feat(postgres): add centralized ClusterImageCatalog with CNPG operator

Protect system PostgreSQL databases from automatic major version upgrades by introducing centralized ClusterImageCatalog resources based on official CNPG artifacts repository. Changes: - Add two ClusterImageCatalog resources (bookworm and trixie OS variants) - Based on CNPG official standard images with PostgreSQL 13-17 support - PostgreSQL 18 excluded to prevent auto-upgrades - Replace hardcoded imageName with imageCatalogRef in all system databases - Add Makefile target 'update-image-catalogs' for automated catalog updates System components using catalogs: - keycloak-db → postgresql-bookworm major 17 - harbor-db → postgresql-bookworm major 17 - grafana-db → postgresql-bookworm major 17 - alerta-db → postgresql-bookworm major 17 - seaweedfs-db → postgresql-bookworm major 17 Benefits: - Catalogs deploy with operator, always available before cluster changes - Standard images include additional extensions (pgaudit, etc.) - Support for both Debian bookworm and trixie - Automated updates via 'make update-image-catalogs' - Changes propagate through OCIRepo without manual migrations Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
2026-04-06 15:21:45 +03:00
8 changed files with 81 additions and 5 deletions
--- a/packages/system/harbor/templates/database.yaml
+++ b/packages/system/harbor/templates/database.yaml
@ -5,7 +5,11 @@ metadata:
  name: {{ .Values.harbor.fullnameOverride }}-db
 spec:
  instances: {{ .Values.db.replicas }}
-  imageName: ghcr.io/cloudnative-pg/postgresql:17.7
+  imageCatalogRef:
+    apiGroup: postgresql.cnpg.io
+    kind: ClusterImageCatalog
+    name: postgresql-bookworm
+    major: 17
  storage:
    size: {{ .Values.db.size }}
    {{- with .Values.db.storageClass }}
--- a/packages/system/keycloak/templates/db.yaml
+++ b/packages/system/keycloak/templates/db.yaml
@ -4,7 +4,11 @@ metadata:
  name: keycloak-db
 spec:
  instances: 2
-  imageName: ghcr.io/cloudnative-pg/postgresql:17.7
+  imageCatalogRef:
+    apiGroup: postgresql.cnpg.io
+    kind: ClusterImageCatalog
+    name: postgresql-bookworm
+    major: 17
  storage:
    size: 20Gi
  {{- if .Values._cluster.scheduling }}
--- a/packages/system/monitoring/templates/alerta/alerta-db.yaml
+++ b/packages/system/monitoring/templates/alerta/alerta-db.yaml
@ -5,7 +5,11 @@ metadata:
  name: alerta-db
 spec:
  instances: 2
-  imageName: ghcr.io/cloudnative-pg/postgresql:17.7
+  imageCatalogRef:
+    apiGroup: postgresql.cnpg.io
+    kind: ClusterImageCatalog
+    name: postgresql-bookworm
+    major: 17
  {{- if .Values._cluster.scheduling }}
  {{- $rawConstraints := get .Values._cluster.scheduling "globalAppTopologySpreadConstraints" }}
  {{- if $rawConstraints }}
--- a/packages/system/monitoring/templates/grafana/db.yaml
+++ b/packages/system/monitoring/templates/grafana/db.yaml
@ -4,7 +4,11 @@ metadata:
  name: grafana-db
 spec:
  instances: 2
-  imageName: ghcr.io/cloudnative-pg/postgresql:17.7
+  imageCatalogRef:
+    apiGroup: postgresql.cnpg.io
+    kind: ClusterImageCatalog
+    name: postgresql-bookworm
+    major: 17
  storage:
    size: {{ .Values.grafana.db.size }}
  {{- if .Values._cluster.scheduling }}
--- a/packages/system/postgres-operator/Makefile
+++ b/packages/system/postgres-operator/Makefile
@ -9,3 +9,15 @@ update:
 	helm repo update cnpg
 	helm pull cnpg/cloudnative-pg --untar --untardir charts --version 0.26.1
 	rm -rf charts/cloudnative-pg/charts
+
+update-image-catalogs:
+	@echo "Downloading PostgreSQL image catalogs from CNPG artifacts..."
