordKey" . }}

249

250

- name: POSTGRES_CLUSTER_APP_NAME

251

value: {{ .Values.replication.applicationName }}

252

- name: POSTGRES_MASTER_HOST

253

value: {{ include "postgresql.primary.fullname" . }}

254

- name: POSTGRES_MASTER_PORT_NUMBER

255

value: {{ include "postgresql.service.port" . | quote }}

256

# TLS

257

- name: POSTGRESQL_ENABLE_TLS

258

value: {{ ternary "yes" "no" .Values.tls.enabled | quote }}

259

260

- name: POSTGRESQL_TLS_PREFER_SERVER_CIPHERS

261

value: {{ ternary "yes" "no" .Values.tls.preferServerCiphers | quote }}

262

- name: POSTGRESQL_TLS_CERT_FILE

263

value: {{ include "postgresql.tlsCert" . }}

264

- name: POSTGRESQL_TLS_KEY_FILE

265

value: {{ include "postgresql.tlsCertKey" . }}

266

267

- name: POSTGRESQL_TLS_CA_FILE

268

value: {{ include "postgresql.tlsCACert" . }}

269

270

271

- name: POSTGRESQL_TLS_CRL_FILE

272

value: {{ include "postgresql.tlsCRL" . }}

# Audit

- name: POSTGRESQL_LOG_HOSTNAME

277

value: {{ .Values.audit.logHostname | quote }}

278

- name: POSTGRESQL_LOG_CONNECTIONS

279

value: {{ .Values.audit.logConnections | quote }}

280

- name: POSTGRESQL_LOG_DISCONNECTIONS

281

value: {{ .Values.audit.logDisconnections | quote }}

282

283

- name: POSTGRESQL_LOG_LINE_PREFIX

284

value: {{ .Values.audit.logLinePrefix | quote }}

285

286

287

- name: POSTGRESQL_LOG_TIMEZONE

288

value: {{ .Values.audit.logTimezone | quote }}

289

290

291

- name: POSTGRESQL_PGAUDIT_LOG

292

value: {{ .Values.audit.pgAuditLog | quote }}

293

294

- name: POSTGRESQL_PGAUDIT_LOG_CATALOG

295

value: {{ .Values.audit.pgAuditLogCatalog | quote }}

296

# Others

297

- name: POSTGRESQL_CLIENT_MIN_MESSAGES

298

value: {{ .Values.audit.clientMinMessages | quote }}

299

- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES

300

value: {{ .Values.postgresqlSharedPreloadLibraries | quote }}

301

302

{{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.extraEnvVars "context" $) | nindent 12 }}

303

304

{{- if or .Values.readReplicas.extraEnvVarsCM .Values.readReplicas.extraEnvVarsSecret }}

envFrom:

- configMapRef:

- secretRef:

ports:

- name: tcp-postgresql

317

containerPort: {{ .Values.containerPorts.postgresql }}

318

319

320

startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.customStartupProbe "context" $) | nindent 12 }}

321

322

startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readReplicas.startupProbe "enabled") "context" $) | nindent 12 }}

exec:

command:

- /bin/sh

- -c

- exec pg_isready -U {{ default "postgres" $customUser| quote }} -d "dbname={{ include "postgresql.database" . }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} sslcert={{ include "postgresql.tlsCert" . }} sslkey={{ include "postgresql.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }}

329

330

- exec pg_isready -U {{ default "postgres" $customUser | quote }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} -d "sslcert={{ include "postgresql.tlsCert" . }} sslkey={{ include "postgresql.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }}

livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.customLivenessProbe "context" $) | nindent 12 }}

335

336

livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readReplicas.livenessProbe "enabled") "context" $) | nindent 12 }}

exec:

command:

- /bin/sh

- -c

- exec pg_isready -U {{ default "postgres" $customUser | quote }} -d "dbname={{ include "postgresql.database" . }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} sslcert={{ include "postgresql.tlsCert" . }} sslkey={{ include "postgresql.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }}

343

344

- exec pg_isready -U {{default "postgres" $customUser | quote }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} -d "sslcert={{ include "postgresql.tlsCert" . }} sslkey={{ include "postgresql.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }}

readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.customReadinessProbe "context" $) | nindent 12 }}

349

350

readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readReplicas.readinessProbe "enabled") "context" $) | nindent 12 }}

exec:

command:

- /bin/sh

- -c

- -e

resources: {{- toYaml .Values.readReplicas.resources | nindent 12 }}

361

362

363

lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.lifecycleHooks "context" $) | nindent 12 }}

volumeMounts:

- name: postgresql-password

368

mountPath: /opt/bitnami/postgresql/secrets/

369

370

371

- name: postgresql-extended-config

372

mountPath: {{ .Values.readReplicas.persistence.mountPath }}/conf/conf.d/

373

374

375

- name: postgresql-certificates

376

mountPath: /opt/bitnami/postgresql/certs

readOnly: true

- name: dshm

mountPath: /dev/shm

- name: data

mountPath: {{ .Values.readReplicas.persistence.mountPath }}

386

387

subPath: {{ .Values.readReplicas.persistence.subPath }}

{{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.extraVolumeMounts "context" $) | nindent 12 }}

- name: metrics

image: {{ include "postgresql.metrics.image" . }}

396

imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }}

397

398

securityContext: {{- omit .Values.metrics.containerSecurityContext "enabled" | toYaml | nindent 12 }}

399

400

401

command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}

402

args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}

403

404

args: [ "--extend.query-path", "/conf/custom-metrics.yaml" ]

405

406

env:

407

{{- $database := required "In order to enable metrics you need to specify a database (.Values.auth.database or .Values.global.postgresql.auth.database)" (include "postgresql.database" .) }}

408

- name: DATA_SOURCE_URI

409

value: {{ printf "127.0.0.1:%d/%s?sslmode=disable" (int (include "postgresql.service.port" .)) $database }}

410

411

- name: DATA_SOURCE_PASS_FILE

412

value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.userPasswordKey" .) }}

413

414

- name: DATA_SOURCE_PASS

valueFrom:

secretKeyRef:

key: {{ include "postgresql.userPasswordKey" . }}

419

420

- name: DATA_SOURCE_USER

421

value: {{ default "postgres" $customUser | quote }}

422

423

{{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }}

ports:

- name: http-metrics

containerPort: {{ .Values.metrics.containerPorts.metrics }}

428

429

430

startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }}

431

432

startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }}

tcpSocket:

port: http-metrics

livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }}

438

439

livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }}

httpGet:

path: /

port: http-metrics

readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }}

446

447

readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }}

httpGet:

path: /

port: http-metrics

volumeMounts:

- name: postgresql-password

456

mountPath: /opt/bitnami/postgresql/secrets/

457

458

459

- name: custom-metrics

mountPath: /conf

readOnly: true

resources: {{- toYaml .Values.metrics.resources | nindent 12 }}

{{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.sidecars "context" $ ) | nindent 8 }}

volumes:

- name: postgresql-extended-config

configMap:

- name: postgresql-password

478

secret:

479

secretName: {{ include "postgresql.secretName" . }}

480

481

482

- name: raw-certificates

483

secret:

484

secretName: {{ include "postgresql.tlsSecretName" . }}

485

- name: postgresql-certificates

486

emptyDir: {}

487

488

{{- if and .Values.metrics.enabled .Values.metrics.customMetrics }}

489

- name: custom-metrics

configMap:

- name: dshm

emptyDir:

medium: Memory

sizeLimit: {{ .Values.shmVolume.sizeLimit }}

{{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.extraVolumes "context" $ ) | nindent 8 }}

503

504

{{- if and .Values.readReplicas.persistence.enabled .Values.readReplicas.persistence.existingClaim }}

505

- name: data

506

persistentVolumeClaim:

507

claimName: {{ tpl .Values.readReplicas.persistence.existingClaim $ }}

- name: data

emptyDir: {}

volumeClaimTemplates:

- metadata:

annotations: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.persistence.annotations "context" $) | nindent 10 }}

517

518

519

labels: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.persistence.labels "context" $) | nindent 10 }}

spec:

accessModes:

- {{ . | quote }}

dataSource: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.persistence.dataSource "context" $) | nindent 10 }}

resources:

requests:

storage: {{ .Values.readReplicas.persistence.size | quote }}

532

533

selector: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.persistence.selector "context" $) | nindent 10 }}

534

535

{{- include "common.storage.class" (dict "persistence" .Values.readReplicas.persistence "global" .Values.global) | nindent 8 }}

536

537