Skip to content

Commit 73d9629

Browse files
andrewlecuyerjkatz
andrewlecuyer
authored and
jkatz
committed
The 'add-targeted-namespace.sh' script now only
creates (or recreates) the 'pgo-pg' service account, along with the role and role binding for that service account, if there aren't any pods (i.e. PG DB pods) already running in the namespace utilizing the 'pgo-pg' ServiceAccount. This is to prevent any undesired behavior with any PG DB pods that are relying on this SA to effectively communicate with the Kuburnetes API, i.e. the Patroni DCS (e.g. if the connection is broken the primary will not be able to renew the leader lock).
1 parent aeab02b commit 73d9629

File tree

2 files changed

+45
-12
lines changed

2 files changed

+45
-12
lines changed

‎ansible/roles/pgo-operator/templates/add-targeted-namespace.sh.j2‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@ PGO_IMAGE_PULL_SECRET='{{ pgo_image_pull_secret }}'
2323
PGO_IMAGE_PULL_SECRET_MANIFEST='{{ pgo_image_pull_secret_manifest }}'
2424
TARGET_NAMESPACE='{{ item }}'
2525

26+
# the name of the service account utilized by the PG pods
27+
PG_SA="pgo-pg"
28+
2629
# create the namespace if necessary
2730
{{ kubectl_or_oc }} get ns {{ item }} > /dev/null
2831
if [ $? -eq 0 ]; then
@@ -37,10 +40,26 @@ fi
3740
{{ kubectl_or_oc }} label namespace/{{ item }} vendor=crunchydata
3841
{{ kubectl_or_oc }} label namespace/{{ item }} pgo-installation-name={{ pgo_installation_name }}
3942

43+
# determine if an existing pod is using the 'pgo-pg' service account. if so, do not delete
44+
# and recreate the SA or its associated role and role binding. this is to avoid any undesired
45+
# behavior with existing PG clusters that are actively utilizing the SA.
46+
{{ kubectl_or_oc }} -n {{ item }} get pods -o yaml | grep "serviceAccount: ${PG_SA}" > /dev/null
47+
if [ $? -ne 0 ]; then
48+
{{ kubectl_or_oc }} -n {{ item }} delete --ignore-not-found sa pgo-pg
49+
{{ kubectl_or_oc }} -n {{ item }} delete --ignore-not-found role pgo-pg-role
50+
{{ kubectl_or_oc }} -n {{ item }} delete --ignore-not-found rolebinding pgo-pg-role-binding
51+
52+
cat {{ role_path }}/files/pgo-configs/pgo-pg-sa.json | sed 's/{{ target_namespace }}/'"{{ item }}"'/' | {{ kubectl_or_oc }} -n {{ item }} create -f -
53+
cat {{ role_path }}/files/pgo-configs/pgo-pg-role.json | sed 's/{{ target_namespace }}/'"{{ item }}"'/' | {{ kubectl_or_oc }} -n {{ item }} create -f -
54+
cat {{ role_path }}/files/pgo-configs/pgo-pg-role-binding.json | sed 's/{{ target_namespace }}/'"{{ item }}"'/' | {{ kubectl_or_oc }} -n {{ item }} create -f -
55+
else
56+
echo "Running pods found using SA '${PG_SA}' in namespace {{ item }}, will not recreate"
57+
fi
58+
4059
# create RBAC
41-
{{ kubectl_or_oc }} -n {{ item }} delete --ignore-not-found sa pgo-backrest pgo-default pgo-pg pgo-target
42-
{{ kubectl_or_oc }} -n {{ item }} delete --ignore-not-found role pgo-backrest-role pgo-pg-role pgo-target-role
43-
{{ kubectl_or_oc }} -n {{ item }} delete --ignore-not-found rolebinding pgo-backrest-role-binding pgo-pg-role-binding pgo-target-role-binding
60+
{{ kubectl_or_oc }} -n {{ item }} delete --ignore-not-found sa pgo-backrest pgo-default pgo-target
61+
{{ kubectl_or_oc }} -n {{ item }} delete --ignore-not-found role pgo-backrest-role pgo-target-role
62+
{{ kubectl_or_oc }} -n {{ item }} delete --ignore-not-found rolebinding pgo-backrest-role-binding pgo-target-role-binding
4463

4564
cat {{ role_path }}/files/pgo-configs/pgo-default-sa.json | sed 's/{{ target_namespace }}/'"{{ item }}"'/' | {{ kubectl_or_oc }} -n {{ item }} create -f -
4665
cat {{ role_path }}/files/pgo-configs/pgo-target-sa.json | sed 's/{{ target_namespace }}/'"{{ item }}"'/' | {{ kubectl_or_oc }} -n {{ item }} create -f -
@@ -49,9 +68,6 @@ cat {{ role_path }}/files/pgo-configs/pgo-target-role-binding.json | sed 's/{{ t
4968
cat {{ role_path }}/files/pgo-configs/pgo-backrest-sa.json | sed 's/{{ target_namespace }}/'"{{ item }}"'/' | {{ kubectl_or_oc }} -n {{ item }} create -f -
5069
cat {{ role_path }}/files/pgo-configs/pgo-backrest-role.json | sed 's/{{ target_namespace }}/'"{{ item }}"'/' | {{ kubectl_or_oc }} -n {{ item }} create -f -
5170
cat {{ role_path }}/files/pgo-configs/pgo-backrest-role-binding.json | sed 's/{{ target_namespace }}/'"{{ item }}"'/' | {{ kubectl_or_oc }} -n {{ item }} create -f -
52-
cat {{ role_path }}/files/pgo-configs/pgo-pg-sa.json | sed 's/{{ target_namespace }}/'"{{ item }}"'/' | {{ kubectl_or_oc }} -n {{ item }} create -f -
53-
cat {{ role_path }}/files/pgo-configs/pgo-pg-role.json | sed 's/{{ target_namespace }}/'"{{ item }}"'/' | {{ kubectl_or_oc }} -n {{ item }} create -f -
54-
cat {{ role_path }}/files/pgo-configs/pgo-pg-role-binding.json | sed 's/{{ target_namespace }}/'"{{ item }}"'/' | {{ kubectl_or_oc }} -n {{ item }} create -f -
5571