+	@curl -sSL https://raw.githubusercontent.com/cloudnative-pg/artifacts/main/image-catalogs/catalog-standard-bookworm.yaml \
+		| sed 's/postgresql-standard-bookworm/postgresql-bookworm/' \
+		| awk '/major: 18/,/image:/ {next} {print}' \
+		> templates/image-catalog-bookworm.yaml
+	@curl -sSL https://raw.githubusercontent.com/cloudnative-pg/artifacts/main/image-catalogs/catalog-standard-trixie.yaml \
+		| sed 's/postgresql-standard-trixie/postgresql-trixie/' \
+		| awk '/major: 18/,/image:/ {next} {print}' \
+		> templates/image-catalog-trixie.yaml
+	@echo "Updated image catalogs (PostgreSQL 13-17, excluded v18)"
--- a/packages/system/postgres-operator/templates/image-catalog-bookworm.yaml
+++ b/packages/system/postgres-operator/templates/image-catalog-bookworm.yaml
@ -0,0 +1,22 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: ClusterImageCatalog
+metadata:
+  name: postgresql-bookworm
+  labels:
+    images.cnpg.io/family: postgresql
+    images.cnpg.io/type: standard
+    images.cnpg.io/os: bookworm
+    images.cnpg.io/date: '20260406'
+    images.cnpg.io/publisher: cnpg.io
+spec:
+  images:
+  - major: 13
+    image: ghcr.io/cloudnative-pg/postgresql:13.22-202511100817-standard-bookworm@sha256:e65cbf9ba18d313acde4bcdc1bc8eb636b0e005f83f23b44aba3f957ecca1e66
+  - major: 14
+    image: ghcr.io/cloudnative-pg/postgresql:14.22-202604060836-standard-bookworm@sha256:520831b1115377aedf2370f565da88688b5df89f55478130be88e5dabc54d71b
+  - major: 15
+    image: ghcr.io/cloudnative-pg/postgresql:15.17-202604060834-standard-bookworm@sha256:147e208ec48768a5db6b008015a91d8c65859ab5201f96a3240b4b20d54a462b
+  - major: 16
+    image: ghcr.io/cloudnative-pg/postgresql:16.13-202604060836-standard-bookworm@sha256:ad1312a89f2c85f507647e6cb47401fc5265c17dd38b4d5bc511b1ce47e98989
+  - major: 17
+    image: ghcr.io/cloudnative-pg/postgresql:17.9-202604060836-standard-bookworm@sha256:22b5b918265328349d2e99e1d0bfe8851712b92a32739962b852b1428a33874a
--- a/packages/system/postgres-operator/templates/image-catalog-trixie.yaml
+++ b/packages/system/postgres-operator/templates/image-catalog-trixie.yaml
@ -0,0 +1,22 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: ClusterImageCatalog
+metadata:
+  name: postgresql-trixie
+  labels:
+    images.cnpg.io/family: postgresql
+    images.cnpg.io/type: standard
+    images.cnpg.io/os: trixie
+    images.cnpg.io/date: '20260406'
+    images.cnpg.io/publisher: cnpg.io
+spec:
+  images:
+  - major: 13
+    image: ghcr.io/cloudnative-pg/postgresql:13.22-202511100817-standard-trixie@sha256:8252529362b12a451a18cb19fdec9174ea09709102a7e6cf2e2b24d140dbd181
+  - major: 14
+    image: ghcr.io/cloudnative-pg/postgresql:14.22-202604060836-standard-trixie@sha256:8194f92a5da760127aa85b277bfaf71dfed59b22e0bf8f1f38d4893c8aebedd1
+  - major: 15
+    image: ghcr.io/cloudnative-pg/postgresql:15.17-202604060834-standard-trixie@sha256:021f860ac34f52689a966f4427d8bf48f89508aadf7fd60286ae9dbfe32f1f3a
+  - major: 16
+    image: ghcr.io/cloudnative-pg/postgresql:16.13-202604060836-standard-trixie@sha256:af4ccb6f3fad2ca86e53ea53264bd36d3de3facc208db936cf571bc5e264589c
+  - major: 17
+    image: ghcr.io/cloudnative-pg/postgresql:17.9-202604060836-standard-trixie@sha256:eba37bfc4b6cb1f1b3a869cab42ec1833519bbeb8cceacd1859b4faeca01fa4d
--- a/packages/system/seaweedfs/templates/database.yaml
+++ b/packages/system/seaweedfs/templates/database.yaml
@ -5,7 +5,11 @@ metadata:
  name: seaweedfs-db
 spec:
  instances: {{ .Values.db.replicas }}
-  imageName: ghcr.io/cloudnative-pg/postgresql:17.7
+  imageCatalogRef:
+    apiGroup: postgresql.cnpg.io
+    kind: ClusterImageCatalog
+    name: postgresql-bookworm
+    major: 17
  storage:
    size: {{ .Values.db.size }}
    {{- with .Values.db.storageClass }}