Skip to content

K8SPG-624 Add support for S3ForcePathStyle and verifyTLS for custom extensions #1214

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 14 commits into
base: main
Choose a base branch
from
+491 −48
Open

K8SPG-624 Add support for S3ForcePathStyle and verifyTLS for custom extensions #1214

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
ed35964
K8SPG-624 Add support for Using S3ForcePathStyle / verifyTLS customE…
gkech Jul 8, 2025
c9a63b3
Update build/postgres-operator/install-extensions.sh
gkech Jul 8, 2025
d667fec
disable cr extensions
gkech Jul 8, 2025
245b6e5
fix params for extension installer
gkech Jul 8, 2025
7a0551e
handle the missing env vars properly for versions <2.8.0
gkech Jul 8, 2025
25feab6
cr: properly wire disabe ssl with the right env var
gkech Jul 9, 2025
241317a
Merge branch 'main' into K8SPG-624
gkech Jul 9, 2025
1b16cc0
try no boolean
gkech Jul 9, 2025
47fcc18
Update build/postgres-operator/install-extensions.sh
gkech Jul 10, 2025
b04ac57
Update build/postgres-operator/install-extensions.sh
gkech Jul 10, 2025
2680f9b
add conditionally the env vars if the cr is set
gkech Jul 10, 2025
08ff640
Merge branch 'main' into K8SPG-624
hors Jul 14, 2025
d076202
add e2e test
hors Jul 14, 2025
1757812
Update e2e-tests/functions
gkech Jul 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions build/crd/percona/generated/pgv2.percona.com_perconapgclusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8340,8 +8340,12 @@ spec:
properties:
bucket:
type: string
disableSSL:
type: string
endpoint:
type: string
forcePathStyle:
type: string
region:
type: string
secret:
Expand Down
8 changes: 8 additions & 0 deletions build/postgres-operator/install-extensions.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,14 @@ if [[ -n $STORAGE_ENDPOINT ]]; then
args+=(-endpoint "$STORAGE_ENDPOINT")
fi

if [[ ${STORAGE_DISABLE_SSL} == "true" ]]; then
args+=(-disable-ssl)
fi

if [[ ${STORAGE_FORCE_PATH_STYLE} == "true" ]]; then
args+=(-force-path-style)
fi

for key in "${extensions[@]}"; do
if [ -f "${PGDATA_EXTENSIONS}"/"${key}".installed ]; then
echo "Extension ${key} already installed"
Expand Down
10 changes: 6 additions & 4 deletions cmd/extension-installer/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ import (

func main() {
var storageType, endpoint, region, bucket, key, extensionPath string
var install, uninstall bool
var install, uninstall, forcePathStyle, disableSSL bool

flag.StringVar(&storageType, "type", "", "Storage type")
flag.StringVar(&endpoint, "endpoint", "", "Storage endpoint")
Expand All @@ -23,6 +23,8 @@ func main() {

flag.BoolVar(&install, "install", false, "Install extension")
flag.BoolVar(&uninstall, "uninstall", false, "Uninstall extension")
flag.BoolVar(&forcePathStyle, "force-path-style", false, "Force path style")
flag.BoolVar(&disableSSL, "disable-ssl", false, "Disable SSL")
flag.Parse()

if (install && uninstall) || (!install && !uninstall) {
Expand All @@ -31,7 +33,7 @@ func main() {

log.Printf("starting extension installer for %s/%s (%s) in %s", bucket, key, storageType, region)

storage := initStorage(extensions.StorageType(storageType), endpoint, bucket, region)
storage := initStorage(extensions.StorageType(storageType), endpoint, bucket, region, forcePathStyle, disableSSL)

packageName := key + ".tar.gz"

