File tree Expand file tree Collapse file tree 1 file changed +5
-23
lines changed
cluster-tutorials/pgbackrest_with_gcs Expand file tree Collapse file tree 1 file changed +5
-23
lines changed Original file line number Diff line number Diff line change 11# pgbackrest with GCS
22
3- ## Creating the key .json file
3+ ## Creating the gcs .json file
44
5- The key.json file should be created on an appropriate GCP IAM service account with at least the minimum permissions for
6- GCS to read/write to your bucket. Once the keyfile is downloaded, it should be created as a secret within kubernetes using
7- either the appropriate ci/cd pipelines (leveraging an engine like Vault), or via:
5+ The key.json file should be created on a suitable GCP IAM service account that has at least the minimum permissions for
6+ GCS to read/write in your bucket. Once the key file is downloaded, we need to integrate it into the secret used in the backup definition.
7+ To do this, you only need to save the file names as gcs.json in this folder. The kustomize file ensure that gcs.json is integrated into the secret
88
99```
10- kubectl create secret generic gcs-credentials --from-file=/path/to/key.json
10+ kubectl -k .
1111```
12-
13- ## Method 1: operator configuration
14-
15- The operator needs the following configuration enabled to mount the gcs-credentials secret in all postgres containers:
16-
17- ```
18- configuration:
19- aws_or_gcp:
20- additional_secret_mount: gcs-credentials
21- additional_secret_mount_path: /var/secrets/google
22- gcp_credentials: /var/secrets/google/key.json
23- ```
24-
25- ## Method 2: per-cluster configuration
26-
27- Alternatively you could utilize additionalVolumes in postgres.yaml to mount cluster-specific secrets in the postgresql cluster,
28- but if you change the name or the path that the keyfile is mounted to, you need to update spec.backup.pgbackrest.global.repo1-gcs-key
29- in postgres.yaml to match.
You can’t perform that action at this time.
0 commit comments