K8SPG-864: add sidecarPVCs and sidecarVolumes

Makefile

@@ -491,4 +491,4 @@ after-release: update-version generate
 # Update upgrade-consistency
 	$(SED) -i "s/$(PREV2_VERSION)/$(PREV1_VERSION)/g" e2e-tests/tests/upgrade-consistency/01-*.yaml
 	$(SED) -i "s/$(PREV1_VERSION)/$(CURRENT_VERSION)/g" e2e-tests/tests/upgrade-consistency/02-*.yaml
-	$(SED) -i "s/$(CURRENT_VERSION)/$(NEXT_VER)/g" e2e-tests/tests/upgrade-consistency/03-*.yaml e2e-tests/tests/init-deploy/05-assert.yaml
+	$(SED) -i "s/$(CURRENT_VERSION)/$(NEXT_VER)/g" e2e-tests/tests/upgrade-consistency/03-*.yaml e2e-tests/tests/init-deploy/05-assert.yaml

config/rbac/cluster/role.yaml

@@ -8,7 +8,6 @@ rules:
   - ''
   resources:
   - configmaps
-  - persistentvolumeclaims
   - pods
   - secrets
   - serviceaccounts
@@ -47,6 +46,18 @@ rules:
   verbs:
   - create
   - patch
+- apiGroups:
+  - ''
+  resources:
+  - persistentvolumeclaims
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - apps
   resources:

config/rbac/namespace/role.yaml

@@ -8,7 +8,6 @@ rules:
   - ''
   resources:
   - configmaps
-  - persistentvolumeclaims
   - pods
   - secrets
   - serviceaccounts
@@ -47,6 +46,18 @@ rules:
   verbs:
   - create
   - patch
+- apiGroups:
+  - ''
+  resources:
+  - persistentvolumeclaims
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - apps
   resources:

deploy/cr.yaml

@@ -248,6 +248,26 @@ spec:
 #      securityContext: {}
 #    - name: testcontainer2
 #      image: mycontainer1:latest
+#    sidecarVolumes:
+#    - name: sidecar-secret
+#      secret:
+#        secretName: mysecret
+#    - name: sidecar-config
+#      configMap:
+#        name: myconfigmap
+#    - name: backup-nfs
+#      nfs:
+#        server: "nfs-service.storage.svc.cluster.local"
+#        path: "/pg-some-name"
+#    sidecarPVCs:
+#    - name: sidecar-volume-claim
+#      spec:
+#        resources:
+#          requests:
+#            storage: 1Gi
+#        volumeMode: Filesystem
+#        accessModes:
+#          - ReadWriteOnce
 #
 #    topologySpreadConstraints:
 #      - maxSkew: 1
@@ -398,6 +418,26 @@ spec:
 #        image: busybox:latest
 #        command: ["sleep", "30d"]
 #        securityContext: {}
+#      sidecarVolumes:
+#      - name: sidecar-secret
+#        secret:
+#          secretName: mysecret
+#      - name: sidecar-config
+#        configMap:
+#          name: myconfigmap
+#      - name: backup-nfs
+#        nfs:
+#          server: "nfs-service.storage.svc.cluster.local"
+#          path: "/pg-some-name"
+#      sidecarPVCs:
+#      - name: sidecar-volume-claim
+#        spec:
+#          resources:
+#            requests:
+#              storage: 1Gi
+#          volumeMode: Filesystem
+#          accessModes:
+#            - ReadWriteOnce
 #
 #      customTLSSecret:
 #        name: keycloakdb-pgbouncer.tls
@@ -527,6 +567,26 @@ spec:
 #          securityContext: {}
 #        - name: testcontainer2
 #          image: mycontainer1:latest
+#        sidecarVolumes:
+#        - name: sidecar-secret
+#          secret:
+#            secretName: mysecret
+#        - name: sidecar-config
+#          configMap:
+#            name: myconfigmap
+#        - name: backup-nfs
+#          nfs:
+#            server: "nfs-service.storage.svc.cluster.local"
+#            path: "/pg-some-name"
+#        sidecarPVCs:
+#        - name: sidecar-volume-claim
+#          spec:
+#            resources:
+#              requests:
+#                storage: 1Gi
+#            volumeMode: Filesystem
+#            accessModes:
+#              - ReadWriteOnce
 #        resources:
 #          limits:
 #            cpu: 200m

deploy/cw-rbac.yaml

@@ -12,7 +12,6 @@ rules:
   - ""
   resources:
   - configmaps
-  - persistentvolumeclaims
   - pods
   - secrets
   - serviceaccounts
@@ -51,6 +50,18 @@ rules:
   verbs:
   - create
   - patch
+- apiGroups:
+  - ""
+  resources:
+  - persistentvolumeclaims
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - apps
   resources:

deploy/rbac.yaml

@@ -12,7 +12,6 @@ rules:
   - ""
   resources:
   - configmaps
-  - persistentvolumeclaims
   - pods
   - secrets
   - serviceaccounts
@@ -51,6 +50,18 @@ rules:
   verbs:
   - create
   - patch
+- apiGroups:
+  - ""
+  resources:
+  - persistentvolumeclaims
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - apps
   resources:

e2e-tests/tests/sidecars/01-assert.yaml

@@ -183,3 +183,91 @@ status:
     ready: 3
     size: 3
   state: ready
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  finalizers:
+  - kubernetes.io/pvc-protection
+  name: sidecar-pgbouncer-claim
+  labels:
+    app.kubernetes.io/component: pgbouncer
+    app.kubernetes.io/instance: sidecars
+    app.kubernetes.io/managed-by: percona-postgresql-operator
+    app.kubernetes.io/name: percona-postgresql
+    app.kubernetes.io/part-of: percona-postgresql
+    postgres-operator.crunchydata.com/cluster: sidecars
+    postgres-operator.crunchydata.com/role: pgbouncer
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: standard-rwo
+  volumeMode: Filesystem
+status:
+  accessModes:
+  - ReadWriteOnce
+  capacity:
+    storage: 1Gi
+  phase: Bound
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  finalizers:
+  - kubernetes.io/pvc-protection
+  labels:
+    app.kubernetes.io/instance: sidecars
+    app.kubernetes.io/managed-by: percona-postgresql-operator
+    app.kubernetes.io/name: percona-postgresql
+    app.kubernetes.io/part-of: percona-postgresql
+    pgv2.percona.com/version: 2.9.0
+    postgres-operator.crunchydata.com/cluster: sidecars
+    postgres-operator.crunchydata.com/pgbackrest: ""
+  name: sidecar-repohost-claim
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: standard-rwo
+  volumeMode: Filesystem
+status:
+  accessModes:
+  - ReadWriteOnce
+  capacity:
+    storage: 1Gi
+  phase: Bound
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  finalizers:
+  - kubernetes.io/pvc-protection
+  labels:
+    app.kubernetes.io/component: pg
+    app.kubernetes.io/instance: sidecars
+    app.kubernetes.io/managed-by: percona-postgresql-operator
+    app.kubernetes.io/name: percona-postgresql
+    app.kubernetes.io/part-of: percona-postgresql
+    postgres-operator.crunchydata.com/cluster: sidecars
+    postgres-operator.crunchydata.com/data: postgres
+    postgres-operator.crunchydata.com/instance-set: instance1
+  name: sidecar-instance-claim
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: standard-rwo
+  volumeMode: Filesystem
+status:
+  accessModes:
+  - ReadWriteOnce
+  capacity:
+    storage: 1Gi
+  phase: Bound

e2e-tests/tests/sidecars/01-create-cluster.yaml

@@ -11,7 +11,14 @@ commands:
       get_cr \
         | yq eval '.spec.instances[0].sidecars = [{"name": "sidecar1", "image": "busybox", "command": ["sleep", "30d"]}]' - \
         | yq eval '.spec.instances[0].sidecars += [{"name": "sidecar2", "image": "busybox", "command": ["sleep", "30d"]}]' - \
+        | yq eval '.spec.instances[0].sidecarVolumes = [{"name": "sidecar-secret", "secret": {"secretName": "mysecret"}}]' - \
+        | yq eval '.spec.instances[0].sidecarPVCs = [{"name": "sidecar-instance-claim", "spec": {"resources": {"requests": {"storage": "1Gi"}}, "volumeMode": "Filesystem", "accessModes": ["ReadWriteOnce"]}}]' - \
       	| yq eval '.spec.proxy.pgBouncer.sidecars = [{"name": "sidecar1", "image": "busybox", "command": ["sleep", "30d"]}]' - \
+        | yq eval '.spec.proxy.pgBouncer.sidecarVolumes = [{"name": "sidecar-secret", "secret": {"secretName": "mysecret"}}]' - \
+        | yq eval '.spec.proxy.pgBouncer.sidecarPVCs = [{"name": "sidecar-pgbouncer-claim", "spec": {"resources": {"requests": {"storage": "1Gi"}}, "volumeMode": "Filesystem", "accessModes": ["ReadWriteOnce"]}}]' - \
+      	| yq eval '.spec.backups.pgbackrest.repoHost.sidecars = [{"name": "sidecar1", "image": "busybox", "command": ["sleep", "30d"]}]' - \
+        | yq eval '.spec.backups.pgbackrest.repoHost.sidecarVolumes = [{"name": "sidecar-secret", "secret": {"secretName": "mysecret"}}]' - \
+        | yq eval '.spec.backups.pgbackrest.repoHost.sidecarPVCs = [{"name": "sidecar-repohost-claim", "spec": {"resources": {"requests": {"storage": "1Gi"}}, "volumeMode": "Filesystem", "accessModes": ["ReadWriteOnce"]}}]' - \
       	| kubectl -n "${NAMESPACE}" apply -f -
     timeout: 30
 

internal/controller/postgrescluster/instance.go

@@ -1257,6 +1257,20 @@ func (r *Reconciler) reconcileInstance(
 		}
 	}
 
+	// K8SPG-864
+	if cluster.CompareVersion("2.9.0") >= 0 {
+		for _, v := range spec.SidecarPVCs {
+			instance.Spec.Template.Spec.Volumes = append(instance.Spec.Template.Spec.Volumes, corev1.Volume{
+				Name: v.Name,
+				VolumeSource: corev1.VolumeSource{
+					PersistentVolumeClaim: &corev1.PersistentVolumeClaimVolumeSource{
+						ClaimName: v.Name,
+					},
+				},
+			})
+		}
+	}
+
 	if err == nil {
 		err = errors.WithStack(r.apply(ctx, instance))
 	}

internal/controller/postgrescluster/pgbackrest.go

@@ -742,6 +742,20 @@ func (r *Reconciler) generateRepoHostIntent(ctx context.Context, postgresCluster
 		// defined, add the defined container to the Pod.
 		if feature.Enabled(ctx, feature.PGBackrestRepoHostSidecars) && repoHost.Sidecars != nil {
 			repo.Spec.Template.Spec.Containers = append(repo.Spec.Template.Spec.Containers, repoHost.Sidecars...)
+			if postgresCluster.CompareVersion("2.9.0") >= 0 {
+				repo.Spec.Template.Spec.Volumes = append(repo.Spec.Template.Spec.Volumes, repoHost.SidecarVolumes...)
+
+				for _, v := range repoHost.SidecarPVCs {
+					repo.Spec.Template.Spec.Volumes = append(repo.Spec.Template.Spec.Volumes, corev1.Volume{
+						Name: v.Name,
+						VolumeSource: corev1.VolumeSource{
+							PersistentVolumeClaim: &corev1.PersistentVolumeClaimVolumeSource{
+								ClaimName: v.Name,
+							},
+						},
+					})
+				}
+			}
 		}
 	}
 	sizeLimit := getTMPSizeLimit(repo.Labels[naming.LabelVersion], resources)

internal/pgbouncer/reconcile.go

@@ -182,14 +182,29 @@ func Pod(
 
 	outPod.Containers = []corev1.Container{container, reloader}
 
+	outPod.Volumes = []corev1.Volume{configVolume}
+
 	// If the PGBouncerSidecars feature gate is enabled and custom pgBouncer
 	// sidecars are defined, add the defined container to the Pod.
 	if feature.Enabled(ctx, feature.PGBouncerSidecars) &&
 		inCluster.Spec.Proxy.PGBouncer.Containers != nil {
 		outPod.Containers = append(outPod.Containers, inCluster.Spec.Proxy.PGBouncer.Containers...)
-	}
 
-	outPod.Volumes = []corev1.Volume{configVolume}
+		if inCluster.CompareVersion("2.9.0") >= 0 {
+			outPod.Volumes = append(outPod.Volumes, inCluster.Spec.Proxy.PGBouncer.SidecarVolumes...)
+
+			for _, v := range inCluster.Spec.Proxy.PGBouncer.SidecarPVCs {
+				outPod.Volumes = append(outPod.Volumes, corev1.Volume{
+					Name: v.Name,
+					VolumeSource: corev1.VolumeSource{
+						PersistentVolumeClaim: &corev1.PersistentVolumeClaimVolumeSource{
+							ClaimName: v.Name,
+						},
+					},
+				})
+			}
+		}
+	}
 
 	// K8SPG-833
 	if pgbouncer := inCluster.Spec.Proxy.PGBouncer; inCluster.CompareVersion("2.8.0") >= 0 && pgbouncer != nil {

internal/postgres/reconcile.go

@@ -314,6 +314,9 @@ func InstancePod(ctx context.Context,
 	if feature.Enabled(ctx, feature.InstanceSidecars) &&
 		inInstanceSpec.Containers != nil {
 		outInstancePod.Containers = append(outInstancePod.Containers, inInstanceSpec.Containers...)
+		if inCluster.CompareVersion("2.9.0") >= 0 {
+			outInstancePod.Volumes = append(outInstancePod.Volumes, inInstanceSpec.SidecarVolumes...)
+		}
 	}
 
 	outInstancePod.InitContainers = []corev1.Container{startup}