Patch v1.5.0 to set user and group in security context

charts/postgres-operator-ui/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 name: postgres-operator-ui
-version: 1.4.0
-appVersion: 1.4.0
+version: 1.5.0
+appVersion: 1.5.0
 home: https://github.com/zalando/postgres-operator
 description: Postgres Operator UI provides a graphical interface for a convenient database-as-a-service user experience
 keywords:
@@ -14,8 +14,6 @@ keywords:
 maintainers:
 - name: Zalando
   email: opensource@zalando.de
-- name: siku4
-  email: sk@sik-net.de
 sources:
 - https://github.com/zalando/postgres-operator
 engine: gotpl

charts/postgres-operator-ui/index.yaml

@@ -1,9 +1,32 @@
 apiVersion: v1
 entries:
   postgres-operator-ui:
+  - apiVersion: v1
+    appVersion: 1.5.0
+    created: "2020-05-04T16:36:04.770110276+02:00"
+    description: Postgres Operator UI provides a graphical interface for a convenient
+      database-as-a-service user experience
+    digest: ff373185f9d125f918935b226eaed0a245cc4dd561f884424d92f094b279afe9
+    home: https://github.com/zalando/postgres-operator
+    keywords:
+    - postgres
+    - operator
+    - ui
+    - cloud-native
+    - patroni
+    - spilo
+    maintainers:
+    - email: opensource@zalando.de
+      name: Zalando
+    name: postgres-operator-ui
+    sources:
+    - https://github.com/zalando/postgres-operator
+    urls:
+    - postgres-operator-ui-1.5.0.tgz
+    version: 1.5.0
   - apiVersion: v1
     appVersion: 1.4.0
-    created: "2020-02-24T15:32:47.610967635+01:00"
+    created: "2020-05-04T16:36:04.769604808+02:00"
     description: Postgres Operator UI provides a graphical interface for a convenient
       database-as-a-service user experience
     digest: 00e0eff7056d56467cd5c975657fbb76c8d01accd25a4b7aca81bc42aeac961d
@@ -26,4 +49,4 @@ entries:
     urls:
     - postgres-operator-ui-1.4.0.tgz
     version: 1.4.0
-generated: "2020-02-24T15:32:47.610348278+01:00"
+generated: "2020-05-04T16:36:04.768922456+02:00"

charts/postgres-operator-ui/templates/deployment.yaml

@@ -41,6 +41,10 @@ spec:
               value: "http://localhost:8081"
             - name: "OPERATOR_API_URL"
               value: {{ .Values.envs.operatorApiUrl }}
+            - name: "OPERATOR_CLUSTER_NAME_LABEL"
+              value: {{ .Values.envs.operatorClusterNameLabel }}
+            - name: "RESOURCES_VISIBLE"
+              value: {{ .Values.envs.resourcesVisible }}
             - name: "TARGET_NAMESPACE"
               value: {{ .Values.envs.targetNamespace }}
             - name: "TEAMS"

charts/postgres-operator-ui/values.yaml

@@ -8,7 +8,7 @@ replicaCount: 1
 image:
   registry: registry.opensource.zalan.do
   repository: acid/postgres-operator-ui
-  tag: v1.4.0
+  tag: v1.5.0
   pullPolicy: "IfNotPresent"
 
 rbac:
@@ -25,8 +25,8 @@ serviceAccount:
 # configure UI pod resources
 resources:
   limits:
-    cpu: 300m
-    memory: 3000Mi
+    cpu: 200m
+    memory: 200Mi
   requests:
     cpu: 100m
     memory: 100Mi
@@ -36,12 +36,14 @@ envs:
   # IMPORTANT: While operator chart and UI chart are idendependent, this is the interface between
   # UI and operator API. Insert the service name of the operator API here!
   operatorApiUrl: "http://postgres-operator:8080"
+  operatorClusterNameLabel: "cluster-name"
+  resourcesVisible: "False"
   targetNamespace: "default"
 
 # configure UI service
 service:
   type: "ClusterIP"
-  port: "8080"
+  port: "8081"
   # If the type of the service is NodePort a port can be specified using the nodePort field
   # If the nodePort field is not specified, or if it has no value, then a random port is used
   # notePort: 32521

charts/postgres-operator/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 name: postgres-operator
-version: 1.4.0
-appVersion: 1.4.0
+version: 1.5.1
+appVersion: 1.5.1
 home: https://github.com/zalando/postgres-operator
 description: Postgres Operator creates and manages PostgreSQL clusters running in Kubernetes
 keywords:

charts/postgres-operator/crds/operatorconfigurations.yaml

@@ -168,6 +168,10 @@ spec:
                   type: string
                 secret_name_template:
                   type: string
+                spilo_runasuser:
+                  type: integer
+                spilo_runasgroup:
+                  type: integer
                 spilo_fsgroup:
                   type: integer
                 spilo_privileged:

charts/postgres-operator/crds/postgresqls.yaml

@@ -373,6 +373,10 @@ spec:
               items:
                 type: object
                 additionalProperties: true
+            spiloRunAsUser:
+              type: integer
+            spiloRunAsGroup:
+              type: integer
             spiloFSGroup:
               type: integer
             standby:

charts/postgres-operator/index.yaml

@@ -2,33 +2,33 @@ apiVersion: v1
 entries:
   postgres-operator:
   - apiVersion: v1
-    appVersion: 1.4.0
-    created: "2020-02-20T17:39:25.443276193+01:00"
+    appVersion: 1.5.1
+    created: "2021-01-05T12:07:46.259913369+00:00"
     description: Postgres Operator creates and manages PostgreSQL clusters running
       in Kubernetes
-    digest: b93ccde5581deb8ed0857136b8ce74ca3f1b7240438fa4415f705764a1300bed
+    digest: 455ecf0446dc22c3b65c8ecba9019b4bd711d9a6e0ec0605d9851393b8c835ea
     home: https://github.com/zalando/postgres-operator
     keywords:
-    - postgres
-    - operator
-    - cloud-native
-    - patroni
-    - spilo
+      - postgres
+      - operator
+      - cloud-native
+      - patroni
+      - spilo
     maintainers:
-    - email: opensource@zalando.de
-      name: Zalando
+      - email: opensource@zalando.de
+        name: Zalando
     name: postgres-operator
     sources:
-    - https://github.com/zalando/postgres-operator
+      - https://github.com/zalando/postgres-operator
     urls:
-    - postgres-operator-1.4.0.tgz
-    version: 1.4.0
+      - postgres-operator-1.5.1.tgz
+    version: 1.5.1
   - apiVersion: v1
-    appVersion: 1.3.0
-    created: "2020-02-20T17:39:25.441532163+01:00"
+    appVersion: 1.5.0
+    created: "2020-05-04T16:36:19.646719041+02:00"
     description: Postgres Operator creates and manages PostgreSQL clusters running
       in Kubernetes
-    digest: 7e788fd37daec76a01f6d6f9fe5be5b54f5035e4eba0041e80a760d656537325
+    digest: 43510e4ed7005b2b80708df24cfbb0099b263b4a2954cff4e8f305543760be6d
     home: https://github.com/zalando/postgres-operator
     keywords:
     - postgres
@@ -43,14 +43,14 @@ entries:
     sources:
     - https://github.com/zalando/postgres-operator
     urls:
-    - postgres-operator-1.3.0.tgz
-    version: 1.3.0
+    - postgres-operator-1.5.0.tgz
+    version: 1.5.0
   - apiVersion: v1
-    appVersion: 1.2.0
-    created: "2020-02-20T17:39:25.440278302+01:00"
+    appVersion: 1.4.0
+    created: "2020-05-04T16:36:19.645338751+02:00"
     description: Postgres Operator creates and manages PostgreSQL clusters running
       in Kubernetes
-    digest: d10710c7cf19f4e266e7704f5d1e98dcfc61bee3919522326c35c22ca7d2f2bf
+    digest: f8b90fecfc3cb825b94ed17edd9d5cefc36ae61801d4568597b4a79bcd73b2e9
     home: https://github.com/zalando/postgres-operator
     keywords:
     - postgres
@@ -61,12 +61,10 @@ entries:
     maintainers:
     - email: opensource@zalando.de
       name: Zalando
-    - email: kgyoo8232@gmail.com
-      name: kimxogus
     name: postgres-operator
     sources:
     - https://github.com/zalando/postgres-operator
     urls:
-    - postgres-operator-1.2.0.tgz
-    version: 1.2.0
-generated: "2020-02-20T17:39:25.439168098+01:00"
+    - postgres-operator-1.4.0.tgz
+    version: 1.4.0
+generated: "2020-05-04T16:36:19.643857452+02:00"

