Examples of configuration

Important

The available examples are for demonstration and experimentation purposes only.

These examples are configuration files for setting up your EDB Postgres Distributed cluster in a Kubernetes environment.

Basics

Flexible 3 regions :

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-a
spec:
  instances: 2
  proxyInstances: 2
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
      create: true
    discovery:
      - host: region-a-group
      - host: region-b-group
      - host: region-c-group
  cnp:
    storage:
      size: 1Gi
  connectivity:
    dns:
      additional:
        - domain: alternate.domain
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
- --
apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-b
spec:
  instances: 2
  proxyInstances: 2
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
    discovery:
      - host: region-a-group
      - host: region-b-group
      - host: region-c-group
  cnp:
    storage:
      size: 1Gi
  connectivity:
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
- --
apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-c
spec:
  instances: 0
  proxyInstances: 0
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
    discovery:
      - host: region-a-group
      - host: region-b-group
      - host: region-c-group
  cnp:
    storage:
      size: 1Gi
  connectivity:
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io

: provides a PGD cluster with two data groups and a global witness node spread across three regions, where each data group consists of two data nodes and a local witness node.

Flexible 3 regions with pre-provisioned client secrets :

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-a
spec:
  instances: 2
  proxyInstances: 2
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
      create: true
    discovery:
      - host: region-a-group
      - host: region-b-group
      - host: region-c-group
  cnp:
    storage:
      size: 1Gi
  connectivity:
    dns:
      additional:
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
      # if the pre-provisioned secrets is set, the caCertSecret will accept a CA secrets, which contains ca.crt or ca.key optionally
        caCertSecret: client-ca-secrets
        preProvisioned:
          streamingReplica:
            secretRef: replication-secrets-region-a
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
- --
apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-b
spec:
  instances: 2
  proxyInstances: 2
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
    discovery:
      - host: region-a-group
      - host: region-b-group
      - host: region-c-group
  cnp:
    storage:
      size: 1Gi
  connectivity:
    dns:
      additional:
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-secrets
        preProvisioned:
          streamingReplica:
            secretRef: replication-secrets-region-b
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
- --
apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-c
spec:
  instances: 0
  proxyInstances: 0
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
    discovery:
      - host: region-a-group
      - host: region-b-group
      - host: region-c-group
  cnp:
    storage:
      size: 1Gi
  connectivity:
    dns:
      additional:
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-secrets
        preProvisioned:
          streamingReplica:
            secretRef: replication-secrets-region-c
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
- --
- -- This is the pre-provisioned client certificate which is signed by certificate in client-ca-secrets
apiVersion: v1