Expand Down Expand Up @@ -70,10 +72,10 @@ func main() {
}
}

func initStorage(storageType extensions.StorageType, endpoint, bucket, region string) extensions.ObjectGetter {
func initStorage(storageType extensions.StorageType, endpoint, bucket, region string, s3ForcePathStyle, disableSSL bool) extensions.ObjectGetter {
switch storageType {
case extensions.StorageTypeS3:
return extensions.NewS3(endpoint, region, bucket)
return extensions.NewS3(endpoint, region, bucket, s3ForcePathStyle, disableSSL)
default:
log.Fatalf("unknown storage type: %s", os.Getenv("STORAGE_TYPE"))
}
Expand Down
4 changes: 4 additions & 0 deletions config/crd/bases/pgv2.percona.com_perconapgclusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8747,8 +8747,12 @@ spec:
properties:
bucket:
type: string
disableSSL:
type: string
endpoint:
type: string
forcePathStyle:
type: string
region:
type: string
secret:
Expand Down
4 changes: 4 additions & 0 deletions deploy/bundle.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9044,8 +9044,12 @@ spec:
properties:
bucket:
type: string
disableSSL:
type: string
endpoint:
type: string
forcePathStyle:
type: string
region:
type: string
secret:
Expand Down
2 changes: 2 additions & 0 deletions deploy/cr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -629,6 +629,8 @@ spec:
# bucket: pg-extensions
# region: eu-central-1
# endpoint: s3.eu-central-1.amazonaws.com
# forcePathStyle: false
# disableSSL: false
# secret:
# name: cluster1-extensions-secret
# builtin:
Expand Down
4 changes: 4 additions & 0 deletions deploy/crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9044,8 +9044,12 @@ spec:
properties:
bucket:
type: string
disableSSL:
type: string
endpoint:
type: string
forcePathStyle:
type: string
region:
type: string
secret:
Expand Down
4 changes: 4 additions & 0 deletions deploy/cw-bundle.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9044,8 +9044,12 @@ spec:
properties:
bucket:
type: string
disableSSL:
type: string
endpoint:
type: string
forcePathStyle:
type: string
region:
type: string
secret:
Expand Down
100 changes: 99 additions & 1 deletion e2e-tests/functions
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,6 +125,56 @@ get_operator_pod() {
echo $(kubectl get pods -n "${OPERATOR_NS:-$NAMESPACE}" --selector=app.kubernetes.io/name=percona-postgresql-operator -o jsonpath='{.items[].metadata.name}')
}

retry() {
local max=$1
local delay=$2
shift 2 # cut delay and max args
local n=1

until "$@"; do
if [[ $n -ge $max ]]; then
echo "The command ${*} has failed after $n attempts."
exit 1
fi
((n++))
sleep $delay
done
}

deploy_minio() {
local access_key
local secret_key
access_key="$(kubectl -n "${NAMESPACE}" get secret minio-secret -o jsonpath='{.data.AWS_ACCESS_KEY_ID}' | base64 -d)"
secret_key="$(kubectl -n "${NAMESPACE}" get secret minio-secret -o jsonpath='{.data.AWS_SECRET_ACCESS_KEY}' | base64 -d)"

helm uninstall -n "${NAMESPACE}" minio-service || :
helm repo remove minio || :
helm repo add minio https://charts.min.io/
retry 10 60 helm install minio-service \
-n "${NAMESPACE}" \
--version "${MINIO_VER}" \
--set replicas=1 \
--set mode=standalone \
--set resources.requests.memory=256Mi \
--set rootUser=rootuser \
--set rootPassword=rootpass123 \
--set "users[0].accessKey"="$(printf '%q' "$(printf '%q' "$access_key")")" \
--set "users[0].secretKey"="$(printf '%q' "$(printf '%q' "$secret_key")")" \
--set "users[0].policy"=consoleAdmin \
--set service.type=ClusterIP \
--set configPathmc=/tmp/.minio/ \
--set persistence.size=2G \
--set securityContext.enabled=false \
minio/minio
MINIO_POD=$(kubectl -n "${NAMESPACE}" get pods --selector=release=minio-service -o 'jsonpath={.items[].metadata.name}')
wait_pod $MINIO_POD