charts/postgres-operator/values-crd.yaml

@@ -1,7 +1,7 @@
 image:
   registry: registry.opensource.zalan.do
   repository: acid/postgres-operator
-  tag: v1.4.0
+  tag: v1.5.1
   pullPolicy: "IfNotPresent"
 
 # Optionally specify an array of imagePullSecrets.
@@ -28,7 +28,7 @@ configGeneral:
   # Select if setup uses endpoints (default), or configmaps to manage leader (DCS=k8s)
   # kubernetes_use_configmaps: false
   # Spilo docker image
-  docker_image: registry.opensource.zalan.do/acid/spilo-cdp-12:1.6-p115
+  docker_image: registry.opensource.zalan.do/acid/spilo-12:1.6-p3
   # max number of instances in Postgres cluster. -1 = no limit
   min_instances: -1
   # min number of instances in Postgres cluster. -1 = no limit
@@ -67,7 +67,7 @@ configKubernetes:
   #   keya: valuea
   #   keyb: valueb
 
-  # list of annotations propagated from cluster manifest to statefulset and deployment 
+  # list of annotations propagated from cluster manifest to statefulset and deployment
   # downscaler_annotations:
   #   - deployment-time
   #   - downscaler/*
@@ -119,6 +119,9 @@ configKubernetes:
   pod_terminate_grace_period: 5m
   # template for database user secrets generated by the operator
   secret_name_template: "{username}.{cluster}.credentials.{tprkind}.{tprgroup}"
+  # set user and group for the spilo container (required to run Spilo as non-root process)
+  # spilo_runasuser: "101"
+  # spilo_runasgroup: "103"
   # group ID with write-access to volumes (required to run Spilo as non-root process)
   # spilo_fsgroup: 103
 
@@ -214,7 +217,7 @@ configAwsOrGcp:
 # configure K8s cron job managed by the operator
 configLogicalBackup:
   # image for pods of the logical backup job (example runs pg_dumpall)
-  logical_backup_docker_image: "registry.opensource.zalan.do/acid/logical-backup"
+  logical_backup_docker_image: "registry.opensource.zalan.do/acid/logical-backup:master-58"
   # S3 Access Key ID
   logical_backup_s3_access_key_id: ""
   # S3 bucket to store backup results
@@ -265,7 +268,7 @@ configConnectionPooler:
   # db user for pooler to use
   connection_pooler_user: "pooler"
   # docker image
-  connection_pooler_image: "registry.opensource.zalan.do/acid/pgbouncer"
+  connection_pooler_image: "registry.opensource.zalan.do/acid/pgbouncer:master-7"
   # max db connections the pooler should hold
   connection_pooler_max_db_connections: 60
   # default pooling mode

charts/postgres-operator/values.yaml

@@ -1,7 +1,7 @@
 image:
   registry: registry.opensource.zalan.do
   repository: acid/postgres-operator
-  tag: v1.4.0
+  tag: v1.5.1
   pullPolicy: "IfNotPresent"
 
 # Optionally specify an array of imagePullSecrets.
@@ -28,7 +28,7 @@ configGeneral:
   # Select if setup uses endpoints (default), or configmaps to manage leader (DCS=k8s)
   # kubernetes_use_configmaps: "false"
   # Spilo docker image
-  docker_image: registry.opensource.zalan.do/acid/spilo-cdp-12:1.6-p115
+  docker_image: registry.opensource.zalan.do/acid/spilo-12:1.6-p3
   # max number of instances in Postgres cluster. -1 = no limit
   min_instances: "-1"
   # min number of instances in Postgres cluster. -1 = no limit
@@ -110,6 +110,9 @@ configKubernetes:
   pod_terminate_grace_period: 5m
   # template for database user secrets generated by the operator
   secret_name_template: "{username}.{cluster}.credentials.{tprkind}.{tprgroup}"
+  # set user and group for the spilo container (required to run Spilo as non-root process)
+  # spilo_runasuser: "101"
+  # spilo_runasgroup: "103"
   # group ID with write-access to volumes (required to run Spilo as non-root process)
   # spilo_fsgroup: "103"
 
