Full Code of CrunchyData/postgres-operator-examples for AI

Repository: CrunchyData/postgres-operator-examples
Branch: main
Commit: 26c6fba88a4e
Files: 49
Total size: 58.1 KB

Directory structure:
gitextract_apfpt_9c/

├── .github/
│   └── ISSUE_TEMPLATE/
│       └── issue.md
├── LICENSE.md
├── README.md
├── helm/
│   └── postgres/
│       ├── Chart.yaml
│       ├── templates/
│       │   ├── NOTES.txt
│       │   ├── _azure.tpl
│       │   ├── _gcs.tpl
│       │   ├── _s3.tpl
│       │   ├── pgbackrest-secret.yaml
│       │   └── postgres.yaml
│       └── values.yaml
└── kustomize/
    ├── azure/
    │   ├── .gitignore
    │   ├── azure.conf.example
    │   ├── kustomization.yaml
    │   └── postgres.yaml
    ├── certmanager/
    │   ├── README.md
    │   ├── certman/
    │   │   ├── ca-cert.yaml
    │   │   ├── ca-issuer.yaml
    │   │   ├── kustomization.yaml
    │   │   ├── selfsigned-clusterissuer.yaml
    │   │   └── selfsigned-issuer.yaml
    │   └── postgres/
    │       ├── cert-repl.yaml
    │       ├── cert.yaml
    │       ├── kustomization.yaml
    │       └── postgres.yaml
    ├── gcs/
    │   ├── .gitignore
    │   ├── gcs.conf
    │   ├── kustomization.yaml
    │   └── postgres.yaml
    ├── high-availability/
    │   ├── ha-postgres.yaml
    │   └── kustomization.yaml
    ├── keycloak/
    │   ├── keycloak.yaml
    │   ├── kustomization.yaml
    │   └── postgres.yaml
    ├── multi-backup-repo/
    │   ├── .gitignore
    │   ├── azure.conf.example
    │   ├── gcs.conf
    │   ├── kustomization.yaml
    │   ├── postgres.yaml
    │   └── s3.conf.example
    ├── pgadmin/
    │   ├── README.md
    │   ├── kustomization.yaml
    │   └── pgadmin.yaml
    ├── postgres/
    │   ├── kustomization.yaml
    │   └── postgres.yaml
    └── s3/
        ├── .gitignore
        ├── kustomization.yaml
        ├── postgres.yaml
        └── s3.conf.example

================================================
FILE CONTENTS
================================================

================================================
FILE: .github/ISSUE_TEMPLATE/issue.md
================================================
---
name: Open an Issue for PGO Examples
about: Open an issue specific to the "postgres-operator-examples" repository. For all other issues please visit https://github.com/CrunchyData/postgres-operator
---

Please report any bugs or feature requests specific to the PGO Examples that are in this repository. This includes anything around the examples for Kustomize and Helm.

For any bugs or feature request related to PGO itself, please visit https://github.com/CrunchyData/postgres-operator


================================================
FILE: LICENSE.md
================================================
                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/

   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

   1. Definitions.

      "License" shall mean the terms and conditions for use, reproduction,
      and distribution as defined by Sections 1 through 9 of this document.

      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.

      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.

      "You" (or "Your") shall mean an individual or Legal Entity
      exercising permissions granted by this License.

      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.

      "Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.

      "Work" shall mean the work of authorship, whether in Source or
      Object form, made available under the License, as indicated by a
      copyright notice that is included in or attached to the work
      (an example is provided in the Appendix below).

      "Derivative Works" shall mean any work, whether in Source or Object
      form, that is based on (or derived from) the Work and for which the
      editorial revisions, annotations, elaborations, or other modifications
      represent, as a whole, an original work of authorship. For the purposes
      of this License, Derivative Works shall not include works that remain
      separable from, or merely link (or bind by name) to the interfaces of,
      the Work and Derivative Works thereof.

      "Contribution" shall mean any work of authorship, including
      the original version of the Work and any modifications or additions
      to that Work or Derivative Works thereof, that is intentionally
      submitted to Licensor for inclusion in the Work by the copyright owner
      or by an individual or Legal Entity authorized to submit on behalf of
      the copyright owner. For the purposes of this definition, "submitted"
      means any form of electronic, verbal, or written communication sent
      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise
      designated in writing by the copyright owner as "Not a Contribution."

      "Contributor" shall mean Licensor and any individual or Legal Entity
      on behalf of whom a Contribution has been received by Licensor and
      subsequently incorporated within the Work.

   2. Grant of Copyright License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      copyright license to reproduce, prepare Derivative Works of,
      publicly display, publicly perform, sublicense, and distribute the
      Work and such Derivative Works in Source or Object form.

   3. Grant of Patent License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct
      or contributory patent infringement, then any patent licenses
      granted to You under this License for that Work shall terminate
      as of the date such litigation is filed.

   4. Redistribution. You may reproduce and distribute copies of the
      Work or Derivative Works thereof in any medium, with or without
      modifications, and in Source or Object form, provided that You
      meet the following conditions:

      (a) You must give any other recipients of the Work or
          Derivative Works a copy of this License; and

      (b) You must cause any modified files to carry prominent notices
          stating that You changed the files; and

      (c) You must retain, in the Source form of any Derivative Works
          that You distribute, all copyright, patent, trademark, and
          attribution notices from the Source form of the Work,
          excluding those notices that do not pertain to any part of
          the Derivative Works; and

      (d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed
          as part of the Derivative Works; within the Source form or
          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. You may add Your own attribution
          notices within Derivative Works that You distribute, alongside
          or as an addendum to the NOTICE text from the Work, provided
          that such additional attribution notices cannot be construed
          as modifying the License.

      You may add Your own copyright statement to Your modifications and
      may provide additional or different license terms and conditions
      for use, reproduction, or distribution of Your modifications, or
      for any such Derivative Works as a whole, provided Your use,
      reproduction, and distribution of the Work otherwise complies with
      the conditions stated in this License.

   5. Submission of Contributions. Unless You explicitly state otherwise,
      any Contribution intentionally submitted for inclusion in the Work
      by You to the Licensor shall be under the terms and conditions of
      this License, without any additional terms or conditions.
      Notwithstanding the above, nothing herein shall supersede or modify
      the terms of any separate license agreement you may have executed
      with Licensor regarding such Contributions.

   6. Trademarks. This License does not grant permission to use the trade
      names, trademarks, service marks, or product names of the Licensor,
      except as required for reasonable and customary use in describing the
      origin of the Work and reproducing the content of the NOTICE file.

   7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. You are solely responsible for determining the
      appropriateness of using or redistributing the Work and assume any
      risks associated with Your exercise of permissions under this License.

   8. Limitation of Liability. In no event and under no legal theory,
      whether in tort (including negligence), contract, or otherwise,
      unless required by applicable law (such as deliberate and grossly
      negligent acts) or agreed to in writing, shall any Contributor be
      liable to You for damages, including any direct, indirect, special,
      incidental, or consequential damages of any character arising as a
      result of this License or out of the use or inability to use the
      Work (including but not limited to damages for loss of goodwill,
      work stoppage, computer failure or malfunction, or any and all
      other commercial damages or losses), even if such Contributor
      has been advised of the possibility of such damages.

