chore(postgres): regenerate postgres.yaml after rebase

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>

api/apps/v1alpha1/postgresql/types.go

@@ -112,15 +112,9 @@ type DatabaseRoles struct {
 }
 
 type PostgreSQL struct {
-	// PostgreSQL server parameters.
+	// PostgreSQL server parameters. All values must be strings (enclose numbers in quotes). See PostgreSQL documentation for available parameters. WARNING: Some parameters are managed by CloudNativePG and should NOT be overridden (archive_mode, archive_command, restore_command, primary_conninfo, etc.). Incorrect values may break backup/replication or require pod restart.
-	// +kubebuilder:default:={}
+	// +kubebuilder:default:={"max_connections":"100"}
-	Parameters PostgreSQLParameters `json:"parameters,omitempty"`
+	Parameters map[string]string `json:"parameters,omitempty"`
-}
-
-type PostgreSQLParameters struct {
-	// Maximum number of concurrent connections to the database server.
-	// +kubebuilder:default:=100
-	MaxConnections int `json:"max_connections,omitempty"`
 }
 
 type Quorum struct {

api/apps/v1alpha1/postgresql/zz_generated.deepcopy.go

@@ -85,7 +85,7 @@ func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	*out = *in
 	in.Resources.DeepCopyInto(&out.Resources)
 	out.Size = in.Size.DeepCopy()
-	out.Postgresql = in.Postgresql
+	in.Postgresql.DeepCopyInto(&out.Postgresql)
 	out.Quorum = in.Quorum
 	if in.Users != nil {
 		in, out := &in.Users, &out.Users
@@ -164,7 +164,13 @@ func (in *DatabaseRoles) DeepCopy() *DatabaseRoles {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *PostgreSQL) DeepCopyInto(out *PostgreSQL) {
 	*out = *in
-	out.Parameters = in.Parameters
+	if in.Parameters != nil {
+		in, out := &in.Parameters, &out.Parameters
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PostgreSQL.
@@ -177,21 +183,6 @@ func (in *PostgreSQL) DeepCopy() *PostgreSQL {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PostgreSQLParameters) DeepCopyInto(out *PostgreSQLParameters) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PostgreSQLParameters.
-func (in *PostgreSQLParameters) DeepCopy() *PostgreSQLParameters {
-	if in == nil {
-		return nil
-	}
-	out := new(PostgreSQLParameters)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Quorum) DeepCopyInto(out *Quorum) {
 	*out = *in

hack/e2e-apps/postgres.bats

@@ -16,7 +16,7 @@ spec:
   storageClass: ""
   postgresql:
     parameters:
-      max_connections: 100
+      max_connections: "100"
   quorum:
     minSyncReplicas: 0
     maxSyncReplicas: 0

packages/apps/postgres/README.md

@@ -81,11 +81,10 @@ See:
 
 ### Application-specific parameters
 
-| Name                                    | Description                                                      | Type     | Value |
+| Name                    | Description                                                                                                                                                                                                                                                                                                                                                                     | Type                | Value |
-| --------------------------------------- | ---------------------------------------------------------------- | -------- | ----- |
+| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- | ----- |
-| `postgresql`                            | PostgreSQL server configuration.                                 | `object` | `{}`  |
+| `postgresql`            | PostgreSQL server configuration.                                                                                                                                                                                                                                                                                                                                                | `object`            | `{}`  |
-| `postgresql.parameters`                 | PostgreSQL server parameters.                                    | `object` | `{}`  |
+| `postgresql.parameters` | PostgreSQL server parameters. All values must be strings (enclose numbers in quotes). See PostgreSQL documentation for available parameters. WARNING: Some parameters are managed by CloudNativePG and should NOT be overridden (archive_mode, archive_command, restore_command, primary_conninfo, etc.). Incorrect values may break backup/replication or require pod restart. | `map[string]string` | `{}`  |
-| `postgresql.parameters.max_connections` | Maximum number of concurrent connections to the database server. | `int`    | `100` |
 
 
 ### Quorum-based synchronous replication

packages/apps/postgres/templates/db.yaml

@@ -60,9 +60,16 @@ spec:
   {{- end }}
   postgresql:
     parameters:
-      max_wal_senders: "30"
+      {{- $defaults := dict "max_wal_senders" "30" }}
-      {{- with .Values.postgresql.parameters.max_connections }}
+      {{- $params := merge (dict) .Values.postgresql.parameters $defaults }}
-      max_connections: "{{ . }}"
+      {{- /* Security: Block parameters that could allow shell command execution */ -}}
+      {{- $dangerousParams := list "archive_command" "restore_command" "ssl_passphrase_command" "log_destination" "event_source" }}
+      {{- range $key, $value := $params }}
+      {{- $normalizedKey := lower $key }}
+      {{- if has $normalizedKey $dangerousParams }}
+      {{- fail (printf "SECURITY: Parameter '%s' is blocked for security reasons. This parameter could allow arbitrary shell command execution and is managed by CloudNativePG operator." $key) }}
+      {{- end }}
+      {{ $key }}: {{ $value | quote }}
       {{- end }}
 
   minSyncReplicas: {{ .Values.quorum.minSyncReplicas }}

packages/apps/postgres/values.schema.json

@@ -97,15 +97,13 @@
       "default": {},
       "properties": {
         "parameters": {
-          "description": "PostgreSQL server parameters.",
+          "description": "PostgreSQL server parameters. All values must be strings (enclose numbers in quotes). See PostgreSQL documentation for available parameters. WARNING: Some parameters are managed by CloudNativePG and should NOT be overridden (archive_mode, archive_command, restore_command, primary_conninfo, etc.). Incorrect values may break backup/replication or require pod restart.",
           "type": "object",
-          "default": {},
+          "default": {
-          "properties": {
+            "max_connections": "100"
-            "max_connections": {
+          },
-              "description": "Maximum number of concurrent connections to the database server.",
+          "additionalProperties": {
-              "type": "integer",
+            "type": "string"
-              "default": 100
-            }
           }
         }
       }

packages/apps/postgres/values.yaml

@@ -48,16 +48,32 @@ version: v18
 ## @section Application-specific parameters
 ##
 