@@ -203,7 +206,7 @@ configAwsOrGcp:
 # configure K8s cron job managed by the operator
 configLogicalBackup:
   # image for pods of the logical backup job (example runs pg_dumpall)
-  logical_backup_docker_image: "registry.opensource.zalan.do/acid/logical-backup"
+  logical_backup_docker_image: "registry.opensource.zalan.do/acid/logical-backup:master-58"
   # S3 Access Key ID
   logical_backup_s3_access_key_id: ""
   # S3 bucket to store backup results
@@ -257,7 +260,7 @@ configConnectionPooler:
   # db user for pooler to use
   connection_pooler_user: "pooler"
   # docker image
-  connection_pooler_image: "registry.opensource.zalan.do/acid/pgbouncer"
+  connection_pooler_image: "registry.opensource.zalan.do/acid/pgbouncer:master-7"
   # max db connections the pooler should hold
   connection_pooler_max_db_connections: "60"
   # default pooling mode

docs/index.md

@@ -37,9 +37,10 @@ in some overarching orchestration, like rolling updates to improve the user
 experience.
 
 Monitoring or tuning Postgres is not in scope of the operator in the current
-state. Other tools like [ZMON](https://opensource.zalando.com/zmon/),
-[Prometheus](https://prometheus.io/) or more Postgres specific options can be
-used to complement it.
+state. However, with globally configurable sidecars we provide enough
+flexibility to complement it with other tools like [ZMON](https://opensource.zalando.com/zmon/),
+[Prometheus](https://prometheus.io/) or more Postgres specific options.
+
 
 ## Overview of involved entities
 
@@ -70,12 +71,26 @@ Please, report any issues discovered to https://github.com/zalando/postgres-oper
 
 ## Talks
 
-1. "Building your own PostgreSQL-as-a-Service on Kubernetes" talk by Alexander Kukushkin, KubeCon NA 2018: [video](https://www.youtube.com/watch?v=G8MnpkbhClc) | [slides](https://static.sched.com/hosted_files/kccna18/1d/Building%20your%20own%20PostgreSQL-as-a-Service%20on%20Kubernetes.pdf)
+- "PostgreSQL on K8S at Zalando: Two years in production" talk by Alexander Kukushkin, FOSSDEM 2020: [video](https://fosdem.org/2020/schedule/event/postgresql_postgresql_on_k8s_at_zalando_two_years_in_production/) | [slides](https://fosdem.org/2020/schedule/event/postgresql_postgresql_on_k8s_at_zalando_two_years_in_production/attachments/slides/3883/export/events/attachments/postgresql_postgresql_on_k8s_at_zalando_two_years_in_production/slides/3883/PostgreSQL_on_K8s_at_Zalando_Two_years_in_production.pdf)
+
+- "Postgres as a Service at Zalando" talk by Jan Mußler, DevOpsDays Poznań 2019: [video](https://www.youtube.com/watch?v=FiWS5m72XI8)
+
+- "Building your own PostgreSQL-as-a-Service on Kubernetes" talk by Alexander Kukushkin, KubeCon NA 2018: [video](https://www.youtube.com/watch?v=G8MnpkbhClc) | [slides](https://static.sched.com/hosted_files/kccna18/1d/Building%20your%20own%20PostgreSQL-as-a-Service%20on%20Kubernetes.pdf)
+
+- "PostgreSQL and Kubernetes: DBaaS without a vendor-lock" talk by Oleksii Kliukin, PostgreSQL Sessions 2018: [video](https://www.youtube.com/watch?v=q26U2rQcqMw) | [slides](https://speakerdeck.com/alexeyklyukin/postgresql-and-kubernetes-dbaas-without-a-vendor-lock)
+
+- "PostgreSQL High Availability on Kubernetes with Patroni" talk by Oleksii Kliukin, Atmosphere 2018: [video](https://www.youtube.com/watch?v=cFlwQOPPkeg) | [slides](https://speakerdeck.com/alexeyklyukin/postgresql-high-availability-on-kubernetes-with-patroni)
+
+- "Blue elephant on-demand: Postgres + Kubernetes" talk by Oleksii Kliukin and Jan Mussler, FOSDEM 2018: [video](https://fosdem.org/2018/schedule/event/blue_elephant_on_demand_postgres_kubernetes/) | [slides (pdf)](https://www.postgresql.eu/events/fosdem2018/sessions/session/1735/slides/59/FOSDEM%202018_%20Blue_Elephant_On_Demand.pdf)
+
+- "Kube-Native Postgres" talk by Josh Berkus, KubeCon 2017: [video](https://www.youtube.com/watch?v=Zn1vd7sQ_bc)
+
+## Posts
 
-2. "PostgreSQL and Kubernetes: DBaaS without a vendor-lock" talk by Oleksii Kliukin, PostgreSQL Sessions 2018: [video](https://www.youtube.com/watch?v=q26U2rQcqMw) | [slides](https://speakerdeck.com/alexeyklyukin/postgresql-and-kubernetes-dbaas-without-a-vendor-lock)
+- "How to set up continuous backups and monitoring" by Pål Kristensen on [GitHub](https://github.com/zalando/postgres-operator/issues/858#issuecomment-608136253), Mar. 2020.
 
-3. "PostgreSQL High Availability on Kubernetes with Patroni" talk by Oleksii Kliukin, Atmosphere 2018: [video](https://www.youtube.com/watch?v=cFlwQOPPkeg) | [slides](https://speakerdeck.com/alexeyklyukin/postgresql-high-availability-on-kubernetes-with-patroni)
+- "Postgres on Kubernetes with the Zalando operator" by Vito Botta on [has_many :code](https://vitobotta.com/2020/02/05/postgres-kubernetes-zalando-operator/), Feb. 2020.
 
-4. "Blue elephant on-demand: Postgres + Kubernetes" talk by Oleksii Kliukin and Jan Mussler, FOSDEM 2018: [video](https://fosdem.org/2018/schedule/event/blue_elephant_on_demand_postgres_kubernetes/) | [slides (pdf)](https://www.postgresql.eu/events/fosdem2018/sessions/session/1735/slides/59/FOSDEM%202018_%20Blue_Elephant_On_Demand.pdf)
+- "Running PostgreSQL in Google Kubernetes Engine" by Kenneth Rørvik on [Repill Linpro](https://www.redpill-linpro.com/techblog/2019/09/28/postgres-in-kubernetes.html), Sep. 2019.
 
-5. "Kube-Native Postgres" talk by Josh Berkus, KubeCon 2017: [video](https://www.youtube.com/watch?v=Zn1vd7sQ_bc)
+- "Zalando Postgres Operator: One Year Later" by Sergey Dudoladov on [Open Source Zalando](https://opensource.zalando.com/blog/2018/11/postgres-operator/), Nov. 2018

docs/reference/cluster_manifest.md

@@ -64,6 +64,16 @@ These parameters are grouped directly under  the `spec` key in the manifest.
 * **dockerImage**
   custom Docker image that overrides the **docker_image** operator parameter.
   It should be a [Spilo](https://github.com/zalando/spilo) image. Optional.
+
+* **spiloRunAsUser**
+  sets the user ID which should be used in the container to run the process.
+  This must be set to run the container without root. By default the container
+  runs with root. This option only works for Spilo versions >= 1.6-p3.
+
+* **spiloRunAsGroup**
+  sets the group ID which should be used in the container to run the process.
+  This must be set to run the container without root. By default the container
+  runs with root. This option only works for Spilo versions >= 1.6-p3.
 
 * **spiloFSGroup**
   the Persistent Volumes for the Spilo pods in the StatefulSet will be owned and