   9. Accepting Warranty or Additional Liability. While redistributing
      the Work or Derivative Works thereof, You may choose to offer,
      and charge a fee for, acceptance of support, warranty, indemnity,
      or other liability obligations and/or rights consistent with this
      License. However, in accepting such obligations, You may act only
      on Your own behalf and on Your sole responsibility, not on behalf
      of any other Contributor, and only if You agree to indemnify,
      defend, and hold each Contributor harmless for any liability
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.

   END OF TERMS AND CONDITIONS

   Copyright 2017 - 2026 Crunchy Data Solutions, Inc.

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.


================================================
FILE: README.md
================================================
# Examples for Using [PGO](https://github.com/CrunchyData/postgres-operator), the Postgres Operator from Crunchy Data

This repository contains a collection of examples for deploying, operating, and maintaining Postgres clusters using PGO, the Postgres Operator from Crunchy Data as part of [Crunchy Postgres for Kubernetes](https://www.crunchydata.com/products/crunchy-postgresql-for-kubernetes). Using these examples assumes that you already have PGO running. The kustomize installer for PGO can be found in the [postgres-operator](https://github.com/CrunchyData/postgres-operator) repo. The PGO helm installer can be [installed via the OCI registry](https://access.crunchydata.com/documentation/postgres-operator/latest/installation/helm).

The use of these examples with PGO and other container images (aside from those provided by Crunchy Data) will require modifications of the examples.

### Using these Examples

The examples are grouped by various tools that can be used to deploy them.
Each of the examples has its own README that guides you through the process of deploying it.
The best way to get started is to fork this repository and experiment with the examples.
The examples as provided are designed for the use of PGO along with Crunchy Data's Postgres distribution, Crunchy Postgres, as Crunchy Postgres for Kubernetes.  For more information on the use of container images downloaded from the Crunchy Data Developer Portal or other third party sources, please see 'License and Terms' below.

By default, these examples are set to use the `v1` version of the PostgresCluster API, which is only available in PGO v6. If you plan to use these examples with PGO v5, or want to use the older API with PGO v6, you will need to change the version suffix in the `apiVersion` of the PostgresCluster manifests to `v1beta1`.

### Help with the Examples

* For general questions or community support, we welcome you to join our [community Discord](https://discord.gg/BnsMEeaPBV).
* If you believe you have discovered a bug, please open an issue in the [PGO project](https://github.com/CrunchyData/postgres-operator).
* You can find the full Crunchy Postgres for Kubernetes documentation [here](https://access.crunchydata.com/documentation/postgres-operator/v5/).
* You can find out more information about PGO, the Postgres Operator from [Crunchy Data](https://www.crunchydata.com), at the [project page](https://github.com/CrunchyData/postgres-operator).

### FAQs, License and Terms

For more information regarding PGO, the Postgres Operator project from Crunchy Data, and Crunchy Postgres for Kubernetes, please see the [frequently asked questions](https://access.crunchydata.com/documentation/postgres-operator/latest/faq).

For information regarding the software versions of the components included and Kubernetes version compatibility, please see the [components and compatibility section of the Crunchy Postgres for Kubernetes documentation](https://access.crunchydata.com/documentation/postgres-operator/latest/references/components).

The examples provided in this project repository are available subject to the [Apache 2.0](https://github.com/CrunchyData/postgres-operator-examples/blob/-/LICENSE.md) license with the PGO logo and branding assets covered by our [trademark guidelines](https://github.com/CrunchyData/postgres-operator/blob/-/docs/static/logos/TRADEMARKS.md).

The examples as provided in this repo are designed for the use of PGO along with Crunchy Data's Postgres distribution, Crunchy Postgres, as Crunchy Postgres for Kubernetes. The unmodified use of these examples will result in downloading container images from Crunchy Data repositories - specifically the Crunchy Data Developer Portal. The use of container images downloaded from the Crunchy Data Developer Portal are subject to the [Crunchy Data Developer Program terms](https://www.crunchydata.com/developers/terms-of-use).


================================================
FILE: helm/postgres/Chart.yaml
================================================
apiVersion: v2
name: postgrescluster
description: A Helm chart for Kubernetes
type: application
# The version below should match the version on the PostgresCluster CRD
version: 6.0.0
appVersion: 6.0.0


================================================
FILE: helm/postgres/templates/NOTES.txt
================================================
Thank you for deploying a Crunchy PostgreSQL cluster!

                          ((((((((((((((((((((((
                    (((((((((((((%%%%%%%(((((((((((((((
                (((((((((((%%%             %%%%((((((((((((
            (((((((((((%%(   (((( (            %%%(((((((((((
          (((((((((((((%%     (( ,((               %%%(((((((((((
        (((((((((((((((%%         *%%/            %%%%%%%((((((((((
      (((((((((((((((((((%%(( %%%%%%%%%%#(((((%%%%%%%%%%#((((((((((((
    ((((((((((((((((((%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%((((((((((((((
  *((((((((((((((((((((%%%%%%     /%%%%%%%%%%%%%%%%%%%((((((((((((((((
  (((((((((((((((((((((((%%%/      .%,             %%%((((((((((((((((((,
  ((((((((((((((((((((((%                             %#(((((((((((((((((
(((((((((((((((%%%%%%                                 #%(((((((((((((((((
((((((((((((((%%                                         %%(((((((((((((((,
((((((((((((%%%#%                                     %   %%(((((((((((((((
((((((((((((%.                      %                 %     #((((((((((((((
(((((((((((%%                        %               %%*     %(((((((((((((
#(###(###(#%%                      %%%    %%        %%%      #%%#(###(###(#
###########%%%%%   /%%%%%%%%%%%%%       %%       %%%%%         ,%%#######
###############%%       %%%%%%        %%%    %%%%%%%%             %%#####
  ################%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   %%               %%##
  ################%%        %%%%%%%%%%%%%%%%%      %%%%               %
    ##############%#        %%   (%%%%%%%           %%%%%%
    #############%     %%%%%                      %%%%%%%%%%%
      ###########%       %%%%%%%%%%%            %%%%%%%%%
        #########%%     %%            %%%%%%%%%%%%%%%#
          ########%%   %%                  %%%%%%%%%
              ######%% %%                      %%%%%%
                ####%%%                        %%%%%  %
                      %%                         %%%%


================================================
FILE: helm/postgres/templates/_azure.tpl
================================================
{{/* Allow for Azure secret information to be stored in a Secret */}}
{{- define "postgres.azure" }}
[global]
{{- if .azure }}
  {{- if .azure.account }}
repo{{ add .index 1 }}-azure-account={{ .azure.account }}
  {{- end }}
  {{- if .azure.key }}
repo{{ add .index 1 }}-azure-key={{ .azure.key }}
  {{- end }}
{{- end }}
{{ end }}


================================================
FILE: helm/postgres/templates/_gcs.tpl
================================================
{{/* Allow for GCS secret information to be stored in a Secret */}}
{{- define "postgres.gcs" }}
[global]
{{- if .gcs }}
repo{{ add .index 1 }}-gcs-key=/etc/pgbackrest/conf.d/gcs-key.json
{{- end }}
{{ end }}


================================================
FILE: helm/postgres/templates/_s3.tpl
================================================
{{/* Allow for S3 secret information to be stored in a Secret */}}
{{- define "postgres.s3" }}
[global]
{{- if .s3 }}
  {{- if .s3.key }}
repo{{ add .index 1 }}-s3-key={{ .s3.key }}
  {{- end }}
  {{- if .s3.keySecret }}
repo{{ add .index 1 }}-s3-key-secret={{ .s3.keySecret }}
  {{- end }}
  {{- if .s3.keyType }}
repo{{ add .index 1 }}-s3-key-type={{ .s3.keyType }}
  {{- end }}
  {{- if .s3.encryptionPassphrase }}
repo{{ add .index 1 }}-cipher-pass={{ .s3.encryptionPassphrase }}
  {{- end }}
{{- end }}
{{ end }}