-## @typedef {struct} PostgreSQLParameters - PostgreSQL server parameters.
-## @field {int} [max_connections] - Maximum number of concurrent connections to the database server.
-
 ## @typedef {struct} PostgreSQL - PostgreSQL server configuration.
-## @field {PostgreSQLParameters} [parameters] - PostgreSQL server parameters.
+## @field {map[string]string} [parameters] - PostgreSQL server parameters. All values must be strings (enclose numbers in quotes). See PostgreSQL documentation for available parameters. WARNING: Some parameters are managed by CloudNativePG and should NOT be overridden (archive_mode, archive_command, restore_command, primary_conninfo, etc.). Incorrect values may break backup/replication or require pod restart.
 
 ## @param {PostgreSQL} postgresql - PostgreSQL server configuration.
 postgresql:
   parameters:
-    max_connections: 100
+    max_connections: "100"
+## Additional parameters examples:
+##   shared_buffers: "1GB"
+##   effective_cache_size: "4GB"
+##   bgwriter_delay: "200ms"
+##   commit_delay: "100"
+##   commit_siblings: "5"
+##   work_mem: "256MB"
+##
+## SECURITY: The following parameters are BLOCKED for security reasons
+## (could allow arbitrary shell command execution):
+##   archive_command, restore_command, ssl_passphrase_command,
+##   log_destination, event_source
+##
+## IMPORTANT: Do NOT override CloudNativePG-managed parameters:
+##   archive_mode, primary_conninfo, wal_level, max_replication_slots
+##
+## NOTE: Some parameters require pod restart (not just reload):
+##   shared_buffers, max_connections, max_prepared_transactions,
+##   wal_buffers, max_wal_senders
 
 ##
 ## @section Quorum-based synchronous replication

packages/system/kubevirt-operator/alerts/PrometheusRule.yaml

@@ -1,42 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: vm-not-running-alert
-spec:
-  groups:
-  - name: kubevirt-alerts
-    rules:
-    - alert: VMNotRunningFor10Minutes
-      expr: |
-        max_over_time(
-          kubevirt_vm_info{
-            status!="running",
-            exported_namespace=~".+",
-            name=~".+"
-          }[10m]
-        ) == 1
-      labels:
-        severity: critical
-        namespace: "{{ $labels.exported_namespace }}"
-      annotations:
-        summary: "VM '{{ $labels.name }}' in namespace '{{ $labels.exported_namespace }}' is not Running for more than 10 minutes"
-        description: >
-          The VM '{{ $labels.name }}' in namespace '{{ $labels.exported_namespace }}' has been in a non-Running state
-          for more than 10 minutes. Please investigate the issue.
-    - alert: VMINotRunningFor10Minutes
-      expr: |
-        max_over_time(
-          kubevirt_vmi_info{
-            phase!="running",
-            exported_namespace=~".+",
-            name=~".+"
-          }[10m]
-        ) == 1
-      labels:
-        severity: critical
-        namespace: "{{ $labels.exported_namespace }}"
-      annotations:
-        summary: "VMI '{{ $labels.name }}' in namespace '{{ $labels.exported_namespace }}' is not Running for more than 10 minutes"
-        description: >
-          The VM '{{ $labels.name }}' in namespace '{{ $labels.exported_namespace }}' has been in a non-Running state
-          for more than 10 minutes. Please investigate the issue.

packages/system/kubevirt-operator/templates/prometheusrule.yaml

@@ -0,0 +1,38 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: vm-not-running-alert
+spec:
+  groups:
+  - name: kubevirt-alerts
+    rules:
+    - alert: VMNotRunningFor10Minutes
+      expr: |
+        max_over_time(
+          kubevirt_vm_info{
+            status!="running",
+            exported_namespace=~".+",
+            name=~".+"
+          }[10m]
+        ) == 1
+      labels:
+        severity: critical
+        namespace: '{{ "{{" }} $labels.exported_namespace {{ "}}" }}'
+      annotations:
+        summary: 'VM {{ "{{" }} $labels.name {{ "}}" }} in namespace {{ "{{" }} $labels.exported_namespace {{ "}}" }} is not Running for more than 10 minutes'
+        description: 'The VM {{ "{{" }} $labels.name {{ "}}" }} in namespace {{ "{{" }} $labels.exported_namespace {{ "}}" }} has been in a non-Running state for more than 10 minutes. Please investigate the issue.'
+    - alert: VMINotRunningFor10Minutes
+      expr: |
+        max_over_time(
+          kubevirt_vmi_info{
+            phase!="running",
+            exported_namespace=~".+",
+            name=~".+"
+          }[10m]
+        ) == 1
+      labels:
+        severity: critical
+        namespace: '{{ "{{" }} $labels.exported_namespace {{ "}}" }}'
+      annotations:
+        summary: 'VMI {{ "{{" }} $labels.name {{ "}}" }} in namespace {{ "{{" }} $labels.exported_namespace {{ "}}" }} is not Running for more than 10 minutes'
+        description: 'The VMI {{ "{{" }} $labels.name {{ "}}" }} in namespace {{ "{{" }} $labels.exported_namespace {{ "}}" }} has been in a non-Running state for more than 10 minutes. Please investigate the issue.'