cnpg-cluster-barmancloud-ext.yaml (40666B)
1 apiVersion: apiextensions.k8s.io/v1 2 kind: CustomResourceDefinition 3 metadata: 4 annotations: 5 controller-gen.kubebuilder.io/version: v0.18.0 6 name: objectstores.barmancloud.cnpg.io 7 spec: 8 group: barmancloud.cnpg.io 9 names: 10 kind: ObjectStore 11 listKind: ObjectStoreList 12 plural: objectstores 13 singular: objectstore 14 scope: Namespaced 15 versions: 16 - name: v1 17 schema: 18 openAPIV3Schema: 19 description: ObjectStore is the Schema for the objectstores API. 20 properties: 21 apiVersion: 22 description: |- 23 APIVersion defines the versioned schema of this representation of an object. 24 Servers should convert recognized schemas to the latest internal value, and 25 may reject unrecognized values. 26 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources 27 type: string 28 kind: 29 description: |- 30 Kind is a string value representing the REST resource this object represents. 31 Servers may infer this from the endpoint the client submits requests to. 32 Cannot be updated. 33 In CamelCase. 34 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds 35 type: string 36 metadata: 37 type: object 38 spec: 39 description: |- 40 Specification of the desired behavior of the ObjectStore. 41 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status 42 properties: 43 configuration: 44 description: The configuration for the barman-cloud tool suite 45 properties: 46 azureCredentials: 47 description: The credentials to use to upload data to Azure Blob Storage 48 properties: 49 connectionString: 50 description: The connection string to be used 51 properties: 52 key: 53 description: The key to select 54 type: string 55 name: 56 description: Name of the referent. 57 type: string 58 required: 59 - key 60 - name 61 type: object 62 inheritFromAzureAD: 63 description: Use the Azure AD based authentication without providing explicitly the keys. 64 type: boolean 65 storageAccount: 66 description: The storage account where to upload data 67 properties: 68 key: 69 description: The key to select 70 type: string 71 name: 72 description: Name of the referent. 73 type: string 74 required: 75 - key 76 - name 77 type: object 78 storageKey: 79 description: |- 80 The storage account key to be used in conjunction 81 with the storage account name 82 properties: 83 key: 84 description: The key to select 85 type: string 86 name: 87 description: Name of the referent. 88 type: string 89 required: 90 - key 91 - name 92 type: object 93 storageSasToken: 94 description: |- 95 A shared-access-signature to be used in conjunction with 96 the storage account name 97 properties: 98 key: 99 description: The key to select 100 type: string 101 name: 102 description: Name of the referent. 103 type: string 104 required: 105 - key 106 - name 107 type: object 108 type: object 109 data: 110 description: |- 111 The configuration to be used to backup the data files 112 When not defined, base backups files will be stored uncompressed and may 113 be unencrypted in the object store, according to the bucket default 114 policy. 115 properties: 116 additionalCommandArgs: 117 description: |- 118 AdditionalCommandArgs represents additional arguments that can be appended 119 to the 'barman-cloud-backup' command-line invocation. These arguments 120 provide flexibility to customize the backup process further according to 121 specific requirements or configurations. 122 123 Example: 124 In a scenario where specialized backup options are required, such as setting 125 a specific timeout or defining custom behavior, users can use this field 126 to specify additional command arguments. 127 128 Note: 129 It's essential to ensure that the provided arguments are valid and supported 130 by the 'barman-cloud-backup' command, to avoid potential errors or unintended 131 behavior during execution. 132 items: 133 type: string 134 type: array 135 compression: 136 description: |- 137 Compress a backup file (a tar file per tablespace) while streaming it 138 to the object store. Available options are empty string (no 139 compression, default), `gzip`, `bzip2`, and `snappy`. 140 enum: 141 - bzip2 142 - gzip 143 - snappy 144 type: string 145 encryption: 146 description: |- 147 Whenever to force the encryption of files (if the bucket is 148 not already configured for that). 