Upgrading to PostgreSQL 15 and moving to sclorg images

.github/workflows/pr.yml

@@ -131,6 +131,7 @@ jobs:
       - name: Logs
         if: always()
         run: .github/workflows/scripts/show_logs.sh
+
       # - name: Debugging example (uncomment when needed)
       #   if: failure()
       #   uses: mxschmitt/action-tmate@v3

Dockerfile

@@ -1,4 +1,4 @@
-FROM quay.io/operator-framework/ansible-operator:v1.23.0
+FROM quay.io/operator-framework/ansible-operator:v1.34.1
 
 ARG DEFAULT_GALAXY_VERSION
 ARG DEFAULT_GALAXY_UI_VERSION
@@ -22,4 +22,8 @@ COPY watches.yaml ${HOME}/watches.yaml
 COPY roles/ ${HOME}/roles/
 COPY playbooks/ ${HOME}/playbooks/
 
-ENTRYPOINT ["/tini", "--", "/usr/local/bin/ansible-operator", "run", "--watches-file=./watches.yaml", "--reconcile-period=0s"]
+ENTRYPOINT ["/tini", "--", "/usr/local/bin/ansible-operator", "run", \
+    "--watches-file=./watches.yaml", \
+    "--reconcile-period=0s", \
+    "--ansible-log-events=Tasks" \
+]

config/crd/bases/galaxy_v1beta1_galaxy_crd.yaml

@@ -135,13 +135,16 @@ spec:
               postgres_storage_class:
                 description: Storage class to use for the PostgreSQL PVC
                 type: string
-              postgres_data_path:
-                description: Path where the PostgreSQL data are located
-                type: string
               postgres_extra_args:
                 type: array
                 items:
                   type: string
+              postgres_data_volume_init:
+                description: Sets permissions on the /var/lib/pgdata/data for postgres container using an init container (not Openshift)
+                type: boolean
+              postgres_init_container_commands:
+                description: Customize the postgres init container commands (Non Openshift)
+                type: string
               postgres_migrant_configuration_secret:
                 description: Secret where the old database configuration can be found for data migration
                 type: string

config/crd/bases/galaxy_v1beta1_galaxybackup_crd.yaml

@@ -33,11 +33,29 @@ spec:
                   description: Name of the PVC to be used for storing the backup
                   type: string
                 backup_pvc_namespace:
-                  description: Namespace PVC is in
+                  description: Namespace PVC is in (Deprecated)
                   type: string
                 backup_storage_requirements:
                   description: Storage requirements for the backup
                   type: string
+                backup_resource_requirements:
+                  description: Resource requirements for the management pod used to create a backup
+                  properties:
+                    requests:
+                      properties:
+                        cpu:
+                          type: string
+                        memory:
+                          type: string
+                      type: object
+                    limits:
+                      properties:
+                        cpu:
+                          type: string
+                        memory:
+                          type: string
+                      type: object
+                  type: object
                 backup_storage_class:
                   description: Storage class to use when creating PVC for backup
                   type: string

config/crd/bases/galaxy_v1beta1_galaxyrestore_crd.yaml

@@ -42,7 +42,7 @@ spec:
                   description: Name of the PVC to be restored from, set as a status found on the backup object (backupClaim)
                   type: string
                 backup_pvc_namespace:
-                  description: Namespace the PVC is in
+                  description: Namespace the PVC is in (Deprecated)
                   type: string
                 backup_dir:
                   description: Backup directory name, set as a status found on the backup object (backupDirectory)
@@ -57,6 +57,24 @@ spec:
                     - azure
                     - Azure
                   type: string
+                restore_resource_requirements:
+                  description: Resource requirements for the management pod used to do a restore
+                  properties:
+                    requests:
+                      properties:
+                        cpu:
+                          type: string
+                        memory:
+                          type: string
+                      type: object
+                    limits:
+                      properties:
+                        cpu:
+                          type: string
+                        memory:
+                          type: string
+                      type: object
+                  type: object
                 postgres_label_selector:
                   description: Label selector used to identify postgres pod for executing migration
                   type: string