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNYekNDQWdTZ0F3SUJBZ0lSQUw0N2V5eXEydzNEN0gwM2RPaE9iaFF3Q2dZSUtvWkl6ajBFQXdJd0lqRWcKTUI0R0ExVUVBeE1YYlhrdGMyVnNabk5wWjI1bFpDMWpiR2xsYm5RdFkyRXdIaGNOTWpReE1URTVNVE14T1RVeQpXaGNOTWpVd01qRTNNVE14T1RVeVdqQWNNUm93R0FZRFZRUUREQkZ6ZEhKbFlXMXBibWRmY21Wd2JHbGpZVENDCkFTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBT0hScytwV3lwVUFGcEFidm82UmZQdHkKc2d6ejM3bXRualYxVVY2MURYL0IrUkd5bmFKNkNuNUxsVXVtSFdrbUFxRVpnNWZOVEV5RnByNXlKRHNKNDQzbQpHb1ZrQ3ZDY3lPSTZMY2lEOU9VRHhFZWNPUDE1QWgrQ0RNMG5URFB2eS9IRG05Mnh3aVFldmYxY0lucGJRVGpPCkVaTFl2YWNkQlR4aWIxS2tVZmJqb0ZNWUJTNHRYaVIzZ2F3aUFRKzYrWHgrN1RUTmUxNlhLT1NXZmdjSkNTNzcKOFZtSS9iOGtnZ2hZU1BZNjdvdEJnK2ZicHJLNUhoNXdpU3ZlMGpORlg1MzhId05YVTBIM29JbEhXM2dEV0svZAova1hsUTdKdHpPSDJtN3NYVnl3eDlHVUlOakZ2TTR1RkFDdkVtYkorcUJ1SkNtQlQ1M1E2NExySzc4c1AvTEVDCkF3RUFBYU5XTUZRd0RnWURWUjBQQVFIL0JBUURBZ09JTUJNR0ExVWRKUVFNTUFvR0NDc0dBUVVGQndNQ01Bd0cKQTFVZEV3RUIvd1FDTUFBd0h3WURWUjBqQkJnd0ZvQVVscmFqNDFKcFROeVRsMkRmTGkzcVZvbXBBcFV3Q2dZSQpLb1pJemowRUF3SURTUUF3UmdJaEFPWkhZUG5aTEV5WlEvejZ2Mm9kYWM2WmZhTXYzVzlBUmlKNE9pNnF5dW5GCkFpRUFvTDhUb1JoVUpaL3pOSTY2N1VMR0JpeUdTU1p3L0R0UHFoTnU5RkVQQWc0PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBNGRHejZsYktsUUFXa0J1K2pwRjgrM0t5RFBQZnVhMmVOWFZSWHJVTmY4SDVFYktkCm9ub0tma3VWUzZZZGFTWUNvUm1EbDgxTVRJV212bklrT3duamplWWFoV1FLOEp6STRqb3R5SVAwNVFQRVI1dzQKL1hrQ0g0SU16U2RNTSsvTDhjT2IzYkhDSkI2OS9Wd2llbHRCT000Umt0aTlweDBGUEdKdlVxUlI5dU9nVXhnRgpMaTFlSkhlQnJDSUJEN3I1Zkg3dE5NMTdYcGNvNUpaK0J3a0pMdnZ4V1lqOXZ5U0NDRmhJOWpydWkwR0Q1OXVtCnNya2VIbkNKSzk3U00wVmZuZndmQTFkVFFmZWdpVWRiZUFOWXI5MytSZVZEc20zTTRmYWJ1eGRYTERIMFpRZzIKTVc4emk0VUFLOFNac242b0c0a0tZRlBuZERyZ3VzcnZ5dy84c1FJREFRQUJBb0lCQUR1MEJMeE5MQXhPMUtoUApIWWQyQWJROU04UG02bHllQVhraXhsdWl4S25sYitOMDlPWlRHOWtlUkorV2tLb1BLWnpNTVJWK2F0REVlVHhhCjB5ZGt5dXZtVFZhOUI0TnNBRlNIaXprN1loRDJlUHR4MjBOd3JkWUV2VHUwU3hwa0tPaUhqZnNFRjA4VGJhbkIKcFQveVJvRXRRa292MFp5UU9LVXBaVU5WUEhKb1p0RkplNXlPK1crZmx6cmFSeDJmVWlsZlZCbm5uT0YxcDFGMAp1azhIa2xFZ3BUVkRlV1RKa0tydlM2L09sMGNhSEhiSTVoNENIL1pzY0R5SVU4bVd0aS9TYTBHOVZjb3pVRUgrCm5EaDFPeTFQZ1FudEg3YWcrQzkxcUZuTUE2QnI3ZzdkWFllVHVpQmVNbzV5UG40aitnNzBVU0JYUVNzM090UEwKeE45VTNwMENnWUVBL2xjand3YkNXZC9PcXRsb0dJbGhGVkpRc0hYd2pzdy91cVNMNkRYRTlQQkJ3U01LOHY4VAo4Z2pwZ2I2ZVpQQjRUQW1Ob1c1Rm1tbTFuNjV0LzlETVRhZE4yMFNuTmJnUWxEQVN6OEUvNDZjMEdLUkRBTjhZClBMVG13MWh4QktIc0dRaTlieUNuTnJPc1M3NzBNM3VTeGtobFpWQmxrd21KTm5mUUp2QlgyZGNDZ1lFQTQwcnIKaXZvK1MwQmYzcExDWTdBR0gwL29ZLytRdUVEczZLdk9pMnR3NHFwekhnNWlTUmhuSHMxTmpqNm5wWlBaMkpwbApMSUthd1o1TDJ6QkhmaEVzOEpnM3NuTG1ieEpySi95N21QTnpkVHVSSlBMM1BEbVVVRlFaU2Y3YlFPL21PbmZFClEzZ0IrNE1VWlRrNVdDaCtrNVJQM1RJejFqd0hvMVQ3S0txV1hMY0NnWUVBelNPRmdaaWpDeEE3eFl0Q3JYK28Kb1NUYVZlbGFWQ0tqU0N2TmVFWmVERnozL0FvQ204bG0wZkdrUFBSOUZ0YnBnQks0ZkRyUHd1SitEa1FIRHF6ZgpDOGJrUWZWV2xEcFlqTjFWWHVIMFlPNk1VMCt4aHpOcGZoVStodEovbllmb1FLek85YUcxbktaQVVudTZ4UWRuCmM2d1N0Q3VyTVhRZ2lxRUtiMDJzM2RNQ2dZRUF3SWpuUzl1OHh3dnA2ZVZScXhZaHFZYUw2YUZFR3dCTWJxK1MKajhGY1ozVlJmSVZjdG1Sb2Zjd1ZSVWhIeE5lZ2NuNGU4L3hTVVc3Zy9QUkJxMFdyVnNicWIwd3JiSzBpZmtYMQpONVFLR3FWeHh1WFZqbnVMNmh2RExFNHB0akZCU2dmSUJncnpTdlYzWW1OOTh2S2lmaXJsR0E5OW41MU1Md3crCmtPMG4zN01DZ1lFQTN1TGJQTG45SjhPT3ZRWjk3eThhQkdaZ1RjdlhOeUpnTHhJTW14NGtoc3pGaTBqMUFhY1MKZ090MEVSWEN0VEQwT2hkS2RWWDE4ZmREZ1BOZUU2MzhEenIxN001NTlIbHc1ZGJJdHQ4MllrV01PYU5SMlJHVwpMcmMreDluUWpvNVNhOUwwZXUwcEQxM0NIS1FCZ2RHNDA0bEh2UnNjT0I5WmRKa29ZeWF0a3cwPQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
kind: Secret
metadata:
  name: replication-secrets-region-a
type: Opaque
- --
- -- This is the pre-provisioned client certificate which is signed by certificate in client-ca-secrets
apiVersion: v1
