panxiao81/postgresql-tenant-operator
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 定义 v1alpha1 API 合同
E2E Tests / Run on Ubuntu (pull_request) Failing after 1m6s
Details
Lint / Run on Ubuntu (pull_request) Successful in 7m7s
Details
Tests / Run on Ubuntu (pull_request) Successful in 4m42s
Details

Browse Source
This commit is contained in:
panxiao81
2026-09-10 06:25:34 +00:00
parent b443d78d14
commit 1f5aa3bd2f
13 changed files with 630 additions and 137 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/crd/bases/database.ddupan.top_postgresqlinstances.yaml
+70 -21
View File
@@ -11,6 +11,8 @@ spec:
kind: PostgreSQLInstance
listKind: PostgreSQLInstanceList
plural: postgresqlinstances
shortNames:
- pginstance
singular: postgresqlinstance
scope: Cluster
versions:
@@ -18,14 +20,20 @@ spec:
- jsonPath: .spec.endpoint.host
name: Endpoint
type: string
- jsonPath: .status.phase
name: Phase
type: string
- jsonPath: .status.conditions[?(@.type=="Ready")].status
name: Ready
type: string
- jsonPath: .metadata.creationTimestamp
name: Age
type: date
name: v1alpha1
schema:
openAPIV3Schema:
description: PostgreSQLInstance is the Schema for the postgresqlinstances
API
API.
properties:
apiVersion:
description: |-
@@ -45,47 +53,82 @@ spec:
metadata:
type: object
spec:
description: spec defines the desired state of PostgreSQLInstance
description: PostgreSQLInstanceSpec defines an external PostgreSQL server
managed by the controller.
properties:
adminCredentialRef:
description: |-
AdminCredentialRef points to an OpenBao KV secret containing the
administrative login. Secret values are never copied into this resource.
AdminCredentialRef identifies the OpenBao KV v2 record containing the
administrative username and password. Values are never copied into this resource.
properties:
passwordKey:
default: password
description: PasswordKey is the key containing the administrative
password.
minLength: 1
type: string
path:
description: Path is mount-relative and must not include the KV
v2 data or metadata API layer.
maxLength: 512
minLength: 1
pattern: ^[^/]+(/[^/]+)*$
type: string
x-kubernetes-validations:
- message: path must not contain . or .. segments
rule: self.split('/').all(segment, segment != '.' && segment
!= '..')
- message: path must not include the KV v2 data or metadata API
layer
rule: self.split('/')[0] != 'data' && self.split('/')[0] !=
'metadata'
usernameKey:
default: username
description: UsernameKey is the key containing the administrative
username.
minLength: 1
type: string
required:
- path
type: object
allowedExtensions:
description: AllowedExtensions is the allowlist tenants may request.
description: |-
AllowedExtensions is the set of extensions tenants may request.
Removing an item does not remove it from databases where it already exists.
items:
type: string
type: array
x-kubernetes-list-type: set
endpoint:
description: Endpoint is the PostgreSQL server managed by this instance.
description: Endpoint identifies the PostgreSQL server and its administrative
database.
properties:
database:
default: postgres
description: Database used for administrative connections.
description: Database is used for administrative connections and
the ownership registry.
pattern: ^[a-z][a-z0-9_]{0,62}$
type: string
host:
description: Host is the DNS name used as a connection target
and TLS server name.
minLength: 1
type: string
hostaddr:
description: HostAddr is an IPv4 or IPv6 address covered by the
server certificate IP SAN.
format: ip
type: string
port:
default: 5432
description: Port is the PostgreSQL TCP port.
format: int32
maximum: 65535
minimum: 1
type: integer
sslMode:
default: verify-full
description: SSLMode controls PostgreSQL TLS verification.
enum:
- disable
- require
@@ -94,25 +137,18 @@ spec:
type: string
required:
- host
- hostaddr
type: object
required:
- adminCredentialRef
- endpoint
type: object
status:
description: status defines the observed state of PostgreSQLInstance
description: PostgreSQLInstanceStatus defines the observed state of PostgreSQLInstance.
properties:
conditions:
description: |-
conditions represent the current state of the PostgreSQLInstance resource.
Each condition has a unique type and reflects the status of a specific aspect of the resource.
Standard condition types include:
- "Available": the resource is fully functional
- "Progressing": the resource is being created or updated
- "Degraded": the resource failed to reach or maintain its desired state
The status of each condition is one of True, False, or Unknown.
description: Conditions contains the current Ready condition and any
future auxiliary conditions.
items:
description: Condition contains details for one aspect of the current
state of this API Resource.
@@ -172,15 +208,28 @@ spec:
- type
x-kubernetes-list-type: map
observedGeneration:
description: ObservedGeneration is the most recent generation observed
by the controller.
description: ObservedGeneration is the most recent generation for
which reconciliation reached a conclusion.
format: int64
type: integer
phase:
description: |-
Phase is the authoritative checkpoint of the controller workflow.
External state is still read back before and after every operation.
enum:
- Pending
- Validating
- InitializingRegistry
- Ready
- Deleting
type: string
postgresqlVersion:
description: PostgreSQLVersion is reported by the target server.
description: PostgreSQLVersion is reported by the target server for
diagnostics.
type: string
type: object
required:
- metadata
- spec
type: object
served: true
config/crd/bases/database.ddupan.top_postgresqltenants.yaml
+87 -33
View File
@@ -20,16 +20,25 @@ spec:
- jsonPath: .spec.instanceRef
name: Instance
type: string
- jsonPath: .spec.database
- jsonPath: .status.database
name: Database
type: string
- jsonPath: .status.phase
name: Phase
type: string
- jsonPath: .status.credential.secretRef.name
name: Secret
type: string
- jsonPath: .status.conditions[?(@.type=="Ready")].status
name: Ready
type: string
- jsonPath: .metadata.creationTimestamp
name: Age
type: date
name: v1alpha1
schema:
openAPIV3Schema:
description: PostgreSQLTenant is the Schema for the postgresqltenants API
description: PostgreSQLTenant is the Schema for the postgresqltenants API.
properties:
apiVersion:
description: |-
@@ -49,31 +58,36 @@ spec:
metadata:
type: object
spec:
description: spec defines the desired state of PostgreSQLTenant
description: PostgreSQLTenantSpec defines one application database and
its login owner.
properties:
credential:
description: Credential configures the application login credential.
description: Credential configures projection of the application credential.
properties:
openBaoPath:
description: OpenBaoPath is the KV path receiving the generated
login credential.
secretName:
description: |-
SecretName is the target Kubernetes Secret in the Tenant namespace.
It semantically defaults to <instanceRef>-<metadata.name>-postgresql.
maxLength: 253
pattern: ^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$
type: string
required:
- openBaoPath
type: object
database:
description: Database defaults to metadata.name when omitted.
description: Database is the database to create. It semantically defaults
to metadata.name.
pattern: ^[a-z][a-z0-9_]{0,62}$
type: string
deletionPolicy:
default: Retain
description: DeletionPolicy controls whether deleting this object
removes the database.
description: DeletionPolicy controls cleanup when this object is deleted.
enum:
- Retain
- Delete
type: string
extensions:
description: Extensions to install from the instance allowlist.
description: |-
Extensions is the set to install from the referenced Instance allowlist.
Once provisioned, this set may only grow.
items:
type: string
type: array
@@ -81,31 +95,25 @@ spec:
instanceRef:
description: InstanceRef names the cluster-scoped PostgreSQLInstance
to use.
maxLength: 253
minLength: 1
pattern: ^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$
type: string
loginRole:
description: LoginRole defaults to metadata.name when omitted.
type: string
ownerRole:
description: OwnerRole defaults to <database>_owner when omitted.
description: |-
LoginRole is both the database owner and application login.
It semantically defaults to metadata.name.
pattern: ^[a-z][a-z0-9_]{0,62}$
type: string
required:
- credential
- instanceRef
type: object
status:
description: status defines the observed state of PostgreSQLTenant
description: PostgreSQLTenantStatus defines the observed state of PostgreSQLTenant.
properties:
conditions:
description: |-
conditions represent the current state of the PostgreSQLTenant resource.
Each condition has a unique type and reflects the status of a specific aspect of the resource.
Standard condition types include:
- "Available": the resource is fully functional
- "Progressing": the resource is being created or updated
- "Degraded": the resource failed to reach or maintain its desired state
The status of each condition is one of True, False, or Unknown.
description: Conditions contains the current Ready condition and any
future auxiliary conditions.
items:
description: Condition contains details for one aspect of the current
state of this API Resource.
@@ -164,20 +172,66 @@ spec:
x-kubernetes-list-map-keys:
- type
x-kubernetes-list-type: map
credential:
description: Credential identifies the projected Secret and the non-authenticated
OpenBao API URL.
properties:
openBaoURL:
description: |-
OpenBaoURL is the complete KV v2 data API URL for non-Kubernetes consumers.
It contains no token or credential value.
type: string
secretRef:
description: SecretRef identifies the target Secret in the Tenant
namespace.
properties:
name:
description: Name is the Secret name.
type: string
type: object
type: object
database:
description: Database is the effective database name after applying
semantic defaults.
type: string
databaseOID:
description: DatabaseOID is the server-side identity observed for
the database.
description: DatabaseOID is the observed PostgreSQL object identifier
for diagnostics.
format: int32
type: integer
loginRole:
description: LoginRole is the effective owner/login role after applying
semantic defaults.
type: string
observedGeneration:
description: ObservedGeneration is the most recent generation observed
by the controller.
description: ObservedGeneration is the most recent generation for
which reconciliation reached a conclusion.
format: int64
type: integer
phase:
description: |-
Phase is the authoritative checkpoint of the controller workflow.
External state is still read back before and after every operation.
enum:
- Pending
- Planned
- CredentialCreated
- RoleCreated
- DatabaseCreated
- ExternalSecretCreated
- CredentialProjected
- Ready
- Deleting
type: string
type: object
required:
- metadata
- spec
type: object
x-kubernetes-validations:
- message: instanceRef and metadata.name are too long to derive the ExternalSecret
name
rule: size(self.spec.instanceRef) + size(self.metadata.name) <= 241
served: true
storage: true
subresources: