Skip to content

Commit 7fcddf1

Browse files
author
Jeff McCormick
committed
update password secret logic
1 parent eaafa27 commit 7fcddf1

File tree

7 files changed

+133
-52
lines changed

7 files changed

+133
-52
lines changed

‎client/cmd/upgrade.go‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -292,15 +292,21 @@ func getUpgradeParams(name string) (*tpr.PgUpgrade, error) {
292292
return nil, errors.New("invalid image tag")
293293
}
294294

295+
requestedMajorVersion := parseMajorVersion(viper.GetString("CLUSTER.CCP_IMAGE_TAG"))
295296
if UpgradeType == MAJOR_UPGRADE {
296-
requestedMajorVersion := parseMajorVersion(viper.GetString("CLUSTER.CCP_IMAGE_TAG"))
297297
if requestedMajorVersion == existingMajorVersion {
298298
log.Error("can't upgrade to the same major version")
299299
return nil, errors.New("requested upgrade major version can not equal existing upgrade major version")
300300
} else if requestedMajorVersion < existingMajorVersion {
301301
log.Error("can't upgrade to a previous major version")
302302
return nil, errors.New("requested upgrade major version can not be older than existing upgrade major version")
303303
}
304+
} else {
305+
//minor upgrade
306+
if requestedMajorVersion > existingMajorVersion {
307+
log.Error("can't do minor upgrade to a newer major version")
308+
return nil, errors.New("requested minor upgrade to major version is not allowed")
309+
}
304310
}
305311

306312
newInstance := &tpr.PgUpgrade{

‎conf/postgres-operator/cluster/1/cluster-deployment-1.json‎

Lines changed: 49 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
},
2525
"spec": {
2626

27-
{{.SECURITY_CONTEXT}}
27+
{{.SECURITY_CONTEXT}}
2828

2929
"containers": [{
3030
"name": "database",
@@ -63,18 +63,26 @@
6363
"name": "PGHOST",
6464
"value": "/tmp"
6565
}],
66-
"volumeMounts": [
67-
{
68-
"mountPath": "/pgdata",
69-
"name": "pgdata",
70-
"readOnly": false
71-
},
72-
{
73-
"mountPath": "/backup",
74-
"name": "backup",
75-
"readOnly": true
76-
}
77-
],
66+
"volumeMounts": [{
67+
"mountPath": "/pgdata",
68+
"name": "pgdata",
69+
"readOnly": false
70+
}, {
71+
"mountPath": "/backup",
72+
"name": "backup",
73+
"readOnly": true
74+
}, {
75+
"mountPath": "/pguser",
76+
"name": "pguser-volume"
77+
}, {
78+
"mountPath": "/pgmaster",
79+
"name": "pgmaster-volume"
80+
}, {
81+
"mountPath": "/pgroot",
82+
"name": "pgroot-volume"
83+
}
84+
85+
],
7886

7987
"ports": [{
8088
"containerPort": 5432,
@@ -83,20 +91,35 @@
8391
"resources": {},
8492
"imagePullPolicy": "IfNotPresent"
8593
}],
86-
"volumes": [
87-
{
88-
"name": "pgdata",
89-
"persistentVolumeClaim": {
90-
"claimName": "{{.PVC_NAME}}"
91-
}
92-
},
93-
{
94-
"name": "backup",
95-
"persistentVolumeClaim": {
96-
"claimName": "{{.BACKUP_PVC_NAME}}"
94+
"volumes": [{
95+
"name": "pgdata",
96+
"persistentVolumeClaim": {
97+
"claimName": "{{.PVC_NAME}}"
98+
}
99+
}, {
100+
"name": "backup",
101+
"persistentVolumeClaim": {
102+
"claimName": "{{.BACKUP_PVC_NAME}}"
103+
}
104+
}, {
105+
"name": "pguser-volume",
106+
"secret": {
107+
"secretName": "{{.PGUSER_SECRET_NAME}}"
108+
}
109+
}, {
110+
"name": "pgmaster-volume",
111+
"secret": {
112+
"secretName": "{{.PGMASTER_SECRET_NAME}}"
113+
}
114+
}, {
115+
"name": "pgroot-volume",
116+
"secret": {
117+
"secretName": "{{.PGROOT_SECRET_NAME}}"
118+
}
97119
}
98-
}
99-
],
120+
121+
122+
],
100123

101124
"restartPolicy": "Always",
102125
"dnsPolicy": "ClusterFirst"

‎conf/postgres-operator/cluster/1/cluster-replica-deployment-1.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@
2323
}
2424
},
2525
"spec": {
26+
27+
{{.SECURITY_CONTEXT}}
28+
2629
"containers": [{
2730
"name": "database",
2831
"image": "crunchydata/crunchy-postgres:{{.CCP_IMAGE_TAG}}",