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNYekNDQWdTZ0F3SUJBZ0lSQUw0N2V5eXEydzNEN0gwM2RPaE9iaFF3Q2dZSUtvWkl6ajBFQXdJd0lqRWcKTUI0R0ExVUVBeE1YYlhrdGMyVnNabk5wWjI1bFpDMWpiR2xsYm5RdFkyRXdIaGNOTWpReE1URTVNVE14T1RVeQpXaGNOTWpVd01qRTNNVE14T1RVeVdqQWNNUm93R0FZRFZRUUREQkZ6ZEhKbFlXMXBibWRmY21Wd2JHbGpZVENDCkFTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBT0hScytwV3lwVUFGcEFidm82UmZQdHkKc2d6ejM3bXRualYxVVY2MURYL0IrUkd5bmFKNkNuNUxsVXVtSFdrbUFxRVpnNWZOVEV5RnByNXlKRHNKNDQzbQpHb1ZrQ3ZDY3lPSTZMY2lEOU9VRHhFZWNPUDE1QWgrQ0RNMG5URFB2eS9IRG05Mnh3aVFldmYxY0lucGJRVGpPCkVaTFl2YWNkQlR4aWIxS2tVZmJqb0ZNWUJTNHRYaVIzZ2F3aUFRKzYrWHgrN1RUTmUxNlhLT1NXZmdjSkNTNzcKOFZtSS9iOGtnZ2hZU1BZNjdvdEJnK2ZicHJLNUhoNXdpU3ZlMGpORlg1MzhId05YVTBIM29JbEhXM2dEV0svZAova1hsUTdKdHpPSDJtN3NYVnl3eDlHVUlOakZ2TTR1RkFDdkVtYkorcUJ1SkNtQlQ1M1E2NExySzc4c1AvTEVDCkF3RUFBYU5XTUZRd0RnWURWUjBQQVFIL0JBUURBZ09JTUJNR0ExVWRKUVFNTUFvR0NDc0dBUVVGQndNQ01Bd0cKQTFVZEV3RUIvd1FDTUFBd0h3WURWUjBqQkJnd0ZvQVVscmFqNDFKcFROeVRsMkRmTGkzcVZvbXBBcFV3Q2dZSQpLb1pJemowRUF3SURTUUF3UmdJaEFPWkhZUG5aTEV5WlEvejZ2Mm9kYWM2WmZhTXYzVzlBUmlKNE9pNnF5dW5GCkFpRUFvTDhUb1JoVUpaL3pOSTY2N1VMR0JpeUdTU1p3L0R0UHFoTnU5RkVQQWc0PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBNGRHejZsYktsUUFXa0J1K2pwRjgrM0t5RFBQZnVhMmVOWFZSWHJVTmY4SDVFYktkCm9ub0tma3VWUzZZZGFTWUNvUm1EbDgxTVRJV212bklrT3duamplWWFoV1FLOEp6STRqb3R5SVAwNVFQRVI1dzQKL1hrQ0g0SU16U2RNTSsvTDhjT2IzYkhDSkI2OS9Wd2llbHRCT000Umt0aTlweDBGUEdKdlVxUlI5dU9nVXhnRgpMaTFlSkhlQnJDSUJEN3I1Zkg3dE5NMTdYcGNvNUpaK0J3a0pMdnZ4V1lqOXZ5U0NDRmhJOWpydWkwR0Q1OXVtCnNya2VIbkNKSzk3U00wVmZuZndmQTFkVFFmZWdpVWRiZUFOWXI5MytSZVZEc20zTTRmYWJ1eGRYTERIMFpRZzIKTVc4emk0VUFLOFNac242b0c0a0tZRlBuZERyZ3VzcnZ5dy84c1FJREFRQUJBb0lCQUR1MEJMeE5MQXhPMUtoUApIWWQyQWJROU04UG02bHllQVhraXhsdWl4S25sYitOMDlPWlRHOWtlUkorV2tLb1BLWnpNTVJWK2F0REVlVHhhCjB5ZGt5dXZtVFZhOUI0TnNBRlNIaXprN1loRDJlUHR4MjBOd3JkWUV2VHUwU3hwa0tPaUhqZnNFRjA4VGJhbkIKcFQveVJvRXRRa292MFp5UU9LVXBaVU5WUEhKb1p0RkplNXlPK1crZmx6cmFSeDJmVWlsZlZCbm5uT0YxcDFGMAp1azhIa2xFZ3BUVkRlV1RKa0tydlM2L09sMGNhSEhiSTVoNENIL1pzY0R5SVU4bVd0aS9TYTBHOVZjb3pVRUgrCm5EaDFPeTFQZ1FudEg3YWcrQzkxcUZuTUE2QnI3ZzdkWFllVHVpQmVNbzV5UG40aitnNzBVU0JYUVNzM090UEwKeE45VTNwMENnWUVBL2xjand3YkNXZC9PcXRsb0dJbGhGVkpRc0hYd2pzdy91cVNMNkRYRTlQQkJ3U01LOHY4VAo4Z2pwZ2I2ZVpQQjRUQW1Ob1c1Rm1tbTFuNjV0LzlETVRhZE4yMFNuTmJnUWxEQVN6OEUvNDZjMEdLUkRBTjhZClBMVG13MWh4QktIc0dRaTlieUNuTnJPc1M3NzBNM3VTeGtobFpWQmxrd21KTm5mUUp2QlgyZGNDZ1lFQTQwcnIKaXZvK1MwQmYzcExDWTdBR0gwL29ZLytRdUVEczZLdk9pMnR3NHFwekhnNWlTUmhuSHMxTmpqNm5wWlBaMkpwbApMSUthd1o1TDJ6QkhmaEVzOEpnM3NuTG1ieEpySi95N21QTnpkVHVSSlBMM1BEbVVVRlFaU2Y3YlFPL21PbmZFClEzZ0IrNE1VWlRrNVdDaCtrNVJQM1RJejFqd0hvMVQ3S0txV1hMY0NnWUVBelNPRmdaaWpDeEE3eFl0Q3JYK28Kb1NUYVZlbGFWQ0tqU0N2TmVFWmVERnozL0FvQ204bG0wZkdrUFBSOUZ0YnBnQks0ZkRyUHd1SitEa1FIRHF6ZgpDOGJrUWZWV2xEcFlqTjFWWHVIMFlPNk1VMCt4aHpOcGZoVStodEovbllmb1FLek85YUcxbktaQVVudTZ4UWRuCmM2d1N0Q3VyTVhRZ2lxRUtiMDJzM2RNQ2dZRUF3SWpuUzl1OHh3dnA2ZVZScXhZaHFZYUw2YUZFR3dCTWJxK1MKajhGY1ozVlJmSVZjdG1Sb2Zjd1ZSVWhIeE5lZ2NuNGU4L3hTVVc3Zy9QUkJxMFdyVnNicWIwd3JiSzBpZmtYMQpONVFLR3FWeHh1WFZqbnVMNmh2RExFNHB0akZCU2dmSUJncnpTdlYzWW1OOTh2S2lmaXJsR0E5OW41MU1Md3crCmtPMG4zN01DZ1lFQTN1TGJQTG45SjhPT3ZRWjk3eThhQkdaZ1RjdlhOeUpnTHhJTW14NGtoc3pGaTBqMUFhY1MKZ090MEVSWEN0VEQwT2hkS2RWWDE4ZmREZ1BOZUU2MzhEenIxN001NTlIbHc1ZGJJdHQ4MllrV01PYU5SMlJHVwpMcmMreDluUWpvNVNhOUwwZXUwcEQxM0NIS1FCZ2RHNDA0bEh2UnNjT0I5WmRKa29ZeWF0a3cwPQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
kind: Secret
metadata:
  name: replication-secrets-region-b
type: kubernetes.io/tls
- --
- -- This is the pre-provisioned client certificate which is signed by certificate in client-ca-secrets
apiVersion: v1
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNYekNDQWdTZ0F3SUJBZ0lSQUw0N2V5eXEydzNEN0gwM2RPaE9iaFF3Q2dZSUtvWkl6ajBFQXdJd0lqRWcKTUI0R0ExVUVBeE1YYlhrdGMyVnNabk5wWjI1bFpDMWpiR2xsYm5RdFkyRXdIaGNOTWpReE1URTVNVE14T1RVeQpXaGNOTWpVd01qRTNNVE14T1RVeVdqQWNNUm93R0FZRFZRUUREQkZ6ZEhKbFlXMXBibWRmY21Wd2JHbGpZVENDCkFTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBT0hScytwV3lwVUFGcEFidm82UmZQdHkKc2d6ejM3bXRualYxVVY2MURYL0IrUkd5bmFKNkNuNUxsVXVtSFdrbUFxRVpnNWZOVEV5RnByNXlKRHNKNDQzbQpHb1ZrQ3ZDY3lPSTZMY2lEOU9VRHhFZWNPUDE1QWgrQ0RNMG5URFB2eS9IRG05Mnh3aVFldmYxY0lucGJRVGpPCkVaTFl2YWNkQlR4aWIxS2tVZmJqb0ZNWUJTNHRYaVIzZ2F3aUFRKzYrWHgrN1RUTmUxNlhLT1NXZmdjSkNTNzcKOFZtSS9iOGtnZ2hZU1BZNjdvdEJnK2ZicHJLNUhoNXdpU3ZlMGpORlg1MzhId05YVTBIM29JbEhXM2dEV0svZAova1hsUTdKdHpPSDJtN3NYVnl3eDlHVUlOakZ2TTR1RkFDdkVtYkorcUJ1SkNtQlQ1M1E2NExySzc4c1AvTEVDCkF3RUFBYU5XTUZRd0RnWURWUjBQQVFIL0JBUURBZ09JTUJNR0ExVWRKUVFNTUFvR0NDc0dBUVVGQndNQ01Bd0cKQTFVZEV3RUIvd1FDTUFBd0h3WURWUjBqQkJnd0ZvQVVscmFqNDFKcFROeVRsMkRmTGkzcVZvbXBBcFV3Q2dZSQpLb1pJemowRUF3SURTUUF3UmdJaEFPWkhZUG5aTEV5WlEvejZ2Mm9kYWM2WmZhTXYzVzlBUmlKNE9pNnF5dW5GCkFpRUFvTDhUb1JoVUpaL3pOSTY2N1VMR0JpeUdTU1p3L0R0UHFoTnU5RkVQQWc0PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBNGRHejZsYktsUUFXa0J1K2pwRjgrM0t5RFBQZnVhMmVOWFZSWHJVTmY4SDVFYktkCm9ub0tma3VWUzZZZGFTWUNvUm1EbDgxTVRJV212bklrT3duamplWWFoV1FLOEp6STRqb3R5SVAwNVFQRVI1dzQKL1hrQ0g0SU16U2RNTSsvTDhjT2IzYkhDSkI2OS9Wd2llbHRCT000Umt0aTlweDBGUEdKdlVxUlI5dU9nVXhnRgpMaTFlSkhlQnJDSUJEN3I1Zkg3dE5NMTdYcGNvNUpaK0J3a0pMdnZ4V1lqOXZ5U0NDRmhJOWpydWkwR0Q1OXVtCnNya2VIbkNKSzk3U00wVmZuZndmQTFkVFFmZWdpVWRiZUFOWXI5MytSZVZEc20zTTRmYWJ1eGRYTERIMFpRZzIKTVc4emk0VUFLOFNac242b0c0a0tZRlBuZERyZ3VzcnZ5dy84c1FJREFRQUJBb0lCQUR1MEJMeE5MQXhPMUtoUApIWWQyQWJROU04UG02bHllQVhraXhsdWl4S25sYitOMDlPWlRHOWtlUkorV2tLb1BLWnpNTVJWK2F0REVlVHhhCjB5ZGt5dXZtVFZhOUI0TnNBRlNIaXprN1loRDJlUHR4MjBOd3JkWUV2VHUwU3hwa0tPaUhqZnNFRjA4VGJhbkIKcFQveVJvRXRRa292MFp5UU9LVXBaVU5WUEhKb1p0RkplNXlPK1crZmx6cmFSeDJmVWlsZlZCbm5uT0YxcDFGMAp1azhIa2xFZ3BUVkRlV1RKa0tydlM2L09sMGNhSEhiSTVoNENIL1pzY0R5SVU4bVd0aS9TYTBHOVZjb3pVRUgrCm5EaDFPeTFQZ1FudEg3YWcrQzkxcUZuTUE2QnI3ZzdkWFllVHVpQmVNbzV5UG40aitnNzBVU0JYUVNzM090UEwKeE45VTNwMENnWUVBL2xjand3YkNXZC9PcXRsb0dJbGhGVkpRc0hYd2pzdy91cVNMNkRYRTlQQkJ3U01LOHY4VAo4Z2pwZ2I2ZVpQQjRUQW1Ob1c1Rm1tbTFuNjV0LzlETVRhZE4yMFNuTmJnUWxEQVN6OEUvNDZjMEdLUkRBTjhZClBMVG13MWh4QktIc0dRaTlieUNuTnJPc1M3NzBNM3VTeGtobFpWQmxrd21KTm5mUUp2QlgyZGNDZ1lFQTQwcnIKaXZvK1MwQmYzcExDWTdBR0gwL29ZLytRdUVEczZLdk9pMnR3NHFwekhnNWlTUmhuSHMxTmpqNm5wWlBaMkpwbApMSUthd1o1TDJ6QkhmaEVzOEpnM3NuTG1ieEpySi95N21QTnpkVHVSSlBMM1BEbVVVRlFaU2Y3YlFPL21PbmZFClEzZ0IrNE1VWlRrNVdDaCtrNVJQM1RJejFqd0hvMVQ3S0txV1hMY0NnWUVBelNPRmdaaWpDeEE3eFl0Q3JYK28Kb1NUYVZlbGFWQ0tqU0N2TmVFWmVERnozL0FvQ204bG0wZkdrUFBSOUZ0YnBnQks0ZkRyUHd1SitEa1FIRHF6ZgpDOGJrUWZWV2xEcFlqTjFWWHVIMFlPNk1VMCt4aHpOcGZoVStodEovbllmb1FLek85YUcxbktaQVVudTZ4UWRuCmM2d1N0Q3VyTVhRZ2lxRUtiMDJzM2RNQ2dZRUF3SWpuUzl1OHh3dnA2ZVZScXhZaHFZYUw2YUZFR3dCTWJxK1MKajhGY1ozVlJmSVZjdG1Sb2Zjd1ZSVWhIeE5lZ2NuNGU4L3hTVVc3Zy9QUkJxMFdyVnNicWIwd3JiSzBpZmtYMQpONVFLR3FWeHh1WFZqbnVMNmh2RExFNHB0akZCU2dmSUJncnpTdlYzWW1OOTh2S2lmaXJsR0E5OW41MU1Md3crCmtPMG4zN01DZ1lFQTN1TGJQTG45SjhPT3ZRWjk3eThhQkdaZ1RjdlhOeUpnTHhJTW14NGtoc3pGaTBqMUFhY1MKZ090MEVSWEN0VEQwT2hkS2RWWDE4ZmREZ1BOZUU2MzhEenIxN001NTlIbHc1ZGJJdHQ4MllrV01PYU5SMlJHVwpMcmMreDluUWpvNVNhOUwwZXUwcEQxM0NIS1FCZ2RHNDA0bEh2UnNjT0I5WmRKa29ZeWF0a3cwPQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
kind: Secret
metadata:
  name: replication-secrets-region-c
type: kubernetes.io/tls
- --
- -- This is the client CA certificate, which will be used to sign other client certificate
apiVersion: v1
data:
  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJoakNDQVN1Z0F3SUJBZ0lSQU9ZYmNIcmxuSVgzcU55bi8wWkNSem93Q2dZSUtvWkl6ajBFQXdJd0lqRWcKTUI0R0ExVUVBeE1YYlhrdGMyVnNabk5wWjI1bFpDMWpiR2xsYm5RdFkyRXdIaGNOTWpReE1URTVNVE14T0RVMgpXaGNOTWpVd01qRTNNVE14T0RVMldqQWlNU0F3SGdZRFZRUURFeGR0ZVMxelpXeG1jMmxuYm1Wa0xXTnNhV1Z1CmRDMWpZVEJaTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCQ3gvRHNQMHVPeXFEQjJRbjkzaG40OUQKVEZUOTVrOVpRY2lSeHoyWnMzZ1pWdms0TS80MzZRK3ZVTmZsMDJBS2s3ZWp2Q1YvQ29aYUFIUmkra3NOSkdLagpRakJBTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlNXCnRxUGpVbWxNM0pPWFlOOHVMZXBXaWFrQ2xUQUtCZ2dxaGtqT1BRUURBZ05KQURCR0FpRUFveHowZENYZnlqZFIKckhjN3YvTjh6OFdDYWxSMEJrOTgwUFhWL0NNbVU4RUNJUUNsRVRkRnZncVFYWTM2UHUzSGNiS1ZURnJ1aDJkUQpMaStZQUxHSGI3aGZ5QT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
kind: Secret
metadata:
  name: client-ca-secrets
type: Opaque