5672
if [ -r "$PGO_IMAGE_PULL_SECRET_MANIFEST" ]; then
5773
$PGO_CMD -n "$TARGET_NAMESPACE" create -f "$PGO_IMAGE_PULL_SECRET_MANIFEST"

‎deploy/add-targeted-namespace.sh‎

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@
1414

1515

1616
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
17+
18+
# the name of the service account utilized by the PG pods
19+
PG_SA="pgo-pg"
20+
1721
# Enforce required environment variables
1822
test="${PGO_CMD:?Need to set PGO_CMD env variable}"
1923
test="${PGOROOT:?Need to set PGOROOT env variable}"
@@ -39,10 +43,26 @@ $PGO_CMD label namespace/$1 pgo-created-by=add-script
3943
$PGO_CMD label namespace/$1 vendor=crunchydata
4044
$PGO_CMD label namespace/$1 pgo-installation-name=$PGO_INSTALLATION_NAME
4145

46+
# determine if an existing pod is using the 'pgo-pg' service account. if so, do not delete
47+
# and recreate the SA or its associated role and role binding. this is to avoid any undesired
48+
# behavior with existing PG clusters that are actively utilizing the SA.
49+
$PGO_CMD -n $1 get pods -o yaml | grep "serviceAccount: ${PG_SA}" > /dev/null
50+
if [ $? -ne 0 ]; then
51+
$PGO_CMD -n $1 delete --ignore-not-found sa pgo-pg
52+
$PGO_CMD -n $1 delete --ignore-not-found role pgo-pg-role
53+
$PGO_CMD -n $1 delete --ignore-not-found rolebinding pgo-pg-role-binding
54+
55+
cat $PGOROOT/conf/postgres-operator/pgo-pg-sa.json | sed 's/{{.TargetNamespace}}/'"$1"'/' | $PGO_CMD -n $1 create -f -
56+
cat $PGOROOT/conf/postgres-operator/pgo-pg-role.json | sed 's/{{.TargetNamespace}}/'"$1"'/' | $PGO_CMD -n $1 create -f -
57+
cat $PGOROOT/conf/postgres-operator/pgo-pg-role-binding.json | sed 's/{{.TargetNamespace}}/'"$1"'/' | $PGO_CMD -n $1 create -f -
58+
else
59+
echo "Running pods found using SA '${PG_SA}' in namespace $1, will not recreate"
60+
fi
61+
4262
# create RBAC
43-
$PGO_CMD -n $1 delete --ignore-not-found sa pgo-backrest pgo-default pgo-pg pgo-target
44-
$PGO_CMD -n $1 delete --ignore-not-found role pgo-backrest-role pgo-pg-role pgo-target-role
45-
$PGO_CMD -n $1 delete --ignore-not-found rolebinding pgo-backrest-role-binding pgo-pg-role-binding pgo-target-role-binding
63+
$PGO_CMD -n $1 delete --ignore-not-found sa pgo-backrest pgo-default pgo-target
64+
$PGO_CMD -n $1 delete --ignore-not-found role pgo-backrest-role pgo-target-role
65+
$PGO_CMD -n $1 delete --ignore-not-found rolebinding pgo-backrest-role-binding pgo-target-role-binding
4666

4767
cat $PGOROOT/conf/postgres-operator/pgo-default-sa.json | sed 's/{{.TargetNamespace}}/'"$1"'/' | $PGO_CMD -n $1 create -f -
4868
cat $PGOROOT/conf/postgres-operator/pgo-target-sa.json | sed 's/{{.TargetNamespace}}/'"$1"'/' | $PGO_CMD -n $1 create -f -
@@ -51,9 +71,6 @@ cat $PGOROOT/conf/postgres-operator/pgo-target-role-binding.json | sed 's/{{.Tar
5171
cat $PGOROOT/conf/postgres-operator/pgo-backrest-sa.json | sed 's/{{.TargetNamespace}}/'"$1"'/' | $PGO_CMD -n $1 create -f -
5272
cat $PGOROOT/conf/postgres-operator/pgo-backrest-role.json | sed 's/{{.TargetNamespace}}/'"$1"'/' | $PGO_CMD -n $1 create -f -
5373
cat $PGOROOT/conf/postgres-operator/pgo-backrest-role-binding.json | sed 's/{{.TargetNamespace}}/'"$1"'/' | $PGO_CMD -n $1 create -f -
54-
cat $PGOROOT/conf/postgres-operator/pgo-pg-sa.json | sed 's/{{.TargetNamespace}}/'"$1"'/' | $PGO_CMD -n $1 create -f -
55-
cat $PGOROOT/conf/postgres-operator/pgo-pg-role.json | sed 's/{{.TargetNamespace}}/'"$1"'/' | $PGO_CMD -n $1 create -f -
56-
cat $PGOROOT/conf/postgres-operator/pgo-pg-role-binding.json | sed 's/{{.TargetNamespace}}/'"$1"'/' | $PGO_CMD -n $1 create -f -
5774

5875
if [ -r "$PGO_IMAGE_PULL_SECRET_MANIFEST" ]; then
5976
$PGO_CMD -n $1 create -f "$PGO_IMAGE_PULL_SECRET_MANIFEST"

0 commit comments

Comments
 (0)