You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|`path`|`string`| The absolute path inside the operator Pod to the file containing the admin credentials. | Yes |
35
37
36
-
Use this option when the credentials are mounted as a file instead of a Kubernetes Secret.
37
38
38
39
#### File format
39
40
@@ -51,35 +52,23 @@ The file must contain JSON with the following fields:
51
52
52
53
#### Mount the credentials file
53
54
54
-
The file must be accessible inside the operator pod at the path specified in `adminSecretFileRef.path`. Mount it using a Volume and VolumeMount on the operator Deployment:
55
+
The file must be accessible inside the operator Pod at the path in `adminSecretFileRef.path`.
55
56
56
-
```yaml
57
-
apiVersion: apps/v1
58
-
kind: Deployment
59
-
metadata:
60
-
name: postgresql-operator
61
-
spec:
62
-
template:
63
-
spec:
64
-
containers:
65
-
- name: postgresql-operator
66
-
volumeMounts:
67
-
- name: db-credentials
68
-
mountPath: /mnt/secrets
69
-
readOnly: true
70
-
volumes:
71
-
- name: db-credentials
72
-
secret:
73
-
secretName: db-credentials-secret
74
-
```
57
+
The Helm chart exposes the `app.volumes` and `app.volumeMounts` values for this.
58
+
Both take the raw Kubernetes syntax, so any volume source that provides a file works.
75
59
76
-
> **Note:** The volume source can be any type that provides a file.
60
+
The value of `adminSecretFileRef.path` is the `mountPath` plus the name of the file. The volume source decides the file name:
77
61
78
-
> **Note:** The Helm chart does not support extra volumes yet.
|`csi` (Secrets Store CSI driver) | the `objectAlias` of the object |
79
66
80
-
### Examples
67
+
See [Using a file reference](#using-a-file-reference-adminsecretfileref) in the examples for a complete setup with each volume source.
81
68
82
-
#### Using a Kubernetes Secret (`adminSecretRef`)
69
+
## Examples
70
+
71
+
### Using a Kubernetes Secret (`adminSecretRef`)
83
72
84
73
```yaml
85
74
apiVersion: v1
@@ -110,18 +99,119 @@ spec:
110
99
#connectTimeout: "10" # Timeout in seconds for connection attempts
111
100
```
112
101
113
-
#### Using a file reference (`adminSecretFileRef`)
102
+
### Using a file reference (`adminSecretFileRef`)
114
103
115
104
```yaml
116
105
apiVersion: postgresql.aboutbits.it/v1
117
106
kind: ClusterConnection
118
107
metadata:
119
-
name: quarkus-postgres-connection
108
+
name: my-postgres-connection
120
109
spec:
121
110
adminSecretFileRef:
122
111
path: "/mnt/secrets/db-credentials.json"
123
112
host: localhost
124
113
port: 5432
125
114
database: postgres
115
+
# Example parameters
116
+
parameters:
117
+
ApplicationName: "k8s-operator"# Helps identify this connection in Postgres logs
118
+
#sslmode: "require" # Enforce SSL encryption
119
+
#connectTimeout: "10" # Timeout in seconds for connection attempts
126
120
```
127
121
122
+
The mount that creates `/mnt/secrets/db-credentials.json` depends on the volume source.
123
+
124
+
#### From a Secret volume
125
+
126
+
Create the Secret. Its key becomes the file name:
127
+
128
+
```yaml
129
+
apiVersion: v1
130
+
kind: Secret
131
+
metadata:
132
+
name: db-credentials-secret
133
+
stringData:
134
+
db-credentials.json: |
135
+
{
136
+
"username": "root",
137
+
"password": "password"
138
+
}
139
+
```
140
+
141
+
Then mount it through the chart values:
142
+
143
+
```yaml
144
+
app:
145
+
volumes:
146
+
- name: db-credentials
147
+
secret:
148
+
secretName: db-credentials-secret
149
+
volumeMounts:
150
+
- name: db-credentials
151
+
mountPath: /mnt/secrets
152
+
readOnly: true
153
+
```
154
+
155
+
#### From the Secrets Store CSI driver
156
+
157
+
Use this option to read the credentials from an external secret store, for example AWS Secrets Manager.
158
+
159
+
> **Note:** Install the [Secrets Store CSI driver](https://secrets-store-csi-driver.sigs.k8s.io/getting-started/installation) and the [provider](https://secrets-store-csi-driver.sigs.k8s.io/providers) for your secret store first. Neither the operator nor the chart installs them. Without the driver, the operator Pod stays in `ContainerCreating` and reports a failed mount.
160
+
161
+
The chart does not create the `SecretProviderClass`, so you have to apply it yourself. Its `objectAlias` becomes the file name:
162
+
163
+
```yaml
164
+
apiVersion: secrets-store.csi.x-k8s.io/v1
165
+
kind: SecretProviderClass
166
+
metadata:
167
+
name: db-credentials
168
+
spec:
169
+
provider: aws
170
+
parameters:
171
+
objects: |
172
+
- objectName: "my/db/credentials"
173
+
objectAlias: "db-credentials.json"
174
+
```
175
+
176
+
> **Note:** The `SecretProviderClass` must live in the namespace of the operator.
177
+
178
+
Then mount it through the chart values:
179
+
180
+
```yaml
181
+
app:
182
+
volumes:
183
+
- name: db-credentials
184
+
csi:
185
+
driver: secrets-store.csi.k8s.io
186
+
readOnly: true
187
+
volumeAttributes:
188
+
secretProviderClass: db-credentials
189
+
volumeMounts:
190
+
- name: db-credentials
191
+
mountPath: /mnt/secrets
192
+
readOnly: true
193
+
```
194
+
195
+
#### Without the Helm chart
196
+
197
+
If you deploy the operator directly from the OCI image, set the same `volumes` and `volumeMounts` fields on the Deployment:
0 commit comments