mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-04 11:07:03 +09:00
Myasnikov DaniilandIvanHunters
14e196cf22
Ivan's original schema edits were correct in intent but lived in the
generated artifacts (values.schema.json and the embedded openAPISchema
in postgres-rd/cozyrds/postgres.yaml). `make generate` reverts them
because values.yaml's `@field {map[string]string}` annotation is the
source of truth -- same regeneration trap that caught #2466 (issue #2597).
cozyvalues-gen v1.4.0 (cozystack/cozyvalues-gen#25, merged 2026-05-21)
adds an `intOrString` type alias for map values that emits
`additionalProperties.anyOf: [integer, string]` plus
`x-kubernetes-int-or-string: true`. Move the change to source by
flipping the annotation, then regenerate:
- packages/apps/postgres/values.yaml: `@field {map[string]intOrString}`
with updated description noting integer values are accepted.
- packages/apps/postgres/values.schema.json: regenerated -- now carries
anyOf + x-kubernetes-int-or-string: true.
- packages/system/postgres-rd/cozyrds/postgres.yaml: embedded
openAPISchema regenerated to match.
- packages/apps/postgres/README.md: regenerated type column.
- api/apps/v1alpha1/postgresql/types.go: Parameters is now
`map[string]intstr.IntOrString`.
The result survives future regenerations. The template's
`{{ \$value | toString | quote }}` already coerces both inputs to
quoted strings, verified end-to-end with helm template against both
`max_connections: 100` (int) and `max_connections: "100"` (string) --
identical render output. Dangerous-param block list still rejects
archive_cleanup_command and recovery_end_command additions from the
prior commit.
Co-Authored-By: IvanHunters <xorokhotnikov@gmail.com>
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
240 lines
9.6 KiB
YAML
240 lines
9.6 KiB
YAML
##
|
|
## @section Common parameters
|
|
##
|
|
|
|
## @typedef {struct} Resources - Explicit CPU and memory configuration for each PostgreSQL replica.
|
|
## @field {quantity} [cpu] - CPU available to each replica.
|
|
## @field {quantity} [memory] - Memory (RAM) available to each replica.
|
|
|
|
## @enum {string} ResourcesPreset - Default sizing preset.
|
|
## @value t1.nano
|
|
## @value t1.micro
|
|
## @value t1.small
|
|
## @value t1.medium
|
|
## @value t1.large
|
|
## @value t1.xlarge
|
|
## @value t1.2xlarge
|
|
## @value t1.4xlarge
|
|
## @value c1.nano
|
|
## @value c1.micro
|
|
## @value c1.small
|
|
## @value c1.medium
|
|
## @value c1.large
|
|
## @value c1.xlarge
|
|
## @value c1.2xlarge
|
|
## @value c1.4xlarge
|
|
## @value s1.nano
|
|
## @value s1.micro
|
|
## @value s1.small
|
|
## @value s1.medium
|
|
## @value s1.large
|
|
## @value s1.xlarge
|
|
## @value s1.2xlarge
|
|
## @value s1.4xlarge
|
|
## @value u1.nano
|
|
## @value u1.micro
|
|
## @value u1.small
|
|
## @value u1.medium
|
|
## @value u1.large
|
|
## @value u1.xlarge
|
|
## @value u1.2xlarge
|
|
## @value u1.4xlarge
|
|
## @value m1.nano
|
|
## @value m1.micro
|
|
## @value m1.small
|
|
## @value m1.medium
|
|
## @value m1.large
|
|
## @value m1.xlarge
|
|
## @value m1.2xlarge
|
|
## @value m1.4xlarge
|
|
## @value nano
|
|
## @value micro
|
|
## @value small
|
|
## @value medium
|
|
## @value large
|
|
## @value xlarge
|
|
## @value 2xlarge
|
|
|
|
## @param {int} replicas - Number of Postgres replicas.
|
|
replicas: 2
|
|
|
|
## @param {Resources} [resources] - Explicit CPU and memory configuration for each PostgreSQL replica. When omitted, the preset defined in `resourcesPreset` is applied.
