addNSSWrapper adds nss_wrapper environment variables to the database and pgBackRest containers in the Pod template. Additionally, an init container is added to the Pod template as needed to setup the nss_wrapper. Please note that the nss_wrapper is required for compatibility with OpenShift: https:/
(image string, imagePullPolicy corev1.PullPolicy, template *corev1.PodTemplateSpec)
| 173 | // as needed to setup the nss_wrapper. Please note that the nss_wrapper is required for |
| 174 | // compatibility with OpenShift: https://access.redhat.com/articles/4859371. |
| 175 | func addNSSWrapper(image string, imagePullPolicy corev1.PullPolicy, template *corev1.PodTemplateSpec) { |
| 176 | |
| 177 | nssWrapperCmd := postgresNSSWrapperPrefix + nssWrapperScript |
| 178 | for i, c := range template.Spec.Containers { |
| 179 | switch c.Name { |
| 180 | case naming.ContainerDatabase, naming.PGBackRestRepoContainerName, |
| 181 | naming.PGBackRestRestoreContainerName: |
| 182 | passwd := fmt.Sprintf(nssWrapperDir, "postgres", "passwd") |
| 183 | group := fmt.Sprintf(nssWrapperDir, "postgres", "group") |
| 184 | template.Spec.Containers[i].Env = append(template.Spec.Containers[i].Env, []corev1.EnvVar{ |
| 185 | {Name: "LD_PRELOAD", Value: "/usr/lib64/libnss_wrapper.so"}, |
| 186 | {Name: "NSS_WRAPPER_PASSWD", Value: passwd}, |
| 187 | {Name: "NSS_WRAPPER_GROUP", Value: group}, |
| 188 | }...) |
| 189 | case naming.ContainerPGAdmin: |
| 190 | nssWrapperCmd = pgAdminNSSWrapperPrefix + nssWrapperScript |
| 191 | passwd := fmt.Sprintf(nssWrapperDir, "pgadmin", "passwd") |
| 192 | group := fmt.Sprintf(nssWrapperDir, "pgadmin", "group") |
| 193 | template.Spec.Containers[i].Env = append(template.Spec.Containers[i].Env, []corev1.EnvVar{ |
| 194 | {Name: "LD_PRELOAD", Value: "/usr/lib64/libnss_wrapper.so"}, |
| 195 | {Name: "NSS_WRAPPER_PASSWD", Value: passwd}, |
| 196 | {Name: "NSS_WRAPPER_GROUP", Value: group}, |
| 197 | }...) |
| 198 | } |
| 199 | } |
| 200 | |
| 201 | container := corev1.Container{ |
| 202 | Command: []string{"bash", "-c", nssWrapperCmd}, |
| 203 | Image: image, |
| 204 | ImagePullPolicy: imagePullPolicy, |
| 205 | Name: naming.ContainerNSSWrapperInit, |
| 206 | SecurityContext: initialize.RestrictedSecurityContext(), |
| 207 | } |
| 208 | |
| 209 | // Here we set the NSS wrapper container resources to the 'database', 'pgadmin' |
| 210 | // or 'pgbackrest' container configuration, as appropriate. |
| 211 | |
| 212 | // First, we'll set the NSS wrapper container configuration for any pgAdmin |
| 213 | // containers because pgAdmin Pods won't contain any other containers |
| 214 | containsPGAdmin := false |
| 215 | for i, c := range template.Spec.Containers { |
| 216 | if c.Name == naming.ContainerPGAdmin { |
| 217 | containsPGAdmin = true |
| 218 | container.Resources = template.Spec.Containers[i].Resources |
| 219 | break |
| 220 | } |
| 221 | } |
| 222 | |
| 223 | // If this was a pgAdmin Pod, we don't need to check anything else. |
| 224 | if !containsPGAdmin { |
| 225 | // Because the instance Pod has both a 'database' and 'pgbackrest' container, |
| 226 | // we'll first check for the 'database' container and use those resource |
| 227 | // settings for any instance pods. |
| 228 | containsDatabase := false |
| 229 | for i, c := range template.Spec.Containers { |
| 230 | if c.Name == naming.ContainerDatabase { |
| 231 | containsDatabase = true |
| 232 | container.Resources = template.Spec.Containers[i].Resources |