mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-05 19:47:37 +09:00
Aleksei SviridkinandMatthieu ROBIN
fdffedbd4b
Rewrite resourcesPreset values in every apps/* and extras/* chart from the legacy flat names to the new instance-type form, using the 1:1 mapping: nano -> t1.nano micro -> t1.micro small -> t1.small medium -> c1.small large -> c1.medium xlarge -> c1.large 2xlarge -> c1.xlarge Each affected values.yaml carries the canonical 47-value enum (40 instance-type names plus 7 legacy aliases) so the schema accepts both forms during the deprecation window. cozyvalues-gen regenerates the matching api/apps/v1alpha1/*/types.go kubebuilder enum and defaults, the chart values.schema.json, the README parameter table, and the ApplicationDefinition openAPISchema in packages/system/*-rd/cozyrds. Three hardcoded legacy literals in chart templates migrated: - packages/apps/harbor/templates/harbor.yaml:121 (portal) - packages/apps/opensearch/templates/opensearch.yaml:43 (dashboards) - packages/system/keycloak/templates/sts.yaml:115 (heap fallback) packages/apps/foundationdb/Makefile gains the missing hack/update-crd.sh call. Without it, every regen left foundationdb-rd cozyrds stale and new FoundationDB app CRs through cozystack-api were rejected at validation for any non-legacy resourcesPreset value. Every default-rendered chart produces identical CPU and memory to the value applied before the rename, courtesy of the legacy alias table in cozy-lib and the 1:1 default mapping. Co-authored-by: Matthieu ROBIN <matthieu@hidora.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
240 lines
9.4 KiB
YAML
240 lines
9.4 KiB
YAML
##
|
|
## @section Common parameters
|
|
##
|
|
|
|
## @typedef {struct} Resources - Explicit CPU and memory configuration for each PostgreSQL replica.
|
|
## @field {quantity} [cpu] - CPU available to each replica.
|
|
## @field {quantity} [memory] - Memory (RAM) available to each replica.
|
|
|
|
## @enum {string} ResourcesPreset - Default sizing preset.
|
|
## @value t1.nano
|
|
## @value t1.micro
|
|
## @value t1.small
|
|
## @value t1.medium
|
|
## @value t1.large
|
|
## @value t1.xlarge
|
|
## @value t1.2xlarge
|
|
## @value t1.4xlarge
|
|
## @value c1.nano
|
|
## @value c1.micro
|
|
## @value c1.small
|
|
## @value c1.medium
|
|
## @value c1.large
|
|
## @value c1.xlarge
|
|
## @value c1.2xlarge
|
|
## @value c1.4xlarge
|
|
## @value s1.nano
|
|
## @value s1.micro
|
|
## @value s1.small
|
|
## @value s1.medium
|
|
## @value s1.large
|
|
## @value s1.xlarge
|
|
## @value s1.2xlarge
|
|
## @value s1.4xlarge
|
|
## @value u1.nano
|
|
## @value u1.micro
|
|
## @value u1.small
|
|
## @value u1.medium
|
|
## @value u1.large
|
|
## @value u1.xlarge
|
|
## @value u1.2xlarge
|
|
## @value u1.4xlarge
|
|
## @value m1.nano
|
|
## @value m1.micro
|
|
## @value m1.small
|
|
## @value m1.medium
|
|
## @value m1.large
|
|
## @value m1.xlarge
|
|
## @value m1.2xlarge
|
|
## @value m1.4xlarge
|
|
## @value nano
|
|
## @value micro
|
|
## @value small
|
|
## @value medium
|
|
## @value large
|
|
## @value xlarge
|
|
## @value 2xlarge
|
|
|
|
## @param {int} replicas - Number of Postgres replicas.
|
|
replicas: 2
|
|
|
|
## @param {Resources} [resources] - Explicit CPU and memory configuration for each PostgreSQL replica. When omitted, the preset defined in `resourcesPreset` is applied.
|
|
resources: {}
|
|
|
|
## @param {ResourcesPreset} resourcesPreset="t1.micro" - Default sizing preset used when `resources` is omitted.
|
|
resourcesPreset: "t1.micro"
|
|
|
|
## @param {quantity} size - Persistent Volume Claim size available for application data.
|
|
size: 10Gi
|
|
|
|
## @param {string} storageClass - StorageClass used to store the data.
|
|
storageClass: ""
