Skip to content

K8SPG-911: Add pg_tde support #1508

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
egegunes wants to merge 27 commits into
base: main
Choose a base branch
from
Open

K8SPG-911: Add pg_tde support #1508

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
27 commits
Select commit Hold shift + click to select a range
34f16a1
K8SPG-911: Add pg_tde support
egegunes Feb 26, 2026
fd5ae3d
add more unit tests
egegunes Jul 21, 2026
379a18b
improve temp file management
egegunes Jul 21, 2026
23bdc22
fix stale provider
egegunes Jul 21, 2026
3d6aead
remove side effects of sql hashing
egegunes Jul 21, 2026
be5c7ad
decouple pg_tde conditions from other extensions
egegunes Jul 21, 2026
f476148
remove unnecessary setdefault
egegunes Jul 21, 2026
51da790
stage credentials on all pods
egegunes Jul 21, 2026
576a2e2
fix preserveOldTDEVolume
egegunes Jul 21, 2026
54debb6
improve pgtde config hashing
egegunes Jul 21, 2026
b6dc330
fix leftover credentials if pg_tde disabled before phase 2
egegunes Jul 21, 2026
ed22245
unify vault ca secret checks
egegunes Jul 21, 2026
0ee79e9
fix tde setup when temp revision is empty
egegunes Jul 21, 2026
7e563e7
unify tde setup phases
egegunes Jul 21, 2026
7056123
fix pg-tde
egegunes Jul 21, 2026
b5e6265
refactor
egegunes Jul 22, 2026
b1b65a8
Merge branch 'main' into K8SPG-911-implementation
egegunes Jul 22, 2026
bafa70c
fix cleanup on provider change
egegunes Jul 22, 2026
9f71743
fix tests
egegunes Jul 22, 2026
11de436
fix golangci-lint
egegunes Jul 22, 2026
1ebf747
fix golangci-lint
egegunes Jul 22, 2026
6110d2f
british spelling is a thing
egegunes Jul 22, 2026
dbfcff5
Merge branch 'main' into K8SPG-911-implementation
egegunes Jul 23, 2026
c35b3a2
fix major upgrades with pg_tde
egegunes Jul 26, 2026
b63c16e
Merge branch 'main' into K8SPG-911-implementation
egegunes Jul 26, 2026
2586f1d
Merge branch 'main' into K8SPG-911-implementation
egegunes Jul 27, 2026
1f23aae
fix upgrade-minor
egegunes Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 56 additions & 0 deletions build/crd/crunchy/generated/postgres-operator.crunchydata.com_postgresclusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13594,6 +13594,53 @@ spec:
type: boolean
extensions:
properties:
pg_tde:
properties:
enabled:
type: boolean
vault:
properties:
caSecret:
description: Name of the secret that contains the CA certificate
for SSL verification.
properties:
key:
type: string
name:
type: string
required:
- key
- name
type: object
host:
description: Host of Vault server.
type: string
mountPath:
default: secret/data
description: The mount point on the Vault server where
the key provider should store the keys.
type: string
tokenSecret:
description: Name of the secret that contains the access
token with read and write access to the mount path.
properties:
key:
type: string
name:
type: string
required:
- key
- name
type: object
required:
- host
- tokenSecret
type: object
type: object
x-kubernetes-validations:
- message: vault is required for enabling pg_tde
rule: '!has(self.enabled) || (has(self.enabled) && self.enabled
== false) || has(self.vault)'
Comment thread
oksana-grishchenko marked this conversation as resolved.
pgAudit:
type: boolean
pgRepack:
Expand All @@ -13605,6 +13652,11 @@ spec:
pgvector:
type: boolean
type: object
x-kubernetes-validations:
- message: to disable pg_tde first set enabled=false without removing
vault and wait for pod restarts
rule: '!has(oldSelf.pg_tde) || !has(oldSelf.pg_tde.vault) || !has(oldSelf.pg_tde.enabled)
|| !oldSelf.pg_tde.enabled || has(self.pg_tde.vault)'
image:
description: |-
The image name to use for PostgreSQL containers. When omitted, the value
Expand Down Expand Up @@ -30978,6 +31030,10 @@ spec:
description: The PostgreSQL system identifier reported by Patroni.
type: string
type: object
pgTDERevision:
description: Identifies the pg_tde configuration that have been installed
into PostgreSQL.
type: string
pgbackrest:
description: Status information for pgBackRest
properties:
Expand Down
96 changes: 92 additions & 4 deletions build/crd/percona/generated/pgv2.percona.com_perconapgclusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13696,11 +13696,11 @@ spec:
description: The specification of extensions.
properties:
builtin:
description: 'Deprecated: Use extensions.<extension> instead.
This field will be removed after 3.4.0.'
properties:
pg_audit:
type: boolean
pg_cron:
type: boolean
pg_repack:
type: boolean
pg_stat_monitor:
Expand All @@ -13709,8 +13709,6 @@ spec:
type: boolean
pgvector:
type: boolean
set_user:
type: boolean
type: object
custom:
items:
Expand All @@ -13729,6 +13727,88 @@ spec:
description: PullPolicy describes a policy for if/when to pull
a container image
type: string
pg_audit:
properties:
enabled:
type: boolean
type: object
pg_cron:
properties:
enabled:
type: boolean
type: object
pg_repack:
properties:
enabled:
type: boolean
type: object
pg_stat_monitor:
properties:
enabled:
type: boolean
type: object
pg_stat_statements:
properties:
enabled:
type: boolean
type: object
pg_tde:
properties:
enabled:
type: boolean
vault:
properties:
caSecret:
description: Name of the secret that contains the CA certificate
for SSL verification.
properties:
key:
type: string
name:
type: string
required:
- key
- name
type: object
host:
description: Host of Vault server.
type: string
mountPath:
default: secret/data
description: The mount point on the Vault server where
the key provider should store the keys.
type: string
tokenSecret:
description: Name of the secret that contains the access
token with read and write access to the mount path.
properties:
key:
type: string
name:
type: string
required:
- key
- name
type: object
required:
- host
- tokenSecret
type: object
type: object
x-kubernetes-validations:
- message: vault is required for enabling pg_tde
rule: '!has(self.enabled) || (has(self.enabled) && self.enabled
== false) || has(self.vault)'
pgvector:
properties:
enabled:
type: boolean
type: object
set_user:
properties:
enabled:
type: boolean
type: object
storage:
properties:
bucket:
Expand Down Expand Up @@ -13811,6 +13891,11 @@ spec:
type: string
type: object
type: object
x-kubernetes-validations:
- message: to disable pg_tde first set enabled=false without removing
vault and wait for pod restarts
rule: '!has(oldSelf.pg_tde) || !has(oldSelf.pg_tde.vault) || !has(oldSelf.pg_tde.enabled)
|| !oldSelf.pg_tde.enabled || has(self.pg_tde.vault)'
image:
description: The image name to use for PostgreSQL containers.
type: string
Expand Down Expand Up @@ -28842,6 +28927,9 @@ spec:
- postgresVersion
type: object
x-kubernetes-validations:
- message: pg_tde is only supported for PG17 and above
rule: '!has(self.extensions) || !has(self.extensions.pg_tde) || !has(self.extensions.pg_tde.enabled)
|| !self.extensions.pg_tde.enabled || self.postgresVersion >= 17'
- message: PostgresVersion must be >= 15 if grantPublicSchemaAccess exists
and is true
rule: '!has(self.users) || self.postgresVersion >= 15 || self.users.all(u,
Expand Down
96 changes: 92 additions & 4 deletions config/crd/bases/pgv2.percona.com_perconapgclusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14394,11 +14394,11 @@ spec:
description: The specification of extensions.
properties:
builtin:
description: 'Deprecated: Use extensions.<extension> instead.
This field will be removed after 3.4.0.'
properties:
pg_audit:
type: boolean
pg_cron:
type: boolean
pg_repack:
type: boolean
pg_stat_monitor:
Expand All @@ -14407,8 +14407,6 @@ spec:
type: boolean
pgvector:
type: boolean
set_user:
type: boolean
type: object
custom:
items:
Expand All @@ -14427,6 +14425,88 @@ spec:
description: PullPolicy describes a policy for if/when to pull
a container image
type: string
pg_audit:
properties:
enabled:
type: boolean
type: object
pg_cron:
properties:
enabled:
type: boolean
type: object
pg_repack:
properties:
enabled:
type: boolean
type: object
pg_stat_monitor:
properties:
enabled:
type: boolean
type: object
pg_stat_statements:
properties:
enabled:
type: boolean
type: object
pg_tde:
properties:
enabled:
type: boolean
vault:
properties:
caSecret:
description: Name of the secret that contains the CA certificate
for SSL verification.
properties:
key:
type: string
name:
type: string
required:
- key
- name
type: object
host:
description: Host of Vault server.
type: string
mountPath:
default: secret/data
description: The mount point on the Vault server where
the key provider should store the keys.
type: string
tokenSecret:
description: Name of the secret that contains the access
token with read and write access to the mount path.
properties:
key:
type: string
name:
type: string
required:
- key
- name
type: object
required:
- host
- tokenSecret
type: object
type: object
x-kubernetes-validations:
- message: vault is required for enabling pg_tde
rule: '!has(self.enabled) || (has(self.enabled) && self.enabled
== false) || has(self.vault)'
pgvector:
properties:
enabled:
type: boolean
type: object
set_user:
properties:
enabled:
type: boolean
type: object
storage:
properties:
bucket:
Expand Down Expand Up @@ -14509,6 +14589,11 @@ spec:
type: string
type: object
type: object
x-kubernetes-validations:
- message: to disable pg_tde first set enabled=false without removing
vault and wait for pod restarts
rule: '!has(oldSelf.pg_tde) || !has(oldSelf.pg_tde.vault) || !has(oldSelf.pg_tde.enabled)
|| !oldSelf.pg_tde.enabled || has(self.pg_tde.vault)'
image:
description: The image name to use for PostgreSQL containers.
type: string
Expand Down Expand Up @@ -29540,6 +29625,9 @@ spec:
- postgresVersion
type: object
x-kubernetes-validations:
- message: pg_tde is only supported for PG17 and above
rule: '!has(self.extensions) || !has(self.extensions.pg_tde) || !has(self.extensions.pg_tde.enabled)
|| !self.extensions.pg_tde.enabled || self.postgresVersion >= 17'
- message: PostgresVersion must be >= 15 if grantPublicSchemaAccess exists
and is true
rule: '!has(self.users) || self.postgresVersion >= 15 || self.users.all(u,
Expand Down
Loading
Loading