: provides a PGD cluster with two data groups and a global witness node just like Flexible 3 regions . In each PGD group, the server TLS certificate is managed by the operator and cert-manager. The client replication certificate is pre-provisioned. Here are the steps to set up this sample:

1. Establish the self-signed issuer and certificate in target namespace. Since we are using a pre-provisioned client replication certificate, we can delete the client secrets, certificate, and issuer created by issuer-selfsigned.yaml .

kubectl -n <namespace> apply -f issuer-selfsigned.yaml
kubectl -n <namespace> delete secrets/client-ca-key-pair \
    certificate/client-ca \
    issuer/client-ca-issuer

2. Create the PGD group. The pre-provisioned client certificate and its CA certificate are included in the flexible_3regions_previsioned_secrets.yaml file as well.

kubectl -n <namespace> apply -f flexible_3regions_previsioned_secrets.yaml

Flexible 3 regions in different namespaces :

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-a
  namespace: region-a
spec:
  instances: 2
  proxyInstances: 2
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
      create: true
    discovery:
    # need list the full discovery name for the group
      - host: region-a-group.region-a.svc.cluster.local
      - host: region-b-group.region-b.svc.cluster.local
      - host: region-c-group.region-c.svc.cluster.local
  cnp:
    storage:
      size: 1Gi
  connectivity:
    dns:
      # we need to configure the domain for the group so it could be resolved
      domain: region-a.svc.cluster.local
      additional:
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
- --
apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-b
  namespace: region-b
spec:
  instances: 2
  proxyInstances: 2
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
    discovery:
    # need list the full discovery name for the group
      - host: region-a-group.region-a.svc.cluster.local
      - host: region-b-group.region-b.svc.cluster.local
      - host: region-c-group.region-c.svc.cluster.local
  cnp:
    storage:
      size: 1Gi
  connectivity:
    dns:
    # we need to configure the domain for the group so it could be resolved
      domain: region-b.svc.cluster.local
      additional:
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
- --
apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-c
  namespace: region-c
spec:
  instances: 0
  proxyInstances: 0
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
    discovery:
    - need list the full discovery name for the group
      - host: region-a-group.region-a.svc.cluster.local
      - host: region-b-group.region-b.svc.cluster.local
      - host: region-c-group.region-c.svc.cluster.local
  cnp:
    storage:
      size: 1Gi
  connectivity:
    dns:
    - we need to configure the domain for the group so it could be resolved
      domain: region-c.svc.cluster.local
      additional:
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io

: provides a sample that builds upon the Flexible 3 regions example. Each region is assigned a different namespace. The discovery and connectivity section are changed in accordance with the namespaces. To setup this sample, we need to pre-create the client-ca-key-pair and server-ca-key-pair secrets in each namespace utilizing private keys generated with the ECDSA algorithm. This ensures that the server TLS certificates and client replication certificates generated by cert-manager are signed from the same private key.

• Create the namespaces region-a , region-b and region-c .

• Create the CA secrets using

## Those two secrets are used to store the ECDSA private key for the client and server CA pairs used by certificate

## in self-signed issuer. The client-ca-key-pair and server-ca-key-pair is finally used in sample flexible_3regions_3ns.yaml

## This is to make sure in different namespaces, we have same CA certificate

apiVersion: v1
data:
tls.key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUNOZW1KbHplK3VPbFR1UHltWHZLWHN0aFlUSkRRSkpIQzJsQ0grblNNMERvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTEg4T3cvUzQ3S29NSFpDZjNlR2ZqME5NVlAzbVQxbEJ5SkhIUFptemVCbFcrVGd6L2pmcApENjlRMStYVFlBcVR0Nk84Slg4S2hsb0FkR0w2U3cwa1lnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
kind: Secret
metadata:
name: client-ca-key-pair
type: Opaque

---

apiVersion: v1
data:
tls.key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUZqVXc5b2hQNVl2blo0RkRML1ZQV092ODhRUGpRb2xHYXFCL1NwOWZFM2lvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFbmNJYnpiODdkWVhabVFzRWZNWGxxWlFIWXlFeGVKT1ZqVWNNc05kMXFUOUVqcmFENTM2YgpGdkdudEhCZUxCOEVYNnJQN0lweXFLTkM2c0lEbWhMVVFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
kind: Secret
metadata:
name: server-ca-key-pair
type: Opaque

in each namespace for the certificates.

kubectl -n region-a apply -f issuer-ecdsa-key.yaml
kubectl -n region-b apply -f issuer-ecdsa-key.yaml
kubectl -n region-c apply -f issuer-ecdsa-key.yaml

• Create the self-signed issuer and corresponding certificate in each namespace. The CA secrets client-ca-key-pair and server-ca-key-pair will be refreshed with ca.crt .

kubectl -n region-a apply -f issuer-selfsigned.yaml
kubectl -n region-b apply -f issuer-selfsigned.yaml
kubectl -n region-c apply -f issuer-selfsigned.yaml

• Create the PGD group

kubectl apply -f flexible_3regions_3ns.yaml

parted group cleanup :

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroupCleanup
metadata:
  name: region-b-cleanup
spec:
  executor: region-a
  target: region-b

: provides a sample of using PGDGroupCleanup to clean up the metadata of region-b . The cleanup is run from region-a . All nodes belonging to region-b need to be in PARTED status before running this CR.