|
|
|
|
## @param {bool} external - Enable external access from outside the cluster.
|
|
external: false
|
|
|
|
##
|
|
## @enum {string} Version
|
|
## @value v18
|
|
## @value v17
|
|
## @value v16
|
|
## @value v15
|
|
## @value v14
|
|
## @value v13
|
|
|
|
## @param {Version} version - PostgreSQL major version to deploy
|
|
version: v18
|
|
|
|
## @section Application-specific parameters
|
|
##
|
|
|
|
## @typedef {struct} PostgreSQL - PostgreSQL server configuration.
|
|
## @field {map[string]string} [parameters] - PostgreSQL server parameters. All values must be strings (quote numbers: "100"). BLOCKED (enable arbitrary code execution): archive_command, restore_command, ssl_passphrase_command, dynamic_library_path, local_preload_libraries, session_preload_libraries, shared_preload_libraries. Do NOT override CloudNativePG-managed parameters: archive_mode, primary_conninfo, wal_level, max_replication_slots.
|
|
|
|
## @param {PostgreSQL} postgresql - PostgreSQL server configuration.
|
|
postgresql:
|
|
parameters:
|
|
max_connections: "100"
|
|
## Additional parameters examples:
|
|
## shared_buffers: "1GB"
|
|
## effective_cache_size: "4GB"
|
|
## bgwriter_delay: "200ms"
|
|
## commit_delay: "100"
|
|
## commit_siblings: "5"
|
|
## work_mem: "256MB"
|
|
##
|
|
## SECURITY: The following parameters are BLOCKED (enable arbitrary code execution):
|
|
## archive_command, restore_command, ssl_passphrase_command (shell commands),
|
|
## dynamic_library_path, local_preload_libraries, session_preload_libraries,
|
|
## shared_preload_libraries (arbitrary .so loading)
|
|
##
|
|
## IMPORTANT: Do NOT override CloudNativePG-managed parameters:
|
|
## archive_mode, primary_conninfo, wal_level, max_replication_slots
|
|
##
|
|
## NOTE: Some parameters require pod restart (not just reload):
|
|
## shared_buffers, max_connections, max_prepared_transactions,
|
|
## wal_buffers, max_wal_senders
|
|
|
|
##
|
|
## @section Quorum-based synchronous replication
|
|
##
|
|
|
|
## @typedef {struct} Quorum - Quorum configuration for synchronous replication.
|
|
## @field {int} minSyncReplicas - Minimum number of synchronous replicas required for commit.
|
|
## @field {int} maxSyncReplicas - Maximum number of synchronous replicas allowed (must be less than total replicas).
|
|
|
|
## @param {Quorum} quorum - Quorum configuration for synchronous replication.
|
|
quorum:
|
|
minSyncReplicas: 0
|
|
maxSyncReplicas: 0
|
|
|
|
##
|
|
## @section Users configuration
|
|
##
|
|
|
|
## @typedef {struct} User - User configuration.
|
|
## @field {string} [password] - Password for the user.
|
|
## @field {bool} [replication] - Whether the user has replication privileges.
|
|
|
|
## @param {map[string]User} users - Users configuration map.
|
|
users: {}
|
|
## Example:
|
|
## users:
|
|
## user1:
|
|
## password: strongpassword
|
|
## user2:
|
|
## password: hackme
|
|
## airflow:
|
|
## password: qwerty123
|
|
## debezium:
|
|
## replication: true
|
|
|
|
##
|
|
## @section Databases configuration
|
|
##
|
|
|
|
## @typedef {struct} DatabaseRoles - Role assignments for a database.
|
|
## @field {[]string} [admin] - List of users with admin privileges.
|
|
## @field {[]string} [readonly] - List of users with read-only privileges.
|
|
|
|
## @typedef {struct} Database - Database configuration.
|
|
## @field {DatabaseRoles} [roles] - Roles assigned to users.
|
|
## @field {[]string} [extensions] - List of enabled PostgreSQL extensions.
|
|
|
|
## @param {map[string]Database} databases - Databases configuration map.
|
|
databases: {}
|
|
## Example:
|
|
## databases:
|
|
## myapp:
|
|
## roles:
|
|
## admin:
|
|
## - user1
|
|
## - debezium
|
|
## readonly:
|
|
## - user2
|
|
## airflow:
|
|
## roles:
|
|
## admin:
|
|
## - airflow
|
|
## extensions:
|
|
## - hstore
|
|
|
|
##
|
|
## @section Backup parameters
|
|
##
|
|
|
|
## @typedef {struct} S3CredentialsSecret - Reference to a pre-existing Secret with S3 credentials. Setting `name` makes the chart bind the cnpg.io Cluster's barmanObjectStore directly to that Secret instead of materialising `<release>-s3-creds` from `s3AccessKey`/`s3SecretKey`. Use this to keep credentials out of the Postgres CR's `.spec`.