149 Allowed options are empty string (use the bucket policy, default), 150 `AES256` and `aws:kms` 151 enum: 152 - AES256 153 - aws:kms 154 type: string 155 immediateCheckpoint: 156 description: |- 157 Control whether the I/O workload for the backup initial checkpoint will 158 be limited, according to the `checkpoint_completion_target` setting on 159 the PostgreSQL server. If set to true, an immediate checkpoint will be 160 used, meaning PostgreSQL will complete the checkpoint as soon as 161 possible. `false` by default. 162 type: boolean 163 jobs: 164 description: |- 165 The number of parallel jobs to be used to upload the backup, defaults 166 to 2 167 format: int32 168 minimum: 1 169 type: integer 170 type: object 171 destinationPath: 172 description: |- 173 The path where to store the backup (i.e. s3://bucket/path/to/folder) 174 this path, with different destination folders, will be used for WALs 175 and for data 176 minLength: 1 177 type: string 178 endpointCA: 179 description: |- 180 EndpointCA store the CA bundle of the barman endpoint. 181 Useful when using self-signed certificates to avoid 182 errors with certificate issuer and barman-cloud-wal-archive 183 properties: 184 key: 185 description: The key to select 186 type: string 187 name: 188 description: Name of the referent. 189 type: string 190 required: 191 - key 192 - name 193 type: object 194 endpointURL: 195 description: |- 196 Endpoint to be used to upload data to the cloud, 197 overriding the automatic endpoint discovery 198 type: string 199 googleCredentials: 200 description: The credentials to use to upload data to Google Cloud Storage 201 properties: 202 applicationCredentials: 203 description: The secret containing the Google Cloud Storage JSON file with the credentials 204 properties: 205 key: 206 description: The key to select 207 type: string 208 name: 209 description: Name of the referent. 210 type: string 211 required: 212 - key 213 - name 214 type: object 215 gkeEnvironment: 216 description: |- 217 If set to true, will presume that it's running inside a GKE environment, 218 default to false. 219 type: boolean 220 type: object 221 historyTags: 222 additionalProperties: 223 type: string 224 description: |- 225 HistoryTags is a list of key value pairs that will be passed to the 226 Barman --history-tags option. 227 type: object 228 s3Credentials: 229 description: The credentials to use to upload data to S3 230 properties: 231 accessKeyId: 232 description: The reference to the access key id 233 properties: 234 key: 235 description: The key to select 236 type: string 237 name: 238 description: Name of the referent. 239 type: string 240 required: 241 - key 242 - name 243 type: object 244 inheritFromIAMRole: 245 description: Use the role based authentication without providing explicitly the keys. 246 type: boolean 247 region: 248 description: The reference to the secret containing the region name 249 properties: 250 key: 251 description: The key to select 252 type: string 253 name: 254 description: Name of the referent. 255 type: string 256 required: 257 - key 258 - name 259 type: object 260 secretAccessKey: 261 description: The reference to the secret access key 262 properties: 263 key: 264 description: The key to select 265 type: string 266 name: 267 description: Name of the referent. 268 type: string 269 required: 270 - key 271 - name 272 type: object 273 sessionToken: 274 description: The references to the session key 275 properties: 276 key: 277 description: The key to select 278 type: string 279 name: 280 description: Name of the referent. 281 type: string 282 required: 283 - key 284 - name 285 type: object 286 type: object 287 serverName: 288 description: |- 289 The server name on S3, the cluster name is used if this 290 parameter is omitted 291 type: string 292 tags: 293 additionalProperties: 294 type: string 295 description: |- 296 Tags is a list of key value pairs that will be passed to the 297 Barman --tags option. 298 type: object 299 wal: 300 description: |- 301 The configuration for the backup of the WAL stream. 302 When not defined, WAL files will be stored uncompressed and may be 303 unencrypted in the object store, according to the bucket default policy. 304 properties: 305 archiveAdditionalCommandArgs: 306 description: |- 307 Additional arguments that can be appended to the 'barman-cloud-wal-archive' 308 command-line invocation. These arguments provide flexibility to customize 309 the WAL archive process further, according to specific requirements or configurations. 310 311 Example: 312 In a scenario where specialized backup options are required, such as setting 313 a specific timeout or defining custom behavior, users can use this field 314 to specify additional command arguments. 315 316 Note: 317 It's essential to ensure that the provided arguments are valid and supported 318 by the 'barman-cloud-wal-archive' command, to avoid potential errors or unintended 319 behavior during execution. 320 items: 321 type: string 322 type: array 323 compression: 324 description: |- 325 Compress a WAL file before sending it to the object store. Available 326 options are empty string (no compression, default), `gzip`, `bzip2`, 327 `lz4`, `snappy`, `xz`, and `zstd`. 328 enum: 329 - bzip2 330 - gzip 331 - lz4 332 - snappy 333 - xz 334 - zstd 335 type: string 336 encryption: 337 description: |- 338 Whenever to force the encryption of files (if the bucket is 339 not already configured for that). 340 Allowed options are empty string (use the bucket policy, default), 341 `AES256` and `aws:kms` 342 enum: 343 - AES256 344 - aws:kms 345 type: string 346 maxParallel: 347 description: |- 348 Number of WAL files to be either archived in parallel (when the 349 PostgreSQL instance is archiving to a backup object store) or 350 restored in parallel (when a PostgreSQL standby is fetching WAL 351 files from a recovery object store). If not specified, WAL files 352 will be processed one at a time. It accepts a positive integer as a 353 value - with 1 being the minimum accepted value. 354 minimum: 1 355 type: integer 356 restoreAdditionalCommandArgs: 357 description: |- 358 Additional arguments that can be appended to the 'barman-cloud-wal-restore' 359 command-line invocation. These arguments provide flexibility to customize 360 the WAL restore process further, according to specific requirements or configurations. 361 362 Example: 363 In a scenario where specialized backup options are required, such as setting 364 a specific timeout or defining custom behavior, users can use this field 365 to specify additional command arguments. 366 367 Note: 368 It's essential to ensure that the provided arguments are valid and supported 369 by the 'barman-cloud-wal-restore' command, to avoid potential errors or unintended 370 behavior during execution. 371 items: 372 type: string 373 type: array 374 type: object 375 required: 376 - destinationPath 377 type: object 378 x-kubernetes-validations: 379 - fieldPath: .serverName 380 message: use the 'serverName' plugin parameter in the Cluster resource 381 reason: FieldValueForbidden 382 rule: "!has(self.serverName)" 383 instanceSidecarConfiguration: 384 description: The configuration for the sidecar that runs in the instance pods 385 properties: 386 env: 387 description: The environment to be explicitly passed to the sidecar 388 items: 389 description: EnvVar represents an environment variable present in a Container. 390 properties: 391 name: 392 description: Name of the environment variable. Must be a C_IDENTIFIER. 393 type: string 394 value: 395 description: |- 396 Variable references $(VAR_NAME) are expanded 397 using the previously defined environment variables in the container and 398 any service environment variables. If a variable cannot be resolved, 399 the reference in the input string will be unchanged. Double $$ are reduced 400 to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. 401 "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". 402 Escaped references will never be expanded, regardless of whether the variable 403 exists or not. 404 Defaults to "". 405 type: string 406 valueFrom: 407 description: Source for the environment variable's value. Cannot be used if value is not empty. 408 properties: 409 configMapKeyRef: 410 description: Selects a key of a ConfigMap. 411 properties: 412 key: 413 description: The key to select. 414 type: string 415 name: 416 default: "" 417 description: |- 418 Name of the referent. 419 This field is effectively required, but due to backwards compatibility is 420 allowed to be empty. Instances of this type with an empty value here are 421 almost certainly wrong. 422 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names 423 type: string 424 optional: 425 description: Specify whether the ConfigMap or its key must be defined 426 type: boolean 427 required: 428 - key 429 type: object 430 x-kubernetes-map-type: atomic 431 fieldRef: 432 description: |- 433 Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`, 434 spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. 