zalando / postgres-operator

Postgres operator creates and manages PostgreSQL clusters running in Kubernetes
https://postgres-operator.readthedocs.io/
MIT License
4.37k stars 980 forks source link

fix(2582): added cluster level delete secrets config #2750

Open Yingrjimsch opened 2 months ago

Yingrjimsch commented 2 months ago

Here #2582 it has been discussed to add a config for deleting secrets globally on operator level. This is very nice and helps greatly.

In my case I have a setup where my operator contains the config delete_annotation_name_key: delete-clustername and as a safety config enable_secrets_deletion: false which is needed if I want to clear a postgres cluster completely but still need the secrets. This works like a charm but I have temporary walg cluster clones which can be applied to get some backups. This temporary walg clones should still delete their secrets post deletion therefore a config is needed on cluster level. I implemented the config enable_secrets_deletion_key in a similar way as delete_annotation_name_key works. This allows me to override the operator wide enable_secrets_deletion configuratin per postgresql cluster. If it is not set, the operator decides whether the secrets should be deleted, if it is set to true the secrets are deleted nevertheless and if it is set to false the secrets will not be deleted, allowing for a more fine granular configuration.

I have checked several possible scenarios with the following results: enable_secrets_deletion delete_annotation_name_key delete-clustername enable-secrets-deletion Keep Secrets?
- - - - NO
true - - - NO
false - - - YES
- delete-clustername acid-minimal-cluster - NO
- delete-clustername - - YES
true delete-clustername - - YES
false delete-clustername - - YES
true delete-clustername - true YES
false delete-clustername - false YES
true delete-clustername acid-minimal-cluster - NO
false delete-clustername acid-minimal-cluster - YES
true delete-clustername acid-minimal-cluster true NO
false delete-clustername acid-minimal-cluster false YES

@dmotte can you review this please?

Yingrjimsch commented 1 month ago

@FxKu could you please review this "small" fix? I would really appreciate it 😄