API Reference
API Reference
Packages:
authorization.dataservices.vmware.com/v1alpha1
Resource Types:
DsmRoleBinding
The DsmRoleBinding schema links DSM role to specific users or LDAP groups, defining the permissions each user or group receives. Multiple DsmRoleBinding resources can exist for the same role, but a specific user or group cannot be included in more than one binding.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
authorization.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
DsmRoleBinding |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
role |
string |
Assigns a DSM role to the specified subjects. Supported values: DSM_ADMIN, DSM_USER Immutable. |
true |
[]object |
Subjects represent either DSM local users (https://<provider_ip>/provider/users) or LDAP groups to which the role applies. Mutable.
|
true |
DsmRoleBinding.subjects[index]
Subject defines a user or group to be bound to a role
| Name | Type | Description | Required |
|---|---|---|---|
kind |
string |
Kind of the Subject. Supported values: User, Group |
true |
name |
string |
Name of the user or group. This value is stored exactly as provided (case-sensitive), but all comparisons and validations involving this field are case-insensitive. |
true |
DSMUserNamespaceBinding
The DSMUserNamespaceBinding schema defines a binding between a namespace and specific users or LDAP groups. It establishes access control by associating subjects (users or groups) with the namespace. Any user or group in the subjects of a DSMUserNamespaceBinding is implicitly granted the DSM_USER role.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
authorization.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
DSMUserNamespaceBinding |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
[]object |
Subjects represent either DSM local users (https://<provider_ip>/provider/users) or LDAP groups in the namespace. Mutable. |
false |
DSMUserNamespaceBinding.subjects[index]
Subject defines a user or group to be bound to a role
| Name | Type | Description | Required |
|---|---|---|---|
kind |
string |
Kind of the Subject. Supported values: User, Group |
true |
name |
string |
Name of the user or group. This value is stored exactly as provided (case-sensitive), but all comparisons and validations involving this field are case-insensitive. |
true |
databases.dataservices.vmware.com/v1alpha1
Resource Types:
ArchivedMySQLCluster
ArchivedMySQLCluster is the Schema for the ArchivedMySQLCluster API. ArchivedMySQLCluster is created automatically when MySQLCluster with enabled automated backups is deleted. An ArchivedMySQLCluster represents the retained automated backups and binlogs that were taken for that deleted MySQLCluster. It is named after the MySQLCluster and is created in the same namespace. ArchivedMySQLCluster can be used to perform point-in-time recovery for that deleted cluster. ArchivedMySQLCluster is automatically deleted once retention expires. To use a ArchivedMySQLCluster reference its name when creating a new MySQLCluster by passing the .spec.basedOn.cluster.name field. Example:
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: MySQLCluster
metadata:
name: restored-source-1
namespace: default
spec:
basedOn:
cluster:
name: source-1 # the name of the referenced ArchivedMySQLCluster
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
databases.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
ArchivedMySQLCluster |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
ArchivedMySQLClusterSpec defines the desired state of ArchivedMySQLCluster. |
false |
|
object |
ArchivedMySQLClusterStatus defines the observed state of ArchivedMySQLCluster. |
false |
ArchivedMySQLCluster.spec
ArchivedMySQLClusterSpec defines the desired state of ArchivedMySQLCluster.
| Name | Type | Description | Required |
|---|---|---|---|
expiresAt |
string |
ExpiresAt represents the point in time when backups and binary logs associated with ArchivedMySQLCluster will be expired. DSM will perform the cleanup after this point in time. Required. Mutable.
|
true |
ArchivedMySQLCluster.status
ArchivedMySQLClusterStatus defines the observed state of ArchivedMySQLCluster.
| Name | Type | Description | Required |
|---|---|---|---|
backupId |
string |
BackupId is set only for clusters with enabled automatic backups. This is a unique ID that can be used to locate backup files in storage. For MySQL, it is the UID of the MySQL cluster object in the workload cluster. Required. Immutable. |
true |
databaseName |
string |
The name of the default MySQL database used by any restored clusters from this archive. DSM will use the default database name from MySQLCluster.Status.Connection.DbName of the MySQLCluster associated with this archive. Required. Immutable. |
true |
object |
The last known spec of the cluster that got archived. Required. Immutable. |
true |
|
object |
UpgradeStatus represents version state transitions history for the deleted cluster Required. Immutable. |
true |
|
[]object |
Conditions contain the list of observed conditions of the archived cluster. One of the following statuses can occur.
|
false |
ArchivedMySQLCluster.status.mysqlClusterSpec
The last known spec of the cluster that got archived.
Required.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
InfrastructurePolicy refers to the infrastructure policy resource used to create this cluster. Required - Must refer to a valid Immutable. |
true |
|
storagePolicyName |
string |
StoragePolicyName declares the name of the storage policy that should be used to create this postgres cluster. It must be part of the InfrastructurePolicy used by this cluster. Required - Must refer to a valid Immutable. |
true |
storageSpace |
string |
StorageSpace declares the disk size allocated to each node hosting the workload. You can express storage as a plain integer or as a fixed-point number using one of these suffixes - E, P, T, G, M, k. You can also use the power-of-two equivalents - Ei, Pi, Ti, Gi, Mi, Ki Range - 20Gi - 32Ti. Required. Mutable - (increase only). |
true |
version |
string |
Version declares the version of the database engine to be used. To upgrade the database engine change this field. The list of supported engine versions can be found by inspecting the DataServiceVersion resources and in the VMware Data Services Manager UI. Version Validations for Cluster Restore Scenarios: When creating a new cluster based on an existing cluster or backup (via spec.basedOn), the following version validation rules apply at cluster creation time: General Rules (All Database Engines):
PostgreSQL-Specific Rules:
MySQL-Specific Rules:
Required. Mutable. |
true |
object |
VMClass refers to the VM class that should be used to create this cluster. It must be part of the InfrastructurePolicy used by this cluster. Required - Must refer to a valid Mutable - (Only increases in resources are allowed). |
true |
|
object |
AdminPasswordRef refers to a v1.Secret containing the password which the privileged user will use to connect
to the database. The secret must be in the same namespace as the database cluster.
FieldPath field indicates which key in the secret contains the password. Default - If the cluster is a replica with SyncUsersFromSource=true, this field has no effect until the replica is promoted. Default - password is auto generated. Mutable. It is possible to refer to a new Secret to update the admin password, but it is not required. Updates in the already referenced Secret will also lead to update of the password. |
false |
|
adminUsername |
string |
AdminUserName is the desired name of the privileged user to be used when connecting to the database. AdminUserName should not be one of the following - root, mysql.sys, mysql.session, mysql.infoschema, mysql-backup, mysql-healthcheck, mysql-metrics, telegraf-metrics, mysql-tls-admin, mysql-router, innodb-cluster-admin, mysqlappuser, mysql-pitr. Its length should not be more than 32 characters. If the cluster is a replica with SyncUsersFromSource=true, this field has no effect until the replica is promoted. Default - mysql-admin. Immutable. |
false |
object |
BackupConfig declares the cluster’s backup configuration details. If specified a Optional. Mutable. |
false |
|
object |
BackupLocation, if specified, must point to an existing BackupLocation custom resource in the same namespace as the cluster or in the DSM system namespace. It will be used by the 'BackupConfig', which must be specified whenever BackupLocation is specified. If specified, a Optional. Mutable. |
false |
|
object |
BasedOn identifies the source cluster on which this cluster will be based on. Users cannot base their clusters on clusters owned by other users unless the user has DSM_Admin role. The new cluster will inherit the ownership from its source cluster. It can be changed if necessary after the cluster is created. Field Cluster works both if the cluster is alive and if it is deleted, but we are still retaining its backups. To create a new MySQL cluster based on a live cluster pass the name of the cluster. To create a new MySQL cluster based on an archived cluster with retained backups pass the name of the ArchivedMySQLCluster The only allowed mutation of the BasedOn field is to set it to nil if it was previously set to contain ReplicationSource. See MySQLBasedOnParams.ReplicationSource for details. Optional. Mutable. |
false |
|
object |
DatabaseConfig refers to the database config object that will be applied to this cluster. Database Config is used to apply custom params/configs to the database represented by this CR.
The provided parameters go into the DatabaseConfig Validation Rules:
Optional. Mutable. |
false |
|
databaseName |
string |
If DatabaseName is set, database with that name will be created (if it doesn’t exist) and MySQLCluster.Status.Connection.DbName and ArchivedMySQLCluster.Status.DatabaseName will be set to that name. If the cluster is restored from another cluster (Spec.BasedOn.Cluster field is used) all databases from the source cluster are restored with preserved names and one additional database is created with name the given DatabaseName. This database is empty and MySQLCluster.Status.Connection.DbName and ArchivedMySQLCluster.Status.DatabaseName refer to it. If DatabaseName is equal to the name of database from the source cluster no additional database is created and MySQLCluster.Status.Connection.DbName and ArchivedMySQLCluster.Status.DatabaseName refer to the specified database with name the given DatabaseName. If DatabaseName is empty no additional database is created and MySQLCluster.Status.Connection.DbName and ArchivedMySQLCluster.Status.DatabaseName refer the same database the status connection info of the source cluster refers to. DatabaseName should not be one of the following - root, mysql.sys, mysql.session, mysql.infoschema, mysql-backup, mysql-healthcheck, mysql-metrics, telegraf-metrics, mysql-tls-admin, mysql-router, innodb-cluster-admin, mysqlappuser, mysql-pitr. Its length should not be more than 64 characters. Default - if the cluster is restored one, the database name in the source cluster’s MySQLCluster.Status.Connection.DbName is used, otherwise DatabaseName is the same as the cluster’s name. Immutable. |
false |
description |
string |
Description contains the human-readable description of the cluster. Optional. Mutable. |
false |
object |
DirectoryService refers to the DirectoryService resource with LDAP settings used by this cluster for authenticating clients. Optional. Mutable. |
false |
|
dnsNames |
[]string |
One or more DNS names / FQDNs for database access. These DNS names will be included in the SAN field of the TLS certificate if auto-generated by DSM. The first DNS name will also be included in the URL connection string displayed in DSM UI. If a custom TLS certificate is provided, it is important its SAN field to match the DNS names provided here, so clients can ensure a secure connection. Optional. Mutable. When updated, DSM will re-generate the TLS certificate if no custom certificate is provided. |
false |
extraClients |
[]string |
ExtraClients is a list of additional IPv4 addresses/ranges that should be allowed to access the database service. Use cases include: * having applications outside of the tenant organization namespace that need to access the database cluster. * configuring replication for the database cluster from a different region. * troubleshooting issues with the database cluster. Optional. Mutable. |
false |
object |
MaintenanceWindow refers to the System maintenance window. Enabled Maintenance Window will allow CVEs, bug fixes and new Lifecycle Management features for the VM, OS, any supporting software to be addressed. Automatic upgrades applied during this window should only result in minimum downtime of deployed databases for HA clusters. Database minor version upgrades might also be performed. Refer to engine-specific automatic upgrade details which are documented at the corresponding top-level API docs. Optional. Mutable. |
false |
|
members |
integer |
The number of members for cluster. Could be Default - Mutable.
|
false |
object |
PlacementSelector refers to a placement declared in the InfrastructurePolicy. Usually this field should be left empty to allow the system to determine it automatically.
A placement should be found in the Optional. Immutable. |
false |
|
supportAsynchReplicas |
boolean |
SupportAsynchReplicas controls whether the cluster is provisioned with features required for it to be used by replicas as a source. Optional. Mutable.
|
false |
object |
TLS refers to the SSL/TLS configuration of the database cluster. Optional. Mutable. |
false |
|
object |
UpgradeSafeguards configures the safeguards that need to pass before allowing a major/minor version upgrade to proceed. If specified, the .spec.upgradeSafeguards.targetVersion must match canonical .spec.Version. If not specified, either default safeguard values will be used or, if present, the values of the following legacy annotations may be applicable (for details, see engine-specific major/minor version upgrade documentation): dsm.vmware.com/skip-pre-upgrade-backup dsm.vmware.com/upgrade-cluster-without-backups dsm.vmware.com/upgrade-cluster-with-failing-backups dsm.vmware.com/upgrade-cluster-with-alerts UpgradeSafeguards cannot be used in combination with any of the deprecated annotations from the list above, regardless of the referenced target versions. Optional. Mutable. |
false |
|
[]object |
VSphereTags is the list of vSphere tags that the cluster’s deployed virtual machines should have assigned. The tags should exist in vSphere in order to be successfully assigned. Optional. Mutable. |
false |
ArchivedMySQLCluster.status.mysqlClusterSpec.infrastructurePolicy
InfrastructurePolicy refers to the infrastructure policy resource used to create this cluster.
Required - Must refer to a valid InfrastructurePolicy.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
kind |
string |
Kind of the referent. |
false |
name |
string |
The Name of the referent. |
false |
namespace |
string |
The Namespace of the referent. |
false |
ArchivedMySQLCluster.status.mysqlClusterSpec.vmClass
VMClass refers to the VM class that should be used to create this cluster. It must be part of the InfrastructurePolicy used by this cluster.
Required - Must refer to a valid VMClass.
Mutable - (Only increases in resources are allowed).
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
ArchivedMySQLCluster.status.mysqlClusterSpec.adminPasswordRef
AdminPasswordRef refers to a v1.Secret containing the password which the privileged user will use to connect
to the database. The secret must be in the same namespace as the database cluster.
FieldPath field indicates which key in the secret contains the password. Default - password.
Providing inline value with Value field is not supported.
The owner of the Secret must be the same as the owner of the DB cluster. When the owner of the DB
cluster is changed the owner of the Secret is automatically changed to the new owner.
If the cluster is a replica with SyncUsersFromSource=true, this field has no effect until the replica is promoted.
Default - password is auto generated.
Mutable. It is possible to refer to a new Secret to update the admin password, but it is not required. Updates in the already referenced Secret will also lead to update of the password.
| Name | Type | Description | Required |
|---|---|---|---|
fieldPath |
string |
data.<key> for secrets. Optional. For most references there is a canonical key |
false |
name |
string |
The name of the secret |
false |
value |
string |
Deprecated. This field is never used by the Data Services Manager. |
false |
ArchivedMySQLCluster.status.mysqlClusterSpec.backupConfig
BackupConfig declares the cluster’s backup configuration details.
If specified a BackupLocation must also be specified.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
backupRetentionDays |
integer |
BackupRetentionDays indicates the number of days for which the database’s
Point-in-Time Recovery (PITR) is expected to be available.
Must be Required. Mutable.
|
true |
[]object |
Schedules determine the type and frequency of backups, with the latter defined by a cron expression. Required. Mutable. |
true |
|
uploadChunkSize |
int or string |
UploadChunkSize setting that allows for the user to override the default chunk size used in multipart uploads and specify the part size themselves, taking into account the specifics of their environment and the target backup storage. There are tradeoffs associated with tuning the value of the UploadChunkSize. On one hand side each part is a separate S3 PUT operation so chunking the backup in too small parts comes at a certain cost. On the other hand side, parts are buffered in memory and the larger the part, the greater the chance of an upload failure depending on the reliability of the network. Thus, a high chunk size value comes with a higher memory footprint and a higher risk for upload failure. The memory utilization of the backup routine may increase with up to 5 times the configured upload chunk size due to the parallel upload capability of the object uploader. Note that the backup doesn’t include all files in the MySQL data directory and the backup stream is compressed, which means that size of the backup object would vary significantly based on the type of data in the database. In general one can expect that the backup object size is around 1% to 10% of the disk utilization of the MySQL database instance (i.e. the MySQL data directory). The format of the specified value should be a Kubernetes resource quantity - https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/quantity/ Range - 5Mi - 5Gi Default - 10Mi Supported in Data Service Manager data plane version 2.2.2 and above. Optional. Mutable. |
false |
ArchivedMySQLCluster.status.mysqlClusterSpec.backupConfig.schedules[index]
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the schedule. Required. Immutable. |
true |
schedule |
string |
The schedule in the form of a cron schedule. Required. Mutable. |
true |
type |
string |
Type of schedule. Can be Required. Immutable. |
true |
ArchivedMySQLCluster.status.mysqlClusterSpec.backupLocation
BackupLocation, if specified, must point to an existing BackupLocation custom resource in the same namespace as the cluster or in the DSM system namespace. It will be used by the 'BackupConfig', which must be specified whenever BackupLocation is specified.
If specified, a backupConfig must also be specified.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
ArchivedMySQLCluster.status.mysqlClusterSpec.basedOn
BasedOn identifies the source cluster on which this cluster will be based on.
Users cannot base their clusters on clusters owned by other users unless the user has DSM_Admin role. The new cluster will inherit the ownership from its source cluster. It can be changed if necessary after the cluster is created.
Field Cluster works both if the cluster is alive and if it is deleted, but we are still retaining its backups. To create a new MySQL cluster based on a live cluster pass the name of the cluster. To create a new MySQL cluster based on an archived cluster with retained backups pass the name of the ArchivedMySQLCluster
The only allowed mutation of the BasedOn field is to set it to nil if it was previously set to contain ReplicationSource. See MySQLBasedOnParams.ReplicationSource for details.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
backup specifies a MySQLClusterBackup to use as the restore source. Cannot be set if Cluster, ReplicationSource, or Snapshot is set, too. One of the four has to be set. Immutable. Once set, this field cannot be modified. Optional.
|
false |
|
object |
Cluster contains the name of the source cluster and timestamp to use as the restore point. Cannot be set if ReplicationSource, Snapshot, or Backup is set, too. One of the four has to be set. Optional. Immutable. |
false |
|
object |
ReplicationSource specifies that the cluster will be based on a source cluster from which this cluster will replicate asynchronously. Cannot be set if Cluster, Snapshot, or Backup is set, too. One of the four has to be set. When a cluster with previously configured basedOn.ReplicationSource field is updated to remove basedOn, the cluster will be decoupled from its source cluster and promoted to an independent read/write cluster. Promotion is irrevocable and doesn’t wait for in-flight data from the source to be flushed to the replica. The completion of promotion will be indicated by the removal of the IncomingReplicationStatus status field. If SyncUsersFromSource was previously true, the admin user credentials on the promoted cluster will be re-generated or, if AdminUser/AdminPasswordRef was populated, set to its value. In both cases, cluster connection status will be changed to refer to these admin user credentials as in any non-replica cluster. Optional. Immutable. |
false |
|
object |
Snapshot specifies that the cluster will be a linked clone of the snapshot to which this reference is pointing. Cannot be set if Cluster, ReplicationSource, or Backup is set, too. One of the four has to be set. A snapshot-based cluster will permanently depend on the existence of the snapshot on which it is based and thus, on the cluster from which the snapshot was taken and the storage used by it. A cluster must be using a SupervisorInfrastructurePolicy and a single availability zone to be a snapshot clone. Optional. Immutable.
|
false |
ArchivedMySQLCluster.status.mysqlClusterSpec.basedOn.backup
backup specifies a MySQLClusterBackup to use as the restore source. Cannot be set if Cluster, ReplicationSource, or Snapshot is set, too. One of the four has to be set.
Immutable. Once set, this field cannot be modified.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
name specifies the MySQLClusterBackup name Optional. |
false |
time |
string |
time is the point in time to restore to when the referenced MySQLClusterBackup has sourceBackup populated and its location pointing to an automated continuous backup set with binlogs that allow PITR. The restore will happen to the last available recovery time before the given time. If time is not provided, restore will be initiated to the latest available recovery time. Optional. Immutable.
|
false |
ArchivedMySQLCluster.status.mysqlClusterSpec.basedOn.cluster
Cluster contains the name of the source cluster and timestamp to use as the restore point. Cannot be set if ReplicationSource, Snapshot, or Backup is set, too. One of the four has to be set.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name is the name of the source cluster from which to restore. Required. Immutable. |
true |
timestamp |
string |
Timestamp is the point in time to restore from. The restore will happen to the last available recovery time before the given time. If timestamp is not provided restore will be initiated to the latest available recovery time. Optional. Immutable.
|
false |
ArchivedMySQLCluster.status.mysqlClusterSpec.basedOn.replicationSource
ReplicationSource specifies that the cluster will be based on a source cluster from which this cluster will replicate asynchronously. Cannot be set if Cluster, Snapshot, or Backup is set, too. One of the four has to be set.
When a cluster with previously configured basedOn.ReplicationSource field is updated to remove basedOn, the cluster will be decoupled from its source cluster and promoted to an independent read/write cluster. Promotion is irrevocable and doesn’t wait for in-flight data from the source to be flushed to the replica. The completion of promotion will be indicated by the removal of the IncomingReplicationStatus status field. If SyncUsersFromSource was previously true, the admin user credentials on the promoted cluster will be re-generated or, if AdminUser/AdminPasswordRef was populated, set to its value. In both cases, cluster connection status will be changed to refer to these admin user credentials as in any non-replica cluster.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
ClusterConnectionParams specifies connection parameters for connecting to the source cluster. This is currently the only option for specifying a source cluster. Required |
true |
|
syncUsersFromSource |
boolean |
SyncUsersFromSource specifies whether database users and their credentials are managed locally on the replica (false) or replicated from the source cluster (true). When set to true, all DB users on the replica and their credentials will be replicated from the source. Cluster connection status will refer to a replication user and its credentials. No local user management (CREATE, DROP, ALTER) should be performed on the replica database directly. If AdminUserName or AdminPasswordRef are set on the replica, they will be ignored until it is promoted or SyncUsersFromSource is switched to false. When set to false, the replica cluster users are managed the same way as in a non-replica cluster. The only permitted change of this field is from true to false, in which case existing replicated users are retained as the initial state of locally managed users, and then AdminUserName/AdminPasswordRef are applied. Required Mutable
|
true |
ArchivedMySQLCluster.status.mysqlClusterSpec.basedOn.replicationSource.clusterConnectionParams
ClusterConnectionParams specifies connection parameters for connecting to the source cluster. This is currently the only option for specifying a source cluster.
Required
| Name | Type | Description | Required |
|---|---|---|---|
object |
Credentials specifies a Kubernetes secret that contains the credentials needed to connect to the source cluster. Required fields of the secret are username and password. The referenced MySQL user must have connection, replication and clone privilege on the source cluster. This field is mutable. Changes to the secret will be automatically applied on the instance. Required. Mutable. |
true |
|
endpoints |
[]string |
Endpoints is a list of servers that are members of a single cluster, in host:port format. Connections to the servers will be tried in the order specified, and a server will be used only if connection attempts to those preceding it in the list have failed. The list can contain a sub-set of the source cluster members, in which case replication will depend on the health of this sub-set. Required. Mutable. |
true |
object |
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when validating the Servers connection.
Optional. By default, it will use the DSM globally trusted certificates ConfigMap. Mutable. |
false |
ArchivedMySQLCluster.status.mysqlClusterSpec.basedOn.replicationSource.clusterConnectionParams.credentials
Credentials specifies a Kubernetes secret that contains the credentials needed to connect to the source cluster. Required fields of the secret are username and password. The referenced MySQL user must have connection, replication and clone privilege on the source cluster. This field is mutable. Changes to the secret will be automatically applied on the instance.
Required.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
ArchivedMySQLCluster.status.mysqlClusterSpec.basedOn.replicationSource.clusterConnectionParams.trustBundle
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when validating the Servers connection.
-
Well-known OS-trusted CA, or a DSM globally trusted certificate - TrustBundle can be omitted, or it should point to DSM globally trusted certificates ConfigMap.
-
Certificate signed by CA that should not be globally trusted by DSM - TrustBundle reference must point to ConfigMap with key
tls.crtthat contains only Issuer certificate(s). If an end-entity (i.e. server) certificate is provided it must be issued by itself, i.e. self-signed.
Optional. By default, it will use the DSM globally trusted certificates ConfigMap.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
ArchivedMySQLCluster.status.mysqlClusterSpec.basedOn.snapshot
Snapshot specifies that the cluster will be a linked clone of the snapshot to which this reference is pointing. Cannot be set if Cluster, ReplicationSource, or Backup is set, too. One of the four has to be set. A snapshot-based cluster will permanently depend on the existence of the snapshot on which it is based and thus, on the cluster from which the snapshot was taken and the storage used by it. A cluster must be using a SupervisorInfrastructurePolicy and a single availability zone to be a snapshot clone.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name refers to a MySQLSnapshot in the same namespace from which to clone this cluster. The snapshot must have Ready condition with status True, be from the same MySQL major and minor version as this cluster, have the same StorageSpace, and use the same vSphere storage and spec.infrastructurePolicy. Supported in Data Services Manager data plane version 9.1.0.0 and above. Immutable. Required.
|
true |
ArchivedMySQLCluster.status.mysqlClusterSpec.databaseConfig
DatabaseConfig refers to the database config object that will be applied to this cluster.
Database Config is used to apply custom params/configs to the database represented by this CR.
The provided parameters go into the mysql.cnf file.
DatabaseConfig Validation Rules:
-
Exclusivity: A DatabaseConfig can only be applied to a single cluster at a time. If a DatabaseConfig is already in use by another cluster, it cannot be assigned to a new cluster or changed to reference a different cluster.
-
Namespace: The DatabaseConfig must exist in the same namespace as the cluster.
-
Deletion Protection: A DatabaseConfig cannot be deleted while it is in use by a cluster.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
ArchivedMySQLCluster.status.mysqlClusterSpec.directoryService
DirectoryService refers to the DirectoryService resource with LDAP settings used by this cluster for authenticating clients.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
ArchivedMySQLCluster.status.mysqlClusterSpec.maintenanceWindow
MaintenanceWindow refers to the System maintenance window. Enabled Maintenance Window will allow CVEs, bug fixes and new Lifecycle Management features for the VM, OS, any supporting software to be addressed. Automatic upgrades applied during this window should only result in minimum downtime of deployed databases for HA clusters. Database minor version upgrades might also be performed. Refer to engine-specific automatic upgrade details which are documented at the corresponding top-level API docs.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
duration |
string |
Duration describes the duration of the maintenance window. Required. Mutable. |
true |
startDay |
enum |
StartDay describes the day of the week the maintenance window will commence. Can be any of Required. Mutable.
|
true |
startTime |
string |
StartTime describes the time of the day (UTC time) to start the maintenance window. Required. Mutable. |
true |
startDayWeeksOfMonth |
[]enum |
StartDayWeeksOfMonth field specifies the weeks of the month in which the
maintenance window will commence. It accepts up to five distinct
values from {1, 2, 3, 4, L}, where each number represents the
occurrence of the designated StartDay within the month ("1" being
the first one that includes it and "L" being the last one).
For example, providing Optional. Mutable.
|
false |
ArchivedMySQLCluster.status.mysqlClusterSpec.placementSelector
PlacementSelector refers to a placement declared in the InfrastructurePolicy.
Usually this field should be left empty to allow the system to determine it automatically.
A placement should be found in the InfrastructurePolicy with the same datacenter,
cluster and resource pool to be considered valid.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
cluster |
string |
Cluster is the datacenter’s cluster name to be used when placing the data service workload. Use the full qualified name of the cluster, relative to the datacenter. A cluster "Cluster1" inside a folder "clusters", should be declared as "clusters/Cluster1". Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the cluster name. Required. Mutable. |
true |
datacenter |
string |
Datacenter is the vSphere Datacenter to be used when placing the data service workload. The full qualified path to the datacenter must be provided if the datacenter is placed inside a folder. Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the datacenter name. Required. Mutable. |
true |
resourcePool |
string |
ResourcePool is the Cluster’s resource pool to be used when placing the data service workload. If the resource pool is not provided, the whole cluster is used as the placement. Optional. Mutable. |
false |
ArchivedMySQLCluster.status.mysqlClusterSpec.tls
TLS refers to the SSL/TLS configuration of the database cluster.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
secretName |
string |
The name of a Secret resource present in the same namespace as the database cluster, describing a custom certificate. The expected format of the Secret is the same as the output Secrets created by cert-manager’s Certificate resource. It needs to have keys: tls.crt: PEM signed certificate chain tls.key: PEM private key ca.crt: PEM CA certificate The ca.crt is optional if there is at least one issuer certificate in the certificate chain (tls.crt key). That issuer can either be a self-signed leaf certificate, or an intermediate or root certificate authority. Optional. When omitted, DSM will auto-generate a certificate using its own internal certificate authority. When specified, DSM will override its auto-generated certificate and use the one described in the Secret. Mutable. To update a custom certificate, either refer to a new Secret, or update the already referenced one. If the database cluster will be accessed by IP, the TLS configuration needs to be applied after initial creation, because the IP can be retrieved only then, so it can be encoded in the certificate. |
false |
ArchivedMySQLCluster.status.mysqlClusterSpec.upgradeSafeguards
UpgradeSafeguards configures the safeguards that need to pass before allowing a major/minor version upgrade to proceed. If specified, the .spec.upgradeSafeguards.targetVersion must match canonical .spec.Version. If not specified, either default safeguard values will be used or, if present, the values of the following legacy annotations may be applicable (for details, see engine-specific major/minor version upgrade documentation): dsm.vmware.com/skip-pre-upgrade-backup dsm.vmware.com/upgrade-cluster-without-backups dsm.vmware.com/upgrade-cluster-with-failing-backups dsm.vmware.com/upgrade-cluster-with-alerts
UpgradeSafeguards cannot be used in combination with any of the deprecated annotations from the list above, regardless of the referenced target versions.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
targetVersion |
string |
TargetVersion must equal spec.version. If the cluster is to be upgraded again and its spec.version changes, either the outdated prior safeguard should be removed or it should be updated along with its TargetVersion. Required. |
true |
allowWithActiveAlerts |
boolean |
AllowWithActiveAlerts, if true, will allow further processing even if active alerts on the cluster exist. Optional. Mutable. Default: false
|
false |
allowWithoutBackup |
boolean |
AllowWithoutBackup, if true, will allow further processing for major version upgrade even if the backup that is taken as part of this safeguard could not be started or failed. An attempt to create such a backup will always be made, with further processing dependent on the value of this field. For minor version upgrade this value is not applicable, as no pre-upgrade backup will be made. Accepted values in this case are nil and true, false will be rejected. Optional. Mutable. |
false |
ArchivedMySQLCluster.status.mysqlClusterSpec.vSphereTags[index]
VSphereTag identifies a single vSphere tag by its tag category and tag name.
| Name | Type | Description | Required |
|---|---|---|---|
category |
string |
Category is the vSphere tag category Required. Mutable. |
true |
tag |
string |
Tag is the vSphere tag. It should be part of vSphere tag category Category. Required. Mutable. |
true |
ArchivedMySQLCluster.status.upgradeStatus
UpgradeStatus represents version state transitions history for the deleted cluster
Required.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
currentVersion |
string |
The actual current version of the data service cluster. This is going to be the same as spec.version, unless an upgrade has been requested. In the latter case, this field will be updated once the upgrade completes. |
false |
[]object |
Historical data of the upgrades performed. |
false |
ArchivedMySQLCluster.status.upgradeStatus.history[index]
| Name | Type | Description | Required |
|---|---|---|---|
complete |
string |
Timestamp of when the upgrade completed.
|
false |
fromVersion |
string |
The version from which the cluster was upgraded. |
false |
isMajorUpgrade |
boolean |
IsMajorUpgrade specifies whether the upgrade was a major or a minor version upgrade. |
false |
message |
string |
Message contains the reason for a failure or rejection. |
false |
start |
string |
Timestamp of when the upgrade started. This is the time right before the upgrade operations has started and restores are guaranteed to succeed at or before that time. The period after Start and before Complete is considered a blackout period and restores within this interval could lead to unexpected results.
|
false |
status |
enum |
Status indicates the status of the upgrade.
|
false |
toVersion |
string |
The version to which the cluster was upgraded. If the upgrade was aborted or has failed, this field will have the same value as FromVersion. |
false |
ArchivedMySQLCluster.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
ArchivedPostgresCluster
ArchivedPostgresCluster is the Schema for the archivedpostgrescluster API. ArchivedPostgresCluster is created automatically when PostgresCluster with enabled automated backups is deleted. An ArchivedPostgresCluster represents the retained automated backups and WAL archive that were taken for that deleted PostgresCluster. It is named after the PostgresCluster and is created in the same namespace. ArchivedPostgresCluster can be used to perform point-in-time recovery for that deleted cluster. ArchivedPostgresCluster is automatically deleted once retention expires.
To use a ArchivedPostgresCluster reference its name when creating a new PostgresCluster by passing the .spec.basedOn.cluster.name field. Example:
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: PostgresCluster
metadata:
name: restored-source-1
namespace: default
spec:
basedOn:
cluster:
name: source-1 # the name of the referenced ArchivedPostgresCluster
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
databases.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
ArchivedPostgresCluster |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
ArchivedPostgresClusterSpec is the Schema for the ArchivedPostgresCluster API. |
false |
|
object |
ArchivedPostgresClusterStatus defines the observed state of ArchivedPostgresCluster. |
false |
ArchivedPostgresCluster.spec
ArchivedPostgresClusterSpec is the Schema for the ArchivedPostgresCluster API.
| Name | Type | Description | Required |
|---|---|---|---|
expiresAt |
string |
ExpiresAt represents the point in time when backups and WAL archive associated with ArchivedPostgresCluster will be expired. DSM will perform the cleanup after this point in time. Required. Mutable.
|
true |
ArchivedPostgresCluster.status
ArchivedPostgresClusterStatus defines the observed state of ArchivedPostgresCluster.
| Name | Type | Description | Required |
|---|---|---|---|
backupId |
string |
BackupId is set only for clusters with enabled automatic backups. This is a unique ID that can be used to locate backup files in storage. For PostgreSQL, it is the stanzaName of the database cluster. Required. Immutable. |
true |
databaseName |
string |
The name of the default Postgres database used by any restored clusters from this archive. DSM will use the default database name from PostgresCluster.Status.Connection.DbName of the PostgresCluster associated with this archive. Required. Immutable. |
true |
object |
The last known spec of the cluster that got archived. Required. Immutable. |
true |
|
object |
UpgradeStatus represents version state transitions history for the deleted cluster Required. Immutable. |
true |
|
[]object |
Conditions contain the list of observed conditions of the archived clusters. One of the following statuses can occur.
|
false |
|
[]object |
RestorableTimeRanges describe chronologically ordered list of restorable time ranges for the deleted cluster. Each range represents a continuous time window during which point-in-time restore can be performed using that range’s backup id. Normally, this list contains a single range representing a continuous restore window. RestorableTimeRanges will contain multiple ranges if the deleted cluster was demoted and later promoted again in a disaster recovery (DR) setup. The final range’s endTime is missing in case the source was a standalone or a primary cluster at the moment of deletion. In this case point-in-time restore can be performed for any timestamp, which is after the startTime of the range. If the source was a read replica, the endTime is populated with a timestamp, corresponding to the last possible time to which point-in-time restore can be performed. If a requested point-in-time restore timestamp falls in the gap between two separate ranges or is after the last range’s endTime, the request will be rejected. |
false |
ArchivedPostgresCluster.status.postgresClusterSpec
The last known spec of the cluster that got archived.
Required.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
InfrastructurePolicy refers to the infrastructure policy resource used to create this cluster. Required - Must refer to a valid Immutable. |
true |
|
storagePolicyName |
string |
StoragePolicyName declares the name of the storage policy that should be used to create this postgres cluster. It must be part of the InfrastructurePolicy used by this cluster. Required - Must refer to a valid Immutable. |
true |
storageSpace |
string |
StorageSpace declares the disk size allocated to each node hosting the workload. You can express storage as a plain integer or as a fixed-point number using one of these suffixes - E, P, T, G, M, k. You can also use the power-of-two equivalents - Ei, Pi, Ti, Gi, Mi, Ki Range - 20Gi - 32Ti. Required. Mutable - (increase only). |
true |
version |
string |
Version declares the version of the database engine to be used. To upgrade the database engine change this field. The list of supported engine versions can be found by inspecting the DataServiceVersion resources and in the VMware Data Services Manager UI. Version Validations for Cluster Restore Scenarios: When creating a new cluster based on an existing cluster or backup (via spec.basedOn), the following version validation rules apply at cluster creation time: General Rules (All Database Engines):
PostgreSQL-Specific Rules:
MySQL-Specific Rules:
Required. Mutable. |
true |
object |
VMClass refers to the VM class that should be used to create this cluster. It must be part of the InfrastructurePolicy used by this cluster. Required - Must refer to a valid Mutable - (Only increases in resources are allowed). |
true |
|
object |
AdminPasswordRef refers to a v1.Secret containing the password which the privileged user will use to connect
to the database. The secret must be in the same namespace as the database cluster.
FieldPath field indicates which key in the secret contains the password. Default - Read replicas (that is, clusters with Spec.BasedOn.ContinuousRecovery.Enabled set to true) do not support having their own privileged user. If this field is set on a read replica, it will only take effect after the read replica is promoted. Default - password is auto generated. Mutable. It is possible to refer to a new Secret to update the admin password, but it is not required. Updates in the already referenced Secret will also lead to update of the password. |
false |
|
adminUsername |
string |
AdminUserName is the desired name of the privileged user to be used when connecting to the database. AdminUserName should not be one of the following - pg_read_all_data, pg_write_all_data, pg_read_all_settings, pg_read_all_stats, pg_stat_scan_tables, pg_monitor, pg_database_owner, pg_signal_backend, pg_read_server_files, pg_write_server_files, pg_execute_server_program, pg_checkpoint, pg_use_reserved_connections, pg_create_subscription, postgres, template1, template0. Default - pgadmin. Immutable. |
false |
object |
BackupConfig declares the cluster’s backup configuration details. If specified a Optional. Mutable. |
false |
|
object |
BackupLocation, if specified, must point to an existing BackupLocation custom resource in the same namespace as the cluster or in the DSM system namespace. It will be used by the 'BackupConfig', which must be specified whenever BackupLocation is specified. If specified, a Optional. Mutable. |
false |
|
object |
BasedOn identifies the source (primary) cluster on which this cluster will be based on. Users cannot base their clusters on clusters owned by other users unless the user has DSM_Admin role. The new cluster will inherit the ownership from its source(primary) cluster. It can be changed if necessary after the cluster is created. Field Cluster works both if the cluster is alive and if it is deleted, but we are still retaining its backups. To create a new Postgres cluster based on a live one pass the name of the cluster. To create a new Postgres cluster based on an archived cluster with retained backups pass the name of the ArchivedPostgresCluster. Optional. Immutable. |
false |
|
blockDatabaseConnections |
boolean |
BlockDatabaseConnections restricts all external client access to the database. When set to true, the database forcibly terminates all existing client connections and prevents any new connection attempts, including those from administrative users such as pgadmin. When set to false or unset, client access to the database is permitted as normal. The Ready condition, in combination with the observedGeneration, can be used to verify that this setting has been applied. This field can be useful in disaster recovery (DR) scenarios to ensure no writes or new sessions occur on the original primary(source) during switchover or failover. Default - Optional. Mutable.
|
false |
object |
DatabaseConfig refers to the database config object that will be applied to this cluster. Database Config is used to apply custom params/configs to the database represented by this CR.
The provided parameters go into the Use of shared_preload_libraries key: The property determines which additional libraries are loaded during Postgres startup. Its value is a comma-separated list of libraries available in DSM. * If the parameter is omitted, the cluster applies the default library set (pg_stat_statements, pgaudit, pg_cron), equivalent to: "shared_preload_libraries": "pg_stat_statements,pgaudit,pg_cron" * pg_stat_statements is required by DSM and is always preloaded. Example values: * "pgaudit" - loads pgaudit and pg_stat_statements * "pg_cron" - loads pg_cron and pg_stat_statements * "" - no extra libraries beyond pg_stat_statements DatabaseConfig Validation Rules:
Optional. Mutable. |
false |
|
databaseName |
string |
If DatabaseName is set, database with that name will be created (if it doesn’t exist) and PostgresCluster.Status.Connection.DbName and ArchivedPostgresCluster.Status.DatabaseName will be set to that name. If the cluster is restored from another cluster (Spec.BasedOn.Cluster field is used) all databases from the source cluster are restored with preserved names and one additional database is created with name the given DatabaseName. This database is empty and PostgresCluster.Status.Connection.DbName and ArchivedPostgresCluster.Status.DatabaseName refer to it. If DatabaseName is equal to the name of database from the source cluster no additional database is created and PostgresCluster.Status.Connection.DbName and ArchivedPostgresCluster.Status.DatabaseName refer to the specified database with name the given DatabaseName. If DatabaseName is empty no additional database is created and PostgresCluster.Status.Connection.DbName and ArchivedPostgresCluster.Status.DatabaseName refer the same database the status connection info of the source cluster refers to. If the cluster is a read replica of a primary cluster and has DatabaseName different from the names of the databases in that primary cluster, the additional database with name DatabaseName will be created only after the read replica is promoted to a standalone cluster. DatabaseName should not be one of the following - pg_read_all_data, pg_write_all_data, pg_read_all_settings, pg_read_all_stats, pg_stat_scan_tables, pg_monitor, pg_database_owner, pg_signal_backend, pg_read_server_files, pg_write_server_files, pg_execute_server_program, pg_checkpoint, pg_use_reserved_connections, pg_create_subscription, postgres, template1, template0. It is recommended the length of DatabaseName to not exceed 63 characters, otherwise it will be truncated and only the first 63 characters will be used for database name. Default - if the cluster is restored one, the database name in the source cluster’s PostgresCluster.Status.Connection.DbName is used, otherwise DatabaseName is the same as the cluster’s name. Immutable. |
false |
description |
string |
Description contains the human-readable description of the cluster. Optional. Mutable. |
false |
object |
DirectoryService refers to the DirectoryService resource with LDAP settings used by this cluster for authenticating clients. Optional. Mutable. |
false |
|
dnsNames |
[]string |
One or more DNS names / FQDNs for database access. These DNS names will be included in the SAN field of the TLS certificate if auto-generated by DSM. The first DNS name will also be included in the URL connection string displayed in DSM UI. If a custom TLS certificate is provided, it is important its SAN field to match the DNS names provided here, so clients can ensure a secure connection. Optional. Mutable. When updated, DSM will re-generate the TLS certificate if no custom certificate is provided. |
false |
extraClients |
[]string |
ExtraClients is a list of additional IPv4 addresses/ranges that should be allowed to access the database service. Use cases include: * having applications outside of the tenant organization namespace that need to access the database cluster. * configuring replication for the database cluster from a different region. * troubleshooting issues with the database cluster. Optional. Mutable. |
false |
object |
HbaRef refers to a Secret containing custom The Secret must be in the same namespace as the database cluster. Once created, the HBA Secret cannot be modified. If you need to change the HBA configuration, create a new Secret and update the reference here. The Secret should contain the Only the authentication methods For example, to permit all users whose usernames end with @local to authenticate using their database passwords, you can add: kind: Secret
metadata:
name: db-cluster-1-custom-pg-hba
immutable: true
stringData:
pg_hba.conf: |
host all /^(.*)@local$ all scram-sha-256
Care should be taken to ensure that the custom entries do not interfere with the system-managed entries
or lock out users from accessing the cluster. This is because the order in which the HBA entries are defined matters.
The first record with a matching connection type, client address, requested database, and user name is used to perform authentication.
The final host all pgadmin all scram-sha-256 host all postgres_exporter all scram-sha-256 #<YOUR CUSTOM ENTRIES ARE ADDED HERE> host all all all ldap ... # This entry is added only if directory service is enabled for the cluster host all all all scram-sha-256 Note: Postgres clusters with versions from DSM release >= 9.0.2 require SSL connections for system users
(admin user, monitoring user). This can be overridden by DSM administrators by setting
|
false |
|
object |
Localization specifies the localization configuration for the database cluster. Optional. Immutable. |
false |
|
object |
MaintenanceWindow refers to the System maintenance window. Enabled Maintenance Window will allow CVEs, bug fixes and new Lifecycle Management features for the VM, OS, any supporting software to be addressed. Automatic upgrades applied during this window should only result in minimum downtime of deployed databases for HA clusters. Database minor version upgrades might also be performed. Refer to engine-specific automatic upgrade details which are documented at the corresponding top-level API docs. Optional. Mutable. |
false |
|
object |
PlacementSelector refers to a placement declared in the InfrastructurePolicy. Usually this field should be left empty to allow the system to determine it automatically.
A placement should be found in the Optional. Immutable. |
false |
|
replicas |
integer |
Represents the number of nodes that are replicating from the primary node. In event of a primary outage one of the replicas will be promoted to primary. Replicas can be set to 0 or 1. Starting with Data Services Manager 2.1, 3-replica clusters are no longer supported. If you have replicas set to 1, then you will have 1 primary node and 1 replica node. Read replicas (that is, clusters with Spec.BasedOn.ContinuousRecovery.Enabled set to true) do not support having their own replicas. If this field is set to a non-zero value on a read replica, it will only take effect after this replica is promoted. Default - Mutable.
|
false |
[]object |
ReplicationSlots configures a list of Postgres replication slots that will be created on this cluster for disaster recovery, read replication, or migration purposes. A replication slot can be removed if it is no longer needed and there is no active consumer of that replication slot. Read replicas (that is, clusters with Spec.BasedOn.ContinuousRecovery.Enabled set to true) do not support having replication slots. If this field is set on a read replica, it will only take effect after the read replica is promoted. When upgrading the primary cluster it is recommended to upgrade all read replicas to the same minor version before upgrading the primary cluster. |
false |
|
requestedSharedMemorySize |
int or string |
RequestedSharedMemorySize is the value we would try to assign for shared memory (/dev/shm) of the OS where the Postgres instance is running. No upper limit is enforced, but the system would apply one based on current VMClass memory. You can express RequestedSharedMemorySize as a fixed-point number using one of these suffixes - E, P, T, G, M, k. You can also use the power-of-two equivalents - Ei, Pi, Ti, Gi, Mi, Ki. Range - 64Mi - no limit. Default - Optional. Mutable.
|
false |
object |
TLS refers to the SSL/TLS configuration of the database cluster. Optional. Mutable. |
false |
|
object |
UpgradeSafeguards configures the safeguards that need to pass before allowing a major/minor version upgrade to proceed. If specified, the .spec.upgradeSafeguards.targetVersion must match canonical .spec.Version. If not specified, either default safeguard values will be used or, if present, the values of the following legacy annotations may be applicable (for details, see engine-specific major/minor version upgrade documentation): dsm.vmware.com/skip-pre-upgrade-backup dsm.vmware.com/upgrade-cluster-without-backups dsm.vmware.com/upgrade-cluster-with-failing-backups dsm.vmware.com/upgrade-cluster-with-alerts UpgradeSafeguards cannot be used in combination with any of the deprecated annotations from the list above, regardless of the referenced target versions. Optional. Mutable. |
false |
|
[]object |
VSphereTags is the list of vSphere tags that the cluster’s deployed virtual machines should have assigned. The tags should exist in vSphere in order to be successfully assigned. Optional. Mutable. |
false |
ArchivedPostgresCluster.status.postgresClusterSpec.infrastructurePolicy
InfrastructurePolicy refers to the infrastructure policy resource used to create this cluster.
Required - Must refer to a valid InfrastructurePolicy.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
kind |
string |
Kind of the referent. |
false |
name |
string |
The Name of the referent. |
false |
namespace |
string |
The Namespace of the referent. |
false |
ArchivedPostgresCluster.status.postgresClusterSpec.vmClass
VMClass refers to the VM class that should be used to create this cluster. It must be part of the InfrastructurePolicy used by this cluster.
Required - Must refer to a valid VMClass.
Mutable - (Only increases in resources are allowed).
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
ArchivedPostgresCluster.status.postgresClusterSpec.adminPasswordRef
AdminPasswordRef refers to a v1.Secret containing the password which the privileged user will use to connect
to the database. The secret must be in the same namespace as the database cluster.
FieldPath field indicates which key in the secret contains the password. Default - password.
Providing inline value with Value field is not supported.
The owner of the Secret must be the same as the owner of the DB cluster. When the owner of the DB
cluster is changed the owner of the Secret is automatically changed to the new owner.
Read replicas (that is, clusters with Spec.BasedOn.ContinuousRecovery.Enabled set to true) do not support having their own privileged user. If this field is set on a read replica, it will only take effect after the read replica is promoted.
Default - password is auto generated.
Mutable. It is possible to refer to a new Secret to update the admin password, but it is not required. Updates in the already referenced Secret will also lead to update of the password.
| Name | Type | Description | Required |
|---|---|---|---|
fieldPath |
string |
data.<key> for secrets. Optional. For most references there is a canonical key |
false |
name |
string |
The name of the secret |
false |
value |
string |
Deprecated. This field is never used by the Data Services Manager. |
false |
ArchivedPostgresCluster.status.postgresClusterSpec.backupConfig
BackupConfig declares the cluster’s backup configuration details.
If specified a BackupLocation must also be specified.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
backupRetentionDays |
integer |
BackupRetentionDays indicates the number of days for which the database’s
Point-in-Time Recovery (PITR) is expected to be available.
Must be Required. Mutable.
|
true |
[]object |
Schedules determine the type and frequency of backups, with the latter defined by a cron expression. Required. Mutable. |
true |
ArchivedPostgresCluster.status.postgresClusterSpec.backupConfig.schedules[index]
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the schedule. Required. Immutable. |
true |
schedule |
string |
The schedule in the form of a cron schedule. Required. Mutable. |
true |
type |
string |
Type of schedule. Can be Required. Immutable. |
true |
ArchivedPostgresCluster.status.postgresClusterSpec.backupLocation
BackupLocation, if specified, must point to an existing BackupLocation custom resource in the same namespace as the cluster or in the DSM system namespace. It will be used by the 'BackupConfig', which must be specified whenever BackupLocation is specified.
If specified, a backupConfig must also be specified.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
ArchivedPostgresCluster.status.postgresClusterSpec.basedOn
BasedOn identifies the source (primary) cluster on which this cluster will be based on.
Users cannot base their clusters on clusters owned by other users unless the user has DSM_Admin role. The new cluster will inherit the ownership from its source(primary) cluster. It can be changed if necessary after the cluster is created.
Field Cluster works both if the cluster is alive and if it is deleted, but we are still retaining its backups. To create a new Postgres cluster based on a live one pass the name of the cluster. To create a new Postgres cluster based on an archived cluster with retained backups pass the name of the ArchivedPostgresCluster.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
backup specifies a PostgresClusterBackup to use as the restore source. This field is mutually exclusive with Cluster. Immutable. Once set, this field cannot be modified. Optional.
|
false |
|
object |
cluster contains the name of the source(primary) cluster and timestamp to use as the restore point. This field is mutually exclusive with Backup. Immutable. Once set, this field cannot be modified. Optional.
|
false |
|
object |
ContinuousRecovery specifies the details of an external cluster that will be used as a source(primary) for continuous recovery. Once configured, this field can’t be unset. |
false |
ArchivedPostgresCluster.status.postgresClusterSpec.basedOn.backup
backup specifies a PostgresClusterBackup to use as the restore source. This field is mutually exclusive with Cluster.
Immutable. Once set, this field cannot be modified.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
name specifies the PostgresClusterBackup name Optional. |
false |
time |
string |
Time is the point in time to restore to. The restore will happen to the last available recovery time before the given time. If time is not provided restore will be initiated to the latest available recovery time. Optional. Immutable.
|
false |
ArchivedPostgresCluster.status.postgresClusterSpec.basedOn.cluster
cluster contains the name of the source(primary) cluster and timestamp to use as the restore point. This field is mutually exclusive with Backup.
Immutable. Once set, this field cannot be modified.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name is the name of the source cluster from which to restore. Required. Immutable. |
true |
timestamp |
string |
Timestamp is the point in time to restore from. The restore will happen to the last available recovery time before the given time. If timestamp is not provided restore will be initiated to the latest available recovery time. Optional. Immutable.
|
false |
ArchivedPostgresCluster.status.postgresClusterSpec.basedOn.continuousRecovery
ContinuousRecovery specifies the details of an external cluster that will be used as a source(primary) for continuous recovery. Once configured, this field can’t be unset.
| Name | Type | Description | Required |
|---|---|---|---|
object |
ReplicationSlot specifies the Postgres replication slot and remote cluster details from which this cluster will continuously recover. If the source (primary) cluster is a DSM managed Postgres cluster, the replication slot details can be retrieved from the status sub-resource of the source (primary) cluster’s PostgresCluster resource. When demoting a Postgres cluster with configured backups to act as a read replica to another cluster, the timeline of the demoted cluster must not exceed the timeline of the primary cluster. |
true |
|
enabled |
boolean |
Enabled specifies if this cluster should continuously retrieve activities from the source (primary) cluster. When Enabled is set to true, this cluster’s Ready condition implies that the cluster is now ready to serve read-only operations. During this period, WAL archiving and backups are paused until the cluster resumes read-write operations. When set to false, the Ready condition implies that the cluster is ready to serve read-write operations. |
false |
ArchivedPostgresCluster.status.postgresClusterSpec.basedOn.continuousRecovery.replicationSlot
ReplicationSlot specifies the Postgres replication slot and remote cluster details from which this cluster will continuously recover. If the source (primary) cluster is a DSM managed Postgres cluster, the replication slot details can be retrieved from the status sub-resource of the source (primary) cluster’s PostgresCluster resource.
When demoting a Postgres cluster with configured backups to act as a read replica to another cluster, the timeline of the demoted cluster must not exceed the timeline of the primary cluster.
| Name | Type | Description | Required |
|---|---|---|---|
object |
Credentials specifies a Kubernetes secret that contains the credentials needed to connect to the source cluster. Required fields of the secret are user, password, dbName. And the optional fields are ca.crt. The referenced Postgres user must have connect and replication privilege on the source cluster. This field is mutable. Changes to the secret will be automatically applied on the instance. |
true |
|
hostname |
string |
Hostname specifies the hostname or ip address that can be used to connect to the source cluster. |
true |
slotName |
string |
slotName specifies the Postgres replication slot name that will be used for streaming replication. Its length should not be more than 63 characters. |
true |
port |
integer |
Port specifies the port number that can be used to connect to the source cluster. This field is immutable.
|
false |
object |
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when validating the Servers connection.
Optional. By default, it will use the DSM globally trusted certificates ConfigMap. Mutable. |
false |
ArchivedPostgresCluster.status.postgresClusterSpec.basedOn.continuousRecovery.replicationSlot.credentials
Credentials specifies a Kubernetes secret that contains the credentials needed to connect to the source cluster. Required fields of the secret are user, password, dbName. And the optional fields are ca.crt. The referenced Postgres user must have connect and replication privilege on the source cluster. This field is mutable. Changes to the secret will be automatically applied on the instance.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
ArchivedPostgresCluster.status.postgresClusterSpec.basedOn.continuousRecovery.replicationSlot.trustBundle
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when validating the Servers connection.
-
Well-known OS-trusted CA, or a DSM globally trusted certificate - TrustBundle can be omitted, or it should point to DSM globally trusted certificates ConfigMap.
-
Certificate signed by CA that should not be globally trusted by DSM - TrustBundle reference must point to ConfigMap with key
tls.crtthat contains only Issuer certificate(s). If an end-entity (i.e. server) certificate is provided it must be issued by itself, i.e. self-signed.
Optional. By default, it will use the DSM globally trusted certificates ConfigMap.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
ArchivedPostgresCluster.status.postgresClusterSpec.databaseConfig
DatabaseConfig refers to the database config object that will be applied to this cluster.
Database Config is used to apply custom params/configs to the database represented by this CR.
The provided parameters go into the postgresql.conf file.
Use of shared_preload_libraries key: The property determines which additional libraries are loaded during Postgres startup. Its value is a comma-separated list of libraries available in DSM. * If the parameter is omitted, the cluster applies the default library set (pg_stat_statements, pgaudit, pg_cron), equivalent to: "shared_preload_libraries": "pg_stat_statements,pgaudit,pg_cron" * pg_stat_statements is required by DSM and is always preloaded. Example values: * "pgaudit" - loads pgaudit and pg_stat_statements * "pg_cron" - loads pg_cron and pg_stat_statements * "" - no extra libraries beyond pg_stat_statements
DatabaseConfig Validation Rules:
-
Exclusivity: A DatabaseConfig can only be applied to a single cluster at a time. If a DatabaseConfig is already in use by another cluster, it cannot be assigned to a new cluster or changed to reference a different cluster.
-
Namespace: The DatabaseConfig must exist in the same namespace as the cluster.
-
Deletion Protection: A DatabaseConfig cannot be deleted while it is in use by a cluster.
-
Restore Validation: When restoring a PostgreSQL cluster from a source cluster (via spec.basedOn.cluster) or from a PostgresClusterBackup created from a source cluster (via spec.basedOn.backup with sourceCluster), the following parameters are validated if present in either source or target DatabaseConfig:
-
max_connections
-
max_worker_processes
-
max_wal_senders
-
max_prepared_transactions
-
max_locks_per_transaction
-
shared_preload_libraries
For each numeric parameter above: * If the parameter exists in the source cluster's DatabaseConfig, it must also exist in the target cluster's DatabaseConfig and vice versa if the parameter exists in the target cluster's DatabaseConfig, it must also exist in the source cluster's DatabaseConfig. * The target cluster's parameter value must be greater than or equal to the source cluster's value.
For shared_preload_libraries, restore validation checks that the target cluster preloads every library that the source cluster preloads.
Note: This validation is skipped when restoring from a PostgresClusterBackup that references an external backup (via spec.basedOn.backup with sourceBackup), as the source DatabaseConfig parameters are not available. In case these rules are violated, the restored cluster will not start properly until the parameters are set correctly as per the requirements above.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
ArchivedPostgresCluster.status.postgresClusterSpec.directoryService
DirectoryService refers to the DirectoryService resource with LDAP settings used by this cluster for authenticating clients.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
ArchivedPostgresCluster.status.postgresClusterSpec.hbaRef
HbaRef refers to a Secret containing custom pg_hba.conf entries for user authentication.
See https://www.postgresql.org/docs/current/auth-pg-hba-conf.html
The Secret must be in the same namespace as the database cluster. Once created, the HBA Secret cannot be modified. If you need to change the HBA configuration, create a new Secret and update the reference here.
The Secret should contain the pg_hba.conf entries under a specific key pg_hba.conf.
These entries will be inserted into the pg_hba.conf file with a priority lower than system users
Only the authentication methods scram-sha-256,reject, cert are allowed in the custom entries.
When cert method is used spec.TLS field is used to supply the trusted CAs.
You cannot override the authentication method for the admin user specified with the AdminUserName field, e.g. pgadmin by default.
For this and any usernames reserved by DSM, the authentication is limited to password-based methods using SCRAM-SHA-256,
and you cannot enforce client certificate authentication.
For example, to permit all users whose usernames end with @local to authenticate using their database passwords, you can add:
kind: Secret
metadata:
name: db-cluster-1-custom-pg-hba
immutable: true
stringData:
pg_hba.conf: |
host all /^(.*)@local$ all scram-sha-256
Care should be taken to ensure that the custom entries do not interfere with the system-managed entries
or lock out users from accessing the cluster. This is because the order in which the HBA entries are defined matters.
The first record with a matching connection type, client address, requested database, and user name is used to perform authentication.
The final pg_hba.conf will functionally look like:
host all pgadmin all scram-sha-256 host all postgres_exporter all scram-sha-256 #<YOUR CUSTOM ENTRIES ARE ADDED HERE> host all all all ldap ... # This entry is added only if directory service is enabled for the cluster host all all all scram-sha-256
Note: Postgres clusters with versions from DSM release >= 9.0.2 require SSL connections for system users
(admin user, monitoring user). This can be overridden by DSM administrators by setting
postgrescluster-allow-non-ssl-system-users to true in the advanced-system-config ConfigMap in the
dsm-system namespace - the setting applies to new clusters and to existing clusters after
resource update. Custom hba entries are not affected.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
ArchivedPostgresCluster.status.postgresClusterSpec.localization
Localization specifies the localization configuration for the database cluster.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
encoding |
string |
Encoding specifies the character set of the default database created by DSM and all newly created databases unless the encoding of those databases is explicitly overridden when they are created. If not specified, Postgres attempts to determine the appropriate encoding to use based on the specified or default locale. This field is only applicable when creating a brand new database cluster and has no effect when cloning a database cluster, when restoring a database cluster from a backup, or when creating a read replica. In these cases this field must not be set; the encoding of the source database cluster will be used instead. If an invalid value is provided, the database cluster’s Ready condition will be set to Failed, and the TerminalFailure condition will indicate the invalid encoding. The specified encoding must be compatible with the selected locale. For supported character sets, see https://www.postgresql.org/docs/current/multibyte.html#MULTIBYTE-CHARSET-SUPPORTED. Immutable. This field cannot be changed after the database is created. Optional. |
false |
locale |
string |
Locale specifies the locale (cultural preferences respected by the database when handling alphabets, sorting, number formatting, etc.) of the default database created by DSM and all newly created databases unless the locale of those databases is explicitly overridden when they are created. If not specified, defaults to the locale of the database cluster’s operating system (typically C.utf8). This field is only applicable when creating a brand new database cluster and has no effect when cloning a database cluster, when restoring a database cluster from a backup, or when creating a read replica. In these cases this field must not be set; the locale of the source database cluster will be used instead. If an invalid value is provided, the database cluster’s Ready condition will be set to Failed, and the TerminalFailure condition will indicate the invalid locale. Common examples include: * C, C.utf8, POSIX (default/system locales) * en_US.utf8, en_GB.utf8 (English variants) * de_DE.utf8, fr_FR.utf8, es_ES.utf8 (European languages) * ja_JP.utf8, zh_CN.utf8, ko_KR.utf8 (Asian languages) * ar_SA.utf8, he_IL.utf8 (Middle Eastern languages) A more comprehensive list of available locales can be seen by querying an existing Postgres database: SELECT * FROM pg_collation WHERE provider = 'c'; Note: The drawback of using locales other than the default is its performance impact. It slows character handling and prevents ordinary indexes from being used by LIKE. For this reason use locales only if you actually need them. Immutable. This field cannot be changed after the database is created. Optional. |
false |
ArchivedPostgresCluster.status.postgresClusterSpec.maintenanceWindow
MaintenanceWindow refers to the System maintenance window. Enabled Maintenance Window will allow CVEs, bug fixes and new Lifecycle Management features for the VM, OS, any supporting software to be addressed. Automatic upgrades applied during this window should only result in minimum downtime of deployed databases for HA clusters. Database minor version upgrades might also be performed. Refer to engine-specific automatic upgrade details which are documented at the corresponding top-level API docs.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
duration |
string |
Duration describes the duration of the maintenance window. Required. Mutable. |
true |
startDay |
enum |
StartDay describes the day of the week the maintenance window will commence. Can be any of Required. Mutable.
|
true |
startTime |
string |
StartTime describes the time of the day (UTC time) to start the maintenance window. Required. Mutable. |
true |
startDayWeeksOfMonth |
[]enum |
StartDayWeeksOfMonth field specifies the weeks of the month in which the
maintenance window will commence. It accepts up to five distinct
values from {1, 2, 3, 4, L}, where each number represents the
occurrence of the designated StartDay within the month ("1" being
the first one that includes it and "L" being the last one).
For example, providing Optional. Mutable.
|
false |
ArchivedPostgresCluster.status.postgresClusterSpec.placementSelector
PlacementSelector refers to a placement declared in the InfrastructurePolicy.
Usually this field should be left empty to allow the system to determine it automatically.
A placement should be found in the InfrastructurePolicy with the same datacenter,
cluster and resource pool to be considered valid.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
cluster |
string |
Cluster is the datacenter’s cluster name to be used when placing the data service workload. Use the full qualified name of the cluster, relative to the datacenter. A cluster "Cluster1" inside a folder "clusters", should be declared as "clusters/Cluster1". Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the cluster name. Required. Mutable. |
true |
datacenter |
string |
Datacenter is the vSphere Datacenter to be used when placing the data service workload. The full qualified path to the datacenter must be provided if the datacenter is placed inside a folder. Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the datacenter name. Required. Mutable. |
true |
resourcePool |
string |
ResourcePool is the Cluster’s resource pool to be used when placing the data service workload. If the resource pool is not provided, the whole cluster is used as the placement. Optional. Mutable. |
false |
ArchivedPostgresCluster.status.postgresClusterSpec.replicationSlots[index]
| Name | Type | Description | Required |
|---|---|---|---|
slotName |
string |
SlotName specifies the Postgres replication slot name that will be created on the cluster. |
true |
description |
string |
Description specifies a human-readable description of this replication slot. |
false |
user |
string |
User specifies the name of the replication user that is associated with the configured replication slot. The lifecycle of this user is tied to the replication slot. If no value is provided, a replication user is auto generated using the resource name as prefix. User should not be one of the following - pg_read_all_data, pg_write_all_data, pg_read_all_settings, pg_read_all_stats, pg_stat_scan_tables, pg_monitor, pg_database_owner, pg_signal_backend, pg_read_server_files, pg_write_server_files, pg_execute_server_program, pg_checkpoint, pg_use_reserved_connections, pg_create_subscription, postgres, template1, template0. |
false |
ArchivedPostgresCluster.status.postgresClusterSpec.tls
TLS refers to the SSL/TLS configuration of the database cluster.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
ClientTrustBundle is a reference to a ConfigMap containing SSL certificate authority/ies (CA). If ClientTrustBundle is configured, trust for client certificate connections from these CAs can be enabled using pg hba rules. To require the client to supply a certificate for authentication, add the authentication option clientcert=verify-ca or clientcert=verify-full
to the appropriate hostssl line(s) in pg hba which must be done via the Secret referenced by spec.hbaRef,
and optionally add the certificates of additional certificate authorities (CAs) you trust in the ConfigMap
by appending it/them to the value of key Optional. When omitted, only the root certificate authority (CA) of the server certificate will be trusted. When set, all the CAs from the ConfigMap will be trusted in addition to the CA of the server certificate. The root CA of the server certificate is set using the Secret which is referred by the spec.tls field. Mutable. To update the custom client trust bundle, either refer to a new ConfigMap, or update the already referenced one. |
false |
|
secretName |
string |
The name of a Secret resource present in the same namespace as the database cluster, describing a custom certificate. The expected format of the Secret is the same as the output Secrets created by cert-manager’s Certificate resource. It needs to have keys: tls.crt: PEM signed certificate chain tls.key: PEM private key ca.crt: PEM CA certificate The ca.crt is optional if there is at least one issuer certificate in the certificate chain (tls.crt key). That issuer can either be a self-signed leaf certificate, or an intermediate or root certificate authority. Optional. When omitted, DSM will auto-generate a certificate using its own internal certificate authority. When specified, DSM will override its auto-generated certificate and use the one described in the Secret. Mutable. To update a custom certificate, either refer to a new Secret, or update the already referenced one. If the database cluster will be accessed by IP, the TLS configuration needs to be applied after initial creation, because the IP can be retrieved only then, so it can be encoded in the certificate. |
false |
ArchivedPostgresCluster.status.postgresClusterSpec.tls.clientTrustBundle
ClientTrustBundle is a reference to a ConfigMap containing SSL certificate authority/ies (CA). If ClientTrustBundle is configured, trust for client certificate connections from these CAs can be enabled using pg hba rules.
To require the client to supply a certificate for authentication, add the authentication option clientcert=verify-ca or clientcert=verify-full
to the appropriate hostssl line(s) in pg hba which must be done via the Secret referenced by spec.hbaRef,
and optionally add the certificates of additional certificate authorities (CAs) you trust in the ConfigMap
by appending it/them to the value of key ca-bundle.crt
Optional. When omitted, only the root certificate authority (CA) of the server certificate will be trusted. When set, all the CAs from the ConfigMap will be trusted in addition to the CA of the server certificate. The root CA of the server certificate is set using the Secret which is referred by the spec.tls field.
Mutable. To update the custom client trust bundle, either refer to a new ConfigMap, or update the already referenced one.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
ArchivedPostgresCluster.status.postgresClusterSpec.upgradeSafeguards
UpgradeSafeguards configures the safeguards that need to pass before allowing a major/minor version upgrade to proceed. If specified, the .spec.upgradeSafeguards.targetVersion must match canonical .spec.Version. If not specified, either default safeguard values will be used or, if present, the values of the following legacy annotations may be applicable (for details, see engine-specific major/minor version upgrade documentation): dsm.vmware.com/skip-pre-upgrade-backup dsm.vmware.com/upgrade-cluster-without-backups dsm.vmware.com/upgrade-cluster-with-failing-backups dsm.vmware.com/upgrade-cluster-with-alerts
UpgradeSafeguards cannot be used in combination with any of the deprecated annotations from the list above, regardless of the referenced target versions.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
targetVersion |
string |
TargetVersion must equal spec.version. If the cluster is to be upgraded again and its spec.version changes, either the outdated prior safeguard should be removed or it should be updated along with its TargetVersion. Required. |
true |
allowWithActiveAlerts |
boolean |
AllowWithActiveAlerts, if true, will allow further processing even if active alerts on the cluster exist. Optional. Mutable. Default: false
|
false |
allowWithoutBackup |
boolean |
AllowWithoutBackup, if true, will allow further processing for major version upgrade even if the backup that is taken as part of this safeguard could not be started or failed. An attempt to create such a backup will always be made, with further processing dependent on the value of this field. For minor version upgrade this value is not applicable, as no pre-upgrade backup will be made. Accepted values in this case are nil and true, false will be rejected. Optional. Mutable. |
false |
ArchivedPostgresCluster.status.postgresClusterSpec.vSphereTags[index]
VSphereTag identifies a single vSphere tag by its tag category and tag name.
| Name | Type | Description | Required |
|---|---|---|---|
category |
string |
Category is the vSphere tag category Required. Mutable. |
true |
tag |
string |
Tag is the vSphere tag. It should be part of vSphere tag category Category. Required. Mutable. |
true |
ArchivedPostgresCluster.status.upgradeStatus
UpgradeStatus represents version state transitions history for the deleted cluster
Required.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
currentVersion |
string |
The actual current version of the data service cluster. This is going to be the same as spec.version, unless an upgrade has been requested. In the latter case, this field will be updated once the upgrade completes. |
false |
[]object |
Historical data of the upgrades performed. |
false |
ArchivedPostgresCluster.status.upgradeStatus.history[index]
| Name | Type | Description | Required |
|---|---|---|---|
complete |
string |
Timestamp of when the upgrade completed.
|
false |
fromVersion |
string |
The version from which the cluster was upgraded. |
false |
isMajorUpgrade |
boolean |
IsMajorUpgrade specifies whether the upgrade was a major or a minor version upgrade. |
false |
message |
string |
Message contains the reason for a failure or rejection. |
false |
start |
string |
Timestamp of when the upgrade started. This is the time right before the upgrade operations has started and restores are guaranteed to succeed at or before that time. The period after Start and before Complete is considered a blackout period and restores within this interval could lead to unexpected results.
|
false |
status |
enum |
Status indicates the status of the upgrade.
|
false |
toVersion |
string |
The version to which the cluster was upgraded. If the upgrade was aborted or has failed, this field will have the same value as FromVersion. |
false |
ArchivedPostgresCluster.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
ArchivedPostgresCluster.status.restorableTimeRanges[index]
| Name | Type | Description | Required |
|---|---|---|---|
backupId |
string |
BackupId is a unique ID that can be used to locate backup files in storage. |
true |
startTime |
string |
StartTime marks the earliest timestamp from which PITR can be triggered for the associated BackupId. The value is inclusive, meaning a PITR may be requested using this exact timestamp. It is not updated when older backups expire due to the retention policy.
|
true |
endTime |
string |
EndTime marks the latest timestamp up to which PITR can be triggered for the associated BackupId. The value is inclusive, meaning a PITR may be requested using this exact timestamp. It is not updated when older backups expire due to the retention policy.
|
false |
ArchivedSQLServerDatabase
ArchivedSQLServerDatabase is the Schema for the ArchivedSQLServerDatabase API. ArchivedSQLServerDatabase is created automatically when SQLServerDatabase with enabled automated backups is deleted. An ArchivedSQLServerDatabase represents the retained backups that were taken for that deleted SQLServerDatabase. ArchivedSQLServerDatabase can be used to perform point-in-time recovery for that deleted database. ArchivedSQLServerDatabase is automatically deleted once retention expires. To use a ArchivedSQLServerDatabase reference its name when creating a new SQLServerDatabase by passing the .spec.basedOn.database.name field. Example:
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: SQLServerDatabase
metadata:
name: restored-db-1
namespace: default
spec:
basedOn:
database:
name: source-db-1 # the name of the referenced ArchivedSQLServerDatabase
type: ArchivedSQLServerDatabase
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
databases.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
ArchivedSQLServerDatabase |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
ArchivedSQLServerDatabaseSpec defines the desired state of the ArchivedSQLServerDatabase |
false |
|
object |
ArchivedSQLServerDatabaseStatus describes the observed status of the ArchivedSQLServerDatabase |
false |
ArchivedSQLServerDatabase.spec
ArchivedSQLServerDatabaseSpec defines the desired state of the ArchivedSQLServerDatabase
| Name | Type | Description | Required |
|---|---|---|---|
expiresAt |
string |
ExpiresAt represents the point in time when backups associated with ArchivedSQLServerDatabase will be expired. From this point forward, DSM will remove all backups associated with the target database. Required. Mutable.
|
true |
ArchivedSQLServerDatabase.status
ArchivedSQLServerDatabaseStatus describes the observed status of the ArchivedSQLServerDatabase
| Name | Type | Description | Required |
|---|---|---|---|
backupId |
string |
BackupId is a unique ID that can be used to locate backup files in storage. Immutable. |
true |
object |
The last known spec of the database that got archived. Immutable. |
true |
|
[]object |
Conditions contain the list of observed conditions of the archived database. One of the following statuses can occur.
|
false |
|
earliestRestoreTime |
string |
EarliestRestoreTime is the earliest point in time to which the archived database can be restored to.
|
false |
ArchivedSQLServerDatabase.status.databaseSpec
The last known spec of the database that got archived.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
DbOwner specifies the contained database user with role 'db_owner' to create. The user can be either a Windows/Domain principal or a SQL user with password. In both cases, the user is a database level security principal that does not have an associated login in the master database. In addition to the DbOwner, Data Services Manager will automatically create a database user for the administrator login of the server. That database user allows administrators to run various maintenance tasks, e.g. integrity checks, index optimization, updating statistics, etc. |
true |
|
object |
Placement determines the SQL Server cluster instance where this databases should be placed on. Immutable.
|
true |
|
object |
BackupConfig declares the database’s automated backups configuration details. If specified, the system will perform automatic database backups as per the configured schedule, and additionally it will continuously perform backups of the database transaction logs so that it can offer Point-in-Time Restore (PITR) capability. If specified a Warning: Do not use backup locations with the same host name but different ports on the same SQLServerCluster instance. SQL Server does not take into account the port difference when taking backups for different databases concurrently. As a result, backup intended for one backup location might end up on another one that has the same host name. Optional. Mutable. |
false |
|
object |
BackupLocation, if specified, must point to an existing BackupLocation custom resource that uses the system trusted root certificates. It will be used by the 'BackupConfig', which must be specified whenever BackupLocation is specified. If specified, a Optional. Mutable. |
false |
|
object |
BasedOn identifies the source to restore from. The source can be a live or archived SQLServerDatabase resource, or a SQLServerDatabaseBackup resource which refers to a full database backup taken outside of DSM or within DSM. Optional. Immutable. |
false |
|
name |
string |
Name specifies the name of database in the SQL Server engine. Must be unique in the placement SQLServerCluster, but two different SQLServerDatabase resources in the same DSM API namespace can use the same database name if their placement SQLServerClusters are different. The name is used as a delimited identifier, accepting any non-empty string up to 128 characters and cannot be one of the system database names - master, model, msdb, tempdb. Using this field to set the database name offers more flexibility, as the kubernetes resource Name must comply with subdomain standards as defined in RFC 1123: https://datatracker.ietf.org/doc/html/rfc1123 The primary application of the name field is to clone/restore a database with an identical name within a different SQLServerCluster. Immutable.
|
false |
ArchivedSQLServerDatabase.status.databaseSpec.dbOwner
DbOwner specifies the contained database user with role 'db_owner' to create. The user can be either a Windows/Domain principal or a SQL user with password. In both cases, the user is a database level security principal that does not have an associated login in the master database.
In addition to the DbOwner, Data Services Manager will automatically create a database user for the administrator login of the server. That database user allows administrators to run various maintenance tasks, e.g. integrity checks, index optimization, updating statistics, etc.
| Name | Type | Description | Required |
|---|---|---|---|
type |
enum |
Type specifies the type of the user to create. Could be either 'WindowsPrincipal' or 'SQLUser'. Windows principal (WindowsPrincipal) can be used only if the SQL Server that hosts the database is integrated with Active Directory, and represents the principal that will be able to use Windows Authentication to connect to the database instance. Immutable.
|
true |
username |
string |
Username is the name of the database user. In case of Windows principal, it can be either a Windows/Domain user or a group in the format <domainName>\<loginName> For example: DOMAINFOO\johndoe The user name must not start with prefix |
true |
object |
PasswordRef refers to a v1.Secret containing the password for a user of type SQLUser.
The secret must be in the same namespace as the database resource.
FieldPath field indicates which key in the secret contains the password. Default - Must be omitted in case of WindowsPrincipal user type. |
false |
ArchivedSQLServerDatabase.status.databaseSpec.dbOwner.passwordRef
PasswordRef refers to a v1.Secret containing the password for a user of type SQLUser.
The secret must be in the same namespace as the database resource.
FieldPath field indicates which key in the secret contains the password. Default - password.
Providing inline value with Value field is not supported.
Must be omitted in case of WindowsPrincipal user type.
| Name | Type | Description | Required |
|---|---|---|---|
fieldPath |
string |
data.<key> for secrets. Optional. For most references there is a canonical key |
false |
name |
string |
The name of the secret |
false |
value |
string |
Deprecated. This field is never used by the Data Services Manager. |
false |
ArchivedSQLServerDatabase.status.databaseSpec.placement
Placement determines the SQL Server cluster instance where this databases should be placed on.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
SQLServer is a reference to a SQLServerCluster resource that will host the database. Immutable. |
true |
ArchivedSQLServerDatabase.status.databaseSpec.placement.sqlServer
SQLServer is a reference to a SQLServerCluster resource that will host the database.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
The Name of the referent. Required. |
true |
namespace |
string |
The Namespace of the referent. Optional. If not specified, it’s implied that the referent object resides in the same namespace as the referer. |
false |
ArchivedSQLServerDatabase.status.databaseSpec.backupConfig
BackupConfig declares the database’s automated backups configuration details. If specified, the system will perform automatic database backups as per the configured schedule, and additionally it will continuously perform backups of the database transaction logs so that it can offer Point-in-Time Restore (PITR) capability.
If specified a BackupLocation must also be specified.
If specified the database will run in full recovery model.
If not specified, the database will not be protected with any backups and cannot be restored.
Warning: Do not use backup locations with the same host name but different ports on the same SQLServerCluster instance. SQL Server does not take into account the port difference when taking backups for different databases concurrently. As a result, backup intended for one backup location might end up on another one that has the same host name.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
Schedules determine the type and frequency of backups, with the latter defined by a cron expression.
At least one backup schedule with type Required. Mutable. |
true |
|
backupRetentionDays |
integer |
BackupRetentionDays indicates the number of days for which the database’s Point-in-Time Recovery (PITR) is expected to be available. Optional. Mutable.
|
false |
checksumEnabled |
boolean |
ChecksumEnabled specifies whether to use the CHECKSUM option to verify backup file integrity across all backup types (full, differential, and transaction log). By default, checksum verification is disabled. Optional. Mutable. |
false |
logBackupFrequency |
integer |
LogBackupFrequency defines the interval, in minutes, between transaction log backups. If it is not specified, transaction log backups are taken every 5 minutes. Transaction log backup frequency is directly related to the Recovery Point Objective (RPO) and also to the growth of the transaction log file, so it should be carefully configured following Microsoft’s SQL Sever best practices. Optional. Mutable.
|
false |
ArchivedSQLServerDatabase.status.databaseSpec.backupConfig.schedules[index]
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the schedule. Required. Immutable. |
true |
schedule |
string |
true |
|
type |
enum |
Type of schedule. Possible values are: Type For more information check out the official Microsoft SQL Server documentation. Required. Immutable.
|
true |
ArchivedSQLServerDatabase.status.databaseSpec.backupLocation
BackupLocation, if specified, must point to an existing BackupLocation custom resource that uses the system trusted root certificates. It will be used by the 'BackupConfig', which must be specified whenever BackupLocation is specified.
If specified, a backupConfig must also be specified.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
ArchivedSQLServerDatabase.status.databaseSpec.basedOn
BasedOn identifies the source to restore from. The source can be a live or archived SQLServerDatabase resource, or a SQLServerDatabaseBackup resource which refers to a full database backup taken outside of DSM or within DSM.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
Backup provides the SQLServerDatabaseBackup resource to restore from. The database will be restored using the full backup associated with this resource. This field is mutually exclusive with Database field. Optional. Immutable. |
false |
|
object |
Database contains the name of the source database and timestamp to use as the restore point. The source database must be live, i.e. the SQLServerDatabase resource representing it must exist in Data Services Manager and must be accessible to the user performing the restore operation. The source database may be hosted in a different SQL Server cluster instance than the target database. This field is mutually exclusive with Backup field. Optional. Immutable. |
false |
ArchivedSQLServerDatabase.status.databaseSpec.basedOn.backup
Backup provides the SQLServerDatabaseBackup resource to restore from. The database will be restored using the full backup associated with this resource.
This field is mutually exclusive with Database field.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
ArchivedSQLServerDatabase.status.databaseSpec.basedOn.database
Database contains the name of the source database and timestamp to use as the restore point. The source database must be live, i.e. the SQLServerDatabase resource representing it must exist in Data Services Manager and must be accessible to the user performing the restore operation. The source database may be hosted in a different SQL Server cluster instance than the target database.
This field is mutually exclusive with Backup field.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name is the metadata.name of the source SQLServerDatabase/ArchivedSQLServerDatabase resource from which to restore. Required. Immutable. |
true |
timestamp |
string |
Timestamp is the point in time to restore from. The restore will happen to the last available recovery time before the given time. If timestamp is not provided restore will be initiated to the latest available recovery time. Optional. Immutable.
|
false |
type |
enum |
Type specifies the type of the source database resource to be use as a base for the restored database. Could be 'SQLServerDatabase' or 'ArchivedSQLServerDatabase'. Optional.
|
false |
ArchivedSQLServerDatabase.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
BackupLocation
BackupLocation contains access data for a remote storage location, supporting multiple cloud back-ends and holding all data required to access and perform 2-way authentication with the storage provider. All BackupLocation instances that can be used as a target for database cluster backups have the label 'dsm.vmware.com/database-backup-location=true'. In contrast, BackupLocation instances that are reserved for DSM control plane (i.e. Provider) use do not have this label set.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
databases.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
BackupLocation |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
true |
BackupLocation.spec
| Name | Type | Description | Required |
|---|---|---|---|
object |
S3 contains S3-specific location details. At this time, S3 is the only supported storage protocol and this field has to be populated Mutable. |
true |
|
object |
Credentials is a reference to a Secret containing credentials to use when connecting to the Endpoint. At this time, S3 is the only supported storage protocol and the credentials required for it have to be populated. Mutable. |
true |
|
endpoint |
string |
Endpoint is the network endpoint to connect to for accessing the BackupLocation. Mutable. |
true |
object |
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when validating
the Endpoint TLS connection.
If the provided Endpoint is configured with:
* certificate signed by DSM trusted CA, TrustBundle must point to the predefined ConfigMap called Mutable. |
true |
BackupLocation.spec.S3
S3 contains S3-specific location details. At this time, S3 is the only supported storage protocol and this field has to be populated
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
bucket |
string |
Bucket is the S3 bucket. It must exist in the configured S3 service. Mutable. |
true |
checksumCalculationUnsupported |
boolean |
ChecksumCalculationUnsupported indicates that the S3 provider does not support checksum calculation. Starting with version DSM 9.0.1, some data services use a newer version of the S3 SDK that automatically enables data integrity checks for S3 uploads. This feature uses a specific S3 protocol mechanism called "streaming unsigned payload trailer" (header x-amz-content-sha256 = STREAMING-UNSIGNED-PAYLOAD-TRAILER) to calculate checksums client side and sent them during uploads. Some S3-compatible storage services do not yet support this protocol mechanism. Setting this field to true indicates that the S3 provider does not support checksum calculation and it should not be used when making S3 requests. Mutable. Default - false.
|
false |
forcePathStyle |
boolean |
ForcePathStyle forces the use of path-style addressing for S3 operations. The path-style addressing is deprecated for the official AWS S3, but is required for many in-house S3-like implementations to work. A value of true forces the use of path-style S3 URLs. A value of false uses virtual hosted-style S3 URLs. Path-style URLs look like the following: https://bucket-endpoint.example.com/bucket Virtual hosted-style URLs look like the following: https://bucket.bucket-endpoint.example.com Mutable. Default - false.
|
false |
region |
string |
Region is the S3 region. Mutable. |
false |
BackupLocation.spec.credentials
Credentials is a reference to a Secret containing credentials to use when connecting to the Endpoint. At this time, S3 is the only supported storage protocol and the credentials required for it have to be populated.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
BackupLocation.spec.trustBundle
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when validating
the Endpoint TLS connection.
If the provided Endpoint is configured with:
* certificate signed by DSM trusted CA, TrustBundle must point to the predefined ConfigMap called trusted-root-ca in the dsm-system namespace. By default, DSM trusts all well-known OS-trusted CAs. If the certificate is signed by a custom CA then as a prerequisite the custom CA certificate must be added to trusted-root-ca by appending it to the value of key ca-bundle.crt.
* certificate signed by authority that should not be globally trusted by DSM, TrustBundle reference must point to Configmap with key tls.crt that contains only Issuer certificate(s). If an end-entity (i.e. server) certificate is provided it must be issued by itself, i.e. self-signed.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
DatabaseConfig
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
databases.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
DatabaseConfig |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
DatabaseConfigSpec defines the desired state of the DatabaseConfig. |
false |
|
object |
DatabaseConfigStatus describes the observed status of the DatabaseConfig. |
false |
DatabaseConfig.spec
DatabaseConfigSpec defines the desired state of the DatabaseConfig.
| Name | Type | Description | Required |
|---|---|---|---|
params |
map[string]string |
Params is a map key value pairs which correspond to valid configurable parameters for a database. For MySQL these go into one of the For PostgreSQL:
* these values go into the Mutable. |
false |
DatabaseConfig.status
DatabaseConfigStatus describes the observed status of the DatabaseConfig.
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
Conditions contain the list of observed conditions of the DatabaseConfig.
|
false |
DatabaseConfig.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
MySQLClusterBackup
MySQLClusterBackup is the schema for the MySQLClusterBackup API.
A MySQLClusterBackup can be used in two ways:
-
To create a new backup: Set spec.sourceCluster to reference an existing MySQLCluster. The backup will be created from that cluster and stored in the specified backup location. The backup created has its own lifecycle and is independent of any backup configuration defined in the source cluster’s spec.backupConfig.
-
To reference an existing backup: Set spec.sourceBackup.path to reference an existing backup stored at a specific path in the backup location. This allows restoring from backups that were created in different namespaces or DSM instances.
Exactly one of spec.sourceBackup or spec.sourceCluster must be specified. They are mutually exclusive.
To create a new backup, provide a name and namespace for the object, and set: * spec.backupLocation.name to reference an existing backup location * spec.sourceCluster.name to reference the source cluster to back up
Example (creating a new backup):
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: MySQLClusterBackup
metadata:
name: new-mysql-backup
namespace: default
spec:
backupLocation:
name: "backup-storage"
sourceCluster:
name: "mysql-db"
Example (referencing an existing backup):
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: MySQLClusterBackup
metadata:
name: external-backup-reference
namespace: default
spec:
backupLocation:
name: "backup-storage"
sourceBackup:
path: "backup/mysql/new-namespace/src1/"
Once completed or when referencing an existing backup, the MySQLClusterBackup can serve as a restoration point into a new cluster.
Selectable fields are defined to make operational querying easier:
* .spec.sourceCluster.name allows listing backups from a particular source cluster.
Example: kubectl get mysqlbackup --field-selector spec.sourceCluster.name=mysql-db
* .spec.backupLocation.name allows listing backups stored in a specific location.
Example: kubectl get mysqlbackup --field-selector spec.backupLocation.name=backup-storage
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
databases.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
MySQLClusterBackup |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
spec defines the desired state of the MySQLClusterBackup Required.
|
true |
|
object |
status defines the observed state of the MySQLClusterBackup Optional. |
false |
MySQLClusterBackup.spec
spec defines the desired state of the MySQLClusterBackup
Required.
| Name | Type | Description | Required |
|---|---|---|---|
object |
backupLocation must point to an existing BackupLocation resource. Immutable. Required.
|
true |
|
backupFilesDeletionPolicy |
enum |
backupFilesDeletionPolicy defines the behavior of the backup files cleanup process when a MySQLClusterBackup is deleted. Use this to facilitate deletion when the storage is inaccessible or the clean up is otherwise obstructed (which results in the backup’s Ready status condition being stuck in Reason=Deleting), or when you want to keep the backup files for other purposes. Delete: the backup files in the storage are deleted when the MySQLClusterBackup is deleted. Not allowed when sourceBackup is specified. Retain: the backup files in the storage are not deleted when the MySQLClusterBackup is deleted. Mutable. Default: * "Delete" when sourceCluster is specified (creating a new backup) * "Retain" when sourceBackup is specified (referencing an existing backup)
|
false |
object |
sourceBackup specifies the configuration for referencing an existing backup, or a continuous set of existing automated backups from one cluster, created by another DSM instance. This field should be set if the backup/backup set already exists in the referenced backup location and only needs a representation in this DSM instance. The backup/set of backups can be an automated or on-demand backup. This field is mutually exclusive with sourceCluster. Exactly one of sourceBackup or sourceCluster must be specified. When sourceBackup is set, the MySQLClusterBackup references an existing backup at the specified path rather than creating a new backup from a source cluster. Immutable. Optional.
|
false |
|
object |
sourceCluster must point to an existing cluster resource in the same namespace as the MySQLClusterBackup. The full database backup will be performed on this cluster. This field is mutually exclusive with sourceBackup. Exactly one of sourceBackup or sourceCluster must be specified. When sourceCluster is set, a new backup will be created from the specified cluster. The created backup will be stored in the specified remote storage location under the ondemandbackups prefix (e.g., <bucket-path>/ondemandbackups). Immutable. Optional.
|
false |
MySQLClusterBackup.spec.backupLocation
backupLocation must point to an existing BackupLocation resource.
Immutable.
Required.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MySQLClusterBackup.spec.sourceBackup
sourceBackup specifies the configuration for referencing an existing backup, or a continuous set of existing automated backups from one cluster, created by another DSM instance. This field should be set if the backup/backup set already exists in the referenced backup location and only needs a representation in this DSM instance. The backup/set of backups can be an automated or on-demand backup.
This field is mutually exclusive with sourceCluster. Exactly one of sourceBackup or sourceCluster must be specified. When sourceBackup is set, the MySQLClusterBackup references an existing backup at the specified path rather than creating a new backup from a source cluster.
Immutable.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
path |
string |
path is a path in the MySQLClusterBackup.spec.backupLocation under which the backup is stored. This can be either an on-demand backup, in which case the path should match the original MySQLClusterBackup’s status.backupStorageLocation field, or an automated backup, in which case the path should point to a directory where DSM has written the automated backup(s) and binlogs for a single cluster - typically, /backup/mysql/<namespace>/<clusterName>/ Required. |
true |
backupId |
string |
backupId is an optional identifier used to locate a specific backup within {path}. When specified, it must be the UID of the cluster as indicated in the original MySQLClusterBackup’s status.backupId field and will be used to locate matching backups under {path}. When not specified: * If exactly one backup is found under the path, it will be used automatically. * If backups for different cluster UIDs are found under {path}, reconciliation will fail with an error indicating that backupId must be specified to select which backup to use. Optional. |
false |
MySQLClusterBackup.spec.sourceCluster
sourceCluster must point to an existing cluster resource in the same namespace as the MySQLClusterBackup. The full database backup will be performed on this cluster.
This field is mutually exclusive with sourceBackup. Exactly one of sourceBackup or sourceCluster must be specified. When sourceCluster is set, a new backup will be created from the specified cluster.
The created backup will be stored in the specified remote storage location under the ondemandbackups prefix (e.g., <bucket-path>/ondemandbackups).
Immutable.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MySQLClusterBackup.status
status defines the observed state of the MySQLClusterBackup
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
backupId |
string |
backupId is a Backup identifier for DSM internal identification purposes. Optional |
false |
backupStorageLocation |
string |
backupStorageLocation is the full path to the backup files in the backup location. For example, /ondemandbackup/<engine>/<namespace>/<cluster-name>/<backup-name>/<backup-uid> Optional |
false |
[]object |
conditions is an observed conditions list of a MySQLClusterBackup. Each condition provides detailed status information for a specific aspect of the resource lifecycle.
Optional |
false |
|
endTime |
string |
endTime indicates the time that this MySQLClusterBackup completed or failed. Transactions committed after this time will not be included in the backup. Transactions committed while the backup was in progress are expected to be included in the backup, although this is not strictly guaranteed. When using sourceBackup, this represents the latest completion time across all backups in the backup path. The StartTime/EndTime interval represents a time range across potentially multiple backups. Optional
|
false |
object |
mysqlClusterMetadata contains the labels of the source cluster at the time when the backup was created Optional |
false |
|
mysqlClusterSourceName |
string |
mysqlClusterSourceName is the name of the source cluster that was backed up. If SourceCluster is set, it will be the same as SourceCluster.Name otherwise it will be extracted from the backup metadata if available or left as empty string. Optional |
false |
object |
mysqlClusterSpec is the spec of the backed-up cluster at the time of the backup. Optional |
false |
|
startTime |
string |
startTime indicates the time that this MySQLClusterBackup was started. When using sourceBackup, this represents the earliest start time across all backups in the backup path. Optional
|
false |
MySQLClusterBackup.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
MySQLClusterBackup.status.mysqlClusterMetadata
mysqlClusterMetadata contains the labels of the source cluster at the time when the backup was created
Optional
| Name | Type | Description | Required |
|---|---|---|---|
labels |
map[string]string |
Optional |
false |
MySQLClusterBackup.status.mysqlClusterSpec
mysqlClusterSpec is the spec of the backed-up cluster at the time of the backup.
Optional
| Name | Type | Description | Required |
|---|---|---|---|
object |
InfrastructurePolicy refers to the infrastructure policy resource used to create this cluster. Required - Must refer to a valid Immutable. |
true |
|
storagePolicyName |
string |
StoragePolicyName declares the name of the storage policy that should be used to create this postgres cluster. It must be part of the InfrastructurePolicy used by this cluster. Required - Must refer to a valid Immutable. |
true |
storageSpace |
string |
StorageSpace declares the disk size allocated to each node hosting the workload. You can express storage as a plain integer or as a fixed-point number using one of these suffixes - E, P, T, G, M, k. You can also use the power-of-two equivalents - Ei, Pi, Ti, Gi, Mi, Ki Range - 20Gi - 32Ti. Required. Mutable - (increase only). |
true |
version |
string |
Version declares the version of the database engine to be used. To upgrade the database engine change this field. The list of supported engine versions can be found by inspecting the DataServiceVersion resources and in the VMware Data Services Manager UI. Version Validations for Cluster Restore Scenarios: When creating a new cluster based on an existing cluster or backup (via spec.basedOn), the following version validation rules apply at cluster creation time: General Rules (All Database Engines):
PostgreSQL-Specific Rules:
MySQL-Specific Rules:
Required. Mutable. |
true |
object |
VMClass refers to the VM class that should be used to create this cluster. It must be part of the InfrastructurePolicy used by this cluster. Required - Must refer to a valid Mutable - (Only increases in resources are allowed). |
true |
|
object |
AdminPasswordRef refers to a v1.Secret containing the password which the privileged user will use to connect
to the database. The secret must be in the same namespace as the database cluster.
FieldPath field indicates which key in the secret contains the password. Default - If the cluster is a replica with SyncUsersFromSource=true, this field has no effect until the replica is promoted. Default - password is auto generated. Mutable. It is possible to refer to a new Secret to update the admin password, but it is not required. Updates in the already referenced Secret will also lead to update of the password. |
false |
|
adminUsername |
string |
AdminUserName is the desired name of the privileged user to be used when connecting to the database. AdminUserName should not be one of the following - root, mysql.sys, mysql.session, mysql.infoschema, mysql-backup, mysql-healthcheck, mysql-metrics, telegraf-metrics, mysql-tls-admin, mysql-router, innodb-cluster-admin, mysqlappuser, mysql-pitr. Its length should not be more than 32 characters. If the cluster is a replica with SyncUsersFromSource=true, this field has no effect until the replica is promoted. Default - mysql-admin. Immutable. |
false |
object |
BackupConfig declares the cluster’s backup configuration details. If specified a Optional. Mutable. |
false |
|
object |
BackupLocation, if specified, must point to an existing BackupLocation custom resource in the same namespace as the cluster or in the DSM system namespace. It will be used by the 'BackupConfig', which must be specified whenever BackupLocation is specified. If specified, a Optional. Mutable. |
false |
|
object |
BasedOn identifies the source cluster on which this cluster will be based on. Users cannot base their clusters on clusters owned by other users unless the user has DSM_Admin role. The new cluster will inherit the ownership from its source cluster. It can be changed if necessary after the cluster is created. Field Cluster works both if the cluster is alive and if it is deleted, but we are still retaining its backups. To create a new MySQL cluster based on a live cluster pass the name of the cluster. To create a new MySQL cluster based on an archived cluster with retained backups pass the name of the ArchivedMySQLCluster The only allowed mutation of the BasedOn field is to set it to nil if it was previously set to contain ReplicationSource. See MySQLBasedOnParams.ReplicationSource for details. Optional. Mutable. |
false |
|
object |
DatabaseConfig refers to the database config object that will be applied to this cluster. Database Config is used to apply custom params/configs to the database represented by this CR.
The provided parameters go into the DatabaseConfig Validation Rules:
Optional. Mutable. |
false |
|
databaseName |
string |
If DatabaseName is set, database with that name will be created (if it doesn’t exist) and MySQLCluster.Status.Connection.DbName and ArchivedMySQLCluster.Status.DatabaseName will be set to that name. If the cluster is restored from another cluster (Spec.BasedOn.Cluster field is used) all databases from the source cluster are restored with preserved names and one additional database is created with name the given DatabaseName. This database is empty and MySQLCluster.Status.Connection.DbName and ArchivedMySQLCluster.Status.DatabaseName refer to it. If DatabaseName is equal to the name of database from the source cluster no additional database is created and MySQLCluster.Status.Connection.DbName and ArchivedMySQLCluster.Status.DatabaseName refer to the specified database with name the given DatabaseName. If DatabaseName is empty no additional database is created and MySQLCluster.Status.Connection.DbName and ArchivedMySQLCluster.Status.DatabaseName refer the same database the status connection info of the source cluster refers to. DatabaseName should not be one of the following - root, mysql.sys, mysql.session, mysql.infoschema, mysql-backup, mysql-healthcheck, mysql-metrics, telegraf-metrics, mysql-tls-admin, mysql-router, innodb-cluster-admin, mysqlappuser, mysql-pitr. Its length should not be more than 64 characters. Default - if the cluster is restored one, the database name in the source cluster’s MySQLCluster.Status.Connection.DbName is used, otherwise DatabaseName is the same as the cluster’s name. Immutable. |
false |
description |
string |
Description contains the human-readable description of the cluster. Optional. Mutable. |
false |
object |
DirectoryService refers to the DirectoryService resource with LDAP settings used by this cluster for authenticating clients. Optional. Mutable. |
false |
|
dnsNames |
[]string |
One or more DNS names / FQDNs for database access. These DNS names will be included in the SAN field of the TLS certificate if auto-generated by DSM. The first DNS name will also be included in the URL connection string displayed in DSM UI. If a custom TLS certificate is provided, it is important its SAN field to match the DNS names provided here, so clients can ensure a secure connection. Optional. Mutable. When updated, DSM will re-generate the TLS certificate if no custom certificate is provided. |
false |
extraClients |
[]string |
ExtraClients is a list of additional IPv4 addresses/ranges that should be allowed to access the database service. Use cases include: * having applications outside of the tenant organization namespace that need to access the database cluster. * configuring replication for the database cluster from a different region. * troubleshooting issues with the database cluster. Optional. Mutable. |
false |
object |
MaintenanceWindow refers to the System maintenance window. Enabled Maintenance Window will allow CVEs, bug fixes and new Lifecycle Management features for the VM, OS, any supporting software to be addressed. Automatic upgrades applied during this window should only result in minimum downtime of deployed databases for HA clusters. Database minor version upgrades might also be performed. Refer to engine-specific automatic upgrade details which are documented at the corresponding top-level API docs. Optional. Mutable. |
false |
|
members |
integer |
The number of members for cluster. Could be Default - Mutable.
|
false |
object |
PlacementSelector refers to a placement declared in the InfrastructurePolicy. Usually this field should be left empty to allow the system to determine it automatically.
A placement should be found in the Optional. Immutable. |
false |
|
supportAsynchReplicas |
boolean |
SupportAsynchReplicas controls whether the cluster is provisioned with features required for it to be used by replicas as a source. Optional. Mutable.
|
false |
object |
TLS refers to the SSL/TLS configuration of the database cluster. Optional. Mutable. |
false |
|
object |
UpgradeSafeguards configures the safeguards that need to pass before allowing a major/minor version upgrade to proceed. If specified, the .spec.upgradeSafeguards.targetVersion must match canonical .spec.Version. If not specified, either default safeguard values will be used or, if present, the values of the following legacy annotations may be applicable (for details, see engine-specific major/minor version upgrade documentation): dsm.vmware.com/skip-pre-upgrade-backup dsm.vmware.com/upgrade-cluster-without-backups dsm.vmware.com/upgrade-cluster-with-failing-backups dsm.vmware.com/upgrade-cluster-with-alerts UpgradeSafeguards cannot be used in combination with any of the deprecated annotations from the list above, regardless of the referenced target versions. Optional. Mutable. |
false |
|
[]object |
VSphereTags is the list of vSphere tags that the cluster’s deployed virtual machines should have assigned. The tags should exist in vSphere in order to be successfully assigned. Optional. Mutable. |
false |
MySQLClusterBackup.status.mysqlClusterSpec.infrastructurePolicy
InfrastructurePolicy refers to the infrastructure policy resource used to create this cluster.
Required - Must refer to a valid InfrastructurePolicy.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
kind |
string |
Kind of the referent. |
false |
name |
string |
The Name of the referent. |
false |
namespace |
string |
The Namespace of the referent. |
false |
MySQLClusterBackup.status.mysqlClusterSpec.vmClass
VMClass refers to the VM class that should be used to create this cluster. It must be part of the InfrastructurePolicy used by this cluster.
Required - Must refer to a valid VMClass.
Mutable - (Only increases in resources are allowed).
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MySQLClusterBackup.status.mysqlClusterSpec.adminPasswordRef
AdminPasswordRef refers to a v1.Secret containing the password which the privileged user will use to connect
to the database. The secret must be in the same namespace as the database cluster.
FieldPath field indicates which key in the secret contains the password. Default - password.
Providing inline value with Value field is not supported.
The owner of the Secret must be the same as the owner of the DB cluster. When the owner of the DB
cluster is changed the owner of the Secret is automatically changed to the new owner.
If the cluster is a replica with SyncUsersFromSource=true, this field has no effect until the replica is promoted.
Default - password is auto generated.
Mutable. It is possible to refer to a new Secret to update the admin password, but it is not required. Updates in the already referenced Secret will also lead to update of the password.
| Name | Type | Description | Required |
|---|---|---|---|
fieldPath |
string |
data.<key> for secrets. Optional. For most references there is a canonical key |
false |
name |
string |
The name of the secret |
false |
value |
string |
Deprecated. This field is never used by the Data Services Manager. |
false |
MySQLClusterBackup.status.mysqlClusterSpec.backupConfig
BackupConfig declares the cluster’s backup configuration details.
If specified a BackupLocation must also be specified.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
backupRetentionDays |
integer |
BackupRetentionDays indicates the number of days for which the database’s
Point-in-Time Recovery (PITR) is expected to be available.
Must be Required. Mutable.
|
true |
[]object |
Schedules determine the type and frequency of backups, with the latter defined by a cron expression. Required. Mutable. |
true |
|
uploadChunkSize |
int or string |
UploadChunkSize setting that allows for the user to override the default chunk size used in multipart uploads and specify the part size themselves, taking into account the specifics of their environment and the target backup storage. There are tradeoffs associated with tuning the value of the UploadChunkSize. On one hand side each part is a separate S3 PUT operation so chunking the backup in too small parts comes at a certain cost. On the other hand side, parts are buffered in memory and the larger the part, the greater the chance of an upload failure depending on the reliability of the network. Thus, a high chunk size value comes with a higher memory footprint and a higher risk for upload failure. The memory utilization of the backup routine may increase with up to 5 times the configured upload chunk size due to the parallel upload capability of the object uploader. Note that the backup doesn’t include all files in the MySQL data directory and the backup stream is compressed, which means that size of the backup object would vary significantly based on the type of data in the database. In general one can expect that the backup object size is around 1% to 10% of the disk utilization of the MySQL database instance (i.e. the MySQL data directory). The format of the specified value should be a Kubernetes resource quantity - https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/quantity/ Range - 5Mi - 5Gi Default - 10Mi Supported in Data Service Manager data plane version 2.2.2 and above. Optional. Mutable. |
false |
MySQLClusterBackup.status.mysqlClusterSpec.backupConfig.schedules[index]
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the schedule. Required. Immutable. |
true |
schedule |
string |
The schedule in the form of a cron schedule. Required. Mutable. |
true |
type |
string |
Type of schedule. Can be Required. Immutable. |
true |
MySQLClusterBackup.status.mysqlClusterSpec.backupLocation
BackupLocation, if specified, must point to an existing BackupLocation custom resource in the same namespace as the cluster or in the DSM system namespace. It will be used by the 'BackupConfig', which must be specified whenever BackupLocation is specified.
If specified, a backupConfig must also be specified.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MySQLClusterBackup.status.mysqlClusterSpec.basedOn
BasedOn identifies the source cluster on which this cluster will be based on.
Users cannot base their clusters on clusters owned by other users unless the user has DSM_Admin role. The new cluster will inherit the ownership from its source cluster. It can be changed if necessary after the cluster is created.
Field Cluster works both if the cluster is alive and if it is deleted, but we are still retaining its backups. To create a new MySQL cluster based on a live cluster pass the name of the cluster. To create a new MySQL cluster based on an archived cluster with retained backups pass the name of the ArchivedMySQLCluster
The only allowed mutation of the BasedOn field is to set it to nil if it was previously set to contain ReplicationSource. See MySQLBasedOnParams.ReplicationSource for details.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
backup specifies a MySQLClusterBackup to use as the restore source. Cannot be set if Cluster, ReplicationSource, or Snapshot is set, too. One of the four has to be set. Immutable. Once set, this field cannot be modified. Optional.
|
false |
|
object |
Cluster contains the name of the source cluster and timestamp to use as the restore point. Cannot be set if ReplicationSource, Snapshot, or Backup is set, too. One of the four has to be set. Optional. Immutable. |
false |
|
object |
ReplicationSource specifies that the cluster will be based on a source cluster from which this cluster will replicate asynchronously. Cannot be set if Cluster, Snapshot, or Backup is set, too. One of the four has to be set. When a cluster with previously configured basedOn.ReplicationSource field is updated to remove basedOn, the cluster will be decoupled from its source cluster and promoted to an independent read/write cluster. Promotion is irrevocable and doesn’t wait for in-flight data from the source to be flushed to the replica. The completion of promotion will be indicated by the removal of the IncomingReplicationStatus status field. If SyncUsersFromSource was previously true, the admin user credentials on the promoted cluster will be re-generated or, if AdminUser/AdminPasswordRef was populated, set to its value. In both cases, cluster connection status will be changed to refer to these admin user credentials as in any non-replica cluster. Optional. Immutable. |
false |
|
object |
Snapshot specifies that the cluster will be a linked clone of the snapshot to which this reference is pointing. Cannot be set if Cluster, ReplicationSource, or Backup is set, too. One of the four has to be set. A snapshot-based cluster will permanently depend on the existence of the snapshot on which it is based and thus, on the cluster from which the snapshot was taken and the storage used by it. A cluster must be using a SupervisorInfrastructurePolicy and a single availability zone to be a snapshot clone. Optional. Immutable.
|
false |
MySQLClusterBackup.status.mysqlClusterSpec.basedOn.backup
backup specifies a MySQLClusterBackup to use as the restore source. Cannot be set if Cluster, ReplicationSource, or Snapshot is set, too. One of the four has to be set.
Immutable. Once set, this field cannot be modified.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
name specifies the MySQLClusterBackup name Optional. |
false |
time |
string |
time is the point in time to restore to when the referenced MySQLClusterBackup has sourceBackup populated and its location pointing to an automated continuous backup set with binlogs that allow PITR. The restore will happen to the last available recovery time before the given time. If time is not provided, restore will be initiated to the latest available recovery time. Optional. Immutable.
|
false |
MySQLClusterBackup.status.mysqlClusterSpec.basedOn.cluster
Cluster contains the name of the source cluster and timestamp to use as the restore point. Cannot be set if ReplicationSource, Snapshot, or Backup is set, too. One of the four has to be set.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name is the name of the source cluster from which to restore. Required. Immutable. |
true |
timestamp |
string |
Timestamp is the point in time to restore from. The restore will happen to the last available recovery time before the given time. If timestamp is not provided restore will be initiated to the latest available recovery time. Optional. Immutable.
|
false |
MySQLClusterBackup.status.mysqlClusterSpec.basedOn.replicationSource
ReplicationSource specifies that the cluster will be based on a source cluster from which this cluster will replicate asynchronously. Cannot be set if Cluster, Snapshot, or Backup is set, too. One of the four has to be set.
When a cluster with previously configured basedOn.ReplicationSource field is updated to remove basedOn, the cluster will be decoupled from its source cluster and promoted to an independent read/write cluster. Promotion is irrevocable and doesn’t wait for in-flight data from the source to be flushed to the replica. The completion of promotion will be indicated by the removal of the IncomingReplicationStatus status field. If SyncUsersFromSource was previously true, the admin user credentials on the promoted cluster will be re-generated or, if AdminUser/AdminPasswordRef was populated, set to its value. In both cases, cluster connection status will be changed to refer to these admin user credentials as in any non-replica cluster.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
ClusterConnectionParams specifies connection parameters for connecting to the source cluster. This is currently the only option for specifying a source cluster. Required |
true |
|
syncUsersFromSource |
boolean |
SyncUsersFromSource specifies whether database users and their credentials are managed locally on the replica (false) or replicated from the source cluster (true). When set to true, all DB users on the replica and their credentials will be replicated from the source. Cluster connection status will refer to a replication user and its credentials. No local user management (CREATE, DROP, ALTER) should be performed on the replica database directly. If AdminUserName or AdminPasswordRef are set on the replica, they will be ignored until it is promoted or SyncUsersFromSource is switched to false. When set to false, the replica cluster users are managed the same way as in a non-replica cluster. The only permitted change of this field is from true to false, in which case existing replicated users are retained as the initial state of locally managed users, and then AdminUserName/AdminPasswordRef are applied. Required Mutable
|
true |
MySQLClusterBackup.status.mysqlClusterSpec.basedOn.replicationSource.clusterConnectionParams
ClusterConnectionParams specifies connection parameters for connecting to the source cluster. This is currently the only option for specifying a source cluster.
Required
| Name | Type | Description | Required |
|---|---|---|---|
object |
Credentials specifies a Kubernetes secret that contains the credentials needed to connect to the source cluster. Required fields of the secret are username and password. The referenced MySQL user must have connection, replication and clone privilege on the source cluster. This field is mutable. Changes to the secret will be automatically applied on the instance. Required. Mutable. |
true |
|
endpoints |
[]string |
Endpoints is a list of servers that are members of a single cluster, in host:port format. Connections to the servers will be tried in the order specified, and a server will be used only if connection attempts to those preceding it in the list have failed. The list can contain a sub-set of the source cluster members, in which case replication will depend on the health of this sub-set. Required. Mutable. |
true |
object |
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when validating the Servers connection.
Optional. By default, it will use the DSM globally trusted certificates ConfigMap. Mutable. |
false |
MySQLClusterBackup.status.mysqlClusterSpec.basedOn.replicationSource.clusterConnectionParams.credentials
Credentials specifies a Kubernetes secret that contains the credentials needed to connect to the source cluster. Required fields of the secret are username and password. The referenced MySQL user must have connection, replication and clone privilege on the source cluster. This field is mutable. Changes to the secret will be automatically applied on the instance.
Required.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MySQLClusterBackup.status.mysqlClusterSpec.basedOn.replicationSource.clusterConnectionParams.trustBundle
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when validating the Servers connection.
-
Well-known OS-trusted CA, or a DSM globally trusted certificate - TrustBundle can be omitted, or it should point to DSM globally trusted certificates ConfigMap.
-
Certificate signed by CA that should not be globally trusted by DSM - TrustBundle reference must point to ConfigMap with key
tls.crtthat contains only Issuer certificate(s). If an end-entity (i.e. server) certificate is provided it must be issued by itself, i.e. self-signed.
Optional. By default, it will use the DSM globally trusted certificates ConfigMap.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
MySQLClusterBackup.status.mysqlClusterSpec.basedOn.snapshot
Snapshot specifies that the cluster will be a linked clone of the snapshot to which this reference is pointing. Cannot be set if Cluster, ReplicationSource, or Backup is set, too. One of the four has to be set. A snapshot-based cluster will permanently depend on the existence of the snapshot on which it is based and thus, on the cluster from which the snapshot was taken and the storage used by it. A cluster must be using a SupervisorInfrastructurePolicy and a single availability zone to be a snapshot clone.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name refers to a MySQLSnapshot in the same namespace from which to clone this cluster. The snapshot must have Ready condition with status True, be from the same MySQL major and minor version as this cluster, have the same StorageSpace, and use the same vSphere storage and spec.infrastructurePolicy. Supported in Data Services Manager data plane version 9.1.0.0 and above. Immutable. Required.
|
true |
MySQLClusterBackup.status.mysqlClusterSpec.databaseConfig
DatabaseConfig refers to the database config object that will be applied to this cluster.
Database Config is used to apply custom params/configs to the database represented by this CR.
The provided parameters go into the mysql.cnf file.
DatabaseConfig Validation Rules:
-
Exclusivity: A DatabaseConfig can only be applied to a single cluster at a time. If a DatabaseConfig is already in use by another cluster, it cannot be assigned to a new cluster or changed to reference a different cluster.
-
Namespace: The DatabaseConfig must exist in the same namespace as the cluster.
-
Deletion Protection: A DatabaseConfig cannot be deleted while it is in use by a cluster.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MySQLClusterBackup.status.mysqlClusterSpec.directoryService
DirectoryService refers to the DirectoryService resource with LDAP settings used by this cluster for authenticating clients.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
MySQLClusterBackup.status.mysqlClusterSpec.maintenanceWindow
MaintenanceWindow refers to the System maintenance window. Enabled Maintenance Window will allow CVEs, bug fixes and new Lifecycle Management features for the VM, OS, any supporting software to be addressed. Automatic upgrades applied during this window should only result in minimum downtime of deployed databases for HA clusters. Database minor version upgrades might also be performed. Refer to engine-specific automatic upgrade details which are documented at the corresponding top-level API docs.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
duration |
string |
Duration describes the duration of the maintenance window. Required. Mutable. |
true |
startDay |
enum |
StartDay describes the day of the week the maintenance window will commence. Can be any of Required. Mutable.
|
true |
startTime |
string |
StartTime describes the time of the day (UTC time) to start the maintenance window. Required. Mutable. |
true |
startDayWeeksOfMonth |
[]enum |
StartDayWeeksOfMonth field specifies the weeks of the month in which the
maintenance window will commence. It accepts up to five distinct
values from {1, 2, 3, 4, L}, where each number represents the
occurrence of the designated StartDay within the month ("1" being
the first one that includes it and "L" being the last one).
For example, providing Optional. Mutable.
|
false |
MySQLClusterBackup.status.mysqlClusterSpec.placementSelector
PlacementSelector refers to a placement declared in the InfrastructurePolicy.
Usually this field should be left empty to allow the system to determine it automatically.
A placement should be found in the InfrastructurePolicy with the same datacenter,
cluster and resource pool to be considered valid.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
cluster |
string |
Cluster is the datacenter’s cluster name to be used when placing the data service workload. Use the full qualified name of the cluster, relative to the datacenter. A cluster "Cluster1" inside a folder "clusters", should be declared as "clusters/Cluster1". Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the cluster name. Required. Mutable. |
true |
datacenter |
string |
Datacenter is the vSphere Datacenter to be used when placing the data service workload. The full qualified path to the datacenter must be provided if the datacenter is placed inside a folder. Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the datacenter name. Required. Mutable. |
true |
resourcePool |
string |
ResourcePool is the Cluster’s resource pool to be used when placing the data service workload. If the resource pool is not provided, the whole cluster is used as the placement. Optional. Mutable. |
false |
MySQLClusterBackup.status.mysqlClusterSpec.tls
TLS refers to the SSL/TLS configuration of the database cluster.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
secretName |
string |
The name of a Secret resource present in the same namespace as the database cluster, describing a custom certificate. The expected format of the Secret is the same as the output Secrets created by cert-manager’s Certificate resource. It needs to have keys: tls.crt: PEM signed certificate chain tls.key: PEM private key ca.crt: PEM CA certificate The ca.crt is optional if there is at least one issuer certificate in the certificate chain (tls.crt key). That issuer can either be a self-signed leaf certificate, or an intermediate or root certificate authority. Optional. When omitted, DSM will auto-generate a certificate using its own internal certificate authority. When specified, DSM will override its auto-generated certificate and use the one described in the Secret. Mutable. To update a custom certificate, either refer to a new Secret, or update the already referenced one. If the database cluster will be accessed by IP, the TLS configuration needs to be applied after initial creation, because the IP can be retrieved only then, so it can be encoded in the certificate. |
false |
MySQLClusterBackup.status.mysqlClusterSpec.upgradeSafeguards
UpgradeSafeguards configures the safeguards that need to pass before allowing a major/minor version upgrade to proceed. If specified, the .spec.upgradeSafeguards.targetVersion must match canonical .spec.Version. If not specified, either default safeguard values will be used or, if present, the values of the following legacy annotations may be applicable (for details, see engine-specific major/minor version upgrade documentation): dsm.vmware.com/skip-pre-upgrade-backup dsm.vmware.com/upgrade-cluster-without-backups dsm.vmware.com/upgrade-cluster-with-failing-backups dsm.vmware.com/upgrade-cluster-with-alerts
UpgradeSafeguards cannot be used in combination with any of the deprecated annotations from the list above, regardless of the referenced target versions.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
targetVersion |
string |
TargetVersion must equal spec.version. If the cluster is to be upgraded again and its spec.version changes, either the outdated prior safeguard should be removed or it should be updated along with its TargetVersion. Required. |
true |
allowWithActiveAlerts |
boolean |
AllowWithActiveAlerts, if true, will allow further processing even if active alerts on the cluster exist. Optional. Mutable. Default: false
|
false |
allowWithoutBackup |
boolean |
AllowWithoutBackup, if true, will allow further processing for major version upgrade even if the backup that is taken as part of this safeguard could not be started or failed. An attempt to create such a backup will always be made, with further processing dependent on the value of this field. For minor version upgrade this value is not applicable, as no pre-upgrade backup will be made. Accepted values in this case are nil and true, false will be rejected. Optional. Mutable. |
false |
MySQLClusterBackup.status.mysqlClusterSpec.vSphereTags[index]
VSphereTag identifies a single vSphere tag by its tag category and tag name.
| Name | Type | Description | Required |
|---|---|---|---|
category |
string |
Category is the vSphere tag category Required. Mutable. |
true |
tag |
string |
Tag is the vSphere tag. It should be part of vSphere tag category Category. Required. Mutable. |
true |
MySQLCluster
MySQLCluster is the schema for the mysqlclusters API. A MySQLCluster represents the desired specification and the observed status of a MySQLCluster instance. A MySQLCluster is backed by one or more nodes containing the mysql service and supporting services managed as a single object by the Data Services Manager. ### Custom Annotations:
#### Force rolling update with active infra alert
dsm.vmware.com/modify-cluster-with-infra-alerts: generation of the resource
<generation of the resource> : The value of this annotation should match the current resource generation (.metadata.Generation) The system actively prevents edits to the Spec that induces a rolling update when there is an alert for the underlying infrastructure and this annotation can be used to bypass it. It should be used with caution as the System cannot guarantee the update will succeed under infra alert conditions. It is better to check with the Infra/DSM Admin prior to using this.
### Automatic upgrades during Maintenance Window:
If .spec.maintenanceWindow is configured, automatic upgrade will be performed accordingly when applicable MySQL version becomes available. Database minor version upgrade will be performed only if the engine version is equal to or higher than 8.0.45 for 8.0.x versions or 8.4.8 for 8.4.x versions. For engines before 8.0.45 or 8.4.8, only the data plane release is upgraded, and only if the new release includes the current engine version.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
databases.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
MySQLCluster |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
MySQLClusterSpec defines the desired state of the MySQLCluster |
true |
|
object |
MySQLClusterStatus describes the observed status of the MySQLCluster. In case of consumption through VMware Cloud Foundation Automation (VCFA) the status includes the following condition:
|
false |
MySQLCluster.spec
MySQLClusterSpec defines the desired state of the MySQLCluster
| Name | Type | Description | Required |
|---|---|---|---|
object |
InfrastructurePolicy refers to the infrastructure policy resource used to create this cluster. Required - Must refer to a valid Immutable. |
true |
|
storagePolicyName |
string |
StoragePolicyName declares the name of the storage policy that should be used to create this postgres cluster. It must be part of the InfrastructurePolicy used by this cluster. Required - Must refer to a valid Immutable. |
true |
storageSpace |
string |
StorageSpace declares the disk size allocated to each node hosting the workload. You can express storage as a plain integer or as a fixed-point number using one of these suffixes - E, P, T, G, M, k. You can also use the power-of-two equivalents - Ei, Pi, Ti, Gi, Mi, Ki Range - 20Gi - 32Ti. Required. Mutable - (increase only). |
true |
version |
string |
Version declares the version of the database engine to be used. To upgrade the database engine change this field. The list of supported engine versions can be found by inspecting the DataServiceVersion resources and in the VMware Data Services Manager UI. Version Validations for Cluster Restore Scenarios: When creating a new cluster based on an existing cluster or backup (via spec.basedOn), the following version validation rules apply at cluster creation time: General Rules (All Database Engines):
PostgreSQL-Specific Rules:
MySQL-Specific Rules:
Required. Mutable. |
true |
object |
VMClass refers to the VM class that should be used to create this cluster. It must be part of the InfrastructurePolicy used by this cluster. Required - Must refer to a valid Mutable - (Only increases in resources are allowed). |
true |
|
object |
AdminPasswordRef refers to a v1.Secret containing the password which the privileged user will use to connect
to the database. The secret must be in the same namespace as the database cluster.
FieldPath field indicates which key in the secret contains the password. Default - If the cluster is a replica with SyncUsersFromSource=true, this field has no effect until the replica is promoted. Default - password is auto generated. Mutable. It is possible to refer to a new Secret to update the admin password, but it is not required. Updates in the already referenced Secret will also lead to update of the password. |
false |
|
adminUsername |
string |
AdminUserName is the desired name of the privileged user to be used when connecting to the database. AdminUserName should not be one of the following - root, mysql.sys, mysql.session, mysql.infoschema, mysql-backup, mysql-healthcheck, mysql-metrics, telegraf-metrics, mysql-tls-admin, mysql-router, innodb-cluster-admin, mysqlappuser, mysql-pitr. Its length should not be more than 32 characters. If the cluster is a replica with SyncUsersFromSource=true, this field has no effect until the replica is promoted. Default - mysql-admin. Immutable. |
false |
object |
BackupConfig declares the cluster’s backup configuration details. If specified a Optional. Mutable. |
false |
|
object |
BackupLocation, if specified, must point to an existing BackupLocation custom resource in the same namespace as the cluster or in the DSM system namespace. It will be used by the 'BackupConfig', which must be specified whenever BackupLocation is specified. If specified, a Optional. Mutable. |
false |
|
object |
BasedOn identifies the source cluster on which this cluster will be based on. Users cannot base their clusters on clusters owned by other users unless the user has DSM_Admin role. The new cluster will inherit the ownership from its source cluster. It can be changed if necessary after the cluster is created. Field Cluster works both if the cluster is alive and if it is deleted, but we are still retaining its backups. To create a new MySQL cluster based on a live cluster pass the name of the cluster. To create a new MySQL cluster based on an archived cluster with retained backups pass the name of the ArchivedMySQLCluster The only allowed mutation of the BasedOn field is to set it to nil if it was previously set to contain ReplicationSource. See MySQLBasedOnParams.ReplicationSource for details. Optional. Mutable. |
false |
|
object |
DatabaseConfig refers to the database config object that will be applied to this cluster. Database Config is used to apply custom params/configs to the database represented by this CR.
The provided parameters go into the DatabaseConfig Validation Rules:
Optional. Mutable. |
false |
|
databaseName |
string |
If DatabaseName is set, database with that name will be created (if it doesn’t exist) and MySQLCluster.Status.Connection.DbName and ArchivedMySQLCluster.Status.DatabaseName will be set to that name. If the cluster is restored from another cluster (Spec.BasedOn.Cluster field is used) all databases from the source cluster are restored with preserved names and one additional database is created with name the given DatabaseName. This database is empty and MySQLCluster.Status.Connection.DbName and ArchivedMySQLCluster.Status.DatabaseName refer to it. If DatabaseName is equal to the name of database from the source cluster no additional database is created and MySQLCluster.Status.Connection.DbName and ArchivedMySQLCluster.Status.DatabaseName refer to the specified database with name the given DatabaseName. If DatabaseName is empty no additional database is created and MySQLCluster.Status.Connection.DbName and ArchivedMySQLCluster.Status.DatabaseName refer the same database the status connection info of the source cluster refers to. DatabaseName should not be one of the following - root, mysql.sys, mysql.session, mysql.infoschema, mysql-backup, mysql-healthcheck, mysql-metrics, telegraf-metrics, mysql-tls-admin, mysql-router, innodb-cluster-admin, mysqlappuser, mysql-pitr. Its length should not be more than 64 characters. Default - if the cluster is restored one, the database name in the source cluster’s MySQLCluster.Status.Connection.DbName is used, otherwise DatabaseName is the same as the cluster’s name. Immutable. |
false |
description |
string |
Description contains the human-readable description of the cluster. Optional. Mutable. |
false |
object |
DirectoryService refers to the DirectoryService resource with LDAP settings used by this cluster for authenticating clients. Optional. Mutable. |
false |
|
dnsNames |
[]string |
One or more DNS names / FQDNs for database access. These DNS names will be included in the SAN field of the TLS certificate if auto-generated by DSM. The first DNS name will also be included in the URL connection string displayed in DSM UI. If a custom TLS certificate is provided, it is important its SAN field to match the DNS names provided here, so clients can ensure a secure connection. Optional. Mutable. When updated, DSM will re-generate the TLS certificate if no custom certificate is provided. |
false |
extraClients |
[]string |
ExtraClients is a list of additional IPv4 addresses/ranges that should be allowed to access the database service. Use cases include: * having applications outside of the tenant organization namespace that need to access the database cluster. * configuring replication for the database cluster from a different region. * troubleshooting issues with the database cluster. Optional. Mutable. |
false |
object |
MaintenanceWindow refers to the System maintenance window. Enabled Maintenance Window will allow CVEs, bug fixes and new Lifecycle Management features for the VM, OS, any supporting software to be addressed. Automatic upgrades applied during this window should only result in minimum downtime of deployed databases for HA clusters. Database minor version upgrades might also be performed. Refer to engine-specific automatic upgrade details which are documented at the corresponding top-level API docs. Optional. Mutable. |
false |
|
members |
integer |
The number of members for cluster. Could be Default - Mutable.
|
false |
object |
PlacementSelector refers to a placement declared in the InfrastructurePolicy. Usually this field should be left empty to allow the system to determine it automatically.
A placement should be found in the Optional. Immutable. |
false |
|
supportAsynchReplicas |
boolean |
SupportAsynchReplicas controls whether the cluster is provisioned with features required for it to be used by replicas as a source. Optional. Mutable.
|
false |
object |
TLS refers to the SSL/TLS configuration of the database cluster. Optional. Mutable. |
false |
|
object |
UpgradeSafeguards configures the safeguards that need to pass before allowing a major/minor version upgrade to proceed. If specified, the .spec.upgradeSafeguards.targetVersion must match canonical .spec.Version. If not specified, either default safeguard values will be used or, if present, the values of the following legacy annotations may be applicable (for details, see engine-specific major/minor version upgrade documentation): dsm.vmware.com/skip-pre-upgrade-backup dsm.vmware.com/upgrade-cluster-without-backups dsm.vmware.com/upgrade-cluster-with-failing-backups dsm.vmware.com/upgrade-cluster-with-alerts UpgradeSafeguards cannot be used in combination with any of the deprecated annotations from the list above, regardless of the referenced target versions. Optional. Mutable. |
false |
|
[]object |
VSphereTags is the list of vSphere tags that the cluster’s deployed virtual machines should have assigned. The tags should exist in vSphere in order to be successfully assigned. Optional. Mutable. |
false |
MySQLCluster.spec.infrastructurePolicy
InfrastructurePolicy refers to the infrastructure policy resource used to create this cluster.
Required - Must refer to a valid InfrastructurePolicy.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
kind |
string |
Kind of the referent. |
false |
name |
string |
The Name of the referent. |
false |
namespace |
string |
The Namespace of the referent. |
false |
MySQLCluster.spec.vmClass
VMClass refers to the VM class that should be used to create this cluster. It must be part of the InfrastructurePolicy used by this cluster.
Required - Must refer to a valid VMClass.
Mutable - (Only increases in resources are allowed).
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MySQLCluster.spec.adminPasswordRef
AdminPasswordRef refers to a v1.Secret containing the password which the privileged user will use to connect
to the database. The secret must be in the same namespace as the database cluster.
FieldPath field indicates which key in the secret contains the password. Default - password.
Providing inline value with Value field is not supported.
The owner of the Secret must be the same as the owner of the DB cluster. When the owner of the DB
cluster is changed the owner of the Secret is automatically changed to the new owner.
If the cluster is a replica with SyncUsersFromSource=true, this field has no effect until the replica is promoted.
Default - password is auto generated.
Mutable. It is possible to refer to a new Secret to update the admin password, but it is not required. Updates in the already referenced Secret will also lead to update of the password.
| Name | Type | Description | Required |
|---|---|---|---|
fieldPath |
string |
data.<key> for secrets. Optional. For most references there is a canonical key |
false |
name |
string |
The name of the secret |
false |
value |
string |
Deprecated. This field is never used by the Data Services Manager. |
false |
MySQLCluster.spec.backupConfig
BackupConfig declares the cluster’s backup configuration details.
If specified a BackupLocation must also be specified.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
backupRetentionDays |
integer |
BackupRetentionDays indicates the number of days for which the database’s
Point-in-Time Recovery (PITR) is expected to be available.
Must be Required. Mutable.
|
true |
[]object |
Schedules determine the type and frequency of backups, with the latter defined by a cron expression. Required. Mutable. |
true |
|
uploadChunkSize |
int or string |
UploadChunkSize setting that allows for the user to override the default chunk size used in multipart uploads and specify the part size themselves, taking into account the specifics of their environment and the target backup storage. There are tradeoffs associated with tuning the value of the UploadChunkSize. On one hand side each part is a separate S3 PUT operation so chunking the backup in too small parts comes at a certain cost. On the other hand side, parts are buffered in memory and the larger the part, the greater the chance of an upload failure depending on the reliability of the network. Thus, a high chunk size value comes with a higher memory footprint and a higher risk for upload failure. The memory utilization of the backup routine may increase with up to 5 times the configured upload chunk size due to the parallel upload capability of the object uploader. Note that the backup doesn’t include all files in the MySQL data directory and the backup stream is compressed, which means that size of the backup object would vary significantly based on the type of data in the database. In general one can expect that the backup object size is around 1% to 10% of the disk utilization of the MySQL database instance (i.e. the MySQL data directory). The format of the specified value should be a Kubernetes resource quantity - https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/quantity/ Range - 5Mi - 5Gi Default - 10Mi Supported in Data Service Manager data plane version 2.2.2 and above. Optional. Mutable. |
false |
MySQLCluster.spec.backupConfig.schedules[index]
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the schedule. Required. Immutable. |
true |
schedule |
string |
The schedule in the form of a cron schedule. Required. Mutable. |
true |
type |
string |
Type of schedule. Can be Required. Immutable. |
true |
MySQLCluster.spec.backupLocation
BackupLocation, if specified, must point to an existing BackupLocation custom resource in the same namespace as the cluster or in the DSM system namespace. It will be used by the 'BackupConfig', which must be specified whenever BackupLocation is specified.
If specified, a backupConfig must also be specified.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MySQLCluster.spec.basedOn
BasedOn identifies the source cluster on which this cluster will be based on.
Users cannot base their clusters on clusters owned by other users unless the user has DSM_Admin role. The new cluster will inherit the ownership from its source cluster. It can be changed if necessary after the cluster is created.
Field Cluster works both if the cluster is alive and if it is deleted, but we are still retaining its backups. To create a new MySQL cluster based on a live cluster pass the name of the cluster. To create a new MySQL cluster based on an archived cluster with retained backups pass the name of the ArchivedMySQLCluster
The only allowed mutation of the BasedOn field is to set it to nil if it was previously set to contain ReplicationSource. See MySQLBasedOnParams.ReplicationSource for details.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
backup specifies a MySQLClusterBackup to use as the restore source. Cannot be set if Cluster, ReplicationSource, or Snapshot is set, too. One of the four has to be set. Immutable. Once set, this field cannot be modified. Optional.
|
false |
|
object |
Cluster contains the name of the source cluster and timestamp to use as the restore point. Cannot be set if ReplicationSource, Snapshot, or Backup is set, too. One of the four has to be set. Optional. Immutable. |
false |
|
object |
ReplicationSource specifies that the cluster will be based on a source cluster from which this cluster will replicate asynchronously. Cannot be set if Cluster, Snapshot, or Backup is set, too. One of the four has to be set. When a cluster with previously configured basedOn.ReplicationSource field is updated to remove basedOn, the cluster will be decoupled from its source cluster and promoted to an independent read/write cluster. Promotion is irrevocable and doesn’t wait for in-flight data from the source to be flushed to the replica. The completion of promotion will be indicated by the removal of the IncomingReplicationStatus status field. If SyncUsersFromSource was previously true, the admin user credentials on the promoted cluster will be re-generated or, if AdminUser/AdminPasswordRef was populated, set to its value. In both cases, cluster connection status will be changed to refer to these admin user credentials as in any non-replica cluster. Optional. Immutable. |
false |
|
object |
Snapshot specifies that the cluster will be a linked clone of the snapshot to which this reference is pointing. Cannot be set if Cluster, ReplicationSource, or Backup is set, too. One of the four has to be set. A snapshot-based cluster will permanently depend on the existence of the snapshot on which it is based and thus, on the cluster from which the snapshot was taken and the storage used by it. A cluster must be using a SupervisorInfrastructurePolicy and a single availability zone to be a snapshot clone. Optional. Immutable.
|
false |
MySQLCluster.spec.basedOn.backup
backup specifies a MySQLClusterBackup to use as the restore source. Cannot be set if Cluster, ReplicationSource, or Snapshot is set, too. One of the four has to be set.
Immutable. Once set, this field cannot be modified.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
name specifies the MySQLClusterBackup name Optional. |
false |
time |
string |
time is the point in time to restore to when the referenced MySQLClusterBackup has sourceBackup populated and its location pointing to an automated continuous backup set with binlogs that allow PITR. The restore will happen to the last available recovery time before the given time. If time is not provided, restore will be initiated to the latest available recovery time. Optional. Immutable.
|
false |
MySQLCluster.spec.basedOn.cluster
Cluster contains the name of the source cluster and timestamp to use as the restore point. Cannot be set if ReplicationSource, Snapshot, or Backup is set, too. One of the four has to be set.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name is the name of the source cluster from which to restore. Required. Immutable. |
true |
timestamp |
string |
Timestamp is the point in time to restore from. The restore will happen to the last available recovery time before the given time. If timestamp is not provided restore will be initiated to the latest available recovery time. Optional. Immutable.
|
false |
MySQLCluster.spec.basedOn.replicationSource
ReplicationSource specifies that the cluster will be based on a source cluster from which this cluster will replicate asynchronously. Cannot be set if Cluster, Snapshot, or Backup is set, too. One of the four has to be set.
When a cluster with previously configured basedOn.ReplicationSource field is updated to remove basedOn, the cluster will be decoupled from its source cluster and promoted to an independent read/write cluster. Promotion is irrevocable and doesn’t wait for in-flight data from the source to be flushed to the replica. The completion of promotion will be indicated by the removal of the IncomingReplicationStatus status field. If SyncUsersFromSource was previously true, the admin user credentials on the promoted cluster will be re-generated or, if AdminUser/AdminPasswordRef was populated, set to its value. In both cases, cluster connection status will be changed to refer to these admin user credentials as in any non-replica cluster.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
ClusterConnectionParams specifies connection parameters for connecting to the source cluster. This is currently the only option for specifying a source cluster. Required |
true |
|
syncUsersFromSource |
boolean |
SyncUsersFromSource specifies whether database users and their credentials are managed locally on the replica (false) or replicated from the source cluster (true). When set to true, all DB users on the replica and their credentials will be replicated from the source. Cluster connection status will refer to a replication user and its credentials. No local user management (CREATE, DROP, ALTER) should be performed on the replica database directly. If AdminUserName or AdminPasswordRef are set on the replica, they will be ignored until it is promoted or SyncUsersFromSource is switched to false. When set to false, the replica cluster users are managed the same way as in a non-replica cluster. The only permitted change of this field is from true to false, in which case existing replicated users are retained as the initial state of locally managed users, and then AdminUserName/AdminPasswordRef are applied. Required Mutable
|
true |
MySQLCluster.spec.basedOn.replicationSource.clusterConnectionParams
ClusterConnectionParams specifies connection parameters for connecting to the source cluster. This is currently the only option for specifying a source cluster.
Required
| Name | Type | Description | Required |
|---|---|---|---|
object |
Credentials specifies a Kubernetes secret that contains the credentials needed to connect to the source cluster. Required fields of the secret are username and password. The referenced MySQL user must have connection, replication and clone privilege on the source cluster. This field is mutable. Changes to the secret will be automatically applied on the instance. Required. Mutable. |
true |
|
endpoints |
[]string |
Endpoints is a list of servers that are members of a single cluster, in host:port format. Connections to the servers will be tried in the order specified, and a server will be used only if connection attempts to those preceding it in the list have failed. The list can contain a sub-set of the source cluster members, in which case replication will depend on the health of this sub-set. Required. Mutable. |
true |
object |
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when validating the Servers connection.
Optional. By default, it will use the DSM globally trusted certificates ConfigMap. Mutable. |
false |
MySQLCluster.spec.basedOn.replicationSource.clusterConnectionParams.credentials
Credentials specifies a Kubernetes secret that contains the credentials needed to connect to the source cluster. Required fields of the secret are username and password. The referenced MySQL user must have connection, replication and clone privilege on the source cluster. This field is mutable. Changes to the secret will be automatically applied on the instance.
Required.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MySQLCluster.spec.basedOn.replicationSource.clusterConnectionParams.trustBundle
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when validating the Servers connection.
-
Well-known OS-trusted CA, or a DSM globally trusted certificate - TrustBundle can be omitted, or it should point to DSM globally trusted certificates ConfigMap.
-
Certificate signed by CA that should not be globally trusted by DSM - TrustBundle reference must point to ConfigMap with key
tls.crtthat contains only Issuer certificate(s). If an end-entity (i.e. server) certificate is provided it must be issued by itself, i.e. self-signed.
Optional. By default, it will use the DSM globally trusted certificates ConfigMap.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
MySQLCluster.spec.basedOn.snapshot
Snapshot specifies that the cluster will be a linked clone of the snapshot to which this reference is pointing. Cannot be set if Cluster, ReplicationSource, or Backup is set, too. One of the four has to be set. A snapshot-based cluster will permanently depend on the existence of the snapshot on which it is based and thus, on the cluster from which the snapshot was taken and the storage used by it. A cluster must be using a SupervisorInfrastructurePolicy and a single availability zone to be a snapshot clone.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name refers to a MySQLSnapshot in the same namespace from which to clone this cluster. The snapshot must have Ready condition with status True, be from the same MySQL major and minor version as this cluster, have the same StorageSpace, and use the same vSphere storage and spec.infrastructurePolicy. Supported in Data Services Manager data plane version 9.1.0.0 and above. Immutable. Required.
|
true |
MySQLCluster.spec.databaseConfig
DatabaseConfig refers to the database config object that will be applied to this cluster.
Database Config is used to apply custom params/configs to the database represented by this CR.
The provided parameters go into the mysql.cnf file.
DatabaseConfig Validation Rules:
-
Exclusivity: A DatabaseConfig can only be applied to a single cluster at a time. If a DatabaseConfig is already in use by another cluster, it cannot be assigned to a new cluster or changed to reference a different cluster.
-
Namespace: The DatabaseConfig must exist in the same namespace as the cluster.
-
Deletion Protection: A DatabaseConfig cannot be deleted while it is in use by a cluster.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MySQLCluster.spec.directoryService
DirectoryService refers to the DirectoryService resource with LDAP settings used by this cluster for authenticating clients.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
MySQLCluster.spec.maintenanceWindow
MaintenanceWindow refers to the System maintenance window. Enabled Maintenance Window will allow CVEs, bug fixes and new Lifecycle Management features for the VM, OS, any supporting software to be addressed. Automatic upgrades applied during this window should only result in minimum downtime of deployed databases for HA clusters. Database minor version upgrades might also be performed. Refer to engine-specific automatic upgrade details which are documented at the corresponding top-level API docs.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
duration |
string |
Duration describes the duration of the maintenance window. Required. Mutable. |
true |
startDay |
enum |
StartDay describes the day of the week the maintenance window will commence. Can be any of Required. Mutable.
|
true |
startTime |
string |
StartTime describes the time of the day (UTC time) to start the maintenance window. Required. Mutable. |
true |
startDayWeeksOfMonth |
[]enum |
StartDayWeeksOfMonth field specifies the weeks of the month in which the
maintenance window will commence. It accepts up to five distinct
values from {1, 2, 3, 4, L}, where each number represents the
occurrence of the designated StartDay within the month ("1" being
the first one that includes it and "L" being the last one).
For example, providing Optional. Mutable.
|
false |
MySQLCluster.spec.placementSelector
PlacementSelector refers to a placement declared in the InfrastructurePolicy.
Usually this field should be left empty to allow the system to determine it automatically.
A placement should be found in the InfrastructurePolicy with the same datacenter,
cluster and resource pool to be considered valid.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
cluster |
string |
Cluster is the datacenter’s cluster name to be used when placing the data service workload. Use the full qualified name of the cluster, relative to the datacenter. A cluster "Cluster1" inside a folder "clusters", should be declared as "clusters/Cluster1". Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the cluster name. Required. Mutable. |
true |
datacenter |
string |
Datacenter is the vSphere Datacenter to be used when placing the data service workload. The full qualified path to the datacenter must be provided if the datacenter is placed inside a folder. Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the datacenter name. Required. Mutable. |
true |
resourcePool |
string |
ResourcePool is the Cluster’s resource pool to be used when placing the data service workload. If the resource pool is not provided, the whole cluster is used as the placement. Optional. Mutable. |
false |
MySQLCluster.spec.tls
TLS refers to the SSL/TLS configuration of the database cluster.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
secretName |
string |
The name of a Secret resource present in the same namespace as the database cluster, describing a custom certificate. The expected format of the Secret is the same as the output Secrets created by cert-manager’s Certificate resource. It needs to have keys: tls.crt: PEM signed certificate chain tls.key: PEM private key ca.crt: PEM CA certificate The ca.crt is optional if there is at least one issuer certificate in the certificate chain (tls.crt key). That issuer can either be a self-signed leaf certificate, or an intermediate or root certificate authority. Optional. When omitted, DSM will auto-generate a certificate using its own internal certificate authority. When specified, DSM will override its auto-generated certificate and use the one described in the Secret. Mutable. To update a custom certificate, either refer to a new Secret, or update the already referenced one. If the database cluster will be accessed by IP, the TLS configuration needs to be applied after initial creation, because the IP can be retrieved only then, so it can be encoded in the certificate. |
false |
MySQLCluster.spec.upgradeSafeguards
UpgradeSafeguards configures the safeguards that need to pass before allowing a major/minor version upgrade to proceed. If specified, the .spec.upgradeSafeguards.targetVersion must match canonical .spec.Version. If not specified, either default safeguard values will be used or, if present, the values of the following legacy annotations may be applicable (for details, see engine-specific major/minor version upgrade documentation): dsm.vmware.com/skip-pre-upgrade-backup dsm.vmware.com/upgrade-cluster-without-backups dsm.vmware.com/upgrade-cluster-with-failing-backups dsm.vmware.com/upgrade-cluster-with-alerts
UpgradeSafeguards cannot be used in combination with any of the deprecated annotations from the list above, regardless of the referenced target versions.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
targetVersion |
string |
TargetVersion must equal spec.version. If the cluster is to be upgraded again and its spec.version changes, either the outdated prior safeguard should be removed or it should be updated along with its TargetVersion. Required. |
true |
allowWithActiveAlerts |
boolean |
AllowWithActiveAlerts, if true, will allow further processing even if active alerts on the cluster exist. Optional. Mutable. Default: false
|
false |
allowWithoutBackup |
boolean |
AllowWithoutBackup, if true, will allow further processing for major version upgrade even if the backup that is taken as part of this safeguard could not be started or failed. An attempt to create such a backup will always be made, with further processing dependent on the value of this field. For minor version upgrade this value is not applicable, as no pre-upgrade backup will be made. Accepted values in this case are nil and true, false will be rejected. Optional. Mutable. |
false |
MySQLCluster.spec.vSphereTags[index]
VSphereTag identifies a single vSphere tag by its tag category and tag name.
| Name | Type | Description | Required |
|---|---|---|---|
category |
string |
Category is the vSphere tag category Required. Mutable. |
true |
tag |
string |
Tag is the vSphere tag. It should be part of vSphere tag category Category. Required. Mutable. |
true |
MySQLCluster.status
MySQLClusterStatus describes the observed status of the MySQLCluster.
In case of consumption through VMware Cloud Foundation Automation (VCFA) the status includes the following condition:
-
ResourceAvailable: Indicates if the external resources (such as Secrets and ConfigMaps configured in spec.adminPasswordRef, spec.trustBundle) referenced by the cluster are available and successfully synchronized to the DSM appliance from the tenant namespace. Note: Only the first encountered failure is reported. There may be a delay of several minutes before any subsequent reference failures are discovered and reported after the initial fix.-
Status: "True" when all referenced resources are available and ready; "False" otherwise.
-
Reason includes:
-
"Ready": All referenced resources are accessible.
-
"Unavailable": One or more referenced resources (Secret or ConfigMap) could not be found or failed to synchronize.
-
-
| Name | Type | Description | Required |
|---|---|---|---|
alertLevel |
string |
AlertLevel indicates the level of the most severe alert raised for a database cluster. |
false |
[]object |
AvailableUpgrades lists the valid version upgrades for the database cluster. The information here may be stale: when a Data Services Release is enabled or disabled, the available upgrades for existing clusters are populated asynchronously. However, an actual upgrade attempt is always validated against the current system state and the service will accept valid upgrade paths even if they are not yet populated here. |
false |
|
backupId |
string |
BackupId is set only for clusters with enabled automatic backups. This is a unique ID that can be used to locate backup files in storage. For PostgreSQL, it is the stanzaName of the database cluster. For MySQL, it is the UID of the MySQL cluster object in the workload cluster. |
false |
[]object |
Conditions contain the list of observed conditions of the cluster. The following statuses can occur.
|
false |
|
object |
Connection describes the details which can be used to connect to the database represented by CR. |
false |
|
databaseConfigResourceVersion |
string |
DatabaseConfigResourceVersion is set only for clusters that reference a DatabaseConfig CR. It represents the resourceVersion of the last applied DatabaseConfig for database cluster. |
false |
object |
IncomingReplicationStatus contains, only for replicas of another cluster, the replication status It will only be present if BasedOn.BasedOnReplicationSource is set. Optional. |
false |
|
lastSuccessfulBackup |
string |
LastSuccessfulBackup indicates the time when the last successful backup completed. The time may refer to an incremental or full backup depending on which completed most recently.
|
false |
lastUpdate |
string |
LastUpdate gives the timestamp of when the desired state was last applied.
|
false |
[]object |
Nodes represents the underlying infrastructure of a database cluster. |
false |
|
object |
OutgoingReplicationStatus contains the status of other clusters that are replicating from this cluster, if any. It will only be present if SupportAsynchReplicas is true. Optional. |
false |
|
tlsSecretResourceVersion |
string |
TLSSecretResourceVersion is set only for clusters with custom certificates. It represents the resource version of the Secret that was last applied for the DB cluster. |
false |
object |
UpgradeStatus represents that status of version upgrade |
false |
|
vcfaNetworkSecurityConfigResourceVersion |
string |
VCFANetworkSecurityConfigResourceVersion stores the resource version of the VCFANetworkSecurityConfig singleton after the last successful reconciliation. Used to detect any change in VCFANetworkSecurityConfig so reconciliation is not skipped. |
false |
MySQLCluster.status.availableUpgrades[index]
| Name | Type | Description | Required |
|---|---|---|---|
impact |
enum |
Impact indicates whether Virtual Machines backing the workload cluster’s kubernetes nodes will be replaced during the upgrade. When the impact is "RollingUpgrade" the upgrade is performed by adding a new node backed by a new Virtual Machine to the workload cluster, and one of the existing nodes is disabled, drained, and subsequently deleted. The process is repeated until all nodes are replaced. When the impact is "InPlace" the upgrade is performed by replacing the PODs running in the workload cluster, but without replacing the kubernetes nodes.
|
true |
version |
string |
Version indicates the target version of the upgrade path. The version is displayed in qualified canonical format i.e. engine version, followed by the string "+vmware.", followed by the release version. |
true |
autoUpgradeTarget |
boolean |
AutoUpgradeTarget indicates whether the cluster is eligible to be automatically upgraded to the specified version. Automatic upgrades are performed within the configured maintenance period.
|
false |
majorVersionUpgrade |
boolean |
MajorVersionUpgrade indicates whether the upgrade is to newer major version. MajorVersionUpgrade and AutoUpgradeTarget cannot be both true as major version upgrades are only manual.
|
false |
MySQLCluster.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
MySQLCluster.status.connection
Connection describes the details which can be used to connect to the database represented by CR.
| Name | Type | Description | Required |
|---|---|---|---|
dbname |
string |
Name of the Database |
true |
host |
string |
Host describes the IP address of the database cluster’s current primary node. |
true |
port |
integer |
Port describes the port on which the database cluster is listening. |
true |
[]object |
ClusterMemberConnectionDetails contains network connection details of individual servers within the cluster. This status will only be populated if the configuration of the server results in the exposure of individual cluster members to the external network. |
false |
|
object |
PasswordRef refers to a v1.Secret that clients can use when connecting to this database. The secret is in the same namespace as the database resource and contains: * "password": the last successfully applied database password. * "ca.crt": the CA certificate for verifying the server’s TLS identity. |
false |
|
username |
string |
Username for the admin account |
false |
MySQLCluster.status.connection.clusterMemberConnectionDetails[index]
ClusterMemberConnectionInfo contains cluster member identification and network connection details of a single member of a database cluster
| Name | Type | Description | Required |
|---|---|---|---|
clusterMemberId |
string |
ClusterMemberID contains an identification of the member server that will remain the same throughout the lifecycle of the cluster. E.g., for MySQL this will be the MySQL server ID. The cluster role of the member can change. Required. |
true |
host |
string |
Host contains the hostname or IP to connect to Required. |
true |
port |
integer |
Port contains the port to connect to Required.
|
true |
MySQLCluster.status.connection.passwordRef
PasswordRef refers to a v1.Secret that clients can use when connecting to this database. The secret is in the same namespace as the database resource and contains: * "password": the last successfully applied database password. * "ca.crt": the CA certificate for verifying the server’s TLS identity.
| Name | Type | Description | Required |
|---|---|---|---|
fieldPath |
string |
data.<key> for secrets. Optional. For most references there is a canonical key |
false |
name |
string |
The name of the secret |
false |
value |
string |
Deprecated. This field is never used by the Data Services Manager. |
false |
MySQLCluster.status.incomingReplicationStatus
IncomingReplicationStatus contains, only for replicas of another cluster, the replication status It will only be present if BasedOn.BasedOnReplicationSource is set.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
sourceEndpoint |
string |
SourceEndpoint is the ClusterConnectionParams.EndpointElements element to which the replica is currently connected to, in the same host:port format. Required. |
true |
replicaIOState |
string |
ReplicaIOStatus is the replication IO status as reported by MySQL Optional. |
false |
MySQLCluster.status.nodes[index]
Node represents the underlying infrastructure of a workload cluster
| Name | Type | Description | Required |
|---|---|---|---|
cpu |
string |
CPU defines the amount of vCPU that is allocated to this node. This is the actual value that the node is provisioned with. This may differ in WCP where it is possible to change the VMClass size after provisioning. Making VMClass an unreliable source of truth for the actual node size. |
false |
datacenter |
string |
Datacenter is the name or inventory path of the datacenter in which the virtual machine is created/located. |
false |
datastore |
string |
Datastore is the name or inventory path of the datastore in which the virtual machine is created/located. |
false |
folder |
string |
Folder is the name or inventory path of the folder in which the virtual machine is created/located. |
false |
host |
string |
Host is the name or inventory path of the ESXi host on which the virtual machine is running. |
false |
memory |
string |
Memory defines the amount of memory, in Gib that is allocated to this node. This is the actual value that the node is provisioned with. This may differ in WCP where it is possible to change the VMClass size after provisioning. Making VMClass an unreliable source of truth for the actual node size. |
false |
object |
Network is the network configuration for this VM. |
false |
|
resourcePool |
string |
ResourcePool is the name or inventory path of the resource pool in which the virtual machine is created/located. |
false |
server |
string |
Server is the IP address or FQDN of the vSphere server on which the virtual machine is created/located. |
false |
storagePolicyName |
string |
StoragePolicyName of the storage policy to use with this Virtual Machine |
false |
vmMoid |
string |
VmMoid is the VM’s Managed Object Reference on vSphere. |
false |
vmName |
string |
VmName is the name of the virtual machine on vSphere. |
false |
vmRole |
string |
VMRole identifies the role VM plays in the workload cluster. like ControlPlane, Worker. |
false |
MySQLCluster.status.nodes[index].network
Network is the network configuration for this VM.
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
Devices is the list of network devices used by the virtual machine. |
false |
MySQLCluster.status.nodes[index].network.devices[index]
NetworkDevice defines the network configuration for a virtual machine’s network device.
| Name | Type | Description | Required |
|---|---|---|---|
ipPool |
string |
IPPool is the name of the IP Pool that was used to claim an IP address for the VM. |
false |
networkName |
string |
NetworkName is the name of the vSphere network to which the device will be connected. |
false |
MySQLCluster.status.outgoingReplicationStatus
OutgoingReplicationStatus contains the status of other clusters that are replicating from this cluster, if any. It will only be present if SupportAsynchReplicas is true.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
ConnectedReplicas contains information about replicas connected to this cluster, using it as a source. Required. |
true |
|
object |
CredentialsRef is a reference to the kubernetes secret that contains the credentials for connecting to this cluster as a replica. The referenced secrets exist in the same namespace as the cluster resource. Optional |
false |
MySQLCluster.status.outgoingReplicationStatus.connectedReplicas[index]
MySQLOutgoingReplicaStatus describes the status of a single replica of this cluster.
| Name | Type | Description | Required |
|---|---|---|---|
hostname |
string |
Hostname contains the hostname of the connected replica Required. |
true |
replicaUUID |
string |
ReplicaServerID contains the MySQL Server UUID of the connected replica server. Required. |
true |
MySQLCluster.status.outgoingReplicationStatus.credentialsRef
CredentialsRef is a reference to the kubernetes secret that contains the credentials for connecting to this cluster as a replica. The referenced secrets exist in the same namespace as the cluster resource.
Optional
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MySQLCluster.status.upgradeStatus
UpgradeStatus represents that status of version upgrade
| Name | Type | Description | Required |
|---|---|---|---|
currentVersion |
string |
The actual current version of the data service cluster. This is going to be the same as spec.version, unless an upgrade has been requested. In the latter case, this field will be updated once the upgrade completes. |
false |
[]object |
Historical data of the upgrades performed. |
false |
|
lastTransitionTime |
string |
LastTransitionTime shows the last time the cluster’s upgradeStatus.Running field value changed
|
false |
running |
boolean |
Set to true to indicate that a data service cluster upgrade if currently running. Once the upgrade completes, the field will be reset to empty. |
false |
MySQLCluster.status.upgradeStatus.history[index]
| Name | Type | Description | Required |
|---|---|---|---|
complete |
string |
Timestamp of when the upgrade completed.
|
false |
fromVersion |
string |
The version from which the cluster was upgraded. |
false |
isMajorUpgrade |
boolean |
IsMajorUpgrade specifies whether the upgrade was a major or a minor version upgrade. |
false |
message |
string |
Message contains the reason for a failure or rejection. |
false |
start |
string |
Timestamp of when the upgrade started. This is the time right before the upgrade operations has started and restores are guaranteed to succeed at or before that time. The period after Start and before Complete is considered a blackout period and restores within this interval could lead to unexpected results.
|
false |
status |
enum |
Status indicates the status of the upgrade.
|
false |
toVersion |
string |
The version to which the cluster was upgraded. If the upgrade was aborted or has failed, this field will have the same value as FromVersion. |
false |
MySQLSnapshot
MySQLSnapshot represents a request to take a snapshot of a MySQL database’s data directory and the status of executing this request. A snapshot can be used to clone a database by creating a cluster with basedOn.Snapshot pointing to the snapshot. The snapshot and any clone clusters based on it are fully dependent on the source cluster and cannot be used without it existing. Because of this, a MySQLSnapshot is not a suitable mechanism for creating a database backup - by itself, it is not sufficient to restore the source database. A cluster with existing snapshots cannot have its StorageSpace changed and cannot be deleted. A snapshot with existing clones (clusters referencing it in basedOn.Snapshot) cannot be deleted. The number of snapshots per source cluster is currently limited to 32. The source cluster must be one using a SupervisorInfrastructurePolicy and a single availability zone.
Supported in Data Services Manager data plane version 9.1.0.0 and above, and VCenter version 9.1.0.0 and above.
Example:
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: MySQLSnapshot
metadata:
name: new-snapshot
namespace: default
spec:
sourceCluster:
name: "mysql-db"
lockTimeoutMillis: 10000
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
databases.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
MySQLSnapshot |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
Required. |
true |
|
object |
Optional. |
false |
MySQLSnapshot.spec
Required.
| Name | Type | Description | Required |
|---|---|---|---|
object |
SourceCluster refers to an active MySQLCluster from which to create a snapshot. It cannot be a source of asynchronous replication, i.e. it must not have spec.supportAsynchReplicas=true. Immutable. Required.
|
true |
|
lockTimeoutMillis |
integer |
LockTimeoutMillis controls how long, in milliseconds, a global read lock is held on the source database while taking the snapshot. DDL and some DML operations on the source database will be blocked while the snapshot is being taken and this value can be used to control the upper limit of delays caused by this to client applications that issue writes while the snapshot is being taken. If the value is exceeded, snapshot taking will proceed in a non-blocking manner and the Snapshot status condition type "Consistency" will be set to false after completion. This will slow down cloning from the snapshot. Immutable. Default - 25000
|
false |
MySQLSnapshot.spec.sourceCluster
SourceCluster refers to an active MySQLCluster from which to create a snapshot. It cannot be a source of asynchronous replication, i.e. it must not have spec.supportAsynchReplicas=true.
Immutable.
Required.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MySQLSnapshot.status
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
Conditions is an observed conditions list of a snapshot. Each condition provides status information for a specific aspect of the resource lifecycle.
Optional |
false |
|
restoreSize |
int or string |
RestoreSize specifies the required storage space for cloning from the snapshot. It can differ from the source cluster’s StorageSpace due to implementation details of the underlying storage, e.g. padding. All clusters cloning from (i.e. basedOn) the snapshot must specify a StorageSpace equal to the RestoreSize. This field will always be populated for Ready snapshots. Optional. |
false |
snapshotCreateTime |
string |
SnapshotCreateTime indicates the point in time when the snapshot process began. This timestamp represents a lower boundary for the commit times of transactions included in the snapshot. Transactions committed before this time should be included in the snapshot. Optional
|
false |
snapshotId |
string |
For completed snapshots - the underlying snapshot ID; should be considered opaque. Optional |
false |
object |
SourceClusterSpec is the spec of the snapshot’s source cluster at the time the snapshot was taken Optional. |
false |
|
object |
SourceClusterStatus contains preserved, non-ephemeral information from the source cluster’s status at the time the snapshot was taken. Optional. |
false |
MySQLSnapshot.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
MySQLSnapshot.status.sourceClusterSpec
SourceClusterSpec is the spec of the snapshot’s source cluster at the time the snapshot was taken
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
object |
InfrastructurePolicy refers to the infrastructure policy resource used to create this cluster. Required - Must refer to a valid Immutable. |
true |
|
storagePolicyName |
string |
StoragePolicyName declares the name of the storage policy that should be used to create this postgres cluster. It must be part of the InfrastructurePolicy used by this cluster. Required - Must refer to a valid Immutable. |
true |
storageSpace |
string |
StorageSpace declares the disk size allocated to each node hosting the workload. You can express storage as a plain integer or as a fixed-point number using one of these suffixes - E, P, T, G, M, k. You can also use the power-of-two equivalents - Ei, Pi, Ti, Gi, Mi, Ki Range - 20Gi - 32Ti. Required. Mutable - (increase only). |
true |
version |
string |
Version declares the version of the database engine to be used. To upgrade the database engine change this field. The list of supported engine versions can be found by inspecting the DataServiceVersion resources and in the VMware Data Services Manager UI. Version Validations for Cluster Restore Scenarios: When creating a new cluster based on an existing cluster or backup (via spec.basedOn), the following version validation rules apply at cluster creation time: General Rules (All Database Engines):
PostgreSQL-Specific Rules:
MySQL-Specific Rules:
Required. Mutable. |
true |
object |
VMClass refers to the VM class that should be used to create this cluster. It must be part of the InfrastructurePolicy used by this cluster. Required - Must refer to a valid Mutable - (Only increases in resources are allowed). |
true |
|
object |
AdminPasswordRef refers to a v1.Secret containing the password which the privileged user will use to connect
to the database. The secret must be in the same namespace as the database cluster.
FieldPath field indicates which key in the secret contains the password. Default - If the cluster is a replica with SyncUsersFromSource=true, this field has no effect until the replica is promoted. Default - password is auto generated. Mutable. It is possible to refer to a new Secret to update the admin password, but it is not required. Updates in the already referenced Secret will also lead to update of the password. |
false |
|
adminUsername |
string |
AdminUserName is the desired name of the privileged user to be used when connecting to the database. AdminUserName should not be one of the following - root, mysql.sys, mysql.session, mysql.infoschema, mysql-backup, mysql-healthcheck, mysql-metrics, telegraf-metrics, mysql-tls-admin, mysql-router, innodb-cluster-admin, mysqlappuser, mysql-pitr. Its length should not be more than 32 characters. If the cluster is a replica with SyncUsersFromSource=true, this field has no effect until the replica is promoted. Default - mysql-admin. Immutable. |
false |
object |
BackupConfig declares the cluster’s backup configuration details. If specified a Optional. Mutable. |
false |
|
object |
BackupLocation, if specified, must point to an existing BackupLocation custom resource in the same namespace as the cluster or in the DSM system namespace. It will be used by the 'BackupConfig', which must be specified whenever BackupLocation is specified. If specified, a Optional. Mutable. |
false |
|
object |
BasedOn identifies the source cluster on which this cluster will be based on. Users cannot base their clusters on clusters owned by other users unless the user has DSM_Admin role. The new cluster will inherit the ownership from its source cluster. It can be changed if necessary after the cluster is created. Field Cluster works both if the cluster is alive and if it is deleted, but we are still retaining its backups. To create a new MySQL cluster based on a live cluster pass the name of the cluster. To create a new MySQL cluster based on an archived cluster with retained backups pass the name of the ArchivedMySQLCluster The only allowed mutation of the BasedOn field is to set it to nil if it was previously set to contain ReplicationSource. See MySQLBasedOnParams.ReplicationSource for details. Optional. Mutable. |
false |
|
object |
DatabaseConfig refers to the database config object that will be applied to this cluster. Database Config is used to apply custom params/configs to the database represented by this CR.
The provided parameters go into the DatabaseConfig Validation Rules:
Optional. Mutable. |
false |
|
databaseName |
string |
If DatabaseName is set, database with that name will be created (if it doesn’t exist) and MySQLCluster.Status.Connection.DbName and ArchivedMySQLCluster.Status.DatabaseName will be set to that name. If the cluster is restored from another cluster (Spec.BasedOn.Cluster field is used) all databases from the source cluster are restored with preserved names and one additional database is created with name the given DatabaseName. This database is empty and MySQLCluster.Status.Connection.DbName and ArchivedMySQLCluster.Status.DatabaseName refer to it. If DatabaseName is equal to the name of database from the source cluster no additional database is created and MySQLCluster.Status.Connection.DbName and ArchivedMySQLCluster.Status.DatabaseName refer to the specified database with name the given DatabaseName. If DatabaseName is empty no additional database is created and MySQLCluster.Status.Connection.DbName and ArchivedMySQLCluster.Status.DatabaseName refer the same database the status connection info of the source cluster refers to. DatabaseName should not be one of the following - root, mysql.sys, mysql.session, mysql.infoschema, mysql-backup, mysql-healthcheck, mysql-metrics, telegraf-metrics, mysql-tls-admin, mysql-router, innodb-cluster-admin, mysqlappuser, mysql-pitr. Its length should not be more than 64 characters. Default - if the cluster is restored one, the database name in the source cluster’s MySQLCluster.Status.Connection.DbName is used, otherwise DatabaseName is the same as the cluster’s name. Immutable. |
false |
description |
string |
Description contains the human-readable description of the cluster. Optional. Mutable. |
false |
object |
DirectoryService