config/manager/manager.yaml

@@ -59,9 +59,9 @@ spec:
             - name: RELATED_IMAGE_GALAXY_WEB
               value: quay.io/ansible/galaxy-ui:latest
             - name: RELATED_IMAGE_GALAXY_REDIS
-              value: redis:latest
+              value: redis:7
             - name: RELATED_IMAGE_GALAXY_POSTGRES
-              value: postgres:13
+              value: quay.io/sclorg/postgresql-15-c9s:latest
             - name: RELATED_IMAGE_GALAXY_INIT_GPG_CONTAINER
               value: quay.io/centos/centos:stream9
         securityContext:

config/manifests/bases/galaxy-operator.clusterserviceversion.yaml

@@ -100,11 +100,6 @@ spec:
         path: postgres_resource_requirements
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
-      - displayName: Database data path
-        path: postgres_data_path
-        x-descriptors:
-        - urn:alm:descriptor:com.tectonic.ui:advanced
-        - urn:alm:descriptor:com.tectonic.ui:hidden
       - displayName: Postgres Extra Arguments
         path: postgres_extra_args
         x-descriptors:
@@ -119,6 +114,15 @@ spec:
         path: postgres_tolerations
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:advanced
+      - description: Sets permissions on the /var/lib/pgsql/data for postgres container using an init container (not Openshift)
+        displayName: PostgreSQL initialize data volume
+        path: postgres_data_volume_init
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:hidden
+      - description: Customize the postgres init container commands (Non Openshift)
+        displayName: PostgreSQL Init Container Commands
+        path: postgres_init_container_commands
+        x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:hidden
       - displayName: Database storage class
         path: postgres_storage_class
@@ -611,17 +615,22 @@ spec:
         x-descriptors:
         - urn:alm:descriptor:io.kubernetes:PersistentVolumeClaim
         - urn:alm:descriptor:com.tectonic.ui:advanced
-      - displayName: Backup persistent volume claim namespace
+      - displayName: Backup persistent volume claim namespace (Deprecated)
         path: backup_pvc_namespace
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:text
-        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:hidden
         - urn:alm:descriptor:io.kubernetes:Namespace
       - displayName: Backup PVC storage requirements
         path: backup_storage_requirements
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:text
         - urn:alm:descriptor:com.tectonic.ui:advanced
+      - displayName: Backup Management Pod Resource Requirements
+        path: backup_resource_requirements
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:resourceRequirements
       - displayName: Backup PVC storage class
         path: backup_storage_class
         x-descriptors:
@@ -733,6 +742,11 @@ spec:
         - urn:alm:descriptor:com.tectonic.ui:select:S3
         - urn:alm:descriptor:com.tectonic.ui:select:Azure
         - urn:alm:descriptor:com.tectonic.ui:fieldDependency:backup_source:PVC
+      - displayName: Restore Management Pod Resource Requirements
+        path: restore_resource_requirements
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:advanced
+        - urn:alm:descriptor:com.tectonic.ui:resourceRequirements
       - displayName: Database restore label selector
         path: postgres_label_selector
         x-descriptors:
@@ -963,9 +977,9 @@ spec:
                 - name: RELATED_IMAGE_GALAXY_WEB
                   value: quay.io/ansible/galaxy-ui:latest
                 - name: RELATED_IMAGE_GALAXY_REDIS
-                  value: redis:latest
+                  value: redis:7
                 - name: RELATED_IMAGE_GALAXY_POSTGRES
-                  value: postgres:13
+                  value: quay.io/sclorg/postgresql-15-c9s:latest
                 - name: RELATED_IMAGE_GALAXY_INIT_GPG_CONTAINER
                   value: quay.io/centos/centos:stream9
                 image: quay.io/ansible/galaxy-operator:main

config/rbac/role.yaml

@@ -91,6 +91,18 @@ rules:
     verbs:
       - patch
       - get
+  - apiGroups:
+      - batch
+    resources:
+      - jobs
+    verbs:
+      - get
+      - list
+      - create
+      - patch
+      - update
+      - watch
+
   ##
   ## Rules for galaxy.ansible.com/v1beta1, Kind: Galaxy
   ##

config/samples/galaxy_v1beta1_galaxybackup_cr.default.yaml

@@ -9,4 +9,3 @@ spec:
   backup_pvc: ''
   backup_storage_requirements: ''
   backup_storage_class: ''
-  postgres_label_selector: ''

config/samples/galaxy_v1beta1_galaxyrestore_cr.ci.yaml

@@ -4,5 +4,6 @@ kind: GalaxyRestore
 metadata:
   name: ci-galaxyrestore
 spec:
+  deployment_name: example-galaxy
   backup_name: ci-galaxybackup
   no_log: false

