Skip to content

Commit b12caea

Browse files
andrewlecuyerandrewlecuyer
committed
Create OCP 3.11 Specific Spec for Deployer Container
This commit creates a spec specifically for use by OpenShift 3.11 users when installing via the "kubectl" install method. This spec binds the 'pgo-deployer-sa' ServiceAccount to the 'cluster-admin' role as needed to ensure the deployer can create any RBAC required by the Operator. This specifically works around a defect in OCP 3.11 in which the Operator is unable to create roles it does not currently have (specifically due to a deficiency with the "escalate" verb for roles). Being that this is an OpenShift specific container, a few defaults have been changed from the standard 'postgresql-operator.yaml'. Specifically, "DISABLE_FSGROUPS" is set to "true" as required to run within the "restricted" SCC on OpenShift, and "NAMESPACE_MODE" has been set to "readonly" since "dynamic" is unable to work properly in OCP 3.11 due to the same known "escalate" issue.
1 parent 92af3fc commit b12caea

File tree

1 file changed

+205
-0
lines changed

1 file changed

+205
-0
lines changed

‎installers/kubectl/postgres-operator-ocp311.yml‎

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: pgo-deployer-sa
5+
namespace: pgo
6+
---
7+
apiVersion: rbac.authorization.k8s.io/v1
8+
kind: ClusterRoleBinding
9+
metadata:
10+
name: pgo-deployer-crb
11+
namespace: pgo
12+
roleRef:
13+
apiGroup: rbac.authorization.k8s.io
14+
kind: ClusterRole
15+
name: cluster-admin
16+
subjects:
17+
- apiGroup: rbac.authorization.k8s.io
18+
kind: User
19+
name: system:serviceaccount:pgo:pgo-deployer-sa
20+
---
21+
apiVersion: batch/v1
22+
kind: Job
23+
metadata:
24+
name: pgo-deploy
25+
namespace: pgo
26+
spec:
27+
backoffLimit: 0
28+
template:
29+
metadata:
30+
name: pgo-deploy
31+
spec:
32+
serviceAccountName: pgo-deployer-sa
33+
restartPolicy: Never
34+
containers:
35+
- name: pgo-deploy
36+
command: ["/pgo-deploy.sh"]
37+
image: registry.developers.crunchydata.com/crunchydata/pgo-deployer:centos7-4.3.1
38+
imagePullPolicy: IfNotPresent
39+
env:
40+
- name: ARCHIVE_MODE
41+
value: "true"
42+
- name: ARCHIVE_TIMEOUT
43+
value: "60"
44+
- name: BACKREST
45+
value: "true"
46+
- name: BADGER
47+
value: "false"
48+
- name: CRUNCHY_DEBUG
49+
value: "false"
50+
- name: CREATE_RBAC
51+
value: "true"
52+
- name: CCP_IMAGE_PREFIX
53+
value: "registry.developers.crunchydata.com/crunchydata"
54+
- name: CCP_IMAGE_TAG
55+
value: "centos7-12.3-4.3.1"
56+
- name: DB_PASSWORD_LENGTH
57+
value: "24"
58+
- name: DB_PORT
59+
value: "5432"
60+
- name: DB_REPLICAS
61+
value: "0"
62+
- name: DB_USER
63+
value: "testuser"
64+
- name: DEFAULT_INSTANCE_MEMORY
65+
value: "128Mi"
66+
- name: DEFAULT_PGBACKREST_MEMORY
67+
value: ""
68+
- name: DEFAULT_PGBOUNCER_MEMORY
69+
value: ""
70+
- name: DEPLOY_ACTION
71+
value: "install"
72+
- name: DISABLE_AUTO_FAILOVER
73+
value: "false"
74+
- name: DISABLE_FSGROUP
75+
value: "true"
76+
- name: DYNAMIC_RBAC
77+
value: "false"
78+
- name: EXPORTERPORT
79+
value: "9187"
80+
- name: METRICS
81+
value: "false"
82+
- name: NAMESPACE
83+
value: "pgo"
84+
- name: NAMESPACE_MODE
85+
value: "readonly"
86+
- name: PGBADGERPORT
87+