Backup and Restore

sample group with two schedulers :

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: group-example-with-2schedulers
spec:
  instances: 2
  proxyInstances: 2
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
      create: true
  cnp:
    storage:
      storageClass: csi-hostpath-sc
      size: 1Gi
  connectivity:
    dns:
      additional:
        - domain: alternate.domain
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
  backup:
    schedulers:
  # volumeSnapshot scheduler backup
      - method: volumeSnapshot
        immediate: true
        schedule: "0 0 8 * * *"
  # barmanObjectStore scheduler backup
      - method: barmanObjectStore
        immediate: true
        schedule: "0 0 9 * * *"
    configuration:
  # backup configuration for volumeSnapshot
      volumeSnapshot:
        className: csi-hostpath-snapclass
  # backup configuration for barmanObjectStore
      barmanObjectStore:
        destinationPath: s3://backups/
        endpointURL: https://minio-service.minio:9000
        s3Credentials:
          accessKeyId:
            name: minio-secrets
            key: ACCESS_KEY_ID
          secretAccessKey:
            name: minio-secrets
            key: ACCESS_SECRET_KEY
        wal:
          compression: gzip
          maxParallel: 8
        data:
          jobs: 4
          immediateCheckpoint: true

: provides a PGD group sample with two scheduled backups configured: one using volumeSnapshot, the other using barmanObjectStore.

sample group with backup and restore using ``barmanObjectStore`` :

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: group-example-with-barman-backup
spec:
  instances: 3
  proxyInstances: 2
  witnessInstances: 0
  pgd:
    parentGroup:
      name: world
      create: true
  cnp:
    storage:
      size: 1Gi
    walStorage:
      size: 2Gi
  connectivity:
    dns:
      additional:
        - domain: alternate.domain
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
  backup:
    schedulers:
      - method: barmanObjectStore
        immediate: true
        schedule: "0 0 9 * * *"
    configuration:
      barmanObjectStore:
        destinationPath: s3://backups/
        endpointURL: http://minio-service.minio:9000
        s3Credentials:
          accessKeyId:
            name: minio-secrets
            key: ACCESS_KEY_ID
          secretAccessKey:
            name: minio-secrets
            key: ACCESS_SECRET_KEY
        wal:
          compression: gzip
          maxParallel: 8
        data:
          jobs: 4
          immediateCheckpoint: true

: provides a backup sample for a three-node PGD group. This setup includes scheduled backups and continuous WAL archiving to barmanObjectStore.

:

# group-example-with-barman-restore-a is configured to full restore from

# backups in barmanObjectStore, will restore from one of servername

# group-example-with-barman-bak-1, group-example-with-barman-bak-2 or group-example-with-barman-bak-3

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-barman-restore-a
spec:
instances: 3
proxyInstances: 2
witnessInstances: 0
pgd:
parentGroup:
name: world
create: true
cnp:
storage:
size: 1Gi
walStorage:
size: 2Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io
restore:

# List all the serverNames, so pgdgroup will find a more suitable server to restore

    serverNames:
      - group-example-with-barman-backup-1
      - group-example-with-barman-backup-2
      - group-example-with-barman-backup-3
    barmanObjectStore:
      destinationPath: s3://backups/
      endpointURL: http://minio-service.minio:9000
      s3Credentials:
        accessKeyId:
          name: minio-secrets
          key: ACCESS_KEY_ID
        secretAccessKey:
          name: minio-secrets
          key: ACCESS_SECRET_KEY
      wal:
        compression: gzip
        maxParallel: 8
      data:
        jobs: 4
        immediateCheckpoint: true

# The restored pgdgroup also configured with backup, so that it can be used for future restore

# the backup here use a different serverName

backup:
schedulers: - method: barmanObjectStore
immediate: true
schedule: "0 0 9 \* \* \*"
configuration:
barmanObjectStore:
destinationPath: s3://backups/
endpointURL: http://minio-service.minio:9000
s3Credentials:
accessKeyId:
name: minio-secrets
key: ACCESS_KEY_ID
secretAccessKey:
name: minio-secrets
key: ACCESS_SECRET_KEY
wal:
compression: gzip
maxParallel: 8
data:
jobs: 4
immediateCheckpoint: true

---

# group-example-with-barman-restore-b is a three-node data group, it is created from

# scratch and configured to join group-example-with-barman-restore-a and group-example-with-barman-restore-c

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-barman-restore-b
spec:
instances: 3
proxyInstances: 2
witnessInstances: 0
pgd:
parentGroup:
name: world
discovery: - host: group-example-with-barman-restore-a-group - host: group-example-with-barman-restore-b-group - host: group-example-with-barman-restore-c-group
cnp:
storage:
size: 1Gi
walStorage:
size: 2Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io

# The restored pgdgroup also configured with backup, so that it can be used for future restore

# the backup here use a different serverName

backup:
schedulers: - method: barmanObjectStore
immediate: true
schedule: "0 0 9 \* \* \*"
configuration:
barmanObjectStore:
destinationPath: s3://backups/
endpointURL: http://minio-service.minio:9000
s3Credentials:
accessKeyId:
name: minio-secrets
key: ACCESS_KEY_ID
secretAccessKey:
name: minio-secrets
key: ACCESS_SECRET_KEY
wal:
compression: gzip
maxParallel: 8
data:
jobs: 4
immediateCheckpoint: true

