Skip to content

Commit bc0610d

Browse files
cbandycbandy
committed
Make fsGroup of metrics deployments configurable
Setting disable_fsgroup to 'true' allows these deployments to run in an OpenShift SCC or Kubernetes PSP with fsGroup other than RunAsAny.
1 parent 6264657 commit bc0610d

File tree

4 files changed

+17
-10
lines changed

4 files changed

+17
-10
lines changed

‎docs/content/installation/other/ansible/installing-metrics.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,10 @@ metrics infrastructure:
2626
|-----------------------------------|-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
2727
| `ccp_image_prefix` | crunchydata | Configures the image prefix used when creating containers from Crunchy Container Suite. |
2828
| `ccp_image_tag` | | Configures the image tag (version) used when creating containers from Crunchy Container Suite. |
29+
| `disable_fsgroup` | false | Set to `true` for deployments where you do not want to have the default fsGroup set. The typical usage is in deployment environments that have a restricted Security Context Constraints. |
2930
| `grafana_admin_username` | admin | Set to configure the login username for the Grafana administrator. |
3031
| `grafana_admin_password` | | Set to configure the login password for the Grafana administrator. |
31-
| `grafana_install` | true | Set to true to install Crunchy Grafana to visualize metrics. |
32+
| `grafana_install` | false | Set to true to install Crunchy Grafana to visualize metrics. |
3233
| `grafana_storage_access_mode` | | Set to the access mode used by the configured storage class for Grafana persistent volumes. |
3334
| `grafana_storage_class_name` | | Set to the name of the storage class used when creating Grafana persistent volumes. |
3435
| `grafana_volume_size` | | Set to the size of persistent volume to create for Grafana. |
@@ -40,7 +41,7 @@ metrics infrastructure:
4041
| `openshift_skip_tls_verify` | | When deploying to Openshift, set to ignore the integrity of TLS certificates for the OpenShift cluster. |
4142
| `openshift_token` | | When deploying to OpenShift, set to configure the token used for login (when not using username/password authentication). |
4243
| `openshift_user` | | When deploying to OpenShift, set to configure the username used for login. |
43-
| `prometheus_install` | true | Set to true to install Crunchy Prometheus timeseries database. |
44+
| `prometheus_install` | false | Set to true to install Crunchy Prometheus timeseries database. |
4445
| `prometheus_storage_access_mode` | | Set to the access mode used by the configured storage class for Prometheus persistent volumes. |
4546
| `prometheus_storage_class_name` | | Set to the name of the storage class used when creating Prometheus persistent volumes. |
4647

