Examples of configuration

重要

使用可能な例は、デモンストレーションと実験のみを目的としています。

これらの例は、Kubernetes環境でEDB Postgres分散クラスターをセットアップするための構成ファイルです。

基本

柔軟な3つのリージョン

:

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-a
spec:
  instances: 2
  proxyInstances: 2
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
      create: true
    discovery:
      - host: region-a-group
      - host: region-b-group
      - host: region-c-group
  cnp:
    storage:
      size: 1Gi
  connectivity:
    dns:
      additional:
        - domain: alternate.domain
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
- --
apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-b
spec:
  instances: 2
  proxyInstances: 2
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
    discovery:
      - host: region-a-group
      - host: region-b-group
      - host: region-c-group
  cnp:
    storage:
      size: 1Gi
  connectivity:
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
- --
apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-c
spec:
  instances: 0
  proxyInstances: 0
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
    discovery:
      - host: region-a-group
      - host: region-b-group
      - host: region-c-group
  cnp:
    storage:
      size: 1Gi
  connectivity:
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io

は、2つのデータグループと3つのリージョンにまたがるグローバル監視ノードを含むPGDクラスターを提供します。各データグループは2つのデータノードとローカル監視ノードで構成されます。

物理的結合を使用した柔軟な3リージョン

:

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-a
spec:
  instances: 2
  proxyInstances: 2
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
      create: true
  cnp:
    joinMethod: physical
    storage:
      size: 1Gi
  connectivity:
    dns:
      additional:
        - domain: alternate.domain
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
- --
apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-b
spec:
  instances: 2
  proxyInstances: 2
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
    # The first node in region-b will join to one of the node defined in discovery list using physical join
    groupJoinMethod: physical
    # list the data node of region a to physical Join
    discovery:
      - host: region-a-3-node
      - host: region-a-1-node
      - host: region-a-2-node
  cnp:
    joinMethod: physical
    storage:
      size: 1Gi
  connectivity:
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
- --
apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-c
spec:
  instances: 0
  proxyInstances: 0
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
    discovery:
      - host: region-a-group
      - host: region-b-group
      - host: region-c-group
  cnp:
    storage:
      size: 1Gi
  connectivity:
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io

は、2つのデータグループと1つのグローバル監視ノードを含むPGDクラスターを提供します。Flexible 3 regions のような。違いは、このサンプルのグループ結合が物理的結合を使用していることです。グループregion-aは、最初に起動するグループspec.pgd.parentGroup.create=true 、region-aのノードは物理的結合を使用して互いに結合します。グループリージョン-bはそのspec.pgd.groupJoinMethod=physical を定義します。これは、リージョン-bの最初のノードが起動してリモートノードに物理的に参加することを意味します、参加ターゲットはグループリージョン-bのspec.pgd.discovery セクションで定義されます。リージョン-bの残りのノードはに参加しますそれぞれがspec.cnp.joinMethod=physical として物理的結合を使用します。 region-cは、常に論理結合を使用する監視グループです。

事前にプロビジョニングされたクライアントシークレットを使用した柔軟な3リージョン

:

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-a
spec:
  instances: 2
  proxyInstances: 2
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
      create: true
    discovery:
      - host: region-a-group
      - host: region-b-group
      - host: region-c-group
  cnp:
    storage:
      size: 1Gi
  connectivity:
    dns:
      additional:
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
      # if the pre-provisioned secrets is set, the caCertSecret will accept a CA secrets, which contains ca.crt or ca.key optionally
        caCertSecret: client-ca-secrets
        preProvisioned:
          streamingReplica:
            secretRef: replication-secrets-region-a
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
- --
apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-b
spec:
  instances: 2
  proxyInstances: 2
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
    discovery:
      - host: region-a-group
      - host: region-b-group
      - host: region-c-group
  cnp:
    storage:
      size: 1Gi
  connectivity:
    dns:
      additional:
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-secrets
        preProvisioned:
          streamingReplica:
            secretRef: replication-secrets-region-b
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
- --
apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-c
spec:
  instances: 0
  proxyInstances: 0
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
    discovery:
      - host: region-a-group
      - host: region-b-group
      - host: region-c-group
  cnp:
    storage:
      size: 1Gi
  connectivity:
    dns:
      additional:
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-secrets
        preProvisioned:
          streamingReplica:
            secretRef: replication-secrets-region-c
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
- --

