Configuration Reference
PGO Installer Configuration
When installing PGO, the Postgres Operator you have many configuration options, these options are listed in this section.
General Configuration
These variables affect the general configuration of the PostgreSQL Operator.
Name | Default | Required | Description |
---|---|---|---|
archive_mode |
true | Required | Set to true enable archive logging on all newly created clusters. |
archive_timeout |
60 | Required | Set to a value in seconds to configure the timeout threshold for archiving. |
backrest_aws_s3_bucket |
Set to configure the bucket used by pgBackRest with Amazon Web Service S3 for backups and restoration in S3. | ||
backrest_aws_s3_endpoint |
Set to configure the endpoint used by pgBackRest with Amazon Web Service S3 for backups and restoration in S3. | ||
backrest_aws_s3_key |
Set to configure the key used by pgBackRest with Amazon Web Service S3 for backups and restoration in S3. | ||
backrest_aws_s3_region |
Set to configure the region used by pgBackRest with Amazon Web Service S3 for backups and restoration in S3. | ||
backrest_aws_s3_secret |
Set to configure the secret used by pgBackRest with Amazon Web Service S3 for backups and restoration in S3. | ||
backrest_aws_s3_uri_style |
Set to configure whether “host” or “path” style URIs will be used when connecting to S3. | ||
backrest_aws_s3_verify_tls |
Set this value to true to enable TLS verification when making a pgBackRest connection to S3. | ||
backrest_gcs_bucket |
Set to configure the bucket used by pgBackRest with Google Cloud Storage (GCS) for backups and restoration. | ||
backrest_gcs_endpoint |
Set to configure the endpoint used by pgBackRest with Google Cloud Storage (GCS) for backups and restoration. | ||
backrest_gcs_key_type |
Set to configure the key type used by pgBackRest with Google Cloud Storage (GCS) for backups and restoration. Can be service or token . Defaults to service . |
||
backrest_port |
2022 | Required | Defines the port where pgBackRest will run. |
badger |
false | Required | Set to true enable pgBadger capabilities on all newly created clusters. This can be disabled by the client. |
ccp_image_prefix |
registry.developers.crunchydata.com/crunchydata | Required | Configures the image prefix used when creating containers from Crunchy Container Suite. |
ccp_image_pull_secret |
Name of a Secret containing credentials for container image registries. | ||
ccp_image_pull_secret_manifest |
Provide a path to the Secret manifest to be installed in each namespace. (optional) | ||
ccp_image_tag |
ubi8-13.18-4.7.17 | Required | Configures the image tag (version) used when creating containers from Crunchy Container Suite. |
create_rbac |
true | Required | Set to true if the installer should create the RBAC resources required to run the PostgreSQL Operator. |
crunchy_debug |
false | Set to configure Operator to use debugging mode. Note: this can cause sensitive data such as passwords to appear in Operator logs. | |
db_name |
Set to a value to configure the default database name on all newly created clusters. By default, the PostgreSQL Operator will set it to the name of the cluster that is being created. | ||
db_password_age_days |
0 | Set to a value in days to configure the expiration age on PostgreSQL role passwords on all newly created clusters. If set to “0”, this is the same as saying the password never expires | |
db_password_length |
24 | Set to configure the size of passwords generated by the operator on all newly created roles. | |
db_port |
5432 | Required | Set to configure the default port used on all newly created clusters. |
db_replicas |
0 | Required | Set to configure the amount of replicas provisioned on all newly created clusters. |
db_user |
testuser | Required | Set to configure the username of the dedicated user account on all newly created clusters. |
default_instance_memory |
128Mi | Represents the memory request for a PostgreSQL instance. | |
default_pgbackrest_memory |
48Mi | Represents the memory request for a pgBackRest repository. | |
default_pgbouncer_memory |
24Mi | Represents the memory request for a pgBouncer instance. | |
delete_operator_namespace |
false | Set to configure whether or not the PGO operator namespace (defined using variable pgo_operator_namespace ) is deleted when uninstalling the PGO. |
|
delete_watched_namespaces |
false | Set to configure whether or not the PGO watched namespaces (defined using variable namespace ) are deleted when uninstalling the PGO. |
|
disable_auto_failover |
false | If set, will disable autofail capabilities by default in any newly created cluster | |
disable_fsgroup |
Set to true for deployments where you do not want to have the default PostgreSQL fsGroup (26) set. The typical usage is in OpenShift environments that have a restricted Security Context Constraints. If you use the anyuid SCC, you would want to set this to false . The Postgres Operator will set this value appropriately by default, except for when using the anyuid SCC. |
||
exporterport |
9187 | Required | Set to configure the default port used to connect to postgres exporter. |
metrics |
false | Required | Set to true enable performance metrics on all newly created clusters. This can be disabled by the client. |
namespace |
pgo | Set to a comma delimited string of all the namespaces Operator will manage. | |
namespace_mode |
dynamic | Determines which namespace permissions are assigned to the PostgreSQL Operator using a ClusterRole. Options: dynamic , readonly , and disabled |
|
pgbadgerport |
10000 | Required | Set to configure the default port used to connect to pgbadger. |
pgo_add_os_ca_store |
false | Required | When true, includes system default certificate authorities. |
pgo_admin_password |
examplepassword | Configures the pgo administrator password. When blank, a random password is generated. | |
pgo_admin_perms |
* | Required | Sets the access control rules provided by the PostgreSQL Operator RBAC resources for the PostgreSQL Operator administrative account that is created by this installer. Defaults to allowing all of the permissions, which is represented with the * |
pgo_admin_role_name |
pgoadmin | Required | Sets the name of the PostgreSQL Operator role that is utilized for administrative operations performed by the PostgreSQL Operator. |
pgo_admin_username |
admin | Required | Configures the pgo administrator username. |
pgo_apiserver_port |
8443 | Set to configure the port used by the Crunchy PostgreSQL Operator apiserver. | |
pgo_apiserver_url |
https://postgres-operator | Sets the pgo_apiserver_url for the pgo-client deployment. Note that the URL should not end in a / . |
|
pgo_client_cert_secret |
pgo.tls | Sets the secret that the pgo-client will use when connecting to the PostgreSQL Operator. |
|
pgo_client_container_install |
false | Run the pgo-client deployment with the PostgreSQL Operator. |
|
pgo_client_install |
true | Enable to download the pgo client binary as part of the Ansible install |
|
pgo_client_version |
4.7.17 | Required | |
pgo_cluster_admin |
false | Required | Determines whether or not the cluster-admin role is assigned to the PGO service account. Must be true to enable PGO namespace & role creation when installing in OpenShift. |
pgo_disable_eventing |
false | Set to configure whether or not eventing should be enabled for the Crunchy PostgreSQL Operator installation. | |
pgo_disable_tls |
false | Set to configure whether or not TLS should be enabled for the Crunchy PostgreSQL Operator apiserver. | |
pgo_image_prefix |
registry.developers.crunchydata.com/crunchydata | Required | Configures the image prefix used when creating containers for the Crunchy PostgreSQL Operator (apiserver, operator, scheduler..etc). |
pgo_image_pull_secret |
Name of a Secret containing credentials for container image registries. | ||
pgo_image_pull_secret_manifest |
Provide a path to the Secret manifest to be installed in each namespace. (optional) | ||
pgo_image_tag |
ubi8-4.7.17 | Required | Configures the image tag used when creating containers for the Crunchy PostgreSQL Operator (apiserver, operator, scheduler..etc) |
pgo_installation_name |
devtest | Required | The name of the PGO installation. |
pgo_noauth_routes |
Configures URL routes with mTLS and HTTP BasicAuth disabled. | ||
pgo_operator_namespace |
pgo | Required | Set to configure the namespace where Operator will be deployed. |
pgo_tls_ca_store |
Set to add additional Certificate Authorities for Operator to trust (PEM-encoded file). | ||
pgo_tls_no_verify |
false | Set to configure Operator to verify TLS certificates. | |
reconcile_rbac |
true | Determines whether or not the PostgreSQL Operator will granted the permissions needed to reconcile RBAC within targeted namespaces. | |
scheduler_timeout |
3600 | Required | Set to a value in seconds to configure the pgo-scheduler timeout threshold when waiting for schedules to complete. |
service_type |
ClusterIP | Set to configure the type of Kubernetes service provisioned on all newly created clusters. | |
sync_replication |
false | If set to true will automatically enable synchronous replication in new PostgreSQL clusters. |
Storage Settings
The store configuration options defined in this section can be used to specify the storage configurations that are used by the PostgreSQL Operator.