435 properties: 436 apiVersion: 437 description: Version of the schema the FieldPath is written in terms of, defaults to "v1". 438 type: string 439 fieldPath: 440 description: Path of the field to select in the specified API version. 441 type: string 442 required: 443 - fieldPath 444 type: object 445 x-kubernetes-map-type: atomic 446 resourceFieldRef: 447 description: |- 448 Selects a resource of the container: only resources limits and requests 449 (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. 450 properties: 451 containerName: 452 description: "Container name: required for volumes, optional for env vars" 453 type: string 454 divisor: 455 anyOf: 456 - type: integer 457 - type: string 458 description: Specifies the output format of the exposed resources, defaults to "1" 459 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ 460 x-kubernetes-int-or-string: true 461 resource: 462 description: "Required: resource to select" 463 type: string 464 required: 465 - resource 466 type: object 467 x-kubernetes-map-type: atomic 468 secretKeyRef: 469 description: Selects a key of a secret in the pod's namespace 470 properties: 471 key: 472 description: The key of the secret to select from. Must be a valid secret key. 473 type: string 474 name: 475 default: "" 476 description: |- 477 Name of the referent. 478 This field is effectively required, but due to backwards compatibility is 479 allowed to be empty. Instances of this type with an empty value here are 480 almost certainly wrong. 481 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names 482 type: string 483 optional: 484 description: Specify whether the Secret or its key must be defined 485 type: boolean 486 required: 487 - key 488 type: object 489 x-kubernetes-map-type: atomic 490 type: object 491 required: 492 - name 493 type: object 494 type: array 495 resources: 496 description: Resources define cpu/memory requests and limits for the sidecar that runs in the instance pods. 497 properties: 498 claims: 499 description: |- 500 Claims lists the names of resources, defined in spec.resourceClaims, 501 that are used by this container. 502 503 This is an alpha field and requires enabling the 504 DynamicResourceAllocation feature gate. 505 506 This field is immutable. It can only be set for containers. 507 items: 508 description: ResourceClaim references one entry in PodSpec.ResourceClaims. 509 properties: 510 name: 511 description: |- 512 Name must match the name of one entry in pod.spec.resourceClaims of 513 the Pod where this field is used. It makes that resource available 514 inside a container. 515 type: string 516 request: 517 description: |- 518 Request is the name chosen for a request in the referenced claim. 519 If empty, everything from the claim is made available, otherwise 520 only the result of this request. 521 type: string 522 required: 523 - name 524 type: object 525 type: array 526 x-kubernetes-list-map-keys: 527 - name 528 x-kubernetes-list-type: map 529 limits: 530 additionalProperties: 531 anyOf: 532 - type: integer 533 - type: string 534 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ 535 x-kubernetes-int-or-string: true 536 description: |- 537 Limits describes the maximum amount of compute resources allowed. 538 More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ 539 type: object 540 requests: 541 additionalProperties: 542 anyOf: 543 - type: integer 544 - type: string 545 pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ 546 x-kubernetes-int-or-string: true 547 description: |- 548 Requests describes the minimum amount of compute resources required. 549 If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, 550 otherwise to an implementation-defined value. Requests cannot exceed Limits. 551 More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ 552 type: object 553 type: object 554 retentionPolicyIntervalSeconds: 555 default: 1800 556 description: |- 557 The retentionCheckInterval defines the frequency at which the 558 system checks and enforces retention policies. 559 type: integer 560 type: object 561 retentionPolicy: 562 description: |- 563 RetentionPolicy is the retention policy to be used for backups 564 and WALs (i.e. '60d'). The retention policy is expressed in the form 565 of `XXu` where `XX` is a positive integer and `u` is in `[dwm]` - 566 days, weeks, months. 