###  This is the pre-provisioned client certificate which is signed by certificate in client-ca-secrets

apiVersion: v1
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNYekNDQWdTZ0F3SUJBZ0lSQUw0N2V5eXEydzNEN0gwM2RPaE9iaFF3Q2dZSUtvWkl6ajBFQXdJd0lqRWcKTUI0R0ExVUVBeE1YYlhrdGMyVnNabk5wWjI1bFpDMWpiR2xsYm5RdFkyRXdIaGNOTWpReE1URTVNVE14T1RVeQpXaGNOTWpVd01qRTNNVE14T1RVeVdqQWNNUm93R0FZRFZRUUREQkZ6ZEhKbFlXMXBibWRmY21Wd2JHbGpZVENDCkFTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBT0hScytwV3lwVUFGcEFidm82UmZQdHkKc2d6ejM3bXRualYxVVY2MURYL0IrUkd5bmFKNkNuNUxsVXVtSFdrbUFxRVpnNWZOVEV5RnByNXlKRHNKNDQzbQpHb1ZrQ3ZDY3lPSTZMY2lEOU9VRHhFZWNPUDE1QWgrQ0RNMG5URFB2eS9IRG05Mnh3aVFldmYxY0lucGJRVGpPCkVaTFl2YWNkQlR4aWIxS2tVZmJqb0ZNWUJTNHRYaVIzZ2F3aUFRKzYrWHgrN1RUTmUxNlhLT1NXZmdjSkNTNzcKOFZtSS9iOGtnZ2hZU1BZNjdvdEJnK2ZicHJLNUhoNXdpU3ZlMGpORlg1MzhId05YVTBIM29JbEhXM2dEV0svZAova1hsUTdKdHpPSDJtN3NYVnl3eDlHVUlOakZ2TTR1RkFDdkVtYkorcUJ1SkNtQlQ1M1E2NExySzc4c1AvTEVDCkF3RUFBYU5XTUZRd0RnWURWUjBQQVFIL0JBUURBZ09JTUJNR0ExVWRKUVFNTUFvR0NDc0dBUVVGQndNQ01Bd0cKQTFVZEV3RUIvd1FDTUFBd0h3WURWUjBqQkJnd0ZvQVVscmFqNDFKcFROeVRsMkRmTGkzcVZvbXBBcFV3Q2dZSQpLb1pJemowRUF3SURTUUF3UmdJaEFPWkhZUG5aTEV5WlEvejZ2Mm9kYWM2WmZhTXYzVzlBUmlKNE9pNnF5dW5GCkFpRUFvTDhUb1JoVUpaL3pOSTY2N1VMR0JpeUdTU1p3L0R0UHFoTnU5RkVQQWc0PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBNGRHejZsYktsUUFXa0J1K2pwRjgrM0t5RFBQZnVhMmVOWFZSWHJVTmY4SDVFYktkCm9ub0tma3VWUzZZZGFTWUNvUm1EbDgxTVRJV212bklrT3duamplWWFoV1FLOEp6STRqb3R5SVAwNVFQRVI1dzQKL1hrQ0g0SU16U2RNTSsvTDhjT2IzYkhDSkI2OS9Wd2llbHRCT000Umt0aTlweDBGUEdKdlVxUlI5dU9nVXhnRgpMaTFlSkhlQnJDSUJEN3I1Zkg3dE5NMTdYcGNvNUpaK0J3a0pMdnZ4V1lqOXZ5U0NDRmhJOWpydWkwR0Q1OXVtCnNya2VIbkNKSzk3U00wVmZuZndmQTFkVFFmZWdpVWRiZUFOWXI5MytSZVZEc20zTTRmYWJ1eGRYTERIMFpRZzIKTVc4emk0VUFLOFNac242b0c0a0tZRlBuZERyZ3VzcnZ5dy84c1FJREFRQUJBb0lCQUR1MEJMeE5MQXhPMUtoUApIWWQyQWJROU04UG02bHllQVhraXhsdWl4S25sYitOMDlPWlRHOWtlUkorV2tLb1BLWnpNTVJWK2F0REVlVHhhCjB5ZGt5dXZtVFZhOUI0TnNBRlNIaXprN1loRDJlUHR4MjBOd3JkWUV2VHUwU3hwa0tPaUhqZnNFRjA4VGJhbkIKcFQveVJvRXRRa292MFp5UU9LVXBaVU5WUEhKb1p0RkplNXlPK1crZmx6cmFSeDJmVWlsZlZCbm5uT0YxcDFGMAp1azhIa2xFZ3BUVkRlV1RKa0tydlM2L09sMGNhSEhiSTVoNENIL1pzY0R5SVU4bVd0aS9TYTBHOVZjb3pVRUgrCm5EaDFPeTFQZ1FudEg3YWcrQzkxcUZuTUE2QnI3ZzdkWFllVHVpQmVNbzV5UG40aitnNzBVU0JYUVNzM090UEwKeE45VTNwMENnWUVBL2xjand3YkNXZC9PcXRsb0dJbGhGVkpRc0hYd2pzdy91cVNMNkRYRTlQQkJ3U01LOHY4VAo4Z2pwZ2I2ZVpQQjRUQW1Ob1c1Rm1tbTFuNjV0LzlETVRhZE4yMFNuTmJnUWxEQVN6OEUvNDZjMEdLUkRBTjhZClBMVG13MWh4QktIc0dRaTlieUNuTnJPc1M3NzBNM3VTeGtobFpWQmxrd21KTm5mUUp2QlgyZGNDZ1lFQTQwcnIKaXZvK1MwQmYzcExDWTdBR0gwL29ZLytRdUVEczZLdk9pMnR3NHFwekhnNWlTUmhuSHMxTmpqNm5wWlBaMkpwbApMSUthd1o1TDJ6QkhmaEVzOEpnM3NuTG1ieEpySi95N21QTnpkVHVSSlBMM1BEbVVVRlFaU2Y3YlFPL21PbmZFClEzZ0IrNE1VWlRrNVdDaCtrNVJQM1RJejFqd0hvMVQ3S0txV1hMY0NnWUVBelNPRmdaaWpDeEE3eFl0Q3JYK28Kb1NUYVZlbGFWQ0tqU0N2TmVFWmVERnozL0FvQ204bG0wZkdrUFBSOUZ0YnBnQks0ZkRyUHd1SitEa1FIRHF6ZgpDOGJrUWZWV2xEcFlqTjFWWHVIMFlPNk1VMCt4aHpOcGZoVStodEovbllmb1FLek85YUcxbktaQVVudTZ4UWRuCmM2d1N0Q3VyTVhRZ2lxRUtiMDJzM2RNQ2dZRUF3SWpuUzl1OHh3dnA2ZVZScXhZaHFZYUw2YUZFR3dCTWJxK1MKajhGY1ozVlJmSVZjdG1Sb2Zjd1ZSVWhIeE5lZ2NuNGU4L3hTVVc3Zy9QUkJxMFdyVnNicWIwd3JiSzBpZmtYMQpONVFLR3FWeHh1WFZqbnVMNmh2RExFNHB0akZCU2dmSUJncnpTdlYzWW1OOTh2S2lmaXJsR0E5OW41MU1Md3crCmtPMG4zN01DZ1lFQTN1TGJQTG45SjhPT3ZRWjk3eThhQkdaZ1RjdlhOeUpnTHhJTW14NGtoc3pGaTBqMUFhY1MKZ090MEVSWEN0VEQwT2hkS2RWWDE4ZmREZ1BOZUU2MzhEenIxN001NTlIbHc1ZGJJdHQ4MllrV01PYU5SMlJHVwpMcmMreDluUWpvNVNhOUwwZXUwcEQxM0NIS1FCZ2RHNDA0bEh2UnNjT0I5WmRKa29ZeWF0a3cwPQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
kind: Secret
metadata:
  name: replication-secrets-region-a
type: Opaque
- --

###  This is the pre-provisioned client certificate which is signed by certificate in client-ca-secrets

apiVersion: v1
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNYekNDQWdTZ0F3SUJBZ0lSQUw0N2V5eXEydzNEN0gwM2RPaE9iaFF3Q2dZSUtvWkl6ajBFQXdJd0lqRWcKTUI0R0ExVUVBeE1YYlhrdGMyVnNabk5wWjI1bFpDMWpiR2xsYm5RdFkyRXdIaGNOTWpReE1URTVNVE14T1RVeQpXaGNOTWpVd01qRTNNVE14T1RVeVdqQWNNUm93R0FZRFZRUUREQkZ6ZEhKbFlXMXBibWRmY21Wd2JHbGpZVENDCkFTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBT0hScytwV3lwVUFGcEFidm82UmZQdHkKc2d6ejM3bXRualYxVVY2MURYL0IrUkd5bmFKNkNuNUxsVXVtSFdrbUFxRVpnNWZOVEV5RnByNXlKRHNKNDQzbQpHb1ZrQ3ZDY3lPSTZMY2lEOU9VRHhFZWNPUDE1QWgrQ0RNMG5URFB2eS9IRG05Mnh3aVFldmYxY0lucGJRVGpPCkVaTFl2YWNkQlR4aWIxS2tVZmJqb0ZNWUJTNHRYaVIzZ2F3aUFRKzYrWHgrN1RUTmUxNlhLT1NXZmdjSkNTNzcKOFZtSS9iOGtnZ2hZU1BZNjdvdEJnK2ZicHJLNUhoNXdpU3ZlMGpORlg1MzhId05YVTBIM29JbEhXM2dEV0svZAova1hsUTdKdHpPSDJtN3NYVnl3eDlHVUlOakZ2TTR1RkFDdkVtYkorcUJ1SkNtQlQ1M1E2NExySzc4c1AvTEVDCkF3RUFBYU5XTUZRd0RnWURWUjBQQVFIL0JBUURBZ09JTUJNR0ExVWRKUVFNTUFvR0NDc0dBUVVGQndNQ01Bd0cKQTFVZEV3RUIvd1FDTUFBd0h3WURWUjBqQkJnd0ZvQVVscmFqNDFKcFROeVRsMkRmTGkzcVZvbXBBcFV3Q2dZSQpLb1pJemowRUF3SURTUUF3UmdJaEFPWkhZUG5aTEV5WlEvejZ2Mm9kYWM2WmZhTXYzVzlBUmlKNE9pNnF5dW5GCkFpRUFvTDhUb1JoVUpaL3pOSTY2N1VMR0JpeUdTU1p3L0R0UHFoTnU5RkVQQWc0PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBNGRHejZsYktsUUFXa0J1K2pwRjgrM0t5RFBQZnVhMmVOWFZSWHJVTmY4SDVFYktkCm9ub0tma3VWUzZZZGFTWUNvUm1EbDgxTVRJV212bklrT3duamplWWFoV1FLOEp6STRqb3R5SVAwNVFQRVI1dzQKL1hrQ0g0SU16U2RNTSsvTDhjT2IzYkhDSkI2OS9Wd2llbHRCT000Umt0aTlweDBGUEdKdlVxUlI5dU9nVXhnRgpMaTFlSkhlQnJDSUJEN3I1Zkg3dE5NMTdYcGNvNUpaK0J3a0pMdnZ4V1lqOXZ5U0NDRmhJOWpydWkwR0Q1OXVtCnNya2VIbkNKSzk3U00wVmZuZndmQTFkVFFmZWdpVWRiZUFOWXI5MytSZVZEc20zTTRmYWJ1eGRYTERIMFpRZzIKTVc4emk0VUFLOFNac242b0c0a0tZRlBuZERyZ3VzcnZ5dy84c1FJREFRQUJBb0lCQUR1MEJMeE5MQXhPMUtoUApIWWQyQWJROU04UG02bHllQVhraXhsdWl4S25sYitOMDlPWlRHOWtlUkorV2tLb1BLWnpNTVJWK2F0REVlVHhhCjB5ZGt5dXZtVFZhOUI0TnNBRlNIaXprN1loRDJlUHR4MjBOd3JkWUV2VHUwU3hwa0tPaUhqZnNFRjA4VGJhbkIKcFQveVJvRXRRa292MFp5UU9LVXBaVU5WUEhKb1p0RkplNXlPK1crZmx6cmFSeDJmVWlsZlZCbm5uT0YxcDFGMAp1azhIa2xFZ3BUVkRlV1RKa0tydlM2L09sMGNhSEhiSTVoNENIL1pzY0R5SVU4bVd0aS9TYTBHOVZjb3pVRUgrCm5EaDFPeTFQZ1FudEg3YWcrQzkxcUZuTUE2QnI3ZzdkWFllVHVpQmVNbzV5UG40aitnNzBVU0JYUVNzM090UEwKeE45VTNwMENnWUVBL2xjand3YkNXZC9PcXRsb0dJbGhGVkpRc0hYd2pzdy91cVNMNkRYRTlQQkJ3U01LOHY4VAo4Z2pwZ2I2ZVpQQjRUQW1Ob1c1Rm1tbTFuNjV0LzlETVRhZE4yMFNuTmJnUWxEQVN6OEUvNDZjMEdLUkRBTjhZClBMVG13MWh4QktIc0dRaTlieUNuTnJPc1M3NzBNM3VTeGtobFpWQmxrd21KTm5mUUp2QlgyZGNDZ1lFQTQwcnIKaXZvK1MwQmYzcExDWTdBR0gwL29ZLytRdUVEczZLdk9pMnR3NHFwekhnNWlTUmhuSHMxTmpqNm5wWlBaMkpwbApMSUthd1o1TDJ6QkhmaEVzOEpnM3NuTG1ieEpySi95N21QTnpkVHVSSlBMM1BEbVVVRlFaU2Y3YlFPL21PbmZFClEzZ0IrNE1VWlRrNVdDaCtrNVJQM1RJejFqd0hvMVQ3S0txV1hMY0NnWUVBelNPRmdaaWpDeEE3eFl0Q3JYK28Kb1NUYVZlbGFWQ0tqU0N2TmVFWmVERnozL0FvQ204bG0wZkdrUFBSOUZ0YnBnQks0ZkRyUHd1SitEa1FIRHF6ZgpDOGJrUWZWV2xEcFlqTjFWWHVIMFlPNk1VMCt4aHpOcGZoVStodEovbllmb1FLek85YUcxbktaQVVudTZ4UWRuCmM2d1N0Q3VyTVhRZ2lxRUtiMDJzM2RNQ2dZRUF3SWpuUzl1OHh3dnA2ZVZScXhZaHFZYUw2YUZFR3dCTWJxK1MKajhGY1ozVlJmSVZjdG1Sb2Zjd1ZSVWhIeE5lZ2NuNGU4L3hTVVc3Zy9QUkJxMFdyVnNicWIwd3JiSzBpZmtYMQpONVFLR3FWeHh1WFZqbnVMNmh2RExFNHB0akZCU2dmSUJncnpTdlYzWW1OOTh2S2lmaXJsR0E5OW41MU1Md3crCmtPMG4zN01DZ1lFQTN1TGJQTG45SjhPT3ZRWjk3eThhQkdaZ1RjdlhOeUpnTHhJTW14NGtoc3pGaTBqMUFhY1MKZ090MEVSWEN0VEQwT2hkS2RWWDE4ZmREZ1BOZUU2MzhEenIxN001NTlIbHc1ZGJJdHQ4MllrV01PYU5SMlJHVwpMcmMreDluUWpvNVNhOUwwZXUwcEQxM0NIS1FCZ2RHNDA0bEh2UnNjT0I5WmRKa29ZeWF0a3cwPQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
kind: Secret
metadata:
  name: replication-secrets-region-b
type: kubernetes.io/tls
- --

###  This is the pre-provisioned client certificate which is signed by certificate in client-ca-secrets

apiVersion: v1
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNYekNDQWdTZ0F3SUJBZ0lSQUw0N2V5eXEydzNEN0gwM2RPaE9iaFF3Q2dZSUtvWkl6ajBFQXdJd0lqRWcKTUI0R0ExVUVBeE1YYlhrdGMyVnNabk5wWjI1bFpDMWpiR2xsYm5RdFkyRXdIaGNOTWpReE1URTVNVE14T1RVeQpXaGNOTWpVd01qRTNNVE14T1RVeVdqQWNNUm93R0FZRFZRUUREQkZ6ZEhKbFlXMXBibWRmY21Wd2JHbGpZVENDCkFTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBT0hScytwV3lwVUFGcEFidm82UmZQdHkKc2d6ejM3bXRualYxVVY2MURYL0IrUkd5bmFKNkNuNUxsVXVtSFdrbUFxRVpnNWZOVEV5RnByNXlKRHNKNDQzbQpHb1ZrQ3ZDY3lPSTZMY2lEOU9VRHhFZWNPUDE1QWgrQ0RNMG5URFB2eS9IRG05Mnh3aVFldmYxY0lucGJRVGpPCkVaTFl2YWNkQlR4aWIxS2tVZmJqb0ZNWUJTNHRYaVIzZ2F3aUFRKzYrWHgrN1RUTmUxNlhLT1NXZmdjSkNTNzcKOFZtSS9iOGtnZ2hZU1BZNjdvdEJnK2ZicHJLNUhoNXdpU3ZlMGpORlg1MzhId05YVTBIM29JbEhXM2dEV0svZAova1hsUTdKdHpPSDJtN3NYVnl3eDlHVUlOakZ2TTR1RkFDdkVtYkorcUJ1SkNtQlQ1M1E2NExySzc4c1AvTEVDCkF3RUFBYU5XTUZRd0RnWURWUjBQQVFIL0JBUURBZ09JTUJNR0ExVWRKUVFNTUFvR0NDc0dBUVVGQndNQ01Bd0cKQTFVZEV3RUIvd1FDTUFBd0h3WURWUjBqQkJnd0ZvQVVscmFqNDFKcFROeVRsMkRmTGkzcVZvbXBBcFV3Q2dZSQpLb1pJemowRUF3SURTUUF3UmdJaEFPWkhZUG5aTEV5WlEvejZ2Mm9kYWM2WmZhTXYzVzlBUmlKNE9pNnF5dW5GCkFpRUFvTDhUb1JoVUpaL3pOSTY2N1VMR0JpeUdTU1p3L0R0UHFoTnU5RkVQQWc0PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBNGRHejZsYktsUUFXa0J1K2pwRjgrM0t5RFBQZnVhMmVOWFZSWHJVTmY4SDVFYktkCm9ub0tma3VWUzZZZGFTWUNvUm1EbDgxTVRJV212bklrT3duamplWWFoV1FLOEp6STRqb3R5SVAwNVFQRVI1dzQKL1hrQ0g0SU16U2RNTSsvTDhjT2IzYkhDSkI2OS9Wd2llbHRCT000Umt0aTlweDBGUEdKdlVxUlI5dU9nVXhnRgpMaTFlSkhlQnJDSUJEN3I1Zkg3dE5NMTdYcGNvNUpaK0J3a0pMdnZ4V1lqOXZ5U0NDRmhJOWpydWkwR0Q1OXVtCnNya2VIbkNKSzk3U00wVmZuZndmQTFkVFFmZWdpVWRiZUFOWXI5MytSZVZEc20zTTRmYWJ1eGRYTERIMFpRZzIKTVc4emk0VUFLOFNac242b0c0a0tZRlBuZERyZ3VzcnZ5dy84c1FJREFRQUJBb0lCQUR1MEJMeE5MQXhPMUtoUApIWWQyQWJROU04UG02bHllQVhraXhsdWl4S25sYitOMDlPWlRHOWtlUkorV2tLb1BLWnpNTVJWK2F0REVlVHhhCjB5ZGt5dXZtVFZhOUI0TnNBRlNIaXprN1loRDJlUHR4MjBOd3JkWUV2VHUwU3hwa0tPaUhqZnNFRjA4VGJhbkIKcFQveVJvRXRRa292MFp5UU9LVXBaVU5WUEhKb1p0RkplNXlPK1crZmx6cmFSeDJmVWlsZlZCbm5uT0YxcDFGMAp1azhIa2xFZ3BUVkRlV1RKa0tydlM2L09sMGNhSEhiSTVoNENIL1pzY0R5SVU4bVd0aS9TYTBHOVZjb3pVRUgrCm5EaDFPeTFQZ1FudEg3YWcrQzkxcUZuTUE2QnI3ZzdkWFllVHVpQmVNbzV5UG40aitnNzBVU0JYUVNzM090UEwKeE45VTNwMENnWUVBL2xjand3YkNXZC9PcXRsb0dJbGhGVkpRc0hYd2pzdy91cVNMNkRYRTlQQkJ3U01LOHY4VAo4Z2pwZ2I2ZVpQQjRUQW1Ob1c1Rm1tbTFuNjV0LzlETVRhZE4yMFNuTmJnUWxEQVN6OEUvNDZjMEdLUkRBTjhZClBMVG13MWh4QktIc0dRaTlieUNuTnJPc1M3NzBNM3VTeGtobFpWQmxrd21KTm5mUUp2QlgyZGNDZ1lFQTQwcnIKaXZvK1MwQmYzcExDWTdBR0gwL29ZLytRdUVEczZLdk9pMnR3NHFwekhnNWlTUmhuSHMxTmpqNm5wWlBaMkpwbApMSUthd1o1TDJ6QkhmaEVzOEpnM3NuTG1ieEpySi95N21QTnpkVHVSSlBMM1BEbVVVRlFaU2Y3YlFPL21PbmZFClEzZ0IrNE1VWlRrNVdDaCtrNVJQM1RJejFqd0hvMVQ3S0txV1hMY0NnWUVBelNPRmdaaWpDeEE3eFl0Q3JYK28Kb1NUYVZlbGFWQ0tqU0N2TmVFWmVERnozL0FvQ204bG0wZkdrUFBSOUZ0YnBnQks0ZkRyUHd1SitEa1FIRHF6ZgpDOGJrUWZWV2xEcFlqTjFWWHVIMFlPNk1VMCt4aHpOcGZoVStodEovbllmb1FLek85YUcxbktaQVVudTZ4UWRuCmM2d1N0Q3VyTVhRZ2lxRUtiMDJzM2RNQ2dZRUF3SWpuUzl1OHh3dnA2ZVZScXhZaHFZYUw2YUZFR3dCTWJxK1MKajhGY1ozVlJmSVZjdG1Sb2Zjd1ZSVWhIeE5lZ2NuNGU4L3hTVVc3Zy9QUkJxMFdyVnNicWIwd3JiSzBpZmtYMQpONVFLR3FWeHh1WFZqbnVMNmh2RExFNHB0akZCU2dmSUJncnpTdlYzWW1OOTh2S2lmaXJsR0E5OW41MU1Md3crCmtPMG4zN01DZ1lFQTN1TGJQTG45SjhPT3ZRWjk3eThhQkdaZ1RjdlhOeUpnTHhJTW14NGtoc3pGaTBqMUFhY1MKZ090MEVSWEN0VEQwT2hkS2RWWDE4ZmREZ1BOZUU2MzhEenIxN001NTlIbHc1ZGJJdHQ4MllrV01PYU5SMlJHVwpMcmMreDluUWpvNVNhOUwwZXUwcEQxM0NIS1FCZ2RHNDA0bEh2UnNjT0I5WmRKa29ZeWF0a3cwPQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
kind: Secret
metadata:
  name: replication-secrets-region-c
type: kubernetes.io/tls
- --

###  This is the client CA certificate, which will be used to sign other client certificate

apiVersion: v1
data:
  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJoakNDQVN1Z0F3SUJBZ0lSQU9ZYmNIcmxuSVgzcU55bi8wWkNSem93Q2dZSUtvWkl6ajBFQXdJd0lqRWcKTUI0R0ExVUVBeE1YYlhrdGMyVnNabk5wWjI1bFpDMWpiR2xsYm5RdFkyRXdIaGNOTWpReE1URTVNVE14T0RVMgpXaGNOTWpVd01qRTNNVE14T0RVMldqQWlNU0F3SGdZRFZRUURFeGR0ZVMxelpXeG1jMmxuYm1Wa0xXTnNhV1Z1CmRDMWpZVEJaTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCQ3gvRHNQMHVPeXFEQjJRbjkzaG40OUQKVEZUOTVrOVpRY2lSeHoyWnMzZ1pWdms0TS80MzZRK3ZVTmZsMDJBS2s3ZWp2Q1YvQ29aYUFIUmkra3NOSkdLagpRakJBTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlNXCnRxUGpVbWxNM0pPWFlOOHVMZXBXaWFrQ2xUQUtCZ2dxaGtqT1BRUURBZ05KQURCR0FpRUFveHowZENYZnlqZFIKckhjN3YvTjh6OFdDYWxSMEJrOTgwUFhWL0NNbVU4RUNJUUNsRVRkRnZncVFYWTM2UHUzSGNiS1ZURnJ1aDJkUQpMaStZQUxHSGI3aGZ5QT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
kind: Secret
metadata:
  name: client-ca-secrets
type: Opaque

は、2つのデータグループと1つのグローバル監視ノードを含むPGDクラスターを提供します。Flexible 3 regions のような。各PGDグループでは、サーバーTLS証明書はオペレーターとcert-managerによって管理されます。クライアントレプリケーション証明書は事前にプロビジョニングされています。このサンプルをセットアップする手順は次のとおりです。

1. ターゲット名前空間で自己署名発行者と証明書を確立します。事前にプロビジョニングされたクライアントレプリケーション証明書を使用しているため、 issuer-selfsigned.yaml によって作成されたクライアントシークレット、証明書、および発行者を削除できます。

kubectl -n <namespace> apply -f issuer-selfsigned.yaml
kubectl -n <namespace> delete secrets/client-ca-key-pair \
    certificate/client-ca \
    issuer/client-ca-issuer

2. PGDグループを作成します。事前にプロビジョニングされたクライアント証明書とそのCA証明書は、 flexible_3regions_previsioned_secrets.yaml ファイルにも含まれています。

kubectl -n <namespace> apply -f flexible_3regions_previsioned_secrets.yaml

異なる名前空間の柔軟な3つのリージョン

:

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-a
  namespace: region-a
spec:
  instances: 2
  proxyInstances: 2
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
      create: true
    discovery:
    # need list the full discovery name for the group
      - host: region-a-group.region-a.svc.cluster.local
      - host: region-b-group.region-b.svc.cluster.local
      - host: region-c-group.region-c.svc.cluster.local
  cnp:
    storage:
      size: 1Gi
  connectivity:
    dns:
      # we need to configure the domain for the group so it could be resolved
      domain: region-a.svc.cluster.local
      additional:
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
- --
apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-b
  namespace: region-b
spec:
  instances: 2
  proxyInstances: 2
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
    discovery:
    # need list the full discovery name for the group
      - host: region-a-group.region-a.svc.cluster.local
      - host: region-b-group.region-b.svc.cluster.local
      - host: region-c-group.region-c.svc.cluster.local
  cnp:
    storage:
      size: 1Gi
  connectivity:
    dns:
    # we need to configure the domain for the group so it could be resolved
      domain: region-b.svc.cluster.local
      additional:
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
- --
apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: region-c
  namespace: region-c
spec:
  instances: 0
  proxyInstances: 0
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
    discovery:
    # need list the full discovery name for the group
      - host: region-a-group.region-a.svc.cluster.local
      - host: region-b-group.region-b.svc.cluster.local
      - host: region-c-group.region-c.svc.cluster.local
  cnp:
    storage:
      size: 1Gi
  connectivity:
    dns:
    # we need to configure the domain for the group so it could be resolved
      domain: region-c.svc.cluster.local
      additional:
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io

Flexible 3 regions 例に基づいて構築されたサンプルを提供します。各リージョンには、異なる名前空間が割り当てられます。 discovery 、connectivity セクションが名前空間に合わせて変更されます。このサンプルをセットアップするには、 ECDSAアルゴリズムで生成されたプライベートキーを使用して、各名前空間にclient-ca-key-pair およびserver-ca-key-pair シークレットを事前に作成する必要があります。これにより、cert-manager によって生成されたサーバーTLS証明書とクライアントレプリケーション証明書が同じプライベートキーから署名されることが保証されます。

• 名前空間region-a 、region-b 、およびregion-c を作成します。

• 次を使用してCAシークレットを作成します

##  Those two secrets are used to store the ECDSA private key for the client and server CA pairs used by certificate

##  in self-signed issuer. The client-ca-key-pair and server-ca-key-pair is finally used in sample flexible_3regions_3ns.yaml

##  This is to make sure in different namespaces, we have same CA certificate

apiVersion: v1
data:
tls.key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUNOZW1KbHplK3VPbFR1UHltWHZLWHN0aFlUSkRRSkpIQzJsQ0grblNNMERvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTEg4T3cvUzQ3S29NSFpDZjNlR2ZqME5NVlAzbVQxbEJ5SkhIUFptemVCbFcrVGd6L2pmcApENjlRMStYVFlBcVR0Nk84Slg4S2hsb0FkR0w2U3cwa1lnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
kind: Secret
metadata:
name: client-ca-key-pair
type: Opaque

- --

apiVersion: v1
data:
tls.key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUZqVXc5b2hQNVl2blo0RkRML1ZQV092ODhRUGpRb2xHYXFCL1NwOWZFM2lvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFbmNJYnpiODdkWVhabVFzRWZNWGxxWlFIWXlFeGVKT1ZqVWNNc05kMXFUOUVqcmFENTM2YgpGdkdudEhCZUxCOEVYNnJQN0lweXFLTkM2c0lEbWhMVVFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
kind: Secret
metadata:
name: server-ca-key-pair
type: Opaque

証明書の各名前空間で。

kubectl -n region-a apply -f issuer-ecdsa-key.yaml
kubectl -n region-b apply -f issuer-ecdsa-key.yaml
kubectl -n region-c apply -f issuer-ecdsa-key.yaml

• 各名前空間に自己署名発行者と対応する証明書を作成します。 CAシークレット client-ca-key-pair およびserver-ca-key-pair は、 ca.crt で更新されます。

kubectl -n region-a apply -f issuer-selfsigned.yaml
kubectl -n region-b apply -f issuer-selfsigned.yaml
kubectl -n region-c apply -f issuer-selfsigned.yaml

• PGDグループを作成する

kubectl apply -f flexible_3regions_3ns.yaml

分割されたグループのクリーンアップ

:

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroupCleanup
metadata:
  name: region-b-cleanup
spec:
  executor: region-a
  target: region-b

は、 PGDGroupCleanupを使用してregion-b のメタデータをクリーンアップするサンプルを提供します。クリーンアップはregion-a から実行されます。 region-b に属するすべてのノードは、このCRを実行する前にPARTED ステータスになる必要があります。

バックアップとリストア

2つのスケジューラーを含むサンプルグループ

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: group-example-with-2schedulers
spec:
  instances: 2
  proxyInstances: 2
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
      create: true
  cnp:
    storage:
      storageClass: csi-hostpath-sc
      size: 1Gi
  connectivity:
    dns:
      additional:
        - domain: alternate.domain
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
  backup:
    schedulers:
  # volumeSnapshot scheduler backup
      - method: volumeSnapshot
        immediate: true
        schedule: "0 0 8  **  *"
  # barmanObjectStore scheduler backup
      - method: barmanObjectStore
        immediate: true
        schedule: "0 0 9  **  *"
    configuration:
  # backup configuration for volumeSnapshot
      volumeSnapshot:
        className: csi-hostpath-snapclass
  # backup configuration for barmanObjectStore
      barmanObjectStore:
        destinationPath: s3://backups/
        endpointURL: https://minio-service.minio:9000
        s3Credentials:
          accessKeyId:
            name: minio-secrets
            key: ACCESS_KEY_ID
          secretAccessKey:
            name: minio-secrets
            key: ACCESS_SECRET_KEY
        wal:
          compression: gzip
          maxParallel: 8
        data:
          jobs: 4
          immediateCheckpoint: true