docs/build.md

@@ -127,7 +127,7 @@ pod/galaxy-api-5d4d945787-jq2kk                          1/1     Running   0
 pod/galaxy-content-754466b885-8c85x                      1/1     Running   0          2m41s
 pod/galaxy-content-754466b885-bgzz7                      1/1     Running   0          2m41s
 pod/galaxy-operator-controller-manager-d84cd6d4c-2zpw5   2/2     Running   0          3m55s
-pod/galaxy-postgres-13-0                                 1/1     Running   0          3m
+pod/galaxy-postgres-15-0                                 1/1     Running   0          3m
 pod/galaxy-redis-b77c7ccb-zqdv6                          1/1     Running   0          2m30s
 pod/galaxy-web-dc44cff56-k46j2                           1/1     Running   0          2m53s
 pod/galaxy-worker-64f7889dd7-t5jdd                       1/1     Running   0          2m36s
@@ -154,4 +154,4 @@ Password:
 ```
 You can now access Galaxy in your browser by visiting [http://localhost](http://localhost) or [https://localhost](https://localhost):
 <img width="1326" alt="image" src="https://github.com/ansible/galaxy-operator/assets/87674982/5744a107-3630-4e8e-a674-3357da0cfa42">
-<img width="1326" alt="image" src="https://github.com/ansible/galaxy-operator/assets/87674982/e4a66e4a-66ad-4995-a55f-414dd59f8fb7">
+<img width="1326" alt="image" src="https://github.com/ansible/galaxy-operator/assets/87674982/e4a66e4a-66ad-4995-a55f-414dd59f8fb7">

docs/quickstart.md

@@ -83,7 +83,7 @@ galaxy-api-5d4d945787-jtc59                           1/1     Running   0
 galaxy-content-754466b885-cmmp4                       1/1     Running   0          3m23s
 galaxy-content-754466b885-zsfqq                       1/1     Running   0          3m23s
 galaxy-operator-controller-manager-5f75d85bf8-j49mr   2/2     Running   0          4m21s
-galaxy-postgres-13-0                                  1/1     Running   0          3m40s
+galaxy-postgres-15-0                                  1/1     Running   0          3m40s
 galaxy-redis-994cbcbff-9rf55                          1/1     Running   0          3m11s
 galaxy-web-dc44cff56-lmshc                            1/1     Running   0          3m33s
 galaxy-worker-64f7889dd7-9lvkm                        1/1     Running   0          3m17s
@@ -111,4 +111,4 @@ Password:
 ```
 You can now access Galaxy in your browser by visiting [http://localhost](http://localhost) or [https://localhost](https://localhost):
 <img width="1326" alt="image" src="https://github.com/ansible/galaxy-operator/assets/87674982/5744a107-3630-4e8e-a674-3357da0cfa42">
-<img width="1326" alt="image" src="https://github.com/ansible/galaxy-operator/assets/87674982/e4a66e4a-66ad-4995-a55f-414dd59f8fb7">
+<img width="1326" alt="image" src="https://github.com/ansible/galaxy-operator/assets/87674982/e4a66e4a-66ad-4995-a55f-414dd59f8fb7">

