Iron Bank
=========

EDB CloudNativePG Cluster(PG4K) is available on `Iron Bank <https://p1.dso.mil/services/iron-bank>`_  . As you
can read in the `overview page <https://docs-ironbank.dso.mil/overview/>`_  :

   Iron Bank is the DoD’s source for hardened containers. > > [… snipped
   …] > > Iron Bank ultimately is for anyone to consume or contribute.
   However, we specifically target the following personas: > > - DoD
   organizations wishing to consume hardened containers and Iron Banks
   BoE (Body of Evidence) for each container > - DoD organizations
   wishing to help contribute to containers (e.g. bug fixes, new
   applications, updates) > - DoD Authorization Officials wishing to
   understand the risks associated with applications > - Commercial
   vendors wishing to bring their application to the DoD

Iron Bank is a part of DoD’s `Platform One <https://p1.dso.mil/>`_  .

You will need your Iron Bank credentials to access the Iron Bank page
for `EDB CloudNativePG Cluster <https://repo1.dso.mil/dsop/enterprisedb/edb-pg4k-operator>`_  .

Pulling the EDB PG4K and operand images from Iron Bank
------------------------------------------------------

The images are pulled from the separate `Iron Bank container registry <https://registry1.dso.mil/>`_  . To be able to
pull images from the Iron Bank registry, please follow the `instructions from Iron Bank <https://docs-ironbank.dso.mil/tutorials/image-pull/>`_ 
.

Specifically, you will need to use your `registry1 <https://registry1.dso.mil/harbor/projects>`_ 

credentials to pull images.

To find the desired operator or operand images, we recommend to use the
search tool to look with the string ``enterprisedb`` , and filter by
``Tags`` , looking for ``stable`` , as shown in the image. From there,
you can get the instruction to pull the image:

.. figure:: images/ironbank/pulling-the-image.png
   :width: 70% 
   :alt: pulling-ironbank-images

   pulling-ironbank-images

For example, to pull the EPAS16 operand from Ironbank, you can run:

.. code:: bash

   docker pull registry1.dso.mil/ironbank/enterprisedb/edb-postgres-advanced-16:16

If you want to pick a more specific tag or use a specific SHA, you need
to find it from the `Harbor page <https://registry1.dso.mil/harbor/projects/3/repositories/enterprisedb%2Fedb-postgres-advanced-16/artifacts-tab>`_  .

Installing the PG4K operator using the Iron Bank image
------------------------------------------------------

For installation, you will need a deployment manifest that points to
your Iron Bank image. You can take the deployment manifest from the
:ref:`installation instructions for EDB PG4K <Installation and upgrades>`  . For example, for the 1.22.0 release, the manifest is
available at
``https://get.enterprisedb.io/cnp/postgresql-operator-1.22.0.yaml`` .
There are a couple of places where you will need to set the image path
for the IronBank image.

.. code:: yaml

   apiVersion: apps/v1
   kind: Deployment
   metadata:
     labels:
       app.kubernetes.io/name: cloud-native-postgresql
     name: postgresql-operator-controller-manager
     namespace: postgresql-operator-system
   spec:
     [… snipped …]
     template:
       metadata:
         labels:
           app.kubernetes.io/name: cloud-native-postgresql
       spec:
         containers:
         - args:
           - controller
             [… snipped …]
           env:
           - name: PULL_SECRET_NAME
             value: postgresql-operator-pull-secret
           - name: OPERATOR_IMAGE_NAME
             value: <INSERT-YOUR-OPERATOR-IMAGE>

           [… snipped …]
           image: <INSERT-YOUR-OPERATOR-IMAGE>

If you wish for the operator to be deployed from Iron Bank directly, you
will need to create and set the pull secret with the credentials to the
registry, as described above.

It may be easier to get the image from Iron Bank with the instructions
on the site, and from there, re-tag and publish it to a local registry,
or push it directly to your Kubernetes nodes.

Once you have this in place, you can apply your manifest normally with
``kubectl apply -f`` , as described in the :ref:`installation instructions <Installation and upgrades>`  .

Deploying clusters with EPAS operands using IronBank images
-----------------------------------------------------------

To deploy a cluster using the EPAS `operand <https://www.enterprisedb.com/docs/postgres_for_kubernetes/latest/private_edb_registries/#operand-images>`_  you must reference the
Ironbank operand image appropriately in the ``Cluster`` resource YAML.
For example, to deploy a PG4K Cluster using the EPAS 16 operand:

1. Create or edit a ``Cluster`` resource YAML file with the following
   content:

.. code:: yaml

     apiVersion: postgresql.k8s.enterprisedb.io/v1
     kind: Cluster
     metadata:
       name: cluster-example-full
     spec:
       imageName: registry1.dso.mil/ironbank/enterprisedb/edb-postgres-advanced-17:17
       imagePullSecrets:
         - name: my_ironbank_secret

2. Apply the YAML:

::

     kubectl apply -f <filename>

3. Verify the status of the resource:

::

     kubectl get clusters