feat(postgres): support all PostgreSQL configuration parameters
Allow users to configure any PostgreSQL server parameter via the postgresql.parameters field. All parameter values must be provided as strings (numeric values should be quoted). Security measures: - Block parameters that allow shell command execution (archive_command, restore_command, ssl_passphrase_command, log_destination, event_source) - Validation implemented in templates to prevent security vulnerabilities Generated files updated: - types.go: Add Parameters field with map[string]string type - README.md: Add parameter documentation and warnings - values.schema.json: Update schema for new field - CRD: Update OpenAPI schema with new field and reordered properties CloudNativePG manages certain parameters automatically (archive_mode, primary_conninfo, wal_level). Users should not override these as it may break backup/replication functionality. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
This commit is contained in:
IvanHunters
IvanHunters
parent
f45facca77
commit
fb0ed08565
6 changed files with 44 additions and 31 deletions
|
|
@ -112,15 +112,9 @@ type DatabaseRoles struct {
|
|||
}
|
||||
|
||||
type PostgreSQL struct {
|
||||
// PostgreSQL server parameters.
|
||||
// +kubebuilder:default:={}
|
||||
Parameters PostgreSQLParameters `json:"parameters,omitempty"`
|
||||
}
|
||||
|
||||
type PostgreSQLParameters struct {
|
||||
// Maximum number of concurrent connections to the database server.
|
||||
// +kubebuilder:default:=100
|
||||
MaxConnections int `json:"max_connections,omitempty"`
|
||||
// PostgreSQL server parameters. All values must be strings (enclose numbers in quotes). See PostgreSQL documentation for available parameters. WARNING: Some parameters are managed by CloudNativePG and should NOT be overridden (archive_mode, archive_command, restore_command, primary_conninfo, etc.). Incorrect values may break backup/replication or require pod restart.
|
||||
// +kubebuilder:default:={"max_connections":"100"}
|
||||
Parameters map[string]string `json:"parameters,omitempty"`
|
||||
}
|
||||
|
||||
type Quorum struct {
|
||||
|
|
|
|||
|
|
@ -81,11 +81,10 @@ See:
|
|||
|
||||
### Application-specific parameters
|
||||
|
||||
| Name | Description | Type | Value |
|
||||
| --------------------------------------- | ---------------------------------------------------------------- | -------- | ----- |
|
||||
| `postgresql` | PostgreSQL server configuration. | `object` | `{}` |
|
||||
| `postgresql.parameters` | PostgreSQL server parameters. | `object` | `{}` |
|
||||
| `postgresql.parameters.max_connections` | Maximum number of concurrent connections to the database server. | `int` | `100` |
|
||||
| Name | Description | Type | Value |
|
||||
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- | ----- |
|
||||
| `postgresql` | PostgreSQL server configuration. | `object` | `{}` |
|
||||
| `postgresql.parameters` | PostgreSQL server parameters. All values must be strings (enclose numbers in quotes). See PostgreSQL documentation for available parameters. WARNING: Some parameters are managed by CloudNativePG and should NOT be overridden (archive_mode, archive_command, restore_command, primary_conninfo, etc.). Incorrect values may break backup/replication or require pod restart. | `map[string]string` | `{}` |
|
||||
|
||||
|
||||
### Quorum-based synchronous replication
|
||||
|
|
|
|||
|
|
@ -60,9 +60,15 @@ spec:
|
|||
{{- end }}
|
||||
postgresql:
|
||||
parameters:
|
||||
max_wal_senders: "30"
|
||||
{{- with .Values.postgresql.parameters.max_connections }}
|
||||
max_connections: "{{ . }}"
|
||||
{{- $defaults := dict "max_wal_senders" "30" }}
|
||||
{{- $params := merge .Values.postgresql.parameters $defaults }}
|
||||
{{- /* Security: Block parameters that could allow shell command execution */ -}}
|
||||
{{- $dangerousParams := list "archive_command" "restore_command" "ssl_passphrase_command" "log_destination" "event_source" }}
|
||||
{{- range $key, $value := $params }}
|
||||
{{- if has $key $dangerousParams }}
|
||||
{{- fail (printf "SECURITY: Parameter '%s' is blocked for security reasons. This parameter could allow arbitrary shell command execution and is managed by CloudNativePG operator." $key) }}
|
||||
{{- end }}
|
||||
{{ $key }}: "{{ $value }}"
|
||||
{{- end }}
|
||||
|
||||
minSyncReplicas: {{ .Values.quorum.minSyncReplicas }}
|
||||
|
|
|
|||
|
|
@ -97,15 +97,13 @@
|
|||
"default": {},
|
||||
"properties": {
|
||||
"parameters": {
|
||||
"description": "PostgreSQL server parameters.",
|
||||
"description": "PostgreSQL server parameters. All values must be strings (enclose numbers in quotes). See PostgreSQL documentation for available parameters. WARNING: Some parameters are managed by CloudNativePG and should NOT be overridden (archive_mode, archive_command, restore_command, primary_conninfo, etc.). Incorrect values may break backup/replication or require pod restart.",
|
||||
"type": "object",
|
||||
"default": {},
|
||||
"properties": {
|
||||
"max_connections": {
|
||||
"description": "Maximum number of concurrent connections to the database server.",
|
||||
"type": "integer",
|
||||
"default": 100
|
||||
}
|
||||
"default": {
|
||||
"max_connections": "100"
|
||||
},
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -48,16 +48,32 @@ version: v18
|
|||
## @section Application-specific parameters
|
||||
##
|
||||
|
||||
## @typedef {struct} PostgreSQLParameters - PostgreSQL server parameters.
|
||||
## @field {int} [max_connections] - Maximum number of concurrent connections to the database server.
|
||||
|
||||
## @typedef {struct} PostgreSQL - PostgreSQL server configuration.
|
||||
## @field {PostgreSQLParameters} [parameters] - PostgreSQL server parameters.
|
||||
## @field {map[string]string} [parameters] - PostgreSQL server parameters. All values must be strings (enclose numbers in quotes). See PostgreSQL documentation for available parameters. WARNING: Some parameters are managed by CloudNativePG and should NOT be overridden (archive_mode, archive_command, restore_command, primary_conninfo, etc.). Incorrect values may break backup/replication or require pod restart.
|
||||
|
||||
## @param {PostgreSQL} postgresql - PostgreSQL server configuration.
|
||||
postgresql:
|
||||
parameters:
|
||||
max_connections: 100
|
||||
max_connections: "100"
|
||||
## Additional parameters examples:
|
||||
## shared_buffers: "1GB"
|
||||
## effective_cache_size: "4GB"
|
||||
## bgwriter_delay: "200ms"
|
||||
## commit_delay: "100"
|
||||
## commit_siblings: "5"
|
||||
## work_mem: "256MB"
|
||||
##
|
||||
## SECURITY: The following parameters are BLOCKED for security reasons
|
||||
## (could allow arbitrary shell command execution):
|
||||
## archive_command, restore_command, ssl_passphrase_command,
|
||||
## log_destination, event_source
|
||||
##
|
||||
## IMPORTANT: Do NOT override CloudNativePG-managed parameters:
|
||||
## archive_mode, primary_conninfo, wal_level, max_replication_slots
|
||||
##
|
||||
## NOTE: Some parameters require pod restart (not just reload):
|
||||
## shared_buffers, max_connections, max_prepared_transactions,
|
||||
## wal_buffers, max_wal_senders
|
||||
|
||||
##
|
||||
## @section Quorum-based synchronous replication
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
Loading…
Add table
Add a link
Reference in a new issue