Storage Configuration Options
Kubernetes and OpenShift offer support for a wide variety of different storage types and we provide suggested configurations for different environments. These storage types can be modified or removed as needed, while additional storage configurations can also be added to meet the specific storage requirements for your PostgreSQL clusters.
The following storage variables are utilized to add or modify operator storage configurations in the with the installer:
Name | Required | Description |
---|---|---|
storage<ID>_name |
Yes | Set to specify a name for the storage configuration. |
storage<ID>_access_mode |
Yes | Set to configure the access mode of the volumes created when using this storage definition. |
storage<ID>_size |
Yes | Set to configure the size of the volumes created when using this storage definition. |
storage<ID>_class |
Required when using the dynamic storage type |
Set to configure the storage class name used when creating dynamic volumes. |
storage<ID>_supplemental_groups |
Required when using NFS storage | Set to configure any supplemental groups that should be added to security contexts on newly created clusters. |
storage<ID>_type |
Yes | Set to either create or dynamic to configure the operator to create persistent volumes or have them created dynamically by a storage class. |
The ID portion of storage prefix for each variable name above should be an integer that is used to group the various storage variables into a single storage configuration.
Example Storage Configuration
storage3_name: 'nfsstorage'
storage3_access_mode: 'ReadWriteMany'
storage3_size: '1G'
storage3_type: 'create'
storage3_supplemental_groups: 65534
As this example storage configuration shows, integer 3
is used as the ID for
each of the storage
variables, which together form a single storage
configuration called nfsstorage
. This approach allows different storage
configurations to be created by defining the proper storage
variables with a
unique ID for each required storage configuration.
PostgreSQL Cluster Storage Defaults
You can specify the default storage to use for PostgreSQL, pgBackRest, and other
elements that require storage that can outlast the lifetime of a Pod. While the
PostgreSQL Operator defaults to using default
to work with the default storage
class available in your environment.
Name | Default | Required | Description |
---|---|---|---|
backrest_storage |
default | Required | Set the value of the storage configuration to use for the pgBackRest repository. |
backup_storage |
default | Required | required, the value of the storage configuration to use for backups generated by pg_dump . |
primary_storage |
default | Required | Set to configure which storage definition to use when creating volumes used by PostgreSQL primaries on all newly created clusters. |
replica_storage |
default | Required | Set to configure which storage definition to use when creating volumes used by PostgreSQL replicas on all newly created clusters. |
wal_storage |
Set to configure which storage definition to use when creating volumes used for PostgreSQL Write-Ahead Log. |
Example Defaults
backrest_storage: default
backup_storage: default
primary_storage: default
replica_storage: default
With the configuration shown above, the default storage class available in the deployment environment is used.
Considerations for Multi-Zone Cloud Environments
When using the Operator in a Kubernetes cluster consisting of nodes that span multiple zones, special consideration must be taken to ensure all pods and the volumes they require are scheduled and provisioned within the same zone. Specifically, being that a pod is unable mount a volume that is located in another zone, any volumes that are dynamically provisioned must be provisioned in a topology-aware manner according to the specific scheduling requirements for the pod. For instance, this means ensuring that the volume containing the database files for the primary database in a new PostgreSQL cluster is provisioned in the same zone as the node containing the PostgreSQL primary pod that will be using it.