‎docs/content/installation/other/ansible/prerequisites.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@ sets of variables cannot be used at the same time.
118118
* `db_port`
119119
* `db_replicas`
120120
* `db_user`
121-
* `disable_auto_failover``
121+
* `disable_auto_failover`
122122
* `exporterport`
123123
* `kubernetes_context` (Comment out if deploying to am OpenShift environment)
124124
* `metrics`
@@ -179,14 +179,14 @@ sets of variables cannot be used at the same time.
179179
| `exporterport` | 9187 | **Required** | Set to configure the default port used to connect to postgres exporter. |
180180
| `grafana_admin_password` | | | Set to configure the login password for the Grafana administrator. |
181181
| `grafana_admin_username` | admin | | Set to configure the login username for the Grafana administrator. |
182-
| `grafana_install` | true | | Set to true to install Crunchy Grafana to visualize metrics. |
182+
| `grafana_install` | false | | Set to true to install Crunchy Grafana to visualize metrics. |
183183
| `grafana_storage_access_mode` | | | Set to the access mode used by the configured storage class for Grafana persistent volumes. |
184184
| `grafana_storage_class_name` | | | Set to the name of the storage class used when creating Grafana persistent volumes. |
185185
| `grafana_volume_size` | | | Set to the size of persistent volume to create for Grafana. |
186186
| `kubernetes_context` | | **Required**, if deploying to Kubernetes |When deploying to Kubernetes, set to configure the context name of the kubeconfig to be used for authentication. |
187187
| `log_statement` | none | | Set to `none`, `ddl`, `mod`, or `all` to configure the statements that will be logged in PostgreSQL's logs on all newly created clusters. |
188188
| `metrics` | false | **Required** | Set to true enable performance metrics on all newly created clusters. This can be disabled by the client. |
189-
| `metrics_namespace` | metrics | | Configures the target namespace when deploying Grafana and/or Prometheus |
189+
| `metrics_namespace` | pgo | | Configures the target namespace when deploying Grafana and/or Prometheus |
190190
| `namespace` | | | Set to a comma delimited string of all the namespaces Operator will manage. |
191191
| `namespace_mode` | dynamic | **Required** | Determines which `ClusterRoles` will be installed as required to enable various namespace functionality within the Operator. Valid values are `dynamic`, `readonly` or `disabled`. If `disabled` is selected, then no `ClusterRoles` are installed.|
192192
| `openshift_host` | | **Required**, if deploying to OpenShift | When deploying to OpenShift, set to configure the hostname of the OpenShift cluster to connect to. |
@@ -219,7 +219,7 @@ sets of variables cannot be used at the same time.
219219
| `pod_anti_affinity_pgbackrest` | | | If set, overrides the value of `pod_anti_affinity` for just the pgBackRest repository |
220220
| `pod_anti_affinity_pgbouncer` | | | If set, overrides the value of `pod_anti_affinity` for just the pgBouncer Pods |
221221
| `primary_storage` | storageos | **Required** | Set to configure which storage definition to use when creating volumes used by PostgreSQL primaries on all newly created clusters. |
222-
| `prometheus_install` | true | | Set to true to install Crunchy Prometheus timeseries database. |
222+
| `prometheus_install` | false | | Set to true to install Crunchy Prometheus timeseries database. |
223223
| `prometheus_storage_access_mode` | | | Set to the access mode used by the configured storage class for Prometheus persistent volumes. |
224224
| `prometheus_storage_class_name` | | | Set to the name of the storage class used when creating Prometheus persistent volumes. |
225225
| `replica_storage` | storageos | **Required** | Set to configure which storage definition to use when creating volumes used by PostgreSQL replicas on all newly created clusters. |

‎installers/ansible/roles/pgo-metrics/templates/grafana-deployment.json.j2‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,13 @@
2121
},
2222
"spec": {
2323
"securityContext": {
24-
{% if grafana_supplemental_groups is defined and grafana_supplemental_groups != '' %}
25-
"supplementalGroups": [{{ grafana_supplemental_groups }}],
24+
{% if (grafana_supplemental_groups | default('')) != '' %}
25+
"supplementalGroups": [{{ grafana_supplemental_groups }}]
2626
{% endif %}
27+
{% if not (disable_fsgroup | default(false) | bool) %}
28+
{% if (grafana_supplemental_groups | default('')) != '' %},{% endif -%}
2729
"fsGroup": 26
30+
{% endif %}
2831
},
2932
"serviceAccountName": "grafana",
3033
"containers": [

‎installers/ansible/roles/pgo-metrics/templates/prometheus-deployment.json.j2‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,13 @@
2121
},
2222
"spec": {
2323
"securityContext": {
24-
{% if prometheus_supplemental_groups is defined and prometheus_supplemental_groups != '' %}
25-
"supplementalGroups": [{{ prometheus_supplemental_groups }}],
24+
{% if (prometheus_supplemental_groups | default('')) != '' %}
25+
"supplementalGroups": [{{ prometheus_supplemental_groups }}]
2626
{% endif %}
27+
{% if not (disable_fsgroup | default(false) | bool) %}
28+
{% if (prometheus_supplemental_groups | default('')) != '' %},{% endif -%}
2729
"fsGroup": 26
30+
{% endif %}
2831
},
2932
"serviceAccountName": "prometheus-sa",
3033
"containers": [

0 commit comments

Comments
 (0)