Support Postgres 14 for Postgres Operator 5.5 #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

IanKWatts wants to merge 8 commits into main from testing-klab2

charts/crunchy-postgres/README.md

-Original file line number
+Diff line change
@@ Expand Up @@
     | ------------------ | ---------------------- | ------------------ |
     | `fullnameOverride` | Override release name  | `crunchy-postgres` |
     | `crunchyImage`     | Crunchy Postgres image |                    |
-    | `postgresVersion`  | Postgres version       | `14`               |
+    | `postgresVersion`  | Postgres version       | `15`               |
+    | `isNSX`            | Cluster networking     | `false`            |
     ---
@@ Expand Down @@

charts/crunchy-postgres/templates/_helpers.tpl

-Original file line number
+Diff line change
@@ Expand Up / @@ -40,6 +40,9 @@ helm.sh/chart: {{ include "crunchy-postgres.chart" . }} @@
     app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
     {{- end }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if .Values.isNSX }}
+    DataClass: Medium
+    {{- end }}
     {{- end }}
     {{/*
@@ Expand Down @@

charts/crunchy-postgres/values.yaml

-Original file line number
+Diff line change
@@ Expand Up / @@ -3,6 +3,10 @@ fullnameOverride: crunchy-postgres @@
     crunchyImage: # it's not necessary to specify an image as the images specified in the Crunchy Postgres Operator will be pulled by default
     #crunchyImage: artifacts.developer.gov.bc.ca/bcgov-docker-local/crunchy-postgres-gis:ubi8-15.2-3.3-0 # use this image for POSTGIS
     postgresVersion: 15
+    #
+    # Set isNSX to true when deploying to an NSX cluster (Emerald, KLAB2)
+    isNSX: false
+    #
     #postGISVersion: '3.3' # use this version of POSTGIS. both crunchyImage and this property needs to have valid values for POSTGIS to be enabled.
     imagePullPolicy: IfNotPresent
@@ Expand Down @@

charts/tools/README.md

-Original file line number
+Diff line change
@@ Expand Up @@
     ---
+    #### Additional network configuration for NSX clusters
+    Set to 'true' to enable network configuration required in the NSX clusters (Emerald, KLAB2)
+    | Parameter           | Description                                  | Default |
+    | ------------------- | -------------------------------------------- | ------- |
+    | `networking.isNSX`  | Enable operator ingress and DataClass labels | `false` |
+    ---
     #### Route
     OpenShift route whitch allows you to host your application at a public URL.
@@ Expand Down @@

charts/tools/templates/networking/networkPolicy.yaml

-Original file line number
+Diff line change
@@ Expand Up / @@ -11,6 +11,7 @@ spec: @@
       # to accept traffic from the OpenShift router pods. This is
       # required for things outside of OpenShift (like the Internet)
       # to reach your pods.
+    {{- if not .Values.networking.isNSX }}
       ingress:
         - from:
             - namespaceSelector:
@@ Expand All / @@ -19,5 +20,20 @@ spec: @@
       podSelector: {}
       policyTypes:
         - Ingress
+    {{- else }}
+      ingress:
+        - from:
+            - namespaceSelector:
+                matchLabels:
+                  network.openshift.io/policy-group: ingress
+      egress:
+        - to:
+            - namespaceSelector:
+                matchLabels:
+                  network.openshift.io/policy-group: ingress
+      podSelector: {}
+      policyTypes:
+        - Ingress
+        - Egress
+    {{- end -}}
     {{- end }}

charts/tools/templates/networking/operatorPolicy.yaml

-Original file line number
+Diff line change
@@ -0,0 +1,33 @@
+    {{- if and .Values.networking.networkPolicy.enabled .Values.networking.isNSX (ne .Release.Namespace .Values.provisioner.namespace) }}
+    kind: NetworkPolicy
+    apiVersion: networking.k8s.io/v1
+    metadata:
+      name: {{ or .Values.deploymentName .Release.Name }}-operator
+      labels:
+    {{ include "crunchy-postgres-tools.labels" . | indent 4}}
+    spec:
+      # This policy allows the operator to reach the Crunchy pods
+      egress:
+        - ports:
+            - port: 8432
+              protocol: TCP
+          to:
+            - namespaceSelector:
+                matchLabels:
+                  kubernetes.io/metadata.name: openshift-bcgov-crunchy
+      ingress:
+        - from:
+            - namespaceSelector:
+                matchLabels:
+                  kubernetes.io/metadata.name: openshift-bcgov-crunchy
+          ports:
+            - port: 8432
+              protocol: TCP
+      podSelector:
+        matchLabels:
+          app.kubernetes.io/name: crunchy-postgres
+      policyTypes:
+        - Egress
+        - Ingress
+    {{- end }}

charts/tools/templates/networking/podNetworkPolicy.yaml

-Original file line number
+Diff line change
@@ Expand Up / @@ -7,10 +7,24 @@ metadata: @@
       labels:
     {{ include "crunchy-postgres-tools.labels" . | indent 4}}
     spec:
+    {{- if not .Values.networking.isNSX }}
       # This policy allows pods to accept traffic from other pods in this namespace
       ingress:
         - from:
             - podSelector: {}
       podSelector: {}
+    {{- else }}
+      # This policy allows pods to accept traffic from other pods in this namespace
+      egress:
+      - to:
+        - podSelector: {}
+      ingress:
+      - from:
+        - podSelector: {}
+      podSelector: {}
+      policyTypes:
+        - Ingress
+        - Egress
+    {{- end -}}
     {{ end }}

charts/tools/values.yaml

-Original file line number
+Diff line change
@@ Expand Up / @@ -8,7 +8,7 @@ deployer: @@
     # Enable the provisioner service account which is used to deploy services to our other namespaces (dev/test/prod)
     # The tools namespace needs to be passed in so we know which namespace to install the service account in and the rolebindings get proper permissions
     provisioner:
-      namespace: #tools-namespace
+      namespace: #
       serviceAccount:
         enabled: true
@@ Expand All / @@ -18,6 +18,10 @@ linter: @@
         enabled: true
     networking:
+      #
+      # Set isNSX to true if deploying to KLAB2 or Emerald, otherwise leave false
+      isNSX: false
+      #
       # Network policy to allow traffic from outside the namespace (like the internet)
       networkPolicy:
         enabled: true
@@ Expand Down @@

Provide feedback