Default Storage Configuration Types
Default StorageClass
Name | Value |
---|---|
storage1_name | default |
storage1_access_mode | ReadWriteOnce |
storage1_size | 1G |
storage1_type | dynamic |
Host Path Storage
Name | Value |
---|---|
storage2_name | hostpathstorage |
storage2_access_mode | ReadWriteMany |
storage2_size | 1G |
storage2_type | create |
NFS Storage
Name | Value |
---|---|
storage3_name | nfsstorage |
storage3_access_mode | ReadWriteMany |
storage3_size | 1G |
storage3_type | create |
storage3_supplemental_groups | 65534 |
NFS Storage Red
Name | Value |
---|---|
storage4_name | nfsstoragered |
storage4_access_mode | ReadWriteMany |
storage4_size | 1G |
storage4_match_labels | crunchyzone=red |
storage4_type | create |
storage4_supplemental_groups | 65534 |
StorageOS
Name | Value |
---|---|
storage5_name | storageos |
storage5_access_mode | ReadWriteOnce |
storage5_size | 5Gi |
storage5_type | dynamic |
storage5_class | fast |
Primary Site
Name | Value |
---|---|
storage6_name | primarysite |
storage6_access_mode | ReadWriteOnce |
storage6_size | 4G |
storage6_type | dynamic |
storage6_class | primarysite |
Alternate Site
Name | Value |
---|---|
storage7_name | alternatesite |
storage7_access_mode | ReadWriteOnce |
storage7_size | 4G |
storage7_type | dynamic |
storage7_class | alternatesite |
GCE
Name | Value |
---|---|
storage8_name | gce |
storage8_access_mode | ReadWriteOnce |
storage8_size | 300M |
storage8_type | dynamic |
storage8_class | standard |
Rook
Name | Value |
---|---|
storage9_name | rook |
storage9_access_mode | ReadWriteOnce |
storage9_size | 1Gi |
storage9_type | dynamic |
storage9_class | rook-ceph-block |
Pod Anti-affinity Settings
This will set the default pod anti-affinity for the deployed PostgreSQL clusters. Pod Anti-Affinity is set to determine where the PostgreSQL Pods are deployed relative to each other There are three levels:
- required: Pods must be scheduled to different Nodes. If a Pod cannot be scheduled to a different Node from the other Pods in the anti-affinity group, then it will not be scheduled.
- preferred (default): Pods should be scheduled to different Nodes. There is a chance that two Pods in the same anti-affinity group could be scheduled to the same node
- disabled: Pods do not have any anti-affinity rules
The POD_ANTI_AFFINITY
label sets the Pod anti-affinity for all of the Pods
that are managed by the Operator in a PostgreSQL cluster. In addition to the
PostgreSQL Pods, this also includes the pgBackRest repository and any
pgBouncer pods. By default, the pgBackRest and pgBouncer pods inherit the
value of POD_ANTI_AFFINITY
, but one can override the default by setting
the POD_ANTI_AFFINITY_PGBACKREST
and POD_ANTI_AFFINITY_PGBOUNCER
variables
for pgBackRest and pgBouncer respectively
Name | Default | Required | Description |
---|---|---|---|
pod_anti_affinity |
preferred | This will set the default pod anti-affinity for the deployed PostgreSQL clusters. | |
pod_anti_affinity_pgbackrest |
This will set the default pod anti-affinity for the pgBackRest pods. | ||
pod_anti_affinity_pgbouncer |
This will set the default pod anti-affinity for the pgBouncer pods. |
Understanding pgo_operator_namespace
& namespace
The Crunchy PostgreSQL Operator can be configured to be deployed and manage a single namespace or manage several namespaces. The following are examples of different types of deployment models:
Single Namespace
To deploy the Crunchy PostgreSQL Operator to work with a single namespace (in this example
our namespace is named pgo
), configure the following settings:
pgo_operator_namespace: 'pgo'
namespace: 'pgo'
Multiple Namespaces
To deploy the Crunchy PostgreSQL Operator to work with multiple namespaces (in this example
our namespaces are named pgo
, pgouser1
and pgouser2
), configure the following settings:
pgo_operator_namespace: 'pgo'
namespace: 'pgouser1,pgouser2'
Deploying Multiple Operators
The 4.0 release of the Crunchy PostgreSQL Operator allows for multiple operator deployments in the same cluster.
To install the Crunchy PostgreSQL Operator to multiple namespaces, it’s recommended to have an configuration file
for each deployment of the operator.
For each operator deployment the following variables should be configured uniquely for each install.
For example, operator could be deployed twice by changing the pgo_operator_namespace
and namespace
for those
deployments:
Install A would deploy operator to the pgo
namespace and it would manage the pgo
target namespace.
# Config A
pgo_operator_namespace: 'pgo'
namespace: 'pgo'
...
Install B would deploy operator to the pgo2
namespace and it would manage the pgo2
and pgo3
target namespaces.
# Config B
pgo_operator_namespace: 'pgo2'
namespace: 'pgo2,pgo3'
...
Each install of the operator will create a corresponding directory in $HOME/.pgo/<PGO NAMESPACE>
which will contain
the TLS and pgouser
client credentials.