は、2つのスケジュールされたバックアップが構成されたPGDグループサンプルを提供します。1つはvolumeSnapshotを使用し、もう1つはbarmanObjectStoreを使用します。

``barmanObjectStore`` を使用したバックアップとリストアを含むサンプルグループ

:

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: group-example-with-barman-backup
spec:
  instances: 3
  proxyInstances: 2
  witnessInstances: 0
  pgd:
    parentGroup:
      name: world
      create: true
  cnp:
    storage:
      size: 1Gi
    walStorage:
      size: 2Gi
  connectivity:
    dns:
      additional:
        - domain: alternate.domain
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
  backup:
    schedulers:
      - method: barmanObjectStore
        immediate: true
        schedule: "0 0 9  **  *"
    configuration:
      barmanObjectStore:
        destinationPath: s3://backups/
        endpointURL: http://minio-service.minio:9000
        s3Credentials:
          accessKeyId:
            name: minio-secrets
            key: ACCESS_KEY_ID
          secretAccessKey:
            name: minio-secrets
            key: ACCESS_SECRET_KEY
        wal:
          compression: gzip
          maxParallel: 8
        data:
          jobs: 4
          immediateCheckpoint: true

3ノードPGDグループのバックアップサンプルを提供します。このセットアップには、スケジュールされたバックアップとbarmanObjectStoreへの継続的なWALアーカイブが含まれます。

:

#  group-example-with-barman-restore-a is configured to full restore from

#  backups in barmanObjectStore, will restore from one of servername

#  group-example-with-barman-bak-1, group-example-with-barman-bak-2 or group-example-with-barman-bak-3

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-barman-restore-a
spec:
instances: 3
proxyInstances: 2
witnessInstances: 0
pgd:
parentGroup:
name: world
create: true
cnp:
storage:
size: 1Gi
walStorage:
size: 2Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io
restore:

#  List all the serverNames, so pgdgroup will find a more suitable server to restore

    serverNames:
      - group-example-with-barman-backup-1
      - group-example-with-barman-backup-2
      - group-example-with-barman-backup-3
    barmanObjectStore:
      destinationPath: s3://backups/
      endpointURL: http://minio-service.minio:9000
      s3Credentials:
        accessKeyId:
          name: minio-secrets
          key: ACCESS_KEY_ID
        secretAccessKey:
          name: minio-secrets
          key: ACCESS_SECRET_KEY
      wal:
        compression: gzip
        maxParallel: 8
      data:
        jobs: 4
        immediateCheckpoint: true

#  The restored pgdgroup also configured with backup, so that it can be used for future restore

#  the backup here use a different serverName

backup:
schedulers: - method: barmanObjectStore
immediate: true
schedule: "0 0 9 \ **  *"
configuration:
barmanObjectStore:
destinationPath: s3://backups/
endpointURL: http://minio-service.minio:9000
s3Credentials:
accessKeyId:
name: minio-secrets
key: ACCESS_KEY_ID
secretAccessKey:
name: minio-secrets
key: ACCESS_SECRET_KEY
wal:
compression: gzip
maxParallel: 8
data:
jobs: 4
immediateCheckpoint: true

- --

#  group-example-with-barman-restore-b is a three-node data group, it is created from

#  scratch and configured to join group-example-with-barman-restore-a and group-example-with-barman-restore-c

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-barman-restore-b
spec:
instances: 3
proxyInstances: 2
witnessInstances: 0
pgd:
parentGroup:
name: world
discovery: - host: group-example-with-barman-restore-a-group - host: group-example-with-barman-restore-b-group - host: group-example-with-barman-restore-c-group
cnp:
storage:
size: 1Gi
walStorage:
size: 2Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io

#  The restored pgdgroup also configured with backup, so that it can be used for future restore

#  the backup here use a different serverName

backup:
schedulers: - method: barmanObjectStore
immediate: true
schedule: "0 0 9 \ **  *"
configuration:
barmanObjectStore:
destinationPath: s3://backups/
endpointURL: http://minio-service.minio:9000
s3Credentials:
accessKeyId:
name: minio-secrets
key: ACCESS_KEY_ID
secretAccessKey:
name: minio-secrets
key: ACCESS_SECRET_KEY
wal:
compression: gzip
maxParallel: 8
data:
jobs: 4
immediateCheckpoint: true

- --

#  group-example-with-barman-restore-c is a witness group, it will not have any instances

#  it is configured to join group-example-with-barman-restore-a or group-example-with-barman-restore-b

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-barman-restore-c
spec:
instances: 0
proxyInstances: 0
witnessInstances: 1
pgd:
parentGroup:
name: world
discovery: - host: group-example-with-barman-restore-a-group - host: group-example-with-barman-restore-b-group - host: group-example-with-barman-restore-c-group
cnp:
storage:
size: 1Gi
walStorage:
size: 2Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io

は、3つのリージョンPGDグループの復元サンプルを提供します。最初のリージョンでは、グループ group-example-with-barman-restore-a がバックアップから復元され、親グループ world がこのグループに作成されます。 2番目と3番目のリージョンでは、グループgroup-example-with-barman-restore-b およびgroup-example-with-barman-restore-c がスクラッチから作成され、それぞれ復元されたグループに参加します。

``volumeSnapshot`` を使用したバックアップと復元を行うサンプルグループ

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-vs-backup
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
pgd:
parentGroup:
name: world
create: true
cnp:
storage:
storageClass: csi-hostpath-sc
size: 1Gi
walStorage:
storageClass: csi-hostpath-sc
size: 2Gi
tablespaces: - name: ts1
storage:
storageClass: csi-hostpath-sc
size: 1Gi - name: ts2
storage:
storageClass: csi-hostpath-sc
size: 1Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io
backup:
schedulers: - method: volumeSnapshot
immediate: true
schedule: "0 0 8 \ **  *"
configuration:
volumeSnapshot:
className: csi-hostpath-snapclass
barmanObjectStore:
destinationPath: s3://backups/
endpointURL: http://minio-service.minio:9000
s3Credentials:
accessKeyId:
name: minio-secrets
key: ACCESS_KEY_ID
secretAccessKey:
name: minio-secrets
key: ACCESS_SECRET_KEY
wal:
compression: gzip
maxParallel: 8
data:
jobs: 4
immediateCheckpoint: true

は、スケジュールされたボリュームスナップショットバックアップとbarmanObjectStoreへの継続的なWALアーカイブで構成された3ノードPGDグループを指定します。

:

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-vs-restore
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
pgd:
parentGroup:
name: world
create: true
cnp:
storage:
storageClass: csi-hostpath-sc
size: 1Gi
walStorage:
storageClass: csi-hostpath-sc
size: 2Gi
tablespaces: - name: ts1
storage:
storageClass: csi-hostpath-sc
size: 1Gi - name: ts2
storage:
storageClass: csi-hostpath-sc
size: 1Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io
restore:
volumeSnapshots:
selector:
matchLabels: ## we select all the backups from the group-example-with-vs-backup group
"k8s.pgd.enterprisedb.io/group": group-example-with-vs-backup
barmanObjectStore:
destinationPath: s3://backups/
endpointURL: http://minio-service.minio:9000
s3Credentials:
accessKeyId:
name: minio-secrets
key: ACCESS_KEY_ID
secretAccessKey:
name: minio-secrets
key: ACCESS_SECRET_KEY
wal:
compression: gzip
maxParallel: 8
data:
jobs: 4
immediateCheckpoint: true