|
|
resources: {}
|
|
|
|
## @param {ResourcesPreset} resourcesPreset="t1.micro" - Default sizing preset used when `resources` is omitted.
|
|
resourcesPreset: "t1.micro"
|
|
|
|
## @param {quantity} size - Persistent Volume Claim size available for application data.
|
|
size: 10Gi
|
|
|
|
## @param {string} storageClass - StorageClass used to store the data.
|
|
storageClass: ""
|
|
|
|
## @param {bool} external - Enable external access from outside the cluster.
|
|
external: false
|
|
|
|
##
|
|
## @enum {string} Version
|
|
## @value v18
|
|
## @value v17
|
|
## @value v16
|
|
## @value v15
|
|
## @value v14
|
|
## @value v13
|
|
|
|
## @param {Version} version - PostgreSQL major version to deploy
|
|
version: v18
|
|
|
|
## @section Application-specific parameters
|
|
##
|
|
|
|
## @typedef {struct} PostgreSQL - PostgreSQL server configuration.
|
|
## @field {map[string]intOrString} [parameters] - PostgreSQL server parameters. Values may be strings or integers; integers are coerced to strings by the template (e.g. both `max_connections: 100` and `max_connections: "100"` are accepted). BLOCKED (enable arbitrary code execution): archive_command, restore_command, ssl_passphrase_command, archive_cleanup_command, recovery_end_command, dynamic_library_path, local_preload_libraries, session_preload_libraries, shared_preload_libraries. Do NOT override CloudNativePG-managed parameters: archive_mode, primary_conninfo, wal_level, max_replication_slots.
|
|
|
|
## @param {PostgreSQL} postgresql - PostgreSQL server configuration.
|
|
postgresql:
|
|
parameters:
|
|
max_connections: "100"
|
|
## Additional parameters examples:
|
|
## shared_buffers: "1GB"
|
|
## effective_cache_size: "4GB"
|
|
## bgwriter_delay: "200ms"
|
|
## commit_delay: "100"
|
|
## commit_siblings: "5"
|
|
## work_mem: "256MB"
|
|
##
|
|
## SECURITY: The following parameters are BLOCKED (enable arbitrary code execution):
|
|
## archive_command, restore_command, ssl_passphrase_command, archive_cleanup_command, recovery_end_command (shell commands),
|
|
## dynamic_library_path, local_preload_libraries, session_preload_libraries,
|
|
## shared_preload_libraries (arbitrary .so loading)
|
|
##
|
|
## IMPORTANT: Do NOT override CloudNativePG-managed parameters:
|
|
## archive_mode, primary_conninfo, wal_level, max_replication_slots
|
|
##
|
|
## NOTE: Some parameters require pod restart (not just reload):
|
|
## shared_buffers, max_connections, max_prepared_transactions,
|
|
## wal_buffers, max_wal_senders
|
|
|
|
##
|
|
## @section Quorum-based synchronous replication
|
|
##
|
|
|
|
## @typedef {struct} Quorum - Quorum configuration for synchronous replication.
|
|
## @field {int} minSyncReplicas - Minimum number of synchronous replicas required for commit.
|
|
## @field {int} maxSyncReplicas - Maximum number of synchronous replicas allowed (must be less than total replicas).
|
|
|
|
## @param {Quorum} quorum - Quorum configuration for synchronous replication.
|
|
quorum:
|
|
minSyncReplicas: 0
|
|
maxSyncReplicas: 0
|
|
|
|
##
|
|
## @section Users configuration
|
|
##
|
|
|
|
## @typedef {struct} User - User configuration.
|
|
## @field {string} [password] - Password for the user.
|
|
## @field {bool} [replication] - Whether the user has replication privileges.
|
|
|
|
## @param {map[string]User} users - Users configuration map.
|
|
users: {}
|
|
## Example:
|
|
## users:
|
|
## user1:
|
|
## password: strongpassword
|
|
## user2:
|
|
## password: hackme
|
|
## airflow:
|
|
## password: qwerty123
|
|
## debezium:
|
|
## replication: true
|
|
|
|
##
|
|
## @section Databases configuration
|
|
##
|
|
|
|
## @typedef {struct} DatabaseRoles - Role assignments for a database.
|
|
## @field {[]string} [admin] - List of users with admin privileges.
|
|
## @field {[]string} [readonly] - List of users with read-only privileges.
|
|
|
|
## @typedef {struct} Database - Database configuration.
|
|
## @field {DatabaseRoles} [roles] - Roles assigned to users.
|
|
## @field {[]string} [extensions] - List of enabled PostgreSQL extensions.
|
|
|
|
## @param {map[string]Database} databases - Databases configuration map.
|
|
databases: {}
|
|
## Example:
|
|
## databases:
|
|
## myapp:
|
|
## roles:
|
|
## admin:
|
|
## - user1
|
|
## - debezium
|
|
## readonly:
|
|
## - user2
|
|
## airflow:
|
|
## roles:
|
|
## admin:
|
|
## - airflow
|
|
## extensions:
|
|
## - hstore
|
|
|
|
##
|
|
## @section Backup parameters
|
|
##
|
|
|
|
## @typedef {struct} S3CredentialsSecret - Reference to a pre-existing Secret with S3 credentials. Setting `name` makes the chart bind the cnpg.io Cluster's barmanObjectStore directly to that Secret instead of materialising `<release>-s3-creds` from `s3AccessKey`/`s3SecretKey`. Use this to keep credentials out of the Postgres CR's `.spec`.