================================================
FILE: helm/postgres/templates/pgbackrest-secret.yaml
================================================
{{- if or .Values.multiBackupRepos .Values.s3 .Values.gcs .Values.azure }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ default .Release.Name .Values.name }}-pgbackrest-secret
type: Opaque
data:
{{- if .Values.multiBackupRepos }}
  {{- range $index, $repo := .Values.multiBackupRepos }}
  {{- if $repo.s3 }}
  {{- $args := dict "s3" $repo.s3 "index" $index }}
  s3.conf: |-
        {{ include "postgres.s3" $args | b64enc }}
  {{- else if $repo.gcs }}
  {{- $args := dict "gcs" $repo.gcs "index" $index }}
  gcs.conf: |-
        {{ include "postgres.gcs" $args | b64enc }}
  gcs-key.json: |-
        {{ $repo.gcs.key | b64enc }}
  {{- else if $repo.azure }}
  {{- $args := dict "azure" $repo.azure "index" $index }}
  azure.conf: |-
        {{ include "postgres.azure" $args | b64enc }}
  {{- end }}
{{- end }}
{{- else if .Values.s3 }}
  {{- $args := dict "s3" .Values.s3 "index" 0 }}
  s3.conf: |-
        {{ include "postgres.s3" $args | b64enc }}
{{- else if .Values.gcs }}
  {{- $args := dict "gcs" .Values.gcs "index" 0 }}
  gcs.conf: |-
        {{ include "postgres.gcs" $args | b64enc }}
  gcs-key.json: |-
        {{ .Values.gcs.key | b64enc }}
{{- else if .Values.azure }}
  {{- $args := dict "azure" .Values.azure "index" 0 }}
  azure.conf: |-
        {{ include "postgres.azure" $args | b64enc }}
{{- end }}
{{- end }}


================================================
FILE: helm/postgres/templates/postgres.yaml
================================================
apiVersion: postgres-operator.crunchydata.com/{{ required "You must set the PostgresCluster API version to deploy." .Values.apiVersion }}
kind: PostgresCluster
metadata:
  name: {{ default .Release.Name .Values.name }}
spec:
  postgresVersion: {{ required "You must set the version of Postgres to deploy." .Values.postgresVersion }}
  {{- if .Values.postGISVersion }}
  postGISVersion: {{ quote .Values.postGISVersion }}
  {{- end }}
  {{- if .Values.imagePostgres }}
  image: {{ .Values.imagePostgres | quote }}
  {{- end }}
  {{- if .Values.port }}
  port: {{ .Values.port }}
  {{- end }}
  {{- if .Values.instances }}
  instances:
{{ toYaml .Values.instances | indent 4 }}
  {{- else }}
  instances:
    - name: {{ default "instance1" .Values.instanceName | quote }}
      replicas: {{ default 1 .Values.instanceReplicas }}
      dataVolumeClaimSpec:
        {{- if .Values.instanceStorageClassName }}
        storageClassName: {{ .Values.instanceStorageClassName | quote }}
        {{- end }}
        accessModes:
        - "ReadWriteOnce"
        resources:
          requests:
            storage: {{ default "1Gi" .Values.instanceSize | quote }}
      {{- if or .Values.instanceMemory .Values.instanceCPU }}
      resources:
        limits:
          cpu: {{ default "" .Values.instanceCPU | quote }}
          memory: {{ default "" .Values.instanceMemory | quote }}
      {{- end }}
  {{- end }}
  backups:
    pgbackrest:
      {{- if .Values.imagePgBackRest }}
      image: {{ .Values.imagePgBackRest | quote }}
      {{- end }}
      {{- if .Values.pgBackRestConfig }}
{{ toYaml .Values.pgBackRestConfig | indent 6 }}
      {{- else if .Values.multiBackupRepos }}
      configuration:
      - secret:
          name: {{ default .Release.Name .Values.name }}-pgbackrest-secret
      global:
        {{- range $index, $repo := .Values.multiBackupRepos }}
        {{- if or $repo.s3 $repo.gcs $repo.azure }}
        repo{{ add $index 1 }}-path: /pgbackrest/{{ $.Release.Namespace }}/{{ default $.Release.Name $.Values.name }}/repo{{ add $index 1 }}
        {{- end }}
        {{- end }}
      repos:
      {{- range $index, $repo := .Values.multiBackupRepos }}
      - name: repo{{ add $index 1 }}
        {{- if $repo.volume }}
        volume:
          volumeClaimSpec:
            {{- if $repo.volume.backupsStorageClassName }}
            storageClassName: {{ .Values.backupsStorageClassName | quote }}
            {{- end }}
            accessModes:
            - "ReadWriteOnce"
            resources:
              requests:
                storage: {{ default "1Gi" $repo.volume.backupsSize | quote }}
        {{- else if $repo.s3 }}
        s3:
          bucket: {{ $repo.s3.bucket | quote }}
          endpoint: {{ $repo.s3.endpoint | quote }}
          region: {{ $repo.s3.region | quote }}
        {{- else if $repo.gcs }}
        gcs:
          bucket: {{ $repo.gcs.bucket | quote }}
        {{- else if $repo.azure }}
        azure:
          container: {{ $repo.azure.container | quote }}
        {{- end }}
      {{- end }}
      {{- else if .Values.s3 }}
      configuration:
      - secret:
          name: {{ default .Release.Name .Values.name }}-pgbackrest-secret
      global:
        repo1-path: /pgbackrest/{{ .Release.Namespace }}/{{ default .Release.Name .Values.name }}/repo1
        {{- if .Values.s3.encryptionPassphrase }}
        repo1-cipher-type: aes-256-cbc
        {{- end }}
      repos:
      - name: repo1
        s3:
          bucket: {{ .Values.s3.bucket | quote }}
          endpoint: {{ .Values.s3.endpoint | quote }}
          region: {{ .Values.s3.region | quote }}
      {{- else if .Values.gcs }}
      configuration:
      - secret:
          name: {{ default .Release.Name .Values.name }}-pgbackrest-secret
      global:
        repo1-path: /pgbackrest/{{ .Release.Namespace }}/{{ default .Release.Name .Values.name }}/repo1
      repos:
      - name: repo1
        gcs:
          bucket: {{ .Values.gcs.bucket | quote }}
      {{- else if .Values.azure }}
      configuration:
      - secret:
          name: {{ default .Release.Name .Values.name }}-pgbackrest-secret
      global:
        repo1-path: /pgbackrest/{{ .Release.Namespace }}/{{ default .Release.Name .Values.name }}/repo1
      repos:
      - name: repo1
        azure:
          container: {{ .Values.azure.container | quote }}
      {{- else }}
      repos:
      - name: repo1
        volume:
          volumeClaimSpec:
            {{- if .Values.backupsStorageClassName }}
            storageClassName: {{ .Values.backupsStorageClassName | quote }}
            {{- end }}
            accessModes:
            - "ReadWriteOnce"
            resources:
              requests:
                storage: {{ default "1Gi" .Values.backupsSize | quote }}
      {{- end }}
  {{- if or .Values.pgBouncerReplicas .Values.pgBouncerConfig }}
  proxy:
    pgBouncer:
      {{- if .Values.imagePgBouncer }}
      image: {{ .Values.imagePgBouncer | quote }}
      {{- end }}
      {{- if .Values.pgBouncerConfig }}
{{ toYaml .Values.pgBouncerConfig | indent 6 }}
      {{- else }}
      replicas: {{ .Values.pgBouncerReplicas }}
      {{- end }}
  {{- end }}
  {{- if .Values.patroni }}
  patroni:
{{ toYaml .Values.patroni | indent 4 }}
  {{- end }}
  {{- if .Values.users }}
  users:
{{ toYaml .Values.users | indent 4 }}
  {{- end }}
  {{- if .Values.service }}
  service:
{{ toYaml .Values.service | indent 4 }}
  {{- end }}
  {{- if .Values.dataSource }}
  dataSource:
{{ toYaml .Values.dataSource | indent 4 }}
  {{- end }}
  {{- if .Values.databaseInitSQL }}
  databaseInitSQL:
    name: {{ required "A ConfigMap name is required for running bootstrap SQL." .Values.databaseInitSQL.name | quote }}
    key: {{ required "A key in a ConfigMap containing any bootstrap SQL is required." .Values.databaseInitSQL.key | quote }}
  {{- end }}
  {{- if .Values.imagePullPolicy }}
  imagePullPolicy: {{ .Values.imagePullPolicy | quote }}
  {{- end }}
  {{- if .Values.imagePullSecrets }}
  imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 4 }}
  {{- end }}
  {{- if .Values.disableDefaultPodScheduling }}
  disableDefaultPodScheduling: true
  {{- end }}
  {{- if .Values.metadata }}
  metadata:
{{ toYaml .Values.metadata | indent 4 }}
  {{- end }}
  {{- if .Values.monitoring }}
  monitoring:
    pgmonitor:
      exporter:
        image: {{ default "" .Values.imageExporter | quote }}
        {{- if .Values.monitoringConfig }}
{{ toYaml .Values.monitoringConfig | indent 8 }}
        {{- end }}
  {{- end }}
  {{- if .Values.instrumentation }}
  instrumentation:
    config:
    {{- if .Values.instrumentationConfig }}
{{ toYaml .Values.instrumentationConfig | indent 6 }}
    {{- end }}
    image: {{ default "" .Values.instrumentationImage | quote }}
    logs:
    {{- if .Values.instrumentationLogs }}
{{ toYaml .Values.instrumentationLogs | indent 6 }}
    {{- end }}
    metrics:
    {{- if .Values.instrumentationMetrics }}
{{ toYaml .Values.instrumentationMetrics | indent 6 }}
    {{- end }}
    resources:
    {{- if .Values.instrumentationResources }}
{{ toYaml .Values.instrumentationResources | indent 6 }}
    {{- end }}
  {{- end }}
  {{- if .Values.shutdown }}
  shutdown: true
  {{- end }}
  {{- if .Values.standby }}
  standby:
    enabled: {{ .Values.standby.enabled }}
    repoName: {{ .Values.standby.repoName }}
    host: {{ .Values.standby.host }}
    port: {{ .Values.standby.port }}
  {{- end }}
  {{- if .Values.supplementalGroups }}
  supplementalGroups:
{{ toYaml .Values.supplementalGroups | indent 4 }}
  {{- end }}
  {{- if .Values.openshift }}
  openshift: true
  {{- else if eq .Values.openshift false }}
  openshift: false
  {{- end }}
  {{- if .Values.customTLSSecret }}
  customTLSSecret:
{{ toYaml .Values.customTLSSecret | indent 4 }}
  {{- end }}
  {{- if .Values.customReplicationTLSSecret }}
  customReplicationTLSSecret:
{{ toYaml .Values.customReplicationTLSSecret | indent 4 }}
  {{- end }}