##  This is the backup configuration for the restored pgdgroup

backup:
configuration:
volumeSnapshot:
className: csi-hostpath-snapclass
barmanObjectStore:
destinationPath: s3://backups/
endpointURL: http://minio-service.minio:9000
s3Credentials:
accessKeyId:
name: minio-secrets
key: ACCESS_KEY_ID
secretAccessKey:
name: minio-secrets
key: ACCESS_SECRET_KEY
wal:
compression: gzip
maxParallel: 8
data:
jobs: 4
immediateCheckpoint: true

:ボリュームスナップショットバックアップからの完全な復元を定義します。

:

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
  name: group-example-with-vs-pitr
spec:
  instances: 2
  proxyInstances: 2
  witnessInstances: 1
  pgd:
    parentGroup:
      name: world
      create: true
  cnp:
    storage:
      storageClass: csi-hostpath-sc
      size: 1Gi
    walStorage:
      storageClass: csi-hostpath-sc
      size: 2Gi
    tablespaces:
      - name: ts1
        storage:
          storageClass: csi-hostpath-sc
          size: 1Gi
      - name: ts2
        storage:
          storageClass: csi-hostpath-sc
          size: 1Gi
  connectivity:
    dns:
      additional:
        - domain: alternate.domain
        - domain: my.domain
          hostSuffix: -dc1
    tls:
      mode: verify-ca
      clientCert:
        caCertSecret: client-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: client-ca-issuer
              kind: Issuer
              group: cert-manager.io
      serverCert:
        caCertSecret: server-ca-key-pair
        certManager:
          spec:
            issuerRef:
              name: server-ca-issuer
              kind: Issuer
              group: cert-manager.io
  restore:
    recoveryTarget:
      targetTime: "2024-09-10 00:20:12.213757"
    volumeSnapshots:
      selector:
        matchLabels:
          ## we select all the backups from the group-example-with-vs-backup group
          "k8s.pgd.enterprisedb.io/group": group-example-with-vs-backup
    barmanObjectStore:
      destinationPath: s3://backups/
      endpointURL: http://minio-service.minio:9000
      s3Credentials:
        accessKeyId:
          name: minio-secrets
          key: ACCESS_KEY_ID
        secretAccessKey:
          name: minio-secrets
          key: ACCESS_SECRET_KEY
      wal:
        compression: gzip
        maxParallel: 8
      data:
        jobs: 4
        immediateCheckpoint: true
  ## This is the backup configuration for the restored pgdgroup
  backup:
    configuration:
      volumeSnapshot:
        className: csi-hostpath-snapclass
      barmanObjectStore:
        destinationPath: s3://backups/
        endpointURL: http://minio-service.minio:9000
        s3Credentials:
          accessKeyId:
            name: minio-secrets
            key: ACCESS_KEY_ID
          secretAccessKey:
            name: minio-secrets
            key: ACCESS_SECRET_KEY
        wal:
          compression: gzip
          maxParallel: 8
        data:
          jobs: 4
          immediateCheckpoint: true

は、ボリュームスナップショットバックアップからのリストアと、それに続くポイントインタイムリカバリーを定義します。

注釈

上記の`volumeSnapshot` サンプルでは、 csi-hostpath-sc ストレージクラスを使用しています。ストレージクラスがボリュームスナップショットをサポートしていることを確認してください。詳細については、 Backup on volume snapshots を参照してください。

読み取りノードルーティング

読み取りノードルーティングが有効になったサンプルグループ

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-readnode-routing
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
pgd:
proxySettings:
enableReadNodeRouting: true
parentGroup:
name: world
create: true
cnp:
storage:
size: 1Gi
connectivity:
proxyReadServiceTemplate:
metadata:
annotations:
annotationName: "annotationValue"
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io

は、読み取りノードルーティングを有効にしたサンプルを提供します。

LDAP

サンプルグループはバインドと検索でldapを使用します

apiVersion: v1
data:
password: YWRtaW4=
kind: Secret
metadata:
name: ldap-bind-password
type: Opaque

- --

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-ldap-bind-search
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
pgd:
parentGroup:
name: world
create: true
cnp:
postgresql:
ldap:
server: ldap-service.ldap.svc.cluster.local
bindSearchAuth:
baseDN: "dc=example,dc=org"
bindDN: "cn=admin,dc=example,dc=org"
searchAttribute: "uid"
bindPassword:
name: ldap-bind-password
key: password
storage:
size: 1Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io
backup:
schedulers: - method: barmanObjectStore
immediate: true
schedule: "0 0 9 \ **  *"
configuration:
barmanObjectStore:
destinationPath: s3://backups/
endpointURL: https://minio-service.minio:9000
s3Credentials:
accessKeyId:
name: minio-secrets
key: ACCESS_KEY_ID
secretAccessKey:
name: minio-secrets
key: ACCESS_SECRET_KEY
wal:
compression: gzip
maxParallel: 8
data:
jobs: 4
immediateCheckpoint: true

は、認証にbind およびsearch を使用するように構成されたPGDグループのLDAPサンプルを提供します。

サンプルグループは単純なバインドでLDAPを使用します

:

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-ldap-simple-bind
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
pgd:
parentGroup:
name: world
create: true
cnp:
postgresql:
ldap:
server: ldap-service.ldap.svc.cluster.local
bindAsAuth:
prefix: "uid="
suffix: ",dc=example,dc=org"
storage:
size: 1Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io
backup:
schedulers: - method: barmanObjectStore
immediate: true
schedule: "0 0 9 \ **  *"
configuration:
barmanObjectStore:
destinationPath: s3://backups/
endpointURL: https://minio-service.minio:9000
s3Credentials:
accessKeyId:
name: minio-secrets
key: ACCESS_KEY_ID
secretAccessKey:
name: minio-secrets
key: ACCESS_SECRET_KEY
wal:
compression: gzip
maxParallel: 8
data:
jobs: 4
immediateCheckpoint: true

は、認証にシンプルバインドを使用するPGDグループのLDAPサンプルを提供します。

管理対象ロール

管理対象ロールを含むサンプルグループ

:

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-managed
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
pgd:
parentGroup:
name: world
create: true
cnp:
storage:
size: 1Gi
managed:
roles: - name: foo
comment: Foo
ensure: present
connectionLimit: 100
login: true
superuser: true
createdb: true
createrole: true
replication: true
inherit: true - name: bar
ensure: present
inRoles: - foo
login: true
services:
disabledDefaultServices: - ro - r
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io

は、管理対象ロールと管理対象サービスを含むPGDグループサンプルを提供します。

TDE

tdeを使用したサンプルグループ

:

- --

apiVersion: v1
kind: Secret
metadata:
name: tde-key
data:
key: bG9zcG9sbGl0b3NkaWNlbnBpb3Bpb3Bpb2N1YW5kb3RpZW5lbmhhbWJyZWN1YW5kb3RpZW5lbmZyaW8=