# create bucket
kubectl -n "${NAMESPACE}" run -i --rm aws-cli --image=perconalab/awscli --restart=Never -- \
bash -c "AWS_ACCESS_KEY_ID='$access_key' AWS_SECRET_ACCESS_KEY='$secret_key' AWS_DEFAULT_REGION=us-east-1 \
/usr/bin/aws --endpoint-url http://minio-service:9000 s3 mb s3://operator-testing"
}

deploy_s3_secrets() {
set +o xtrace
printf "[global]\nrepo1-s3-key=%s\nrepo1-s3-key-secret=%s\n" \
Expand All @@ -147,6 +197,7 @@ deploy_s3_secrets() {
;;
"custom-extensions" | "major-upgrade")
kubectl -n "${NAMESPACE}" apply -f "${TESTS_CONFIG_DIR}/cloud-secret.yml"
kubectl -n "${NAMESPACE}" apply -f "${TESTS_CONFIG_DIR}/minio-secret.yml"
;;
*)
kubectl -n "${NAMESPACE}" create secret generic "${test_name}-pgbackrest-secrets" --from-file=cloud.conf="${TEMP_DIR}/pgbackrest-secret.ini"
Expand Down Expand Up @@ -229,13 +280,20 @@ get_cr() {
.spec.backups.pgbackrest.repos += [{"name":"repo3","azure":{"container":"'$BUCKET'"}}]
' $TEMP_DIR/cr.yaml
;;
"custom-extensions" | "major-upgrade")
"major-upgrade")
yq eval -i '
.spec.extensions.image = "'$IMAGE'" |
.spec.extensions.imagePullPolicy = "Always" |
.spec.extensions.storage = {"type": "s3", "bucket": "pg-extensions", "region": "eu-central-1", "secret": {"name": "aws-s3-secret"}}
' $TEMP_DIR/cr.yaml
;;
"custom-extensions")
yq eval -i '
.spec.extensions.image = "'$IMAGE'" |
.spec.extensions.imagePullPolicy = "Always" |
.spec.extensions.storage = {"type": "s3", "bucket": "operator-testing", "region": "us-east-1", "endpoint": "http://minio-service:9000", "forcePathStyle": "true", "disableSSL": "true", "secret": {"name": "minio-secret"}}
' $TEMP_DIR/cr.yaml
;;
esac
cat $TEMP_DIR/cr.yaml
}
Expand Down Expand Up @@ -276,12 +334,52 @@ get_psql_user_host() {
kubectl -n ${NAMESPACE} get "secret/${secret_name}" --template='{{.data.host | base64decode }}'
}

get_aws_access_key() {
local secret_name=${1}

kubectl -n ${NAMESPACE} get "secret/${secret_name}" --template='{{.data.AWS_SECRET_ACCESS_KEY | base64decode }}'
}

get_aws_access_key_id() {
local secret_name=${1}

kubectl -n ${NAMESPACE} get "secret/${secret_name}" --template='{{.data.AWS_ACCESS_KEY_ID | base64decode }}'
}

get_psql_user_host() {
local secret_name=${1}

kubectl -n ${NAMESPACE} get "secret/${secret_name}" --template='{{.data.host | base64decode }}'
}
get_instance_set_pods() {
local instance=${1:-instance1}

kubectl get pods -n ${NAMESPACE} --selector postgres-operator.crunchydata.com/instance-set=${instance} -o custom-columns='NAME:.metadata.name' --no-headers
}

copy_custom_extensions_form_aws() {
set +o xtrace

access_key="$(kubectl -n "${NAMESPACE}" get secret minio-secret -o jsonpath='{.data.AWS_ACCESS_KEY_ID}' | base64 -d)"
secret_key="$(kubectl -n "${NAMESPACE}" get secret minio-secret -o jsonpath='{.data.AWS_SECRET_ACCESS_KEY}' | base64 -d)"