value: "10000"
88+
- name: PGO_ADMIN_PASSWORD
89+
value: "password"
90+
- name: PGO_ADMIN_PERMS
91+
value: "*"
92+
- name: PGO_ADMIN_ROLE_NAME
93+
value: "pgoadmin"
94+
- name: PGO_ADMIN_USERNAME
95+
value: "admin"
96+
- name: PGO_CLIENT_VERSION
97+
value: "v4.3.1"
98+
- name: PGO_IMAGE_PREFIX
99+
value: "registry.developers.crunchydata.com/crunchydata"
100+
- name: PGO_IMAGE_TAG
101+
value: "centos7-4.3.1"
102+
- name: PGO_INSTALLATION_NAME
103+
value: "devtest"
104+
- name: PGO_OPERATOR_NAMESPACE
105+
value: "pgo"
106+
- name: SCHEDULER_TIMEOUT
107+
value: "3600"
108+
- name: BACKREST_STORAGE
109+
value: "hostpathstorage"
110+
- name: BACKUP_STORAGE
111+
value: "hostpathstorage"
112+
- name: PRIMARY_STORAGE
113+
value: "hostpathstorage"
114+
- name: REPLICA_STORAGE
115+
value: "hostpathstorage"
116+
- name: WAL_STORAGE
117+
value: ""
118+
- name: STORAGE1_NAME
119+
value: "hostpathstorage"
120+
- name: STORAGE1_ACCESS_MODE
121+
value: "ReadWriteMany"
122+
- name: STORAGE1_SIZE
123+
value: "1G"
124+
- name: STORAGE1_TYPE
125+
value: "create"
126+
- name: STORAGE2_NAME
127+
value: "replicastorage"
128+
- name: STORAGE2_ACCESS_MODE
129+
value: "ReadWriteMany"
130+
- name: STORAGE2_SIZE
131+
value: "700M"
132+
- name: STORAGE2_TYPE
133+
value: "create"
134+
- name: STORAGE3_NAME
135+
value: "nfsstorage"
136+
- name: STORAGE3_ACCESS_MODE
137+
value: "ReadWriteMany"
138+
- name: STORAGE3_SIZE
139+
value: "1G"
140+
- name: STORAGE3_TYPE
141+
value: "create"
142+
- name: STORAGE3_SUPPLEMENTAL_GROUPS
143+
value: "65534"
144+
- name: STORAGE4_NAME
145+
value: "nfsstoragered"
146+
- name: STORAGE4_ACCESS_MODE
147+
value: "ReadWriteMany"
148+
- name: STORAGE4_SIZE
149+
value: "1G"
150+
- name: STORAGE4_MATCH_LABEL
151+
value: "crunchyzone=red"
152+
- name: STORAGE4_TYPE
153+
value: "create"
154+
- name: STORAGE4_SUPPLEMENTAL_GROUPS
155+
value: "65534"
156+
- name: STORAGE5_NAME
157+
value: "storageos"
158+
- name: STORAGE5_ACCESS_MODE
159+
value: "ReadWriteOnce"
160+
- name: STORAGE5_SIZE
161+
value: "5Gi"
162+
- name: STORAGE5_TYPE
163+
value: "dynamic"
164+
- name: STORAGE5_CLASS
165+
value: "fast"
166+
- name: STORAGE6_NAME
167+
value: "primarysite"
168+
- name: STORAGE6_ACCESS_MODE
169+
value: "ReadWriteOnce"
170+
- name: STORAGE6_SIZE
171+
value: "4G"
172+
- name: STORAGE6_TYPE
173+
value: "dynamic"
174+
- name: STORAGE6_CLASS
175+
value: "primarysite"
176+
- name: STORAGE7_NAME
177+
value: "alternatesite"
178+
- name: STORAGE7_ACCESS_MODE
179+
value: "ReadWriteOnce"
180+
- name: STORAGE7_SIZE
181+
value: "4G"
182+
- name: STORAGE7_TYPE
183+
value: "dynamic"
184+
- name: STORAGE7_CLASS
185+
value: "alternatesite"
186+
- name: STORAGE8_NAME
187+
value: "gce"
188+
- name: STORAGE8_ACCESS
189+
value: "ReadWriteOnce"
190+
- name: STORAGE8_SIZE
191+
value: "300M"
192+
- name: STORAGE8_TYPE
193+
value: "dynamic"
194+
- name: STORAGE8_CLASS
195+
value: "standard"
196+
- name: STORAGE9_NAME
197+
value: "rook"
198+
- name: STORAGE9_ACCESS_MODE
199+
value: "ReadWriteOnce"
200+
- name: STORAGE9_SIZE
201+
value: "1Gi"
202+
- name: STORAGE9_TYPE
203+
value: "dynamic"
204+
- name: STORAGE9_CLASS
205+
value: "rook-ceph-block"

0 commit comments

Comments
 (0)