‎operator/cluster/cluster.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,9 @@ type DeploymentTemplateFields struct {
6262
PVC_NAME string
6363
BACKUP_PVC_NAME string
6464
BACKUP_PATH string
65+
PGROOT_SECRET_NAME string
66+
PGUSER_SECRET_NAME string
67+
PGMASTER_SECRET_NAME string
6568
//next 2 are for the replica deployment only
6669
REPLICAS string
6770
PG_MASTER_HOST string
@@ -152,7 +155,7 @@ func addCluster(clientset *kubernetes.Clientset, client *rest.RESTClient, cl *tp
152155

153156
log.Debug("creating PgCluster object strategy is [" + cl.Spec.STRATEGY + "]")
154157

155-
err = util.CreateDatabaseSecrets(clientset, cl.Spec.Name, namespace)
158+
err = util.CreateDatabaseSecrets(clientset, client, cl, namespace)
156159
if err != nil {
157160
log.Error(err.Error())
158161
return

‎operator/cluster/cluster_strategy_1.go‎

Lines changed: 20 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,9 @@ func (r ClusterStrategy1) AddCluster(clientset *kubernetes.Clientset, client *re
134134
PG_DATABASE: cl.Spec.PG_DATABASE,
135135
PG_ROOT_PASSWORD: cl.Spec.PG_ROOT_PASSWORD,
136136
SECURITY_CONTEXT: util.CreateSecContext(cl.Spec.FS_GROUP, cl.Spec.SUPPLEMENTAL_GROUPS),
137+
PGROOT_SECRET_NAME: cl.Spec.PGROOT_SECRET_NAME,
138+
PGMASTER_SECRET_NAME: cl.Spec.PGMASTER_SECRET_NAME,
139+
PGUSER_SECRET_NAME: cl.Spec.PGUSER_SECRET_NAME,
137140
}
138141

139142
err = DeploymentTemplate1.Execute(&masterDoc, deploymentFields)
@@ -160,20 +163,23 @@ func (r ClusterStrategy1) AddCluster(clientset *kubernetes.Clientset, client *re
160163

161164
//create the replica deployment
162165
replicaDeploymentFields := DeploymentTemplateFields{
163-
Name: cl.Spec.Name + REPLICA_SUFFIX,
164-
ClusterName: cl.Spec.Name,
165-
Port: cl.Spec.Port,
166-
CCP_IMAGE_TAG: cl.Spec.CCP_IMAGE_TAG,
167-
PVC_NAME: cl.Spec.PVC_NAME,
168-
PG_MASTER_HOST: cl.Spec.PG_MASTER_HOST,
169-
PG_MASTER_USER: cl.Spec.PG_MASTER_USER,
170-
PG_MASTER_PASSWORD: cl.Spec.PG_MASTER_PASSWORD,
171-
PG_USER: cl.Spec.PG_USER,
172-
PG_PASSWORD: cl.Spec.PG_PASSWORD,
173-
PG_DATABASE: cl.Spec.PG_DATABASE,
174-
PG_ROOT_PASSWORD: cl.Spec.PG_ROOT_PASSWORD,
175-
REPLICAS: cl.Spec.REPLICAS,
176-
SECURITY_CONTEXT: util.CreateSecContext(cl.Spec.FS_GROUP, cl.Spec.SUPPLEMENTAL_GROUPS),
166+
Name: cl.Spec.Name + REPLICA_SUFFIX,
167+
ClusterName: cl.Spec.Name,
168+
Port: cl.Spec.Port,
169+
CCP_IMAGE_TAG: cl.Spec.CCP_IMAGE_TAG,
170+
PVC_NAME: cl.Spec.PVC_NAME,
171+
PG_MASTER_HOST: cl.Spec.PG_MASTER_HOST,
172+
PG_MASTER_USER: cl.Spec.PG_MASTER_USER,
173+
PG_MASTER_PASSWORD: cl.Spec.PG_MASTER_PASSWORD,
174+
PG_USER: cl.Spec.PG_USER,
175+
PG_PASSWORD: cl.Spec.PG_PASSWORD,
176+
PG_DATABASE: cl.Spec.PG_DATABASE,
177+
PG_ROOT_PASSWORD: cl.Spec.PG_ROOT_PASSWORD,
178+
REPLICAS: cl.Spec.REPLICAS,
179+
SECURITY_CONTEXT: util.CreateSecContext(cl.Spec.FS_GROUP, cl.Spec.SUPPLEMENTAL_GROUPS),
180+
PGROOT_SECRET_NAME: cl.Spec.PGROOT_SECRET_NAME,
181+
PGMASTER_SECRET_NAME: cl.Spec.PGMASTER_SECRET_NAME,
182+
PGUSER_SECRET_NAME: cl.Spec.PGUSER_SECRET_NAME,
177183
}
178184

179185
err = ReplicaDeploymentTemplate1.Execute(&replicaDoc, replicaDeploymentFields)