kubectl -n "${NAMESPACE}" run -i --rm aws-cli \
--image=perconalab/awscli \
--restart=Never -- \
bash -c "
AWS_ACCESS_KEY_ID=$(get_aws_access_key_id aws-s3-secret) \
AWS_SECRET_ACCESS_KEY=$(get_aws_access_key aws-s3-secret) \
AWS_DEFAULT_REGION=eu-central-1 \
/usr/bin/aws --endpoint-url https://s3.amazonaws.com s3 cp s3://pg-extensions/ /tmp/ --recursive &&

AWS_ACCESS_KEY_ID='${access_key}' \
AWS_SECRET_ACCESS_KEY='${secret_key}' \
AWS_DEFAULT_REGION=us-east-1 \
/usr/bin/aws --endpoint-url http://minio-service:9000 s3 cp /tmp/ s3://operator-testing/ --recursive
"
set -o xtrace
}

get_psql_pod_host() {
local pod=${1}

Expand Down
2 changes: 2 additions & 0 deletions e2e-tests/tests/custom-extensions/00-deploy-operator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,3 +12,5 @@ commands:
deploy_operator
deploy_client
deploy_s3_secrets
deploy_minio
copy_custom_extensions_form_aws
10 changes: 7 additions & 3 deletions e2e-tests/tests/custom-extensions/02-assert.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,15 +35,19 @@ spec:
value: s3
- name: STORAGE_ENDPOINT
- name: STORAGE_REGION
value: eu-central-1
value: us-east-1
- name: STORAGE_BUCKET
value: pg-extensions
value: operator-testing
- name: INSTALL_EXTENSIONS
- name: PG_VERSION
- name: PGDATA_EXTENSIONS
- name: STORAGE_DISABLE_SSL
value: "true"
- name: STORAGE_FORCE_PATH_STYLE
value: "true"
envFrom:
- secretRef:
name: aws-s3-secret
name: minio-secret
resources: {}
volumeMounts:
- mountPath: /pgdata
Expand Down
2 changes: 1 addition & 1 deletion e2e-tests/tests/custom-extensions/02-install-pg_cron.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,4 +11,4 @@ spec:
dynamicConfiguration:
postgresql:
parameters:
shared_preload_libraries: pg_cron
shared_preload_libraries: pg_cron
10 changes: 7 additions & 3 deletions e2e-tests/tests/custom-extensions/05-assert.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,15 +35,19 @@ spec:
value: s3
- name: STORAGE_ENDPOINT
- name: STORAGE_REGION
value: eu-central-1
value: us-east-1
- name: STORAGE_BUCKET
value: pg-extensions
value: operator-testing
- name: INSTALL_EXTENSIONS
- name: PG_VERSION
- name: PGDATA_EXTENSIONS
- name: STORAGE_DISABLE_SSL
value: "true"
- name: STORAGE_FORCE_PATH_STYLE
value: "true"
envFrom:
- secretRef:
name: aws-s3-secret
name: minio-secret
resources: {}
volumeMounts:
- mountPath: /pgdata
Expand Down
10 changes: 7 additions & 3 deletions e2e-tests/tests/custom-extensions/06-assert.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,15 +37,19 @@ spec:
value: s3
- name: STORAGE_ENDPOINT
- name: STORAGE_REGION
value: eu-central-1
value: us-east-1
- name: STORAGE_BUCKET
value: pg-extensions
value: operator-testing
- name: INSTALL_EXTENSIONS
- name: PG_VERSION
- name: PGDATA_EXTENSIONS
- name: STORAGE_DISABLE_SSL
value: "true"
- name: STORAGE_FORCE_PATH_STYLE
value: "true"
envFrom:
- secretRef:
name: aws-s3-secret
name: minio-secret
resources: {}
volumeMounts:
- mountPath: /pgdata
Expand Down
Loading
Loading