mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 16:04:31 +00:00
c165ee1a87
- cloudnative_pg.py: add _wait_for_webhook_ca_bundle() to poll ValidatingWebhookConfiguration
until cainjector has injected the CA bundle; fall back to _try_inject_ca_bundle_manually()
on timeout (reads cert-manager-webhook-ca secret, patches webhook directly)
- cloudnative_pg.py: add _wait_for_barman_tls_secrets() to wait for barman-cloud-{client,server}-tls
before declaring Barman Cloud ready; surfaces warning instead of silent FailedMount
- deploy/gcp/gke/namespace.yaml: ecosystem-0 -> knoe-db-0 (ekosystem = k8s cluster, not namespace)
- deploy/gcp/gke/knoe-db.yaml: fix namespace ecosystem-0 -> knoe-db-0; set
podAntiAffinityType: required (one CNPG pod per node); add Spot node toleration so
GKE autoscaler simulation succeeds and scale-up is unblocked; add resource
requests/limits (500m/512Mi -> 2/2Gi); set googleCredentials.gkeEnvironment: true
(use Workload Identity - no explicit credentials secret needed)
- deploy/gcp/gke/knoe-db-backup-gcs.yaml: fix namespaces ecosystem-0 -> knoe-db-0
- deploy/gcp/gke/workload-identity.yaml: update comments ecosystem-0 -> knoe-db-0
- tests/installer/test_cnpg_barman_webhook.py: new - 13 tests covering webhook CA bundle
polling, manual CA injection, Barman TLS secret wait, and install_barman_plugin retry logic
Co-authored-by: Junie <junie@jetbrains.com>
27 lines
1.0 KiB
YAML
27 lines
1.0 KiB
YAML
# Workload Identity binding documentation.
|
|
#
|
|
# This file is NOT applied with kubectl — it documents the gcloud commands
|
|
# executed by etc/init_cnpg_gke.sh to establish the Workload Identity link
|
|
# between the Kubernetes ServiceAccount (cnpg-backup-sa) and the GCP
|
|
# service account (cnpg-backup@<project>.iam.gserviceaccount.com).
|
|
#
|
|
# Commands run by init_cnpg_gke.sh:
|
|
#
|
|
# gcloud iam service-accounts create cnpg-backup \
|
|
# --display-name="CNPG GCS Backup" \
|
|
# --project=$GCP_PROJECT_ID
|
|
#
|
|
# gsutil iam ch \
|
|
# serviceAccount:cnpg-backup@$GCP_PROJECT_ID.iam.gserviceaccount.com:objectAdmin \
|
|
# gs://knoe-0-backups
|
|
#
|
|
# gcloud iam service-accounts add-iam-policy-binding \
|
|
# cnpg-backup@$GCP_PROJECT_ID.iam.gserviceaccount.com \
|
|
# --role=roles/iam.workloadIdentityUser \
|
|
# --member="serviceAccount:$GCP_PROJECT_ID.svc.id.goog[knoe-db-0/cnpg-backup-sa]"
|
|
#
|
|
# kubectl annotate serviceaccount cnpg-backup-sa \
|
|
# -n knoe-db-0 \
|
|
# iam.gke.io/gcp-service-account=cnpg-backup@$GCP_PROJECT_ID.iam.gserviceaccount.com \
|
|
# --overwrite
|