Appendixes
storage) and the volume for WALs (walStorage).|storage) and the volume for WALs (walStorage).
# A more restrictive rule for TLS and IP of origin is recommended
host replication streaming_replica all md5
The following manifest creates a new PostgreSQL 16.4 cluster, +
The following manifest creates a new PostgreSQL 17.0 cluster,
called target-db, using the pg_basebackup bootstrap method
to clone an external PostgreSQL cluster defined as source-db
(in the externalClusters array). As you can see, the source-db
@@ -791,7 +787,7 @@
All the requirements must be met for the clone operation to work, including -the same PostgreSQL version (in our case 16.4).
+the same PostgreSQL version (in our case 17.0).The second authentication method supported by CloudNativePG
with the pg_basebackup bootstrap is based on TLS client certificates.
@@ -822,7 +818,7 @@
This example can be easily adapted to cover an instance that resides outside the Kubernetes cluster.
-The manifest defines a new PostgreSQL 16.4 cluster called cluster-clone-tls,
+
The manifest defines a new PostgreSQL 17.0 cluster called cluster-clone-tls,
which is bootstrapped using the pg_basebackup method from the cluster-example
external cluster. The host is identified by the read/write service
in the same cluster, while the streaming_replica user is authenticated
@@ -835,7 +831,7 @@
You can also choose a hybrid approach, where only part of the certificates is generated outside CNPG.
-By default, the operator generates a single CA and uses it for both client and -server certificates, which are then managed and renewed automatically.
+By default, the operator automatically generates a single Certificate Authority +(CA) to issue both client and server certificates. These certificates are +managed continuously by the operator, with automatic renewal 7 days before +expiration (within a 90-day validity period).
+Info
+You can adjust this default behavior by configuring the
+CERTIFICATE_DURATION and EXPIRING_CHECK_THRESHOLD environment variables.
+For detailed guidance, refer to the Operator Configuration.
Important
+Certificate renewal does not cause any downtime for the PostgreSQL server, +as a simple reload operation is sufficient. However, any user-managed +certificates not controlled by CloudNativePG must be re-issued following the +renewal process.
+The operator generates a self-signed CA and stores it in a generic secret diff --git a/assets/documentation/1.23/cloudnative-pg.v1/index.html b/assets/documentation/1.23/cloudnative-pg.v1/index.html index dba1e49a..592a1f21 100644 --- a/assets/documentation/1.23/cloudnative-pg.v1/index.html +++ b/assets/documentation/1.23/cloudnative-pg.v1/index.html @@ -236,16 +236,12 @@
Appears in:
- -AzureCredentials is the type for the credentials to be used to upload -files to Azure Blob Storage. The connection string contains every needed -information. If the connection string is not specified, we'll need the -storage account name and also one (and only one) of:
-storageKey
-storageSasToken
-inheriting the credentials from the pod environment by setting inheritFromAzureAD to true
-| Field | Description |
|---|---|
connectionString-SecretKeySelector - |
-
- The connection string to be used - |
-
storageAccount-SecretKeySelector - |
-
- The storage account where to upload data - |
-
storageKey-SecretKeySelector - |
-
- The storage account key to be used in conjunction -with the storage account name - |
-
storageSasToken-SecretKeySelector - |
-
- A shared-access-signature to be used in conjunction with -the storage account name - |
-
inheritFromAzureAD-bool - |
-
- Use the Azure AD based authentication without providing explicitly the keys. - |
-
Appears in:
barmanObjectStoreThe configuration for the barman-cloud tool suite
@@ -1045,13 +953,13 @@LocalObjectReferenceLocalObjectReference are embedded into this type.)
No description provided.endpointCAEndpointCA store the CA bundle of the barman endpoint. @@ -1073,7 +981,7 @@
cluster [Required]The cluster to backup
@@ -1137,14 +1045,14 @@BarmanCredentialsBarmanCredentials are embedded into this type.)
The potential credentials for each cloud provider
endpointCAEndpointCA store the CA bundle of the barman endpoint. @@ -1329,140 +1237,6 @@
BackupTarget describes the preferred targets for a backup
-Appears in:
-BarmanCredentials an object containing the potential credentials for each cloud provider
- -| Field | Description |
|---|---|
googleCredentials-GoogleCredentials - |
-
- The credentials to use to upload data to Google Cloud Storage - |
-
s3Credentials-S3Credentials - |
-
- The credentials to use to upload data to S3 - |
-
azureCredentials-AzureCredentials - |
-
- The credentials to use to upload data to Azure Blob Storage - |
-
Appears in:
-BarmanObjectStoreConfiguration contains the backup configuration -using Barman against an S3-compatible object storage
- -| Field | Description |
|---|---|
BarmanCredentials-BarmanCredentials - |
-(Members of BarmanCredentials are embedded into this type.)