================================================
FILE: helm/postgres/values.yaml
================================================
---
# For a full explanation of how to set up the custom resource, please refer to
# the documentation:
#    https://access.crunchydata.com/documentation/postgres-operator/v5/

###########
# General #
###########

# name is the name of the cluster. This defaults to the name of the Helm
# release.
# name: hippo

# postgresVersion sets the version to deploy. This version number needs to be
# available as one of the "RELATED_IMAGE_POSTGRES_..." images as part of the PGO
# installation if you want to deploy the image without setting the "postgres"
# image variable. This value is required.
postgresVersion: 18

# apiVersion sets the PostgresCluster API version to use. When deploying a
# PostgresCluster with PGO v6, you can use the newer v1 API version or the older
# v1beta1. When deploying a PostgresCluster with PGO v5, you must use the older
# PostgresCluster API version, v1beta1.
apiVersion: v1

# postGISVersion if set and coupled with a PostGIS enabled container, enables
# PostGIS. This version number needs to be available as one of the
# "RELATED_IMAGE_POSTGRES_..." images as part of the PGO installation if you
# want to deploy the image without setting the "postgres" image variable.
# postGISVersion: 3.4

# NOTE: pgBackRest is enabled by default. It must be set in
# "RELATED_IMAGE_PGBACKREST" on the PGO deployment, otherwise you will need to
# override the "pgBackRest" image.

# pgBouncerReplicas sets the number of pgBouncer instances to deploy. The
# default is 0. You need to set this to at least 1 to deploy pgBouncer or set
# "pgBouncerConfig". Setting "pgBouncerConfig" will override the value of
# pgBouncerReplicas. The "RELATED_IMAGE_PGBOUNCER" in the PGO deployment must be
# set if you want to enable this without explicitly setting "pgBouncer".
# pgBouncerReplicas: 1

# monitoring enables the ability to monitor the Postgres cluster through a
# metrics exporter that can be scraped by Prometheus. This defaults to the value
# below.
# monitoring: false

# instrumentation enables the ability to monitor the Postgres cluster through an
# OpenTelemetry collector. This defaults to the value below.
# This feature is currently behind the feature gates OpenTelemetryLogs and
# OpenTelemetryMetrics; at least one of these feature gates must be turned
# on for `instrumentation` to be turned on.
# instrumentation: false

###################
# Image Overrides #
###################

# imagePostgres can be a Postgres or GIS-enabled Postgres image. This defaults to the
# below value. "postgresVersion" needs to match the version of Postgres that is
# used here. If using the GIS-enabled Postgres image, you need to ensure
# "postGISVersion" matches the version of PostGIS used.
# imagePostgres: registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi8-17.4-0

# imagePgBackRest is the pgBackRest backup utility image. This defaults to the
# below value.
# imagePgBackRest: registry.developers.crunchydata.com/crunchydata/crunchy-pgbackrest:ubi8-2.54.1-1

# imagePgBouncer is the image for the PgBouncer connection pooler. This defaults
# to the below value.
# imagePgBouncer: registry.developers.crunchydata.com/crunchydata/crunchy-pgbouncer:ubi8-1.23-4

# imageExporter is the image name for the exporter used as a part of monitoring.
# This defaults to the value below.
# imageExporter: registry.developers.crunchydata.com/crunchydata/crunchy-postgres-exporter:ubi8-0.16.0-1

###########################
# Basic Postgres Settings #
###########################

# instanceName lets you set the name of your instances. This defaults to
# the value below. Setting "instances" overrides this value.
# instanceName: instance1

# instanceSize sets the size of the volume that contains the data. This defaults
# to the value below. Settings "instances" overrides this value.
# instanceSize: 1Gi

