mirror of
https://github.com/outbackdingo/patroni.git
synced 2026-08-29 00:49:32 +00:00
Alexander KukushkinandGitHub
23dcfaab49
When running on K8s Patroni is communicating with API via the `kubernetes` service, which is address is exposed via the `KUBERNETES_SERVICE_HOST` environment variable. Like any other service, the `kubernetes` service is handled by `kube-proxy`, that depending on configuration is either relying on userspace program or `iptables` for traffic routing. During K8s upgrade, when master nodes are replaced, it is possible that `kube-proxy` doesn't update the service configuration in time and as a result Patroni fails to update the leader lock and demotes postgres. In order to improve the user experience and get more control on the problem we make it possible to bypass the `kubernetes` service and connect directly to API nodes. The strategy is very simple: 1. Resolve list IPs of API nodes from the kubernetes endpoint on every iteration of HA loop. 2. Stick to one of these IPs for API requests 3. Switch to a different IP if connected to IP is not from the list 4. If the request fails, switch to another IP and retry Such a strategy is already used for Etcd and proven to work quite well. In order to enable the feature, you need either to set to `true` `kubernetes.bypass_api_service` in the Patroni configuration file or `PATRONI_KUBERNETES_BYPASS_API_SERVICE` environment variable. If for some reason `GET /default/endpoints/kubernetes` isn't allowed Patroni will disable the feature.
356 lines
10 KiB
YAML
356 lines
10 KiB
YAML
apiVersion: v1
|
|
kind: Template
|
|
metadata:
|
|
name: patroni-pgsql-persistent
|
|
annotations:
|
|
description: |-
|
|
Patroni Postgresql database cluster, with persistent storage.
|
|
iconClass: icon-postgresql
|
|
openshift.io/display-name: Patroni Postgresql (Persistent)
|
|
openshift.io/long-description: This template deploys a a patroni postgresql HA cluster with persistent storage.
|
|
tags: postgresql
|
|
objects:
|
|
- apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
creationTimestamp: null
|
|
labels:
|
|
application: ${APPLICATION_NAME}
|
|
cluster-name: ${PATRONI_CLUSTER_NAME}
|
|
name: ${PATRONI_CLUSTER_NAME}
|
|
spec:
|
|
ports:
|
|
- port: 5432
|
|
protocol: TCP
|
|
targetPort: 5432
|
|
sessionAffinity: None
|
|
type: ClusterIP
|
|
status:
|
|
loadBalancer: {}
|
|
- apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
creationTimestamp: null
|
|
labels:
|
|
application: ${APPLICATION_NAME}
|
|
cluster-name: ${PATRONI_CLUSTER_NAME}
|
|
name: ${PATRONI_MASTER_SERVICE_NAME}
|
|
spec:
|
|
ports:
|
|
- port: 5432
|
|
protocol: TCP
|
|
targetPort: 5432
|
|
selector:
|
|
application: ${APPLICATION_NAME}
|
|
cluster-name: ${PATRONI_CLUSTER_NAME}
|
|
role: master
|
|
sessionAffinity: None
|
|
type: ClusterIP
|
|
status:
|
|
loadBalancer: {}
|
|
- apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ${PATRONI_CLUSTER_NAME}
|
|
labels:
|
|
application: ${APPLICATION_NAME}
|
|
cluster-name: ${PATRONI_CLUSTER_NAME}
|
|
stringData:
|
|
superuser-password: ${PATRONI_SUPERUSER_PASSWORD}
|
|
replication-password: ${PATRONI_REPLICATION_PASSWORD}
|
|
- apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
creationTimestamp: null
|
|
labels:
|
|
application: ${APPLICATION_NAME}
|
|
cluster-name: ${PATRONI_CLUSTER_NAME}
|
|
name: ${PATRONI_REPLICA_SERVICE_NAME}
|
|
spec:
|
|
ports:
|
|
- port: 5432
|
|
protocol: TCP
|
|
targetPort: 5432
|
|
selector:
|
|
application: ${APPLICATION_NAME}
|
|
cluster-name: ${PATRONI_CLUSTER_NAME}
|
|
role: replica
|
|
sessionAffinity: None
|
|
type: ClusterIP
|
|
status:
|
|
loadBalancer: {}
|
|
- apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
creationTimestamp: null
|
|
generation: 3
|
|
labels:
|