- The potential credentials for each cloud provider - |
-
endpointURL-string - |
-
- Endpoint to be used to upload data to the cloud, -overriding the automatic endpoint discovery - |
-
endpointCA-SecretKeySelector - |
-
- EndpointCA store the CA bundle of the barman endpoint. -Useful when using self-signed certificates to avoid -errors with certificate issuer and barman-cloud-wal-archive - |
-
destinationPath [Required]-string - |
-
- The path where to store the backup (i.e. s3://bucket/path/to/folder) -this path, with different destination folders, will be used for WALs -and for data - |
-
serverName-string - |
-
- The server name on S3, the cluster name is used if this -parameter is omitted - |
-
wal-WalBackupConfiguration - |
-
- The configuration for the backup of the WAL stream. -When not defined, WAL files will be stored uncompressed and may be -unencrypted in the object store, according to the bucket default policy. - |
-
data-DataBackupConfiguration - |
-
- The configuration to be used to backup the data files -When not defined, base backups files will be stored uncompressed and may -be unencrypted in the object store, according to the bucket default -policy. - |
-
tags-map[string]string - |
-
- Tags is a list of key value pairs that will be passed to the -Barman --tags option. - |
-
historyTags-map[string]string - |
-
- HistoryTags is a list of key value pairs that will be passed to the -Barman --history-tags option. - |
-
Appears in:
secretName of the secret containing the initial credentials for the @@ -1668,7 +1442,7 @@
secretName of the secret containing the initial credentials for the @@ -1760,7 +1534,7 @@
secretName of the secret containing the initial credentials for the @@ -2033,7 +1807,7 @@
superuserSecretThe secret containing the superuser password. If not defined a new @@ -2060,7 +1834,7 @@
imagePullSecretsThe list of pull secrets to be used to pull the images
@@ -2648,52 +2422,6 @@(Alias of string)
Appears in:
-CompressionType encapsulates the available types of compression
- -Appears in:
-ConfigMapKeySelector contains enough information to let you locate -the key of a ConfigMap
- -| Field | Description |
|---|---|
LocalObjectReference-LocalObjectReference - |
-(Members of LocalObjectReference are embedded into this type.)
- The name of the secret in the pod's namespace to select from. - |
-
key [Required]-string - |
-
- The key to select - |
-
Appears in:
Appears in:
- -DataBackupConfiguration is the configuration of the backup of -the data directory
- -| Field | Description |
|---|---|
compression-CompressionType - |
-
- Compress a backup file (a tar file per tablespace) while streaming it
-to the object store. Available options are empty string (no
-compression, default), |
-
encryption-EncryptionType - |
-
- Whenever to force the encryption of files (if the bucket is
-not already configured for that).
-Allowed options are empty string (use the bucket policy, default),
- |
-
jobs-int32 - |
-
- The number of parallel jobs to be used to upload the backup, defaults -to 2 - |
-
immediateCheckpoint-bool - |
-
- Control whether the I/O workload for the backup initial checkpoint will
-be limited, according to the |
-
additionalCommandArgs [Required]-[]string - |
-
- AdditionalCommandArgs represents additional arguments that can be appended -to the 'barman-cloud-backup' command-line invocation. These arguments -provide flexibility to customize the backup process further according to -specific requirements or configurations. -Example: -In a scenario where specialized backup options are required, such as setting -a specific timeout or defining custom behavior, users can use this field -to specify additional command arguments. -Note: -It's essential to ensure that the provided arguments are valid and supported -by the 'barman-cloud-backup' command, to avoid potential errors or unintended -behavior during execution. - |
-
Appears in:
(Alias of string)
Appears in:
-EncryptionType encapsulated the available types of encryption
-(Alias of string)
Appears in:
@@ -2978,7 +2623,7 @@barmanObjectStoreThe configuration for the barman-cloud tool suite
@@ -2987,35 +2632,6 @@Appears in:
- -GoogleCredentials is the type for the Google Cloud Storage credentials. -This needs to be specified even if we run inside a GKE environment.
- -| Field | Description |
|---|---|
applicationCredentials-SecretKeySelector - |
-
- The secret containing the Google Cloud Storage JSON file with the credentials - |
-
gkeEnvironment-bool - |
-
- If set to true, will presume that it's running inside a GKE environment, -default to false. - |
-
Appears in:
LDAPScheme defines the possible schemes for LDAP
-Appears in:
-LocalObjectReference contains enough information to let you locate a -local object with a known type inside the same namespace
- -| Field | Description |
|---|---|
name [Required]-string - |
-
- Name of the referent. - |
-
Appears in:
customQueriesConfigMapThe list of config maps containing the custom queries
customQueriesSecretThe list of secrets containing the custom queries
@@ -3724,7 +3284,7 @@authQuerySecretThe credentials of the user that need to be used for the authentication @@ -3985,7 +3545,7 @@
cluster [Required]This is the cluster reference on which the Pooler will work. @@ -4094,14 +3654,14 @@
secretRefsSecretRefs holds a list of references to Secrets
configMapRefsConfigMapRefs holds a list of references to ConfigMaps
@@ -4425,7 +3985,7 @@passwordSecretSecret containing the password of the role (if present) @@ -4533,63 +4093,6 @@
Appears in:
- -S3Credentials is the type for the credentials to be used to upload -files to S3. It can be provided in two alternative ways:
-explicitly passing accessKeyId and secretAccessKey
-inheriting the role from the pod environment by setting inheritFromIAMRole to true
-| Field | Description |
|---|---|
accessKeyId-SecretKeySelector - |
-
- The reference to the access key id - |
-
secretAccessKey-SecretKeySelector - |
-
- The reference to the secret access key - |
-
region-SecretKeySelector - |
-
- The reference to the secret containing the region name - |
-
sessionToken-SecretKeySelector - |
-
- The references to the session key - |
-
inheritFromIAMRole-bool - |
-
- Use the role based authentication without providing explicitly the keys. - |
-
Appears in:
cluster [Required]The cluster to backup
@@ -4723,57 +4226,6 @@Appears in:
-SecretKeySelector contains enough information to let you locate -the key of a Secret
- -| Field | Description |
|---|---|
LocalObjectReference-LocalObjectReference - |
-(Members of LocalObjectReference are embedded into this type.)
- The name of the secret in the pod's namespace to select from. - |
-
key [Required]-string - |
-
- The key to select - |
-
Appears in:
Appears in:
- -WalBackupConfiguration is the configuration of the backup of the -WAL stream
- -| Field | Description |
|---|---|
compression-CompressionType - |
-
- Compress a WAL file before sending it to the object store. Available
-options are empty string (no compression, default), |
-
encryption-EncryptionType - |
-
- Whenever to force the encryption of files (if the bucket is
-not already configured for that).
-Allowed options are empty string (use the bucket policy, default),
- |
-
maxParallel-int - |
-
- Number of WAL files to be either archived in parallel (when the -PostgreSQL instance is archiving to a backup object store) or -restored in parallel (when a PostgreSQL standby is fetching WAL -files from a recovery object store). If not specified, WAL files -will be processed one at a time. It accepts a positive integer as a -value - with 1 being the minimum accepted value. - |
-
CloudNativePG is an independent open source project that doesn't endorse any -company.
-The "Support" page website lists -third-party companies and individuals that provide products or services related -to CloudNativePG.
-If you're providing commercial support for CloudNativePG, add yourself or your -organization to that list.
- -du (optional, for kubectl cnpg status)Important
diff --git a/assets/documentation/1.23/controller/index.html b/assets/documentation/1.23/controller/index.html index ab1e1634..c9fa71d1 100644 --- a/assets/documentation/1.23/controller/index.html +++ b/assets/documentation/1.23/controller/index.html @@ -221,7 +221,7 @@Example of a Cluster-Wide Catalog using ClusterImageCatalog Resource:
apiVersion: postgresql.cnpg.io/v1
@@ -338,7 +334,7 @@ Image Catalog
- major: 15
image: ghcr.io/cloudnative-pg/postgresql:15.6
- major: 16
- image: ghcr.io/cloudnative-pg/postgresql:16.4
+ image: ghcr.io/cloudnative-pg/postgresql:17.0
A Cluster resource has the flexibility to reference either an ImageCatalog
or a ClusterImageCatalog to precisely specify the desired image.