Documentation
¶
Index ¶
- Constants
- func ObserveExtension(ctx context.Context, exec postgres.Executor) (bool, error)
- func PostgreSQLParameters(cluster *crunchyv1beta1.PostgresCluster, outParameters *postgres.Parameters)
- func PreserveOldTDEVolume(podSpec *corev1.PodSpec, existing *appsv1.StatefulSet)
- func ReconcileExtension(ctx context.Context, exec postgres.Executor, ...) error
- func ReconcileVaultProvider(ctx context.Context, exec postgres.Executor, ...) error
- func ReportExtension(cluster *crunchyv1beta1.PostgresCluster, record record.EventRecorder, ...)
- func ReportStandby(cluster *crunchyv1beta1.PostgresCluster, installed bool, keyErr error)
- func TempVaultCredentialPaths(vault *crunchyv1beta1.PGTDEVaultSpec) (tokenPath, caPath string)
- func VaultChangeFor(cluster *crunchyv1beta1.PostgresCluster) (vaultChange, error)
- func VaultCredentialPaths(vault *crunchyv1beta1.PGTDEVaultSpec) (tokenPath, caPath string)
- func VaultRevision(vault *crunchyv1beta1.PGTDEVaultSpec, tokenPath, caPath string) (string, error)
- func VerifyPrincipalKey(ctx context.Context, exec postgres.Executor) error
- type Phase
Constants ¶
const ( // TempTokenPath is where the new vault token is written inside the pod // during a vault provider change (before the volume is updated). // Stored under /pgdata so it survives pod restarts (persistent volume). TempTokenPath = "/pgdata/tde-new-token" // nolint:gosec // TempCAPath is where the new CA certificate is written inside the pod // during a vault provider change (before the volume is updated). // Stored under /pgdata so it survives pod restarts (persistent volume). TempCAPath = "/pgdata/tde-new-ca.crt" )
Variables ¶
This section is empty.
Functions ¶
func ObserveExtension ¶
ObserveExtension reports whether pg_tde is installed.
func PostgreSQLParameters ¶
func PostgreSQLParameters(cluster *crunchyv1beta1.PostgresCluster, outParameters *postgres.Parameters)
func PreserveOldTDEVolume ¶
func PreserveOldTDEVolume(podSpec *corev1.PodSpec, existing *appsv1.StatefulSet)
PreserveOldTDEVolume replaces the pg-tde volume and its mount on the database container with the ones from the StatefulSet as it exists in the cluster, adding them back when the new pod spec no longer has them. This prevents pods from restarting with new vault credentials before the vault provider change SQL has been executed, and from restarting with no credentials at all while the extension is still installed.
func ReconcileExtension ¶
func ReconcileExtension(ctx context.Context, exec postgres.Executor, cluster *crunchyv1beta1.PostgresCluster) error
ReconcileExtension installs or drops the pg_tde extension according to the spec.
func ReconcileVaultProvider ¶
func ReconcileVaultProvider(ctx context.Context, exec postgres.Executor, cluster *crunchyv1beta1.PostgresCluster, tokenPath, caPath string) error
ReconcileVaultProvider configures or updates the pg_tde vault key provider. tokenPath and caPath are the file paths inside the pod where the vault credentials can be read. For initial setup these are the standard volume mount paths; for provider changes they may be temporary file paths.
The provider and the global key may already exist even on the initial setup path: a cluster that is deleted and recreated with its PVCs retained, or one where pg_tde was disabled and re-enabled, starts with an empty PGTDERevision but a populated pg_tde state. Rather than interpreting the error text to recognize those cases, each step recovers from a failure by driving the state towards the spec and lets the following step decide whether that worked.
func ReportExtension ¶
func ReportExtension(cluster *crunchyv1beta1.PostgresCluster, record record.EventRecorder, err error)
ReportExtension records the outcome of a ReconcileExtension. The PGTDEEnabled condition decides whether pg_tde is in shared_preload_libraries and whether instance Pods carry the vault volume.
func ReportStandby ¶
func ReportStandby( cluster *crunchyv1beta1.PostgresCluster, installed bool, keyErr error)
ReportStandby records the pg_tde state of a cluster in recovery from what its standby leader reported.
func TempVaultCredentialPaths ¶
func TempVaultCredentialPaths(vault *crunchyv1beta1.PGTDEVaultSpec) (tokenPath, caPath string)
TempVaultCredentialPaths returns the temporary file paths used during a vault provider change, before the pod volume is updated with new credentials.
func VaultChangeFor ¶
func VaultChangeFor(cluster *crunchyv1beta1.PostgresCluster) (vaultChange, error)
VaultChangeFor derives the change from the spec and the stored revision.
func VaultCredentialPaths ¶
func VaultCredentialPaths(vault *crunchyv1beta1.PGTDEVaultSpec) (tokenPath, caPath string)
VaultCredentialPaths returns the standard volume mount paths for the vault token and CA certificate based on the vault spec's secret key names.
func VaultRevision ¶
func VaultRevision(vault *crunchyv1beta1.PGTDEVaultSpec, tokenPath, caPath string) (string, error)
VaultRevision computes a hash of the vault configuration and credential paths for comparing with cluster.Status.PGTDERevision.
Types ¶
type Phase ¶
type Phase int
Phase is where a cluster stands in the two-phase vault credential change described on reconcilePGTDEProviders.
const ( // InitialSetup means no key provider has been configured yet, so the // credentials in the spec are the only ones there have ever been. InitialSetup Phase = iota // Configured means the key provider names the credentials in the spec. Configured // StageCredentials means the spec names credentials the key provider // has not been pointed at yet. Phase 1 has to copy them onto the data // volumes and repoint the provider before the Pods may mount them. StageCredentials // Finalize means the key provider names the staged copies on the data // volumes. Phase 2 repoints it at the mount paths and removes them. Finalize )
Source Files