567 pattern: ^[1-9][0-9]*[dwm]$ 568 type: string 569 required: 570 - configuration 571 type: object 572 status: 573 description: |- 574 Most recently observed status of the ObjectStore. This data may not be up to 575 date. Populated by the system. Read-only. 576 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status 577 properties: 578 serverRecoveryWindow: 579 additionalProperties: 580 description: |- 581 RecoveryWindow represents the time span between the first 582 recoverability point and the last successful backup of a PostgreSQL 583 server, defining the period during which data can be restored. 584 properties: 585 firstRecoverabilityPoint: 586 description: |- 587 The first recoverability point in a PostgreSQL server refers to 588 the earliest point in time to which the database can be 589 restored. 590 format: date-time 591 type: string 592 lastSuccussfulBackupTime: 593 description: The last successful backup time 594 format: date-time 595 type: string 596 type: object 597 description: ServerRecoveryWindow maps each server to its recovery window 598 type: object 599 type: object 600 required: 601 - metadata 602 - spec 603 type: object 604 served: true 605 storage: true 606 subresources: 607 status: {} 608 --- 609 apiVersion: v1 610 kind: ServiceAccount 611 metadata: 612 labels: 613 app.kubernetes.io/managed-by: kustomize 614 app.kubernetes.io/name: plugin-barman-cloud 615 name: plugin-barman-cloud 616 namespace: postgres-cluster 617 --- 618 apiVersion: rbac.authorization.k8s.io/v1 619 kind: Role 620 metadata: 621 labels: 622 app.kubernetes.io/managed-by: kustomize 623 app.kubernetes.io/name: plugin-barman-cloud 624 name: leader-election-role 625 namespace: postgres-cluster 626 rules: 627 - apiGroups: 628 - "" 629 resources: 630 - configmaps 631 verbs: 632 - get 633 - list 634 - watch 635 - create 636 - update 637 - patch 638 - delete 639 - apiGroups: 640 - coordination.k8s.io 641 resources: 642 - leases 643 verbs: 644 - get 645 - list 646 - watch 647 - create 648 - update 649 - patch 650 - delete 651 - apiGroups: 652 - "" 653 resources: 654 - events 655 verbs: 656 - create 657 - patch 658 --- 659 apiVersion: rbac.authorization.k8s.io/v1 660 kind: ClusterRole 661 metadata: 662 name: metrics-auth-role 663 rules: 664 - apiGroups: 665 - authentication.k8s.io 666 resources: 667 - tokenreviews 668 verbs: 669 - create 670 - apiGroups: 671 - authorization.k8s.io 672 resources: 673 - subjectaccessreviews 674 verbs: 675 - create 676 --- 677 apiVersion: rbac.authorization.k8s.io/v1 678 kind: ClusterRole 679 metadata: 680 name: metrics-reader 681 rules: 682 - nonResourceURLs: 683 - /metrics 684 verbs: 685 - get 686 --- 687 apiVersion: rbac.authorization.k8s.io/v1 688 kind: ClusterRole 689 metadata: 690 labels: 691 app.kubernetes.io/managed-by: kustomize 692 app.kubernetes.io/name: plugin-barman-cloud 693 name: objectstore-editor-role 694 rules: 695 - apiGroups: 696 - barmancloud.cnpg.io 697 resources: 698 - objectstores 699 verbs: 700 - create 701 - delete 702 - get 703 - list 704 - patch 705 - update 706 - watch 707 - apiGroups: 708 - barmancloud.cnpg.io 709 resources: 710 - objectstores/status 711 verbs: 712 - get 713 --- 714 apiVersion: rbac.authorization.k8s.io/v1 715 kind: ClusterRole 716 metadata: 717 labels: 718 app.kubernetes.io/managed-by: kustomize 719 app.kubernetes.io/name: plugin-barman-cloud 720 name: objectstore-viewer-role 721 rules: 722 - apiGroups: 723 - barmancloud.cnpg.io 724 resources: 725 - objectstores 726 verbs: 727 - get 728 - list 729 - watch 730 - apiGroups: 731 - barmancloud.cnpg.io 732 resources: 733 - objectstores/status 734 verbs: 735 - get 736 --- 737 apiVersion: rbac.authorization.k8s.io/v1 738 kind: ClusterRole 739 metadata: 740 name: plugin-barman-cloud 741 rules: 742 - apiGroups: 743 - "" 744 resources: 745 - secrets 746 verbs: 747 - create 748 - delete 749 - get 750 - list 751 - watch 752 - apiGroups: 753 - barmancloud.cnpg.io 754 resources: 755 - objectstores 756 verbs: 757 - create 758 - delete 759 - get 760 - list 761 - patch 762 - update 763 - watch 764 - apiGroups: 765 - barmancloud.cnpg.io 766 resources: 767 - objectstores/finalizers 768 verbs: 769 - update 770 - apiGroups: 771 - barmancloud.cnpg.io 772 resources: 773 - objectstores/status 774 verbs: 775 - get 776 - patch 777 - update 778 - apiGroups: 779 - postgresql.cnpg.io 780 resources: 781 - backups 782 verbs: 783 - get 784 - list 785 - watch 786 - apiGroups: 787 - rbac.authorization.k8s.io 788 resources: 789 - rolebindings 790 - roles 791 verbs: 792 - create 793 - get 794 - list 795 - patch 796 - update 797 - watch 798 --- 799 apiVersion: rbac.authorization.k8s.io/v1 800 