docs/user-guide/database-configuration.md

@@ -0,0 +1,114 @@
+### Database Configuration
+
+#### PostgreSQL Version
+
+The default PostgreSQL version for the version of Galaxy bundled with the latest version of the galaxy-operator is PostgreSQL 15. You can find this default for a given version by at the default value for [supported_pg_version](https://github.com/ansible/galaxy-operator/tree/main/roles/installer/vars/main.yml#L7).
+
+We only have coverage for the default version of PostgreSQL. Newer versions of PostgreSQL will likely work, but should only be configured as an external database. If your database is managed by the galaxy-operator (default if you don't specify a `postgres_configuration_secret`), then you should not override the default version as this may cause issues when the operator tries to upgrade your postgresql pod.
+
+#### External PostgreSQL Service
+
+To configure Galaxy to use an external database, the Custom Resource needs to know about the connection details. To do this, create a k8s secret with those connection details and specify the name of the secret as `postgres_configuration_secret` at the CR spec level.
+
+
+The secret should be formatted as follows:
+
+```yaml
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: <resourcename>-postgres-configuration
+  namespace: <target namespace>
+stringData:
+  host: <external ip or url resolvable by the cluster>
+  port: <external port, this usually defaults to 5432>
+  database: <desired database name>
+  username: <username to connect as>
+  password: <password to connect with>
+  sslmode: prefer
+  type: unmanaged
+type: Opaque
+```
+
+> Please ensure that the value for the variable `password` should _not_ contain single or double quotes (`'`, `"`) or backslashes (`\`) to avoid any issues during deployment, [backup](https://github.com/ansible/galaxy-operator/tree/main/roles/backup) or [restoration](https://github.com/ansible/galaxy-operator/tree/main/roles/restore).
+
+> It is possible to set a specific username, password, port, or database, but still have the database managed by the operator. In this case, when creating the postgres-configuration secret, the `type: managed` field should be added.
+
+**Note**: The variable `sslmode` is valid for `external` databases only. The allowed values are: `prefer`, `disable`, `allow`, `require`, `verify-ca`, `verify-full`.
+
+Once the secret is created, you can specify it on your spec:
+
+```yaml
+---
+spec:
+  ...
+  postgres_configuration_secret: <name-of-your-secret>
+```
+
+#### Managed PostgreSQL Service
+
+If you don't have access to an external PostgreSQL service, the galaxy-operator can deploy one for you along side the Galaxy instance itself.
+
+The following variables are customizable for the managed PostgreSQL service
+
+| Name                                          | Description                                                     | Default                                 |
+| --------------------------------------------- | --------------------------------------------------------------- | --------------------------------------- |
+| postgres_image                                | Path of the image to pull                                       | quay.io/sclorg/postgresql-15-c9s        |
+| postgres_image_version                        | Image version to pull                                           | latest                                  |
+| postgres_resource_requirements                | PostgreSQL container (and initContainer) resource requirements  | requests: {cpu: 10m, memory: 64Mi}      |
+| postgres_storage_requirements                 | PostgreSQL container storage requirements                       | requests: {storage: 8Gi}                |
+| postgres_storage_class                        | PostgreSQL PV storage class                                     | Empty string                            |
+
+Example of customization could be:
+
+```yaml
+---
+spec:
+  ...
+  postgres_resource_requirements:
+    requests:
+      cpu: 500m
+      memory: 2Gi
+    limits:
+      cpu: '1'
+      memory: 4Gi
+  postgres_storage_requirements:
+    requests:
+      storage: 8Gi
+    limits:
+      storage: 50Gi
+  postgres_storage_class: fast-ssd
+  postgres_extra_args:
+    - '-c'
+    - 'max_connections=1000'
+```
+
+**Note**: If `postgres_storage_class` is not defined, PostgreSQL will store it's data on a volume using the default storage class for your cluster.
+
+#### Note about overriding the postgres image
+
+We recommend you use the default image sclorg image. If you are coming from a deployment using the old postgres image from dockerhub (postgres:13), upgrading from galaxy-operator version 2024.02.29 to a newer version will handle migrating your data to the new postgresql image (postgresql-15-c9s).
+
+You can no longer configure a custom `postgres_data_path` because it is hardcoded in the quay.io/sclorg/postgresql-15-c9s image.
+
+If you override the postgres image to use a custom postgres image like postgres:15 for example, the default data directory path may be different. These images cannot be used interchangeably.
+
+#### Initialize Postgres data volume
+
+When using a hostPath backed PVC and some other storage classes like longhorn storagfe, the postgres data directory needs to be accessible by the user in the postgres pod (UID 26).
+
+To initialize this directory with the correct permissions, configure the following setting, which will use an init container to set the permissions in the postgres volume.
+
+```yaml
+spec:
+  postgres_data_volume_init: true
+```
+
+Should you need to modify the init container commands, there is an example below.
+
+```yaml
+postgres_init_container_commands: |
+  chown 26:0 /var/lib/pgsql/data
+  chmod 700 /var/lib/pgsql/data
+```

playbooks/galaxy.yaml

@@ -65,6 +65,7 @@
     - common
     - postgres
     - galaxy-web
+    - galaxy-config
 
   tasks:
 
@@ -107,4 +108,4 @@
         - galaxy-worker
         - galaxy-api
         - galaxy-route
-        - galaxy-status
+        - galaxy-status

requirements.yml

@@ -5,4 +5,4 @@ collections:
   - name: kubernetes.core
     version: "==2.3.2"
   - name: operator_sdk.util
-    version: "0.4.0"
+    version: "0.5.0"