|
application: ${APPLICATION_NAME}
|
|
cluster-name: ${PATRONI_CLUSTER_NAME}
|
|
name: ${APPLICATION_NAME}
|
|
spec:
|
|
podManagementPolicy: OrderedReady
|
|
replicas: 3
|
|
revisionHistoryLimit: 10
|
|
selector:
|
|
matchLabels:
|
|
application: ${APPLICATION_NAME}
|
|
cluster-name: ${PATRONI_CLUSTER_NAME}
|
|
serviceName: ${APPLICATION_NAME}
|
|
template:
|
|
metadata:
|
|
creationTimestamp: null
|
|
labels:
|
|
application: ${APPLICATION_NAME}
|
|
cluster-name: ${PATRONI_CLUSTER_NAME}
|
|
spec:
|
|
initContainers:
|
|
- command:
|
|
- sh
|
|
- -c
|
|
- "mkdir -p /home/postgres/pgdata/pgroot/data && chmod 0700 /home/postgres/pgdata/pgroot/data"
|
|
image: docker-registry.default.svc:5000/${NAMESPACE}/patroni:latest
|
|
imagePullPolicy: IfNotPresent
|
|
name: fix-perms
|
|
resources: {}
|
|
terminationMessagePath: /dev/termination-log
|
|
terminationMessagePolicy: File
|
|
volumeMounts:
|
|
- mountPath: /home/postgres/pgdata
|
|
name: ${APPLICATION_NAME}
|
|
containers:
|
|
- env:
|
|
- name: PATRONI_KUBERNETES_POD_IP
|
|
valueFrom:
|
|
fieldRef:
|
|
apiVersion: v1
|
|
fieldPath: status.podIP
|
|
- name: PATRONI_KUBERNETES_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
apiVersion: v1
|
|
fieldPath: metadata.namespace
|
|
- name: PATRONI_KUBERNETES_BYPASS_API_SERVICE
|
|
value: 'true'
|
|
- name: PATRONI_KUBERNETES_LABELS
|
|
value: '{application: ${APPLICATION_NAME}, cluster-name: ${PATRONI_CLUSTER_NAME}}'
|
|
- name: PATRONI_SUPERUSER_USERNAME
|
|
value: ${PATRONI_SUPERUSER_USERNAME}
|
|
- name: PATRONI_SUPERUSER_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: superuser-password
|
|
name: ${PATRONI_CLUSTER_NAME}
|
|
- name: PATRONI_REPLICATION_USERNAME
|
|
value: ${PATRONI_REPLICATION_USERNAME}
|
|
- name: PATRONI_REPLICATION_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: replication-password
|
|
name: ${PATRONI_CLUSTER_NAME}
|
|
- name: PATRONI_SCOPE
|
|
value: ${PATRONI_CLUSTER_NAME}
|
|
- name: PATRONI_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
apiVersion: v1
|
|
fieldPath: metadata.name
|
|
- name: PATRONI_POSTGRESQL_DATA_DIR
|
|
value: /home/postgres/pgdata/pgroot/data
|
|
- name: PATRONI_POSTGRESQL_PGPASS
|
|
value: /tmp/pgpass
|
|
- name: PATRONI_POSTGRESQL_LISTEN
|
|
value: 0.0.0.0:5432
|
|
- name: PATRONI_RESTAPI_LISTEN
|
|
value: 0.0.0.0:8008
|
|
image: docker-registry.default.svc:5000/${NAMESPACE}/patroni:latest
|
|
imagePullPolicy: IfNotPresent
|
|
name: ${APPLICATION_NAME}
|
|
readinessProbe:
|
|
httpGet:
|
|
scheme: HTTP
|
|
path: /readiness
|
|
port: 8008
|
|
initialDelaySeconds: 3
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
successThreshold: 1
|
|
failureThreshold: 3
|
|
ports:
|
|
- containerPort: 8008
|
|
protocol: TCP
|
|
- containerPort: 5432
|
|
protocol: TCP
|
|
resources: {}
|
|
terminationMessagePath: /dev/termination-log
|
|
terminationMessagePolicy: File
|
|
volumeMounts:
|
|
- mountPath: /home/postgres/pgdata
|
|
name: ${APPLICATION_NAME}
|
|
dnsPolicy: ClusterFirst
|
|
restartPolicy: Always
|
|
schedulerName: default-scheduler
|
|
securityContext: {}
|
|
serviceAccount: ${SERVICE_ACCOUNT}
|
|
serviceAccountName: ${SERVICE_ACCOUNT}
|
|
terminationGracePeriodSeconds: 0
|
|
volumes:
|
|
- name: ${APPLICATION_NAME}
|
|
persistentVolumeClaim:
|
|
claimName: ${APPLICATION_NAME}
|
|
volumeClaimTemplates:
|
|
- metadata:
|
|
labels:
|
|
application: ${APPLICATION_NAME}
|
|
name: ${APPLICATION_NAME}
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: ${PVC_SIZE}
|
|
updateStrategy:
|
|
type: OnDelete
|
|
- apiVersion: v1
|
|
kind: Endpoints
|
|
metadata:
|
|
name: ${APPLICATION_NAME}
|
|
labels:
|
|
application: ${APPLICATION_NAME}
|
|
cluster-name: ${PATRONI_CLUSTER_NAME}
|
|
subsets: []
|
|
- apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: ${SERVICE_ACCOUNT}
|
|
- apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: ${SERVICE_ACCOUNT}
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
verbs:
|
|
- create
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
# delete is required only for 'patronictl remove'
|
|
- delete
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- endpoints
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
# the following three privileges are necessary only when using endpoints
|
|
- create
|
|
- list
|
|
- watch
|
|
# delete is required only for for 'patronictl remove'
|
|
- delete
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
verbs:
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
- apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: ${SERVICE_ACCOUNT}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: ${SERVICE_ACCOUNT}
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: ${SERVICE_ACCOUNT}
|
|
# Following privileges are only required if deployed not in the "default"
|
|
# namespace and you want Patroni to bypass kubernetes service
|
|
# (PATRONI_KUBERNETES_BYPASS_API_SERVICE=true)
|
|
- apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: patroni-k8s-ep-access
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- endpoints
|
|
resourceNames:
|
|
- kubernetes
|
|
verbs:
|
|
- get
|
|
- apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: ${NAMESPACE}-${SERVICE_ACCOUNT}-k8s-ep-access
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: patroni-k8s-ep-access
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: ${SERVICE_ACCOUNT}
|
|
namespace: ${NAMESPACE}
|
|
parameters:
|
|
- description: The name of the application for labelling all artifacts.
|
|
displayName: Application Name
|
|
name: APPLICATION_NAME
|
|
value: patroni-persistent
|
|
- description: The name of the patroni-pgsql cluster.
|
|
displayName: Cluster Name
|
|
name: PATRONI_CLUSTER_NAME
|
|
value: patroni-persistent
|
|
- description: The name of the OpenShift Service exposed for the patroni-persistent-master container.
|
|
displayName: Master service name.
|
|
name: PATRONI_MASTER_SERVICE_NAME
|
|
value: patroni-persistent-master
|
|
- description: The name of the OpenShift Service exposed for the patroni-persistent-replica containers.
|
|
displayName: Replica service name.
|
|
name: PATRONI_REPLICA_SERVICE_NAME
|
|
value: patroni-persistent-replica
|
|
- description: Maximum amount of memory the container can use.
|
|
displayName: Memory Limit
|
|
name: MEMORY_LIMIT
|
|
value: 512Mi
|
|
- description: The OpenShift Namespace where the patroni and postgresql ImageStream resides.
|
|
displayName: ImageStream Namespace
|
|
name: NAMESPACE
|
|
value: openshift
|
|
- description: Username of the superuser account for initialization.
|
|
displayName: Superuser Username
|
|
name: PATRONI_SUPERUSER_USERNAME
|
|
value: postgres
|
|
- description: Password of the superuser account for initialization.
|
|
displayName: Superuser Passsword
|
|
name: PATRONI_SUPERUSER_PASSWORD
|
|
value: postgres
|
|
- description: Username of the replication account for initialization.
|
|
displayName: Replication Username
|
|
name: PATRONI_REPLICATION_USERNAME
|
|
value: postgres
|
|
- description: Password of the replication account for initialization.
|
|
displayName: Repication Passsword
|
|
name: PATRONI_REPLICATION_PASSWORD
|
|
value: postgres
|
|
- description: Service account name used for pods and rolebindings to form a cluster in the project.
|
|
displayName: Service Account
|
|
name: SERVICE_ACCOUNT
|
|
value: patroni-persistent
|
|
- description: The size of the persistent volume to create.
|
|
displayName: Persistent Volume Size
|
|
name: PVC_SIZE
|
|
value: 5Gi
|