# instanceStorageClassName sets the storage class for the volume that contains the data.
# This defaults to the "default" storage class defined in the cluster.
# See: 'kubectl get storageclasses.storage.k8s.io | grep default'
# Settings "instances" overrides this value.
# instanceStorageClassName: "hostpath"

# instanceMemory sets the memory limit for the Postgres instances. This defaults
# to no limit being set, but an example value is set below. Settings "instances"
# overrides this value.
# instanceMemory: 2Gi

# instanceCPU sets the CPU limit for the Postgres instances. This defaults to
# no limit being set, but an example value is set below. Setting "instances"
# overrides this value.
# instanceCPU: 1000m

# instanceReplicas lets you set the total number of Postgres replicas. This
# defaults to the value below. More than on replica enables high availability
# (HA). Settings "instances" overrides this value.
# instanceReplicas: 1

##############################
# Advanced Postgres Settings #
##############################

# instances allows you to define one or more Postgres instance sets. By default,
# PGO will only deploy a single instance. Each instance set has similar
# characteristics to the other instances in the set, e.g. storage size, resource
# etc. You can have multiple replicas within an instance set.
#
# This allows you to fully customize the topology of your Postgres instances.
#
# For example, to set up an instance set with HA (due to the default pod
# topology spread constraints)
#
# instances:
#   - name: pgha1
#     replicas: 2
#     dataVolumeClaimSpec:
#       accessModes:
#       - "ReadWriteOnce"
#       resources:
#         requests:
#           storage: 1Gi
# instances: {}

# port sets the port that Postgres listens on. Defaults to 5432.
# port: 5432

# patroni lets you set the Patroni configuration for the Postgres cluster.
# for example, to set up synchronous replication:
# patroni:
#   dynamicConfiguration:
#     synchronous_mode: true
#     postgresql:
#       parameters:
#         synchronous_commit: "on"
# patroni: {}

# users sets any custom Postgres users and databases that they have  access to
# as well as any permissions associated with the user account.
# users: {}

# dataSource specifies a data source for bootstrapping a Postgres cluster.
# dataSource: {}

# customTLSSecret references a Secret that contains the relevant information for
# bringing external TLS artifacts to a PostgreSQL cluster. This provides the
# TLS for the cluster itself.
# customTLSSecret: {}

# customReplicationTLSSecret references a Secret that contains the relevant
# information for bringing external TLS artifacts to a PostgreSQL cluster. This
# provides the information for the replication user.
# customReplicationTLSSecret: {}

# databaseInitSQL references a ConfigMap that contains a SQL file that should be
# run a cluster bootstrap.
# databaseInitSQL:
#   name: bootstrap-sql
#   key: bootstrap.sql

# standby sets whether to run this as a standby cluster. Setting "enabled" to
# "true" enables the standby cluster while "repoName" points to a pgBackRest
# archive to replay WAL files from, and "host" and "port" point to a primary
# cluster from which to stream data.
# standby:
#   enabled: false
#   repoName: repo1
#   host: "192.0.2.2"
#   port: 5432

# shutdown when set scales the entire workload to zero. By default, this is not
# set.
# shutdown: true

#################################
# Backups / pgBackRest Settings #
#################################

# backupsSize sets the storage size of the backups to a volume in Kubernetes.
# can be overridden by "pgBackRestConfig", if set. Defaults to the value below.
# backupsSize: 1Gi

# backupsStorageClassName sets the storage class to a class existing in Kubernetes.
# Defaults to the "default" storage class defined in the cluster.
# Can be overridden by "pgBackRestConfig", if set.
# backupsStorageClassName: "hostpath"

# s3 allows for AWS S3 or an S3 compatible storage system to be used for
# backups. This allows for a quick setup with S3; if you need more advanced
# setup, use pgBackRestConfig.
# s3:
#   # bucket specifies the S3 bucket to use,
#   bucket: ""
#   # endpoint specifies the S3 endpoint to use.
#   endpoint: ""
#   # region specifies the S3 region to use. If your S3 storage system does not
#   # use "region", fill this in with a random value.
#   region: ""
#   # key is the S3 key. This is stored in a Secret.
#   key: ""
#   # keySecret is the S3 key secret. This is stored in a Secret.
#   keySecret: ""
#   # keyType can be configured to enable IAM integration via AssumeRole
#   # For more info, see the documentation at https://access.crunchydata.com/documentation/postgres-operator/latest/tutorials/backups-disaster-recovery/backups#using-an-aws-integrated-identity-provider-and-role
#   keyType: ""
#   # encryptionPassphrase is an optional parameter to enable encrypted backups
#   # with pgBackRest. This is encrypted by pgBackRest and does not use S3's
#   # built-in encryption system.
#   encryptionPassphrase: ""

# gcs allows for Google Cloud Storage (GCS) to be used for backups. This allows
# for a quick setup with GCS; if you need a more advanced setup, use
# "pgBackRestConfig".
# gcs:
#   # bucket is the name of the GCS bucket that the backups will be stored in.
#   bucket: ""
#   # key is a multi-line string that contains the GCS key, which is a JSON
#   # structure.
#   key: |
#     {}

# azure allows for Azure Blob Storage to be used for backups. This allows
# for a quick setup with Azure Blob Storage; if you need a more advanced setup,
# use "pgBackRestConfig".
# azure:
#   # account is the name of the Azure account to be used.
#   account: ""
#   # key is the Secret key used associated with the Azure account.
#   key: ""
#   # container is the Azure container that the backups will be stored in.
#   container: ""

# multiBackupRepos allows for backing up to multiple repositories. This is
# effectively uses the "quickstarts" for each of the backup types (volume, s3,
# gcs, azure). You can have any permutation of these types. You can set up to 4.
# can be overwritten by "pgBackRestConfig".
#
# You can't set "multiBackupRepos" and any of the individual quickstarts at the
# same time. "multiBackupRepos" will take precedence.
#
# Below is an example that enables one of each backup type.
# All available quickstart options are presented below; please see the backup types
# if you want to see how each option works.
# multiBackupRepos:
# - volume:
#     backupsSize: 1Gi
# - s3:
#     bucket: ""
#     endpoint: ""
#     region: ""
#     key: ""
#     keySecret: ""
#     keyType: ""
# - gcs:
#     bucket: ""
#     key: |
#       {}
# - azure:
#     account: ""
#     key: ""
#     container: ""

# pgBackRestConfig allows for the configuration of every pgBackRest option
# except for "image", which is set by "pgBackRest".
# pgBackRestConfig: {}

################################
# Pooling / pgBouncer Settings #
################################

# pgBouncerConfig sets all of the pgBouncer portions of the spec except for
# image. To set image, you need to set the "pgBouncer" setting.
# pgBouncerConfig: {}

#######################
# Monitoring Settings #
#######################

# monitoringConfig sets all of the monitoring portions of the spec except for the
# image. To set the image, which also enables monitoring, you need to set the
# "monitoring" setting.
# monitoringConfig: {}

# The following "instrumentation_" fields will set the specified parts of the instrumentation
# spec. To enable instrumentation, you need to set the "instrumentation" setting to "true".
# This feature is currently behind the feature gates OpenTelemetryMetrics and OpenTelemetryLogs.

# instrumentationConfig: {}
# instrumentationImage: ""
# instrumentationLogs: {}
# instrumentationMetrics: {}
# instrumentationResources: {}

#######################
# Kubernetes Settings #
#######################

# metadata contains any metadata that should be applied to all PGO managed
# objects in this Postgres cluster. This includes "annotations" and "labels" as
# sub-keys.
# metadata: {}

# service customizes the Service that exposes the Postgres primary.
# service: {}

# imagePullPolicy sets the pull policy for all the images. This defaults to
# the Kubernetes heuristic:
# https://kubernetes.io/docs/concepts/containers/images/#imagepullpolicy-defaulting
# imagePullPolicy: IfNotPresent

# imagePullSecrets references Secrets that credentials for pulling image from
# private repositories
# imagePullSecrets: []

# supplementalGroups sets any group IDs that should be assigned to
# Pods, particularly around file system constraints within a system
# supplementalGroups: []

# disableDefaultPodScheduling if set to true, will disable any of the default
# scheduling constraints for Pods, such as the default Pod Topology Spread
# Constraints. If set to false or unset, the default scheduling constraints will
# be used in addition to any customizations that are added in.
# disableDefaultPodScheduling: false

# openshift can be set explicitly if this is an OpenShift cluster or a cluster
# that uses a SecurityContextConstraint. This usually does not need to be set,
# but you may want to explicitly set it to "false" when using an SCC like
# "anyuid"
# openshift: false


================================================
FILE: kustomize/azure/.gitignore
================================================
azure.conf


================================================
FILE: kustomize/azure/azure.conf.example
================================================
[global]
repo1-azure-account=<YOUR_AZURE_ACCOUNT>
repo1-azure-key=<YOUR_AZURE_KEY>


================================================
FILE: kustomize/azure/kustomization.yaml
================================================
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: postgres-operator

secretGenerator:
- name: pgo-azure-creds
  files:
  - azure.conf

generatorOptions:
  disableNameSuffixHash: true

resources:
- postgres.yaml


================================================
FILE: kustomize/azure/postgres.yaml
================================================
apiVersion: postgres-operator.crunchydata.com/v1
kind: PostgresCluster
metadata:
  name: hippo-azure
spec:
  postgresVersion: 18
  instances:
    - dataVolumeClaimSpec:
        accessModes:
        - "ReadWriteOnce"
        resources:
          requests:
            storage: 1Gi
  backups:
    pgbackrest:
      configuration:
      - secret:
          name: pgo-azure-creds
      global:
        repo1-path: /pgbackrest/postgres-operator/hippo-azure/repo1
      repos:
      - name: repo1
        azure:
          container: "<YOUR_AZURE_CONTAINER>"


================================================
FILE: kustomize/certmanager/README.md
================================================
# Using Cert-Manager with Postgres Operator 5.x

## Introduction
Starting with version 5.0 of PGO, the Postgres Operator from Crunchy Data, TLS is on by default to secure all communication to/from the postgres cluster.  By default, the Operator will generate the necessary certificates for the Postgres cluster and components.  It is possible to provide custom certificates by storing the certificates in a Kubernetes Secret and pointing the Operator to those secrets in the Postgres manifest.

Cert-Manager can be used to dynamically generate and manage certificates in Kubernetes.   Cert-Manager can generate self-signed certificates or certificates from several certificate authorities.

This example shows how to use custom self-signed certificates generated by Cert-Manager.

## Cert-Manager Installation
The first step is to deploy Cert-Manager to the Kubernetes cluster.  To do this, follow the instructions on the Cert-Manager website (https://cert-manager.io/docs/installation/).

## Setup Certificate Issuer
After Cert-Manager has been deployed, the next step used in this example is to set up a Certificate Issuer.  The Certificate Issuer can be configured to be local to a namespace or cluster wide.  In the examples provided here, a cluster wide issuer is created.

### Configure Issuer

```
kubectl apply -k certman
```

This Kustomize deployment performs the following actions:

* Creates a cluster wide (ClusterIssuer) self-signed certificate issuer.
* Generates a common CA certificate.
* Creates a cluster wide (ClusterIssuer) CA certificate issuer using the generated CA certificate.

By default, the issues are created in the cert-manager namespace which is the default namespace for Cert-Manager.

The CA certificate issuer is important as the Postgres components require that the ca.crt be the same for the certificates generated to support Postgres.

## Deploy Postgres with Custom Certificates

With the cluster wide certificate issuer in place, the next step is to generate certificates and then instruct the Operator to use these certicates.

Two certificates will be generated by the Kustomize deployment.  The first certificate secret is named <cluster>-tls (hippo-tls in this example) and the second certificate <cluster>-repl-tls (hippo-repl-tls).  The critical different between the two certificates is the Common Name (CN).  For the replication certificate (<cluster>-repl-tls), the Common Name must be _crunchyrepl.  If the Common Name is not set properly then the replicas will fail doing bootstrap process.

In the Postgres manifest, two entries are added to point to the newly created Secrets.  The customTLSSecret key references the <cluster>-tls secret while the customReplicationTLSSecret references the <cluster>-repl-tls secret.

### Deploy Postgres

```shell
kubectl apply -k postgres
```

The following process takes place during the deployment:
* Custom certificate is generated for Postgres using the CA ClusterIssuer created in the previous steps.
* Custom certificate is generated for Postgres replication using the CA ClusterIssuer.
* Postgres cluster deployed using the custom certificates.


================================================
FILE: kustomize/certmanager/certman/ca-cert.yaml
================================================
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: selfsigned-ca
  namespace: cert-manager
spec:
  isCA: true
  commonName: postgres-operator
  secretName: root-secret
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: selfsigned-cluster-issuer
    kind: ClusterIssuer
    group: cert-manager.io

================================================
FILE: kustomize/certmanager/certman/ca-issuer.yaml
================================================
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: ca-issuer
  namespace: cert-manager
spec:
  ca:
    secretName: root-secret


================================================
FILE: kustomize/certmanager/certman/kustomization.yaml
================================================
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
- selfsigned-clusterissuer.yaml
- ca-cert.yaml
- ca-issuer.yaml


================================================
FILE: kustomize/certmanager/certman/selfsigned-clusterissuer.yaml
================================================
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-cluster-issuer
  namespace: cert-manager
spec:
  selfSigned: {}


================================================
FILE: kustomize/certmanager/certman/selfsigned-issuer.yaml
================================================
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: selfsigned-issuer
spec:
  selfSigned: {}


================================================
FILE: kustomize/certmanager/postgres/cert-repl.yaml
================================================
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: hippo-repl-certmanager
spec:
  # Secret names are always required.
  secretName: hippo-repl-tls
  duration: 2160h # 90d
  renewBefore: 360h # 15d
  subject:
    organizations:
    - hippo-org
  # The use of the common name field has been deprecated since 2000 and is
  # discouraged from being used.
  commonName: _crunchyrepl
  isCA: false
  privateKey:
    algorithm: ECDSA
    size: 256
  usages:
    - digital signature
    - key encipherment
  # At least one of a DNS Name, URI, or IP address is required.
  dnsNames:
  - _crunchyrepl
  issuerRef:
    name: ca-issuer
    # We can reference ClusterIssuers by changing the kind here.
    # The default value is Issuer (i.e. a locally namespaced Issuer)
    kind: ClusterIssuer
    # This is optional since cert-manager will default to this value however
    # if you are using an external issuer, change this to that issuer group.
    group: cert-manager.io


