Add Percona Postgres 17.9 catalog version with pg_tde TDE#2392
Open
tamalsaha wants to merge 6 commits into
Open
Add Percona Postgres 17.9 catalog version with pg_tde TDE#2392tamalsaha wants to merge 6 commits into
tamalsaha wants to merge 6 commits into
Conversation
![kodiak-appscode[bot]](https://avatars.githubusercontent.com/in/92481?s=60&v=4){kind=small}
Add a PostgresVersion with distribution Percona and spec.tde.supported so the operator and webhook permit Transparent Data Encryption on it. The db image reference is a placeholder for the Percona Server for PostgreSQL build that bundles pg_tde and the tde_heap access method. Signed-off-by: Tamal Saha <tamal@appscode.com>
Replace the placeholder image with percona/percona-distribution-postgresql:17.9, which is published and bundles pg_tde. It is UBI based and runs as uid 26, so set baseOS and runAsUser accordingly. Signed-off-by: Tamal Saha <tamal@appscode.com>
Use ghcr.io/appscode-images/percona-distribution-postgresql:17.9, the KubeDB rebuild (kubedb/postgres-docker) that matches the runtime contract: debian bookworm and uid 999. This replaces the upstream UBI image, which did not align with the KubeDB init-container layout. Signed-off-by: Tamal Saha <tamal@appscode.com>
The archiver.walg.image was ghcr.io/kubedb/postgres-archiver:(v0.27.0)_17.2-bookworm with a literal, unsubstituted (v0.27.0) placeholder - parentheses are not valid in a Docker tag. The postgres operator's ensureSidekick could not parse it, so the wal-g WAL-push Sidekick was never created and WAL was never shipped to object storage, silently breaking PITR for the Percona/pg_tde distribution. Fix to the valid tag matching the community bookworm versions (v0.27.0_17.2-bookworm). Signed-off-by: Tamal Saha <tamal@appscode.com>
The wal-push sidekick and the PITR wal-restore/recovery pod both read spec.archiver.walg.image. Recovery replays pg_tde WAL, so it must run a Postgres that contains pg_tde and its custom WAL resource manager (rmgr 140); the community postgres-archiver image has neither and recovery of a pg_tde cluster fails. Repoint the Percona catalog entry to the Percona-based archiver build so both push and recovery use a pg_tde capable image. Signed-off-by: Tamal Saha <tamal@appscode.com>
Signed-off-by: Tamal Saha <tamal@appscode.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
PostgresVersionwithdistribution: Perconaandspec.tde.supported: trueso the operator and webhook permit Transparent Data Encryption (pg_tde) on it.The
dbimage reference is a placeholder for the Percona Server for PostgreSQL 17.x build that bundles pg_tde and the tde_heap access method; swap it for the real image before merge. Depends on thespec.tdecatalog field from kubedb/apimachinery#1831.