Function reloadCommand

internal/postgres/config.go:280–397

reloadCommand returns an entrypoint that convinces PostgreSQL to reload certificate files when they change. The process will appear as name in `ps` and `top`.

(
	name string,
	pgdataAutoGrowVolumeSpec *v1beta1.VolumeClaimSpecWithAutoGrow,
	pgwalAutoGrowVolumeSpec *v1beta1.VolumeClaimSpecWithAutoGrow,
)

// certificate files when they change. The process will appear as name in `ps`
// and `top`.
func reloadCommand(
	name string,
	pgdataAutoGrowVolumeSpec *v1beta1.VolumeClaimSpecWithAutoGrow,
	pgwalAutoGrowVolumeSpec *v1beta1.VolumeClaimSpecWithAutoGrow,
) []string {

	pgdataTrigger, pgdataMaxGrow := util.GetAutoGrowFromSpec(pgdataAutoGrowVolumeSpec)
	pgwalTrigger, pgwalMaxGrow := util.GetAutoGrowFromSpec(pgwalAutoGrowVolumeSpec)

	// Use a Bash loop to periodically check the mtime of the mounted
	// certificate volume. When it changes, copy the replication certificate,
	// signal PostgreSQL, and print the observed timestamp.
	//
	// PostgreSQL v10 reads its server certificate files during reload (SIGHUP).
	// - https://www.postgresql.org/docs/current/ssl-tcp.html#SSL-SERVER-FILES
	// - https://www.postgresql.org/docs/current/app-postgres.html
	//
	// PostgreSQL reads its replication credentials every time it opens a
	// replication connection. It does not need to be signaled when the
	// certificate contents change.
	//
	// The copy is necessary because Kubernetes sets g+r when fsGroup is enabled,
	// but PostgreSQL requires client keys to not be readable by other users.
	// - https://www.postgresql.org/docs/current/libpq-ssl.html
	// - https://issue.k8s.io/57923
	//
	// Coreutils `sleep` uses a lot of memory, so the following opens a file
	// descriptor and uses the timeout of the builtin `read` to wait. That same
	// descriptor gets closed and reopened to use the builtin `[ -nt` to check
	// mtimes.
	// - https://unix.stackexchange.com/a/407383
	//
	// In the manageAutogrowAnnotation function below, df is used to return the
	// relevant volume size in Mebibytes. The 'read' variable gets the value from
	// the '1M-blocks' output (second column) and the 'use' variable gets the value
	// from the 'Use%' column (fifth column). This value is grabbed after stripping
	// out the column headers (before the '\n') and then getting the respective
	// value delimited by the white spaces by using the 'read -r' command.
	// The underscores (_) discard fields and the variables store them. This allows
	// for selective parsing of the provided lines. The percent value is stripped of
	// the '%' and then used to determine if a expansion should be triggered by
	// setting the calculated volume size using the 'size' variable.
	script := fmt.Sprintf(`
# Parameters for curl when managing autogrow annotation.
APISERVER="https://kubernetes.default.svc"
SERVICEACCOUNT="/var/run/secrets/kubernetes.io/serviceaccount"
NAMESPACE=$(cat "${SERVICEACCOUNT}/namespace")
TOKEN=$(cat "${SERVICEACCOUNT}/token")
CACERT="${SERVICEACCOUNT}/ca.crt"

# Manage autogrow annotation.
# Return size in Mebibytes.
manageAutogrowAnnotation() {
  local volume=$1
  local trigger=$2
  local maxGrow=$3

  size=$(df --block-size=M /"${volume}")