================================================
FILE: kustomize/certmanager/postgres/cert.yaml
================================================
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: hippo-certmanager
spec:
  # Secret names are always required.
  secretName: hippo-tls
  duration: 2160h # 90d
  renewBefore: 360h # 15d
  subject:
    organizations:
    - hippo-org
  # The use of the common name field has been deprecated since 2000 and is
  # discouraged from being used.
  commonName: hippo-primary
  isCA: false
  privateKey:
    algorithm: ECDSA
    size: 256
  usages:
    - digital signature
    - key encipherment
  # At least one of a DNS Name, URI, or IP address is required.
  dnsNames:
  - hippo-primary
  - hippo-primary.postgres-operator
  - hippo-primary.postgres-operator.svc
  - hippo-primary.postgres-operator.svc.cluster.local
  issuerRef:
    name: ca-issuer
    # We can reference ClusterIssuers by changing the kind here.
    # The default value is Issuer (i.e. a locally namespaced Issuer)
    kind: ClusterIssuer
    # This is optional since cert-manager will default to this value however
    # if you are using an external issuer, change this to that issuer group.
    group: cert-manager.io


================================================
FILE: kustomize/certmanager/postgres/kustomization.yaml
================================================
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: postgres-operator

resources:
- cert.yaml
- cert-repl.yaml
- postgres.yaml


================================================
FILE: kustomize/certmanager/postgres/postgres.yaml
================================================
apiVersion: postgres-operator.crunchydata.com/v1
kind: PostgresCluster
metadata:
  name: hippo
spec:
  postgresVersion: 18
  customReplicationTLSSecret:
    name: hippo-repl-tls
  customTLSSecret:
    name: hippo-tls
  instances:
    - replicas: 2
      dataVolumeClaimSpec:
        accessModes:
        - "ReadWriteOnce"
        resources:
          requests:
            storage: 1Gi
  backups:
    pgbackrest:
      repos:
      - name: repo1
        volume:
          volumeClaimSpec:
            accessModes:
            - "ReadWriteOnce"
            resources:
              requests:
                storage: 1Gi


================================================
FILE: kustomize/gcs/.gitignore
================================================
gcs-key.json


================================================
FILE: kustomize/gcs/gcs.conf
================================================
[global]
repo1-gcs-key=/etc/pgbackrest/conf.d/gcs-key.json


================================================
FILE: kustomize/gcs/kustomization.yaml
================================================
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: postgres-operator

secretGenerator:
- name: pgo-gcs-creds
  files:
  - gcs.conf
  - gcs-key.json

generatorOptions:
  disableNameSuffixHash: true

resources:
- postgres.yaml


================================================
FILE: kustomize/gcs/postgres.yaml
================================================
apiVersion: postgres-operator.crunchydata.com/v1
kind: PostgresCluster
metadata:
  name: hippo-gcs
spec:
  postgresVersion: 18
  instances:
    - dataVolumeClaimSpec:
        accessModes:
        - "ReadWriteOnce"
        resources:
          requests:
            storage: 1Gi
  backups:
    pgbackrest:
      configuration:
      - secret:
          name: pgo-gcs-creds
      global:
        repo1-path: /pgbackrest/postgres-operator/hippo-gcs/repo1
      repos:
      - name: repo1
        gcs:
          bucket: "<YOUR_GCS_BUCKET_NAME>"


================================================
FILE: kustomize/high-availability/ha-postgres.yaml
================================================
apiVersion: postgres-operator.crunchydata.com/v1
kind: PostgresCluster
metadata:
  name: hippo-ha
spec:
  postgresVersion: 18
  instances:
    - name: pgha1
      replicas: 2
      dataVolumeClaimSpec:
        accessModes:
        - "ReadWriteOnce"
        resources:
          requests:
            storage: 1Gi
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 1
            podAffinityTerm:
              topologyKey: kubernetes.io/hostname
              labelSelector:
                matchLabels:
                  postgres-operator.crunchydata.com/cluster: hippo-ha
                  postgres-operator.crunchydata.com/instance-set: pgha1
  backups:
    pgbackrest:
      repos:
      - name: repo1
        volume:
          volumeClaimSpec:
            accessModes:
            - "ReadWriteOnce"
            resources:
              requests:
                storage: 1Gi
  proxy:
    pgBouncer:
      replicas: 2
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 1
            podAffinityTerm:
              topologyKey: kubernetes.io/hostname
              labelSelector:
                matchLabels:
                  postgres-operator.crunchydata.com/cluster: hippo-ha
                  postgres-operator.crunchydata.com/role: pgbouncer


================================================
FILE: kustomize/high-availability/kustomization.yaml
================================================
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: postgres-operator

resources:
- ha-postgres.yaml


================================================
FILE: kustomize/keycloak/keycloak.yaml
================================================
apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
  namespace: postgres-operator
  labels:
    app.kubernetes.io/name: keycloak
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: keycloak
  template:
    metadata:
      labels:
        app.kubernetes.io/name: keycloak
    spec:
      containers:
      - image: quay.io/keycloak/keycloak:latest
        args: ["start-dev"]
        name: keycloak
        env:
        - name: KC_DB
          value: "postgres"
        - name: KC_DB_URL_HOST
          valueFrom: { secretKeyRef: { name: keycloakdb-pguser-keycloakdb, key: host } }
        - name: KC_DB_URL_PORT
          valueFrom: { secretKeyRef: { name: keycloakdb-pguser-keycloakdb, key: port } }
        - name: KC_DB_URL_DATABASE
          valueFrom: { secretKeyRef: { name: keycloakdb-pguser-keycloakdb, key: dbname } }
        - name: KC_DB_USERNAME
          valueFrom: { secretKeyRef: { name: keycloakdb-pguser-keycloakdb, key: user } }
        - name: KC_DB_PASSWORD
          valueFrom: { secretKeyRef: { name: keycloakdb-pguser-keycloakdb, key: password } }
        - name: KC_BOOTSTRAP_ADMIN_USERNAME
          value: "admin"
        - name: KC_BOOTSTRAP_ADMIN_PASSWORD
          value: "admin"
        - name: KC_PROXY_HEADERS
          value: "xforwarded"
        ports:
        - name: http
          containerPort: 8080
        - name: https
          containerPort: 8443
        readinessProbe:
          httpGet:
            path: /realms/master
            port: 8080
      restartPolicy: Always


================================================
FILE: kustomize/keycloak/kustomization.yaml
================================================
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: postgres-operator

resources:
- postgres.yaml
- keycloak.yaml


================================================
FILE: kustomize/keycloak/postgres.yaml
================================================
apiVersion: postgres-operator.crunchydata.com/v1
kind: PostgresCluster
metadata:
  name: keycloakdb
  annotations:
    postgres-operator.crunchydata.com/autoCreateUserSchema: "true"
spec:
  postgresVersion: 18
  instances:
    - replicas: 2
      dataVolumeClaimSpec:
        accessModes:
        - "ReadWriteOnce"
        resources:
          requests:
            storage: 1Gi
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 1
            podAffinityTerm:
              topologyKey: kubernetes.io/hostname
              labelSelector:
                matchLabels:
                  postgres-operator.crunchydata.com/cluster: keycloakdb
                  postgres-operator.crunchydata.com/instance-set: "00"
  backups:
    pgbackrest:
      repos:
      - name: repo1
        volume:
          volumeClaimSpec:
            accessModes:
            - "ReadWriteOnce"
            resources:
              requests:
                storage: 1Gi


================================================
FILE: kustomize/multi-backup-repo/.gitignore
================================================
azure.conf
gcs-key.json
s3.conf