---

# group-example-with-barman-restore-c is a witness group, it will not have any instances

# it is configured to join group-example-with-barman-restore-a or group-example-with-barman-restore-b

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-barman-restore-c
spec:
instances: 0
proxyInstances: 0
witnessInstances: 1
pgd:
parentGroup:
name: world
discovery: - host: group-example-with-barman-restore-a-group - host: group-example-with-barman-restore-b-group - host: group-example-with-barman-restore-c-group
cnp:
storage:
size: 1Gi
walStorage:
size: 2Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io

: offers a restore sample for three regions PGD groups. In the first region, group group-example-with-barman-restore-a is restored from backups, and parent group world is created in this group. In the second and third region, group group-example-with-barman-restore-b and group-example-with-barman-restore-c are created from scratch, and respectively join the restored group.

sample group with backup and restore using ``volumeSnapshot`` :

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-vs-backup
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
pgd:
parentGroup:
name: world
create: true
cnp:
storage:
storageClass: csi-hostpath-sc
size: 1Gi
walStorage:
storageClass: csi-hostpath-sc
size: 2Gi
tablespaces: - name: ts1
storage:
storageClass: csi-hostpath-sc
size: 1Gi - name: ts2
storage:
storageClass: csi-hostpath-sc
size: 1Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io
backup:
schedulers: - method: volumeSnapshot
immediate: true
schedule: "0 0 8 \* \* \*"
configuration:
volumeSnapshot:
className: csi-hostpath-snapclass
barmanObjectStore:
destinationPath: s3://backups/
endpointURL: http://minio-service.minio:9000
s3Credentials:
accessKeyId:
name: minio-secrets
key: ACCESS_KEY_ID
secretAccessKey:
name: minio-secrets
key: ACCESS_SECRET_KEY
wal:
compression: gzip
maxParallel: 8
data:
jobs: 4
immediateCheckpoint: true

: specifies a three-node PGD group configured with scheduled volume snapshot backup and continuous WAL archiving to barmanObjectStore.

:

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-vs-restore
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
pgd:
parentGroup:
name: world
create: true
cnp:
storage:
storageClass: csi-hostpath-sc
size: 1Gi
walStorage:
storageClass: csi-hostpath-sc
size: 2Gi
tablespaces: - name: ts1
storage:
storageClass: csi-hostpath-sc
size: 1Gi - name: ts2
storage:
storageClass: csi-hostpath-sc
size: 1Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io
restore:
volumeSnapshots:
selector:
matchLabels: ## we select all the backups from the group-example-with-vs-backup group
"k8s.pgd.enterprisedb.io/group": group-example-with-vs-backup
barmanObjectStore:
destinationPath: s3://backups/
endpointURL: http://minio-service.minio:9000
s3Credentials:
accessKeyId:
name: minio-secrets
key: ACCESS_KEY_ID
secretAccessKey:
name: minio-secrets
key: ACCESS_SECRET_KEY
wal:
compression: gzip
maxParallel: 8
data:
jobs: 4
immediateCheckpoint: true

## This is the backup configuration for the restored pgdgroup

backup:
configuration:
volumeSnapshot:
className: csi-hostpath-snapclass
barmanObjectStore:
destinationPath: s3://backups/
endpointURL: http://minio-service.minio:9000
s3Credentials:
accessKeyId:
name: minio-secrets
key: ACCESS_KEY_ID
secretAccessKey:
name: minio-secrets
key: ACCESS_SECRET_KEY
wal:
compression: gzip
maxParallel: 8
data:
jobs: 4
immediateCheckpoint: true

: defines full restore from volume snapshot backup.

:

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-vs-pitr
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
pgd:
parentGroup:
name: world
create: true
cnp:
storage:
storageClass: csi-hostpath-sc
size: 1Gi
walStorage:
storageClass: csi-hostpath-sc
size: 2Gi
tablespaces: - name: ts1
storage:
storageClass: csi-hostpath-sc
size: 1Gi - name: ts2
storage:
storageClass: csi-hostpath-sc
size: 1Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io
restore:
recoveryTarget:
targetTime: "2024-09-10 00:20:12.213757"
volumeSnapshots:
selector:
matchLabels: ## we select all the backups from the group-example-with-vs-backup group
"k8s.pgd.enterprisedb.io/group": group-example-with-vs-backup
barmanObjectStore:
destinationPath: s3://backups/
endpointURL: http://minio-service.minio:9000
s3Credentials:
accessKeyId:
name: minio-secrets
key: ACCESS_KEY_ID
secretAccessKey:
name: minio-secrets
key: ACCESS_SECRET_KEY
wal:
compression: gzip
maxParallel: 8
data:
jobs: 4
immediateCheckpoint: true

## This is the backup configuration for the restored pgdgroup

backup:
configuration:
volumeSnapshot:
className: csi-hostpath-snapclass
barmanObjectStore:
destinationPath: s3://backups/
endpointURL: http://minio-service.minio:9000
s3Credentials:
accessKeyId:
name: minio-secrets
key: ACCESS_KEY_ID
secretAccessKey:
name: minio-secrets
key: ACCESS_SECRET_KEY
wal:
compression: gzip
maxParallel: 8
data:
jobs: 4
immediateCheckpoint: true

: defines restore from volume snapshot backup followed by point-in-time recovery.

Note

The volumeSnapshot sample above utilizes the csi-hostpath-sc storage class. Please verify that your storage class supports volume snapshots. For more details, refer to Backup on volume snapshots .

Read node routing

sample group with read node routing enabled :

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-readnode-routing
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
pgd:
proxySettings:
enableReadNodeRouting: true
parentGroup:
name: world
create: true
cnp:
storage:
size: 1Gi
connectivity:
proxyReadServiceTemplate:
metadata:
annotations:
annotationName: "annotationValue"
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io

: offers a sample with read node routing enabled.