- --

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-tde
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
imageName: docker.enterprisedb.com/k8s_enterprise_pgd/edb-postgres-advanced-pgd:16.4.1-5.5.1
pgdProxy:
imageName: docker.enterprisedb.com/k8s_enterprise_pgd/edb-pgd-proxy:5.5.0
pgd:
parentGroup:
name: world
create: true
cnp:
postgresql:
epas:
tde:
enabled: true
secretKeyRef:
name: tde-key
key: key
storage:
size: 1Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io

は、TDEが有効になったPGDグループサンプルを提供します。 TDEではPostgreSQLが特定のフレーバーとバージョンである必要があるため、 YAMLファイルには、PGDとPGDプロキシイメージの両方の構成が含まれています。

構成

Mutationを含むサンプルグループ

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-mutations
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
pgd:
parentGroup:
name: world
create: true
mutations: - isApplied: - |
WITH node_route_config AS (
SELECT node_name, route_dsn
FROM bdr.node_routing_config_summary
)
SELECT NOT EXISTS(SELECT * FROM node_route_config WHERE regexp_count(route_dsn, application_name=) >= 1);
exec: - |
WITH node_route_config AS (
SELECT node_name,
regexp_replace(route_dsn, concat( application_name=, node_name), ) as route_dsn
FROM bdr.node_routing_config_summary
)
SELECT bdr.alter_node_option(node_name, route_dsn, route_dsn)
FROM node_route_config;
cnp:
storage:
size: 1Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io

: always 変異が構成されたPGDグループサンプルを提供します。

サービステンプレートが構成されたサンプルグループ

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-service-template
spec:
instances: 3
proxyInstances: 2
pgd:
parentGroup:
create: true
name: world
proxySettings:
enableReadNodeRouting: true
inheritedMetadata:
labels:
region: zeta
annotations:
region.domain.com: region-domain
cnp:
storage:
size: 1Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io
groupServiceTemplate:
metadata:
labels:
application: test-app
annotations:
test.domain.com: domain-value
nodeServiceTemplate:
metadata:
labels:
application: test-app
annotations:
test.domain.com: domain-value
proxyReadServiceTemplate:
metadata:
annotations:
annotationName: "annotationValue"
proxyServiceTemplate:
metadata:
labels:
application: test-app
annotations:
test.domain.com: domain-value

groupSeviceTemplate 、nodeServiceTemplate proxyServiceTemplate 、およびproxyReadServiceTemplate を構成したサンプルを提供します。

オペランドイメージがカスタマイズされたサンプルグループ

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-customized
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
imageName: docker.enterprisedb.com/k8s_enterprise_pgd/edb-postgres-extended-pgd:17.4-5.7.0-1
imagePullSecrets:


- name: registry-pullsecret
  pgd:
  parentGroup:
  name: world
  create: true
  cnp:
  storage:
  size: 1Gi
  pgdProxy:
  imageName: docker.enterprisedb.com/k8s_enterprise_pgd/edb-pgd-proxy:5.7.0-1
  connectivity:
  dns:
  additional: - domain: alternate.domain - domain: my.domain
  hostSuffix: -dc1
  tls:
  mode: verify-ca
  clientCert:
  caCertSecret: client-ca-key-pair
  certManager:
  spec:
  issuerRef:
  name: client-ca-issuer
  kind: Issuer
  group: cert-manager.io
  serverCert:
  caCertSecret: server-ca-key-pair
  certManager:
  spec:
  issuerRef:
  name: server-ca-issuer
  kind: Issuer
  group: cert-manager.io

: pgdおよびプロキシイメージ名がカスタマイズされたPGDグループサンプルを提供します。

ImageCatalogを使用してカスタマイズされたオペランド画像を含むサンプルグループ

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: ImageCatalog
metadata:
name: postgresql-pgd-catalog
spec:
pgdImages:


-  image: docker.enterprisedb.com/k8s_standard_pgd/postgresql-pgd:15.10-5.6.1-1
  major: 15

-  image: docker.enterprisedb.com/k8s_standard_pgd/postgresql-pgd:16.6-5.6.1-1
  major: 16
  proxyImage: docker.enterprisedb.com/k8s_standard_pgd/edb-pgd-proxy:5.6.0-ubi9

- --

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-catalog
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
imageCatalogRef:
apiGroup: pgd.k8s.enterprisedb.io
kind: ImageCatalog
major: 16
name: postgresql-pgd-catalog
imagePullSecrets:


-  name: registry-pullsecret
  pgd:
  parentGroup:
  name: world
  create: true
  cnp:
  storage:
  size: 1Gi
  connectivity:
  dns:
  additional: - domain: alternate.domain - domain: my.domain
  hostSuffix: -dc1
  tls:
  mode: verify-ca
  clientCert:
  caCertSecret: client-ca-key-pair
  certManager:
  spec:
  issuerRef:
  name: client-ca-issuer
  kind: Issuer
  group: cert-manager.io
  serverCert:
  caCertSecret: server-ca-key-pair
  certManager:
  spec:
  issuerRef:
  name: server-ca-issuer
  kind: Issuer
  group: cert-manager.io

: ImageCatalogを使用してカスタマイズされたpgdとプロキシイメージを使用したPGDグループサンプルを提供します。

物理的結合を使用してスケールアップしたサンプルグループ

:

apiVersion: pgd.k8s.enterprisedb.io/v1beta1
kind: PGDGroup
metadata:
name: group-example-with-physical-local-join
spec:
instances: 2
proxyInstances: 2
witnessInstances: 1
pgd:
parentGroup:
name: world
create: true
cnp:
joinMethod: physical
storage:
size: 1Gi
connectivity:
dns:
additional: - domain: alternate.domain - domain: my.domain
hostSuffix: -dc1
tls:
mode: verify-ca
clientCert:
caCertSecret: client-ca-key-pair
certManager:
spec:
issuerRef:
name: client-ca-issuer
kind: Issuer
group: cert-manager.io
serverCert:
caCertSecret: server-ca-key-pair
certManager:
spec:
issuerRef:
name: server-ca-issuer
kind: Issuer
group: cert-manager.io

は、物理的結合が構成されたPGDグループサンプルを提供します。

使用可能なオプションのリストについては、 APIリファレンス を参照してください。

注釈

上記のPGDグループサンプルでは、自己署名発行者を使用したcert-managerが必要です。使用できます

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: selfsigned-issuer
spec:
selfSigned: {}

- --

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: server-ca
spec:
isCA: true
commonName: my-selfsigned-server-ca
secretName: server-ca-key-pair
privateKey:
algorithm: ECDSA
size: 256
issuerRef:
name: selfsigned-issuer
kind: Issuer
group: cert-manager.io

- --

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: server-ca-issuer
spec:
ca:
secretName: server-ca-key-pair

- --

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: client-ca
spec:
isCA: true
commonName: my-selfsigned-client-ca
secretName: client-ca-key-pair
privateKey:
algorithm: ECDSA
size: 256
issuerRef:
name: selfsigned-issuer
kind: Issuer
group: cert-manager.io

- --

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: client-ca-issuer
spec:
ca:
secretName: client-ca-key-pair

をクリックして、PGDグループを設定する前に自己署名発行者を作成します。