kind: RoleBinding 801 metadata: 802 labels: 803 app.kubernetes.io/managed-by: kustomize 804 app.kubernetes.io/name: plugin-barman-cloud 805 name: leader-election-rolebinding 806 namespace: postgres-cluster 807 roleRef: 808 apiGroup: rbac.authorization.k8s.io 809 kind: Role 810 name: leader-election-role 811 subjects: 812 - kind: ServiceAccount 813 name: plugin-barman-cloud 814 namespace: postgres-cluster 815 --- 816 apiVersion: rbac.authorization.k8s.io/v1 817 kind: ClusterRoleBinding 818 metadata: 819 name: metrics-auth-rolebinding 820 roleRef: 821 apiGroup: rbac.authorization.k8s.io 822 kind: ClusterRole 823 name: metrics-auth-role 824 subjects: 825 - kind: ServiceAccount 826 name: plugin-barman-cloud 827 namespace: postgres-cluster 828 --- 829 apiVersion: rbac.authorization.k8s.io/v1 830 kind: ClusterRoleBinding 831 metadata: 832 labels: 833 app.kubernetes.io/managed-by: kustomize 834 app.kubernetes.io/name: plugin-barman-cloud 835 name: plugin-barman-cloud-binding 836 roleRef: 837 apiGroup: rbac.authorization.k8s.io 838 kind: ClusterRole 839 name: plugin-barman-cloud 840 subjects: 841 - kind: ServiceAccount 842 name: plugin-barman-cloud 843 namespace: postgres-cluster 844 --- 845 apiVersion: v1 846 data: 847 SIDECAR_IMAGE: | 848 Z2hjci5pby9jbG91ZG5hdGl2ZS1wZy9wbHVnaW4tYmFybWFuLWNsb3VkLXNpZGVjYXI6dj 849 AuNS4w 850 kind: Secret 851 metadata: 852 name: plugin-barman-cloud-gt85cmh99d 853 namespace: postgres-cluster 854 type: Opaque 855 --- 856 apiVersion: v1 857 kind: Service 858 metadata: 859 annotations: 860 cnpg.io/pluginClientSecret: barman-cloud-client-tls 861 cnpg.io/pluginPort: "9090" 862 cnpg.io/pluginServerSecret: barman-cloud-server-tls 863 labels: 864 app: barman-cloud 865 cnpg.io/pluginName: barman-cloud.cloudnative-pg.io 866 name: barman-cloud 867 namespace: postgres-cluster 868 spec: 869 ports: 870 - port: 9090 871 protocol: TCP 872 targetPort: 9090 873 selector: 874 app: barman-cloud 875 --- 876 apiVersion: apps/v1 877 kind: Deployment 878 metadata: 879 labels: 880 app: barman-cloud 881 name: barman-cloud 882 namespace: postgres-cluster 883 spec: 884 replicas: 1 885 selector: 886 matchLabels: 887 app: barman-cloud 888 strategy: 889 type: Recreate 890 template: 891 metadata: 892 labels: 893 app: barman-cloud 894 spec: 895 containers: 896 - args: 897 - operator 898 - --server-cert=/server/tls.crt 899 - --server-key=/server/tls.key 900 - --client-cert=/client/tls.crt 901 - --server-address=:9090 902 - --leader-elect 903 - --log-level=debug 904 env: 905 - name: SIDECAR_IMAGE 906 valueFrom: 907 secretKeyRef: 908 key: SIDECAR_IMAGE 909 name: plugin-barman-cloud-gt85cmh99d 910 image: ghcr.io/cloudnative-pg/plugin-barman-cloud:v0.5.0 911 name: barman-cloud 912 ports: 913 - containerPort: 9090 914 protocol: TCP 915 readinessProbe: 916 initialDelaySeconds: 10 917 periodSeconds: 10 918 tcpSocket: 919 port: 9090 920 resources: {} 921 securityContext: 922 allowPrivilegeEscalation: false 923 capabilities: 924 drop: 925 - ALL 926 readOnlyRootFilesystem: true 927 runAsGroup: 10001 928 runAsUser: 10001 929 seccompProfile: 930 type: RuntimeDefault 931 volumeMounts: 932 - mountPath: /server 933 name: server 934 - mountPath: /client 935 name: client 936 securityContext: 937 runAsNonRoot: true 938 seccompProfile: 939 type: RuntimeDefault 940 serviceAccountName: plugin-barman-cloud 941 volumes: 942 - name: server 943 secret: 944 secretName: barman-cloud-server-tls 945 - name: client 946 secret: 947 secretName: barman-cloud-client-tls 948 --- 949 apiVersion: cert-manager.io/v1 950 kind: Certificate 951 metadata: 952 name: barman-cloud-client 953 namespace: postgres-cluster 954 spec: 955 commonName: barman-cloud-client 956 duration: 2160h 957 isCA: false 958 issuerRef: 959 group: cert-manager.io 960 kind: Issuer 961 name: selfsigned-issuer 962 renewBefore: 360h 963 secretName: barman-cloud-client-tls 964 usages: 965 - client auth 966 --- 967 apiVersion: cert-manager.io/v1 968 kind: Certificate 969 metadata: 970 name: barman-cloud-server 971 namespace: postgres-cluster 972 spec: 973 commonName: barman-cloud 974 dnsNames: 975 - barman-cloud 976 duration: 2160h 977 isCA: false 978 issuerRef: 979 group: cert-manager.io 980 kind: Issuer 981 name: selfsigned-issuer 982 renewBefore: 360h 983 secretName: barman-cloud-server-tls 984 usages: 985 - server auth 986 --- 987 apiVersion: cert-manager.io/v1 988 kind: Issuer 989 metadata: 990 name: selfsigned-issuer 991 namespace: postgres-cluster 992 spec: 993 selfSigned: {}