================================================
FILE: kustomize/multi-backup-repo/azure.conf.example
================================================
[global]
repo4-azure-account=<YOUR_AZURE_ACCOUNT>
repo4-azure-key=<YOUR_AZURE_KEY>


================================================
FILE: kustomize/multi-backup-repo/gcs.conf
================================================
[global]
repo3-gcs-key=/etc/pgbackrest/conf.d/gcs-key.json


================================================
FILE: kustomize/multi-backup-repo/kustomization.yaml
================================================
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: postgres-operator

secretGenerator:
- name: pgo-multi-repo-creds
  files:
  - azure.conf
  - gcs.conf
  - gcs-key.json
  - s3.conf

generatorOptions:
  disableNameSuffixHash: true

resources:
- postgres.yaml


================================================
FILE: kustomize/multi-backup-repo/postgres.yaml
================================================
apiVersion: postgres-operator.crunchydata.com/v1
kind: PostgresCluster
metadata:
  name: hippo-multi-repo
spec:
  postgresVersion: 18
  instances:
    - dataVolumeClaimSpec:
        accessModes:
        - "ReadWriteOnce"
        resources:
          requests:
            storage: 1Gi
  backups:
    pgbackrest:
      configuration:
      - secret:
          name: pgo-multi-repo-creds
      global:
        repo2-path: /pgbackrest/postgres-operator/hippo-multi-repo/repo2
        repo3-path: /pgbackrest/postgres-operator/hippo-multi-repo/repo3
        repo4-path: /pgbackrest/postgres-operator/hippo-multi-repo/repo4
      repos:
      - name: repo1
        volume:
          volumeClaimSpec:
            accessModes:
            - "ReadWriteOnce"
            resources:
              requests:
                storage: 1Gi
      - name: repo2
        s3:
          bucket: "<YOUR_AWS_S3_BUCKET_NAME>"
          endpoint: "<YOUR_AWS_S3_ENDPOINT>"
          region: "<YOUR_AWS_S3_REGION>"
      - name: repo3
        gcs:
          bucket: "<YOUR_GCS_BUCKET_NAME>"
      - name: repo4
        azure:
          container: "<YOUR_AZURE_CONTAINER>"


================================================
FILE: kustomize/multi-backup-repo/s3.conf.example
================================================
[global]
repo2-s3-key=<YOUR_AWS_S3_KEY>
repo2-s3-key-secret=<YOUR_AWS_S3_KEY_SECRET>


================================================
FILE: kustomize/pgadmin/README.md
================================================
# Pgadmin considerations

Starting with **PGO v5.5.0** the user interface has its own CRD. You have better control and can fully customize your user interface via PGAdmin.spec.config.settings as demonstrated in the included pgadmin.yaml

For more architectural insights please refer to [docs](https://access.crunchydata.com/documentation/postgres-operator/latest/guides/pgadmin)

For a list of possible pgadmin settings refer to [pgadmin docs](https://www.pgadmin.org/docs/pgadmin4/latest/config_py.html)



================================================
FILE: kustomize/pgadmin/kustomization.yaml
================================================
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: postgres-operator

resources:
- pgadmin.yaml

secretGenerator:
- name: pgadmin-password-secret
  literals:
  - rhino-password=pgadmin
  type: Opaque

generatorOptions:
  disableNameSuffixHash: true


================================================
FILE: kustomize/pgadmin/pgadmin.yaml
================================================
apiVersion: postgres-operator.crunchydata.com/v1beta1
kind: PGAdmin
metadata:
  name: rhino
spec:
  users:
    - username: rhino@example.com
      role: Administrator
      passwordRef:
        name: pgadmin-password-secret
        key: rhino-password
  dataVolumeClaimSpec:
    accessModes:
    - "ReadWriteOnce"
    resources:
      requests:
        storage: 1Gi
  serverGroups:
    - name: supply
      # An empty selector selects all postgresclusters in the Namespace
      postgresClusterSelector: {}
  config:
    settings:
      AUTHENTICATION_SOURCES: ['internal']
      # Uncomment DEBUG to enable debug logging in pgAdmin
      # DEBUG: "True"
      # Configure OAUTH by setting the following *AND* adding
      # `oauth` to AUTHENTICATION_SOURCES
      #OAUTH2_CONFIG:
      #  - OAUTH2_NAME: "google"
      #    OAUTH2_DISPLAY_NAME: "Google"
      #    OAUTH2_CLIENT_ID: "XXXXXXX"
      #    OAUTH2_CLIENT_SECRET: "XXXXXXX"
      #    OAUTH2_TOKEN_URL: "https://oauth2.googleapis.com/token"
      #    OAUTH2_AUTHORIZATION_URL: "https://accounts.google.com/o/oauth2/auth"
      #    OAUTH2_API_BASE_URL: "https://openidconnect.googleapis.com/v1/"
      #    OAUTH2_SERVER_METADATA_URL: "https://accounts.google.com/.well-known/openid-configuration"
      #    OAUTH2_SCOPE: "openid email profile"
      #    OAUTH2_USERINFO_ENDPOINT: "userinfo"
      #    OAUTH2_SSL_CERT_VERIFICATION: "False" # for testing purposes
      #    OAUTH2_BUTTON_COLOR: "red"   
      #OAUTH2_AUTO_CREATE_USER : "True"


================================================
FILE: kustomize/postgres/kustomization.yaml
================================================
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: postgres-operator

resources:
- postgres.yaml


================================================
FILE: kustomize/postgres/postgres.yaml
================================================
apiVersion: postgres-operator.crunchydata.com/v1
kind: PostgresCluster
metadata:
  name: hippo
  annotations:
    postgres-operator.crunchydata.com/autoCreateUserSchema: "true"
spec:
  postgresVersion: 18
  users:
    - name: hippo
      databases:
        - zoo
  instances:
    - name: instance1
      dataVolumeClaimSpec:
        accessModes:
        - "ReadWriteOnce"
        resources:
          requests:
            storage: 1Gi
  backups:
    pgbackrest:
      repos:
      - name: repo1
        volume:
          volumeClaimSpec:
            accessModes:
            - "ReadWriteOnce"
            resources:
              requests:
                storage: 1Gi


================================================
FILE: kustomize/s3/.gitignore
================================================
s3.conf


================================================
FILE: kustomize/s3/kustomization.yaml
================================================
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: postgres-operator

secretGenerator:
- name: pgo-s3-creds
  files:
  - s3.conf

generatorOptions:
  disableNameSuffixHash: true

resources:
- postgres.yaml


================================================
FILE: kustomize/s3/postgres.yaml
================================================
apiVersion: postgres-operator.crunchydata.com/v1
kind: PostgresCluster
metadata:
  name: hippo-s3
spec:
  postgresVersion: 18
  instances:
    - dataVolumeClaimSpec:
        accessModes:
        - "ReadWriteOnce"
        resources:
          requests:
            storage: 1Gi
  backups:
    pgbackrest:
      configuration:
      - secret:
          name: pgo-s3-creds
      global:
        repo1-path: /pgbackrest/postgres-operator/hippo-s3/repo1
      repos:
      - name: repo1
        s3:
          bucket: "<YOUR_AWS_S3_BUCKET_NAME>"
          endpoint: "<YOUR_AWS_S3_ENDPOINT>"
          region: "<YOUR_AWS_S3_REGION>"


================================================
FILE: kustomize/s3/s3.conf.example
================================================
[global]
repo1-s3-key=<YOUR_AWS_S3_KEY>
repo1-s3-key-secret=<YOUR_AWS_S3_KEY_SECRET>