|
|
## @field {string} [name] - Name of the Secret in the application namespace. Empty means the chart materialises `<release>-s3-creds` from `s3AccessKey`/`s3SecretKey`.
|
|
## @field {string} [accessKeyIDKey] - Key in the Secret holding the access key ID. Defaults to `AWS_ACCESS_KEY_ID`.
|
|
## @field {string} [secretAccessKeyKey] - Key in the Secret holding the secret access key. Defaults to `AWS_SECRET_ACCESS_KEY`.
|
|
|
|
## @typedef {struct} EndpointCA - Reference to a Secret holding a PEM-encoded CA bundle the Barman client should trust when reaching a self-signed S3 endpoint. Required when the cluster's S3 (e.g. cozystack's seaweedfs-s3) presents a certificate not signed by a publicly-trusted CA. Used by both spec.backup.barmanObjectStore.endpointCA and the bootstrap-time externalClusters[].barmanObjectStore.endpointCA so backup *and* recovery can verify TLS.
|
|
## @field {string} [name] - Name of the Secret in the application namespace. Empty means no endpointCA is emitted (Barman uses the system trust store).
|
|
## @field {string} [key] - Key within the Secret containing the CA bundle. Defaults to `ca.crt`.
|
|
|
|
## @typedef {struct} Backup - Backup configuration.
|
|
## @field {bool} enabled - Enable regular backups.
|
|
## @field {string} [schedule] - Legacy. Cron schedule (CNPG 6-field format) for the chart-emitted ScheduledBackup. Empty means no chart-managed schedule, which is the recommended setup when a `BackupClass` from `backups.cozystack.io` already drives backup orchestration. The chart still emits `spec.backup.barmanObjectStore` whenever `backup.enabled=true`, so `archive_command` runs and the BackupClass driver can take ad-hoc / Plan-driven backups against a live WAL archive.
|
|
## @field {string} [retentionPolicy] - Retention policy (e.g. "30d").
|
|
## @field {string} [destinationPath] - Destination path for backups (e.g. s3://bucket/path/).
|
|
## @field {string} [endpointURL] - S3 endpoint URL for uploads.
|
|
## @field {string} [s3AccessKey] - Access key for S3 authentication. Ignored when `s3CredentialsSecret.name` is set.
|
|
## @field {string} [s3SecretKey] - Secret key for S3 authentication. Ignored when `s3CredentialsSecret.name` is set.
|
|
## @field {S3CredentialsSecret} [s3CredentialsSecret] - Pre-existing Secret with S3 credentials. When set, the chart references this Secret directly instead of materialising one from `s3AccessKey`/`s3SecretKey`. The CNPG backup driver writes this field on restore so credentials never land in the CR `.spec`.
|
|
## @field {EndpointCA} [endpointCA] - Pre-existing Secret with the CA bundle Barman should trust when reaching a self-signed S3 endpoint. Used for both backup and bootstrap recovery. The CNPG backup driver writes this field on restore.
|
|
|
|
## @param {Backup} backup - Backup configuration.
|
|
backup:
|
|
enabled: false
|
|
retentionPolicy: 30d
|
|
destinationPath: "s3://bucket/path/to/folder/"
|
|
endpointURL: "http://minio-gateway-service:9000"
|
|
schedule: ""
|
|
s3AccessKey: "<your-access-key>"
|
|
s3SecretKey: "<your-secret-key>"
|
|
s3CredentialsSecret:
|
|
name: ""
|
|
accessKeyIDKey: ""
|
|
secretAccessKeyKey: ""
|
|
endpointCA:
|
|
name: ""
|
|
key: ""
|
|
|
|
##
|
|
## @section Bootstrap (recovery) parameters
|
|
##
|
|
|
|
## @typedef {struct} Bootstrap - Bootstrap configuration for restoring a database cluster from a backup.
|
|
## @field {bool} enabled - Whether to restore from a backup.
|
|
## @field {string} [recoveryTime] - Timestamp (RFC3339) for point-in-time recovery; empty means latest.
|
|
## @field {string} oldName - Previous cluster name before deletion.
|
|
## @field {string} [serverName] - Barman server name (S3 path prefix) used by the original cluster when writing backups. Set this only when the original cluster had an explicit barmanObjectStore.serverName that differed from its Kubernetes resource name.
|
|
|
|
## @param {Bootstrap} bootstrap - Bootstrap configuration.
|
|
bootstrap:
|
|
enabled: false
|
|
# example: 2020-11-26 15:22:00.00000+00
|
|
recoveryTime: ""
|
|
oldName: ""
|
|
serverName: ""
|