247e19252f
Remove the ability for users to specify custom container images
(images.pmm and images.backup) in the MongoDB application values.
This is a security hardening measure - allowing users to specify
arbitrary container images could lead to running malicious or
compromised images, supply chain attacks, or privilege escalation.
The images are now hardcoded in the template:
- percona/pmm-client:2.44.1
- percona/percona-backup-mongodb:2.11.0
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
(cherry picked from commit beb6e1a0ba)
134 lines
4.1 KiB
YAML
134 lines
4.1 KiB
YAML
##
|
|
## @section Common parameters
|
|
##
|
|
|
|
## @typedef {struct} Resources - Explicit CPU and memory configuration for each MongoDB replica.
|
|
## @field {quantity} [cpu] - CPU available to each replica.
|
|
## @field {quantity} [memory] - Memory (RAM) available to each replica.
|
|
|
|
## @enum {string} ResourcesPreset - Default sizing preset.
|
|
## @value nano
|
|
## @value micro
|
|
## @value small
|
|
## @value medium
|
|
## @value large
|
|
## @value xlarge
|
|
## @value 2xlarge
|
|
|
|
## @param {int} replicas - Number of MongoDB replicas in replica set.
|
|
replicas: 3
|
|
|
|
## @param {Resources} [resources] - Explicit CPU and memory configuration for each MongoDB replica. When omitted, the preset defined in `resourcesPreset` is applied.
|
|
resources: {}
|
|
|
|
## @param {ResourcesPreset} resourcesPreset="small" - Default sizing preset used when `resources` is omitted.
|
|
resourcesPreset: "small"
|
|
|
|
## @param {quantity} size - Persistent Volume Claim size available for application data.
|
|
size: 10Gi
|
|
|
|
## @param {string} storageClass - StorageClass used to store the data.
|
|
storageClass: ""
|
|
|
|
## @param {bool} external - Enable external access from outside the cluster.
|
|
external: false
|
|
|
|
##
|
|
## @enum {string} Version
|
|
## @value v8
|
|
## @value v7
|
|
## @value v6
|
|
|
|
## @param {Version} version - MongoDB major version to deploy.
|
|
version: v8
|
|
|
|
##
|
|
## @section Sharding configuration
|
|
##
|
|
|
|
## @param {bool} sharding - Enable sharded cluster mode. When disabled, deploys a replica set.
|
|
sharding: false
|
|
|
|
## @typedef {struct} ShardingConfig - Sharded cluster configuration.
|
|
## @field {int} configServers - Number of config server replicas.
|
|
## @field {quantity} configServerSize - PVC size for config servers.
|
|
## @field {int} mongos - Number of mongos router replicas.
|
|
## @field {[]Shard} shards - List of shard configurations.
|
|
|
|
## @typedef {struct} Shard - Individual shard configuration.
|
|
## @field {string} name - Shard name.
|
|
## @field {int} replicas - Number of replicas in this shard.
|
|
## @field {quantity} size - PVC size for this shard.
|
|
|
|
## @param {ShardingConfig} shardingConfig - Configuration for sharded cluster mode.
|
|
shardingConfig:
|
|
configServers: 3
|
|
configServerSize: 3Gi
|
|
mongos: 2
|
|
shards:
|
|
- name: rs0
|
|
replicas: 3
|
|
size: 10Gi
|
|
|
|
##
|
|
## @section Users configuration
|
|
##
|
|
|
|
## @typedef {struct} Role - MongoDB role configuration.
|
|
## @field {string} name - Role name (e.g., readWrite, dbAdmin, clusterAdmin).
|
|
## @field {string} db - Database the role applies to.
|
|
|
|
## @typedef {struct} User - User configuration.
|
|
## @field {string} [password] - Password for the user (auto-generated if omitted).
|
|
## @field {string} db - Database to authenticate against.
|
|
## @field {[]Role} roles - List of MongoDB roles with database scope.
|
|
|
|
## @param {map[string]User} users - Custom MongoDB users configuration map.
|
|
users: {}
|
|
## Example:
|
|
## users:
|
|
## myuser:
|
|
## db: mydb
|
|
## roles:
|
|
## - name: readWrite
|
|
## db: mydb
|
|
## - name: dbAdmin
|
|
## db: mydb
|
|
|
|
##
|
|
## @section Backup parameters
|
|
##
|
|
|
|
## @typedef {struct} Backup - Backup configuration.
|
|
## @field {bool} enabled - Enable regular backups.
|
|
## @field {string} [schedule] - Cron schedule for automated backups.
|
|
## @field {string} [retentionPolicy] - Retention policy (e.g. "30d").
|
|
## @field {string} [destinationPath] - Destination path for backups (e.g. s3://bucket/path/).
|
|
## @field {string} [endpointURL] - S3 endpoint URL for uploads.
|
|
## @field {string} [s3AccessKey] - Access key for S3 authentication.
|
|
## @field {string} [s3SecretKey] - Secret key for S3 authentication.
|
|
|
|
## @param {Backup} backup - Backup configuration.
|
|
backup:
|
|
enabled: false
|
|
schedule: "0 2 * * *"
|
|
retentionPolicy: 30d
|
|
destinationPath: "s3://bucket/path/to/folder/"
|
|
endpointURL: "http://minio-gateway-service:9000"
|
|
s3AccessKey: ""
|
|
s3SecretKey: ""
|
|
|
|
##
|
|
## @section Bootstrap (recovery) parameters
|
|
##
|
|
|
|
## @typedef {struct} Bootstrap - Bootstrap configuration for restoring a database cluster from a backup.
|
|
## @field {bool} enabled - Whether to restore from a backup.
|
|
## @field {string} [recoveryTime] - Timestamp for point-in-time recovery; empty means latest.
|
|
## @field {string} backupName - Name of backup to restore from.
|
|
|
|
## @param {Bootstrap} bootstrap - Bootstrap configuration.
|
|
bootstrap:
|
|
enabled: false
|
|
recoveryTime: ""
|
|
backupName: ""
|