|
|
## @field {string} [name] - Name of the Secret in the application namespace. Empty means the chart materialises `<release>-s3-creds` from `s3AccessKey`/`s3SecretKey`.
|
|
## @field {string} [accessKeyIDKey] - Key in the Secret holding the access key ID. Defaults to `AWS_ACCESS_KEY_ID`.
|
|
## @field {string} [secretAccessKeyKey] - Key in the Secret holding the secret access key. Defaults to `AWS_SECRET_ACCESS_KEY`.
|
|
|
|
## @typedef {struct} EndpointCA - Reference to a Secret holding a PEM-encoded CA bundle the Barman client should trust when reaching a self-signed S3 endpoint. Required when the cluster's S3 (e.g. cozystack's seaweedfs-s3) presents a certificate not signed by a publicly-trusted CA. Used by both spec.backup.barmanObjectStore.endpointCA and the bootstrap-time externalClusters[].barmanObjectStore.endpointCA so backup *and* recovery can verify TLS.
|
|
## @field {string} [name] - Name of the Secret in the application namespace. Empty means no endpointCA is emitted (Barman uses the system trust store).
|
|
## @field {string} [key] - Key within the Secret containing the CA bundle. Defaults to `ca.crt`.
|
|
|
|
## @typedef {struct} Backup - Backup configuration.
|
|
## @field {bool} enabled - Enable regular backups.
|
|
## @field {string} [schedule] - Legacy. Cron schedule (CNPG 6-field format) for the chart-emitted ScheduledBackup. Empty means no chart-managed schedule, which is the recommended setup when a `BackupClass` from `backups.cozystack.io` already drives backup orchestration. The chart still emits `spec.backup.barmanObjectStore` whenever `backup.enabled=true`, so `archive_command` runs and the BackupClass driver can take ad-hoc / Plan-driven backups against a live WAL archive.
|
|
## @field {string} [retentionPolicy] - Retention policy (e.g. "30d").
|
|
## @field {string} [destinationPath] - Destination path for backups (e.g. s3://bucket/path/).
|
|
## @field {string} [endpointURL] - S3 endpoint URL for uploads.
|
|
## @field {string} [s3AccessKey] - Access key for S3 authentication. Ignored when `s3CredentialsSecret.name` is set.
|
|
## @field {string} [s3SecretKey] - Secret key for S3 authentication. Ignored when `s3CredentialsSecret.name` is set.
|
|
## @field {S3CredentialsSecret} [s3CredentialsSecret] - Pre-existing Secret with S3 credentials. When set, the chart references this Secret directly instead of materialising one from `s3AccessKey`/`s3SecretKey`. The CNPG backup driver writes this field on restore so credentials never land in the CR `.spec`.
|
|
## @field {EndpointCA} [endpointCA] - Pre-existing Secret with the CA bundle Barman should trust when reaching a self-signed S3 endpoint. Used for both backup and bootstrap recovery. The CNPG backup driver writes this field on restore.
|
|
|
|
## @param {Backup} backup - Backup configuration.
|
|
backup:
|
|
enabled: false
|
|
retentionPolicy: 30d
|
|
destinationPath: "s3://bucket/path/to/folder/"
|
|
endpointURL: "http://minio-gateway-service:9000"
|
|
schedule: ""
|
|
s3AccessKey: "<your-access-key>"
|
|
s3SecretKey: "<your-secret-key>"
|
|
s3CredentialsSecret:
|
|
name: ""
|
|
accessKeyIDKey: ""
|
|
secretAccessKeyKey: ""
|
|
endpointCA:
|
|
name: ""
|
|
key: ""
|
|
|
|
##
|
|
## @section Bootstrap (recovery) parameters
|
|
##
|
|
|
|
## @typedef {struct} Bootstrap - Bootstrap configuration for restoring a database cluster from a backup.
|
|
## @field {bool} enabled - Whether to restore from a backup.
|
|
## @field {string} [recoveryTime] - Timestamp (RFC3339) for point-in-time recovery; empty means latest.
|
|
## @field {string} oldName - Previous cluster name before deletion.
|
|
## @field {string} [serverName] - Barman server name (S3 path prefix) used by the original cluster when writing backups. Set this only when the original cluster had an explicit barmanObjectStore.serverName that differed from its Kubernetes resource name.
|
|
|
|
## @param {Bootstrap} bootstrap - Bootstrap configuration.
|
|
bootstrap:
|
|
enabled: false
|
|
# example: 2020-11-26 15:22:00.00000+00
|
|
recoveryTime: ""
|
|
oldName: ""
|
|
serverName: ""
|