‎operator/util/secrets.go‎

Lines changed: 47 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,10 @@ package util
1818
import (
1919
//"encoding/base64"
2020
log "github.com/Sirupsen/logrus"
21+
"github.com/crunchydata/postgres-operator/tpr"
2122
"k8s.io/client-go/kubernetes"
23+
"k8s.io/client-go/rest"
24+
2225
"k8s.io/client-go/pkg/api/v1"
2326
"math/rand"
2427
"time"
@@ -31,34 +34,68 @@ var seededRand *rand.Rand = rand.New(
3134
rand.NewSource(time.Now().UnixNano()))
3235

3336
//create pgroot, pgmaster, and pguser secrets
34-
func CreateDatabaseSecrets(clientset *kubernetes.Clientset, db, namespace string) error {
35-
36-
var username string
37-
var err error
37+
func CreateDatabaseSecrets(clientset *kubernetes.Clientset, tprclient *rest.RESTClient, cl *tpr.PgCluster, namespace string) error {
3838

3939
//pgroot
40-
username = "postgres"
41-
err = CreateSecret(clientset, db, "pgroot-secret", username, namespace)
40+
username := "postgres"
41+
suffix := "-pgroot-secret"
42+
secretName := cl.Spec.Name + suffix
43+
err := CreateSecret(clientset, cl.Spec.Name, secretName, username, cl.Spec.PG_ROOT_PASSWORD, namespace)
44+
if err != nil {
45+
log.Error(err.Error())
46+
}
47+
cl.Spec.PGROOT_SECRET_NAME = secretName
48+
err = Patch(tprclient, "/spec/pgrootsecretname", secretName, "pgclusters", cl.Spec.Name, namespace)
49+
if err != nil {
50+
log.Error(err.Error())
51+
}
52+
4253
///pgmaster
4354
username = "master"
44-
err = CreateSecret(clientset, db, "pgmaster-secret", username, namespace)
55+
suffix = "-pgmaster-secret"
56+
secretName = cl.Spec.Name + suffix
57+
err = CreateSecret(clientset, cl.Spec.Name, secretName, username, cl.Spec.PG_MASTER_PASSWORD, namespace)
58+
if err != nil {
59+
log.Error(err.Error())
60+
}
61+
cl.Spec.PGMASTER_SECRET_NAME = secretName
62+
err = Patch(tprclient, "/spec/pgmastersecretname", secretName, "pgclusters", cl.Spec.Name, namespace)
63+
if err != nil {
64+
log.Error(err.Error())
65+
}
66+
4567
///pguser
4668
username = "testuser"
47-
err = CreateSecret(clientset, db, "pguser-secret", username, namespace)
69+
suffix = "-pguser-secret"
70+
secretName = cl.Spec.Name + suffix
71+
err = CreateSecret(clientset, cl.Spec.Name, secretName, username, cl.Spec.PG_PASSWORD, namespace)
72+
if err != nil {
73+
log.Error(err.Error())
74+
}
75+
cl.Spec.PGUSER_SECRET_NAME = secretName
76+
err = Patch(tprclient, "/spec/pgusersecretname", secretName, "pgclusters", cl.Spec.Name, namespace)
77+
if err != nil {
78+
log.Error(err.Error())
79+
}
80+
4881
return err
4982
}
5083

5184
//create the secret, user, and master secrets
52-
func CreateSecret(clientset *kubernetes.Clientset, db, suffix, username, namespace string) error {
85+
func CreateSecret(clientset *kubernetes.Clientset, db, secretName, username, password, namespace string) error {
5386

5487
//var enUsername = base64.StdEncoding.EncodeToString([]byte(username))
5588
var enUsername = username
5689
//var enPassword = base64.StdEncoding.EncodeToString([]byte(generatePassword(10)))
5790
var enPassword = generatePassword(10)
91+
if password != "" {
92+
log.Debug("using user specified password for secret " + secretName)
93+
enPassword = password
94+
}
5895

5996
secret := v1.Secret{}
6097

61-
secret.Name = db + "-" + suffix
98+
secret.Name = secretName
6299
secret.ObjectMeta.Labels = make(map[string]string)
63100
secret.ObjectMeta.Labels["pg-database"] = db
64101
secret.Data = make(map[string][]byte)

‎tpr/cluster.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,9 @@ type PgClusterSpec struct {
4747
STRATEGY string `json:"strategy"`
4848
BACKUP_PVC_NAME string `json:"backuppvcname"`
4949
BACKUP_PATH string `json:"backuppath"`
50+
PGUSER_SECRET_NAME string `json:"pgusersecretname"`
51+
PGROOT_SECRET_NAME string `json:"pgrootsecretname"`
52+
PGMASTER_SECRET_NAME string `json:"pgmastersecretname"`
5053
}
5154

5255
type PgCluster struct {

0 commit comments

Comments
 (0)