LDAP

sample group use ldap with bind and search :

apiVersion: v1
data:
password: YWRtaW4=
kind: Secret
metadata:
name: ldap-bind-password
type: Opaque

---

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-ldap-bind-search
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
pgd:
parentGroup:
name: world
create: true
cnp:
postgresql:
ldap:
server: ldap-service.ldap.svc.cluster.local
bindSearchAuth:
baseDN: "dc=example,dc=org"
bindDN: "cn=admin,dc=example,dc=org"
searchAttribute: "uid"
bindPassword:
name: ldap-bind-password
key: password
storage:
size: 1Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io
backup:
schedulers: - method: barmanObjectStore
immediate: true
schedule: "0 0 9 \* \* \*"
configuration:
barmanObjectStore:
destinationPath: s3://backups/
endpointURL: https://minio-service.minio:9000
s3Credentials:
accessKeyId:
name: minio-secrets
key: ACCESS_KEY_ID
secretAccessKey:
name: minio-secrets
key: ACCESS_SECRET_KEY
wal:
compression: gzip
maxParallel: 8
data:
jobs: 4
immediateCheckpoint: true

: provides an LDAP sample of PGD group configured to use bind and search for authentication.

sample group use ldap with simple bind :

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-ldap-simple-bind
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
pgd:
parentGroup:
name: world
create: true
cnp:
postgresql:
ldap:
server: ldap-service.ldap.svc.cluster.local
bindAsAuth:
prefix: "uid="
suffix: ",dc=example,dc=org"
storage:
size: 1Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io
backup:
schedulers: - method: barmanObjectStore
immediate: true
schedule: "0 0 9 \* \* \*"
configuration:
barmanObjectStore:
destinationPath: s3://backups/
endpointURL: https://minio-service.minio:9000
s3Credentials:
accessKeyId:
name: minio-secrets
key: ACCESS_KEY_ID
secretAccessKey:
name: minio-secrets
key: ACCESS_SECRET_KEY
wal:
compression: gzip
maxParallel: 8
data:
jobs: 4
immediateCheckpoint: true

: provides an LDAP sample of PGD group to use simple bind for authentication.

Managed roles

sample group with managed roles :

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-managed
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
pgd:
parentGroup:
name: world
create: true
cnp:
storage:
size: 1Gi
managed:
roles: - name: foo
comment: Foo
ensure: present
connectionLimit: 100
login: true
superuser: true
createdb: true
createrole: true
replication: true
inherit: true - name: bar
ensure: present
inRoles: - foo
login: true
services:
disabledDefaultServices: - ro - r
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io

: provides a PGD group sample with managed roles and managed services.

TDE

sample group using tde :

- --

apiVersion: v1
kind: Secret
metadata:
name: tde-key
data:
key: bG9zcG9sbGl0b3NkaWNlbnBpb3Bpb3Bpb2N1YW5kb3RpZW5lbmhhbWJyZWN1YW5kb3RpZW5lbmZyaW8=

- --

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-tde
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
imageName: docker.enterprisedb.com/k8s_enterprise_pgd/edb-postgres-advanced-pgd:16.4.1-5.5.1
pgdProxy:
imageName: docker.enterprisedb.com/k8s_enterprise_pgd/edb-pgd-proxy:5.5.0
pgd:
parentGroup:
name: world
create: true
cnp:
postgresql:
epas:
tde:
enabled: true
secretKeyRef:
name: tde-key
key: key
storage:
size: 1Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io

: provides a PGD group sample with TDE enabled. Since TDE requires PostgreSQL to be a specific flavor and version, the YAML file includes configurations for both the PGD and PGD proxy images.

Configurations

sample group with mutations :

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-mutations
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
pgd:
parentGroup:
name: world
create: true
mutations: - isApplied: - |
WITH node_route_config AS (
SELECT node_name, route_dsn
FROM bdr.node_routing_config_summary
)
SELECT NOT EXISTS(SELECT \* FROM node_route_config WHERE regexp_count(route_dsn, application_name=) >= 1);
exec: - |
WITH node_route_config AS (
SELECT node_name,
regexp_replace(route_dsn, concat( application_name=, node_name), ) as route_dsn
FROM bdr.node_routing_config_summary
)
SELECT bdr.alter_node_option(node_name, route_dsn, route_dsn)
FROM node_route_config;
cnp:
storage:
size: 1Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io

: offers a PGD group sample with always mutation configured.

sample group with service template configured :

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-service-template
spec:
instances: 3
proxyInstances: 2
pgd:
parentGroup:
create: true
name: world
proxySettings:
enableReadNodeRouting: true
inheritedMetadata:
labels:
region: zeta
annotations:
region.domain.com: region-domain
cnp:
storage:
size: 1Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io
groupServiceTemplate:
metadata:
labels:
application: test-app
annotations:
test.domain.com: domain-value
nodeServiceTemplate:
metadata:
labels:
application: test-app
annotations:
test.domain.com: domain-value
proxyReadServiceTemplate:
metadata:
annotations:
annotationName: "annotationValue"
proxyServiceTemplate:
metadata:
labels:
application: test-app
annotations:
test.domain.com: domain-value

: offers a sample with groupSeviceTemplate , nodeServiceTemplate proxyServiceTemplate and proxyReadServiceTemplate configured.

sample group with operand image customized :

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-customized
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
imageName: docker.enterprisedb.com/k8s_enterprise_pgd/edb-postgres-extended-pgd:15.10-5.6.1-1
imagePullSecrets:


- name: registry-pullsecret
  pgd:
  parentGroup:
  name: world
  create: true
  cnp:
  storage:
  size: 1Gi
  pgdProxy:
  imageName: docker.enterprisedb.com/k8s_enterprise_pgd/edb-pgd-proxy:5.6.0
  connectivity:
  dns:
  additional: - domain: alternate.domain - domain: my.domain
  hostSuffix: -dc1
  tls:
  mode: verify-ca
  clientCert:
  caCertSecret: client-ca-key-pair
  certManager:
  spec:
  issuerRef:
  name: client-ca-issuer
  kind: Issuer
  group: cert-manager.io
  serverCert:
  caCertSecret: server-ca-key-pair
  certManager:
  spec:
  issuerRef:
  name: server-ca-issuer
  kind: Issuer
  group: cert-manager.io

: offers a PGD group sample with pgd and proxy image name customized.

For a list of available options, see the 'API reference' .

Note

The PGD group sample above requires cert-manager with a self-signed issuer. You can use

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: selfsigned-issuer
spec:
selfSigned: {}

---

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: server-ca
spec:
isCA: true
commonName: my-selfsigned-server-ca
secretName: server-ca-key-pair
privateKey:
algorithm: ECDSA
size: 256
issuerRef:
name: selfsigned-issuer
kind: Issuer
group: cert-manager.io

---

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: server-ca-issuer
spec:
ca:
secretName: server-ca-key-pair

---

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: client-ca
spec:
isCA: true
commonName: my-selfsigned-client-ca
secretName: client-ca-key-pair
privateKey:
algorithm: ECDSA
size: 256
issuerRef:
name: selfsigned-issuer
kind: Issuer
group: cert-manager.io

---

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: client-ca-issuer
spec:
ca:
secretName: client-ca-key-pair

to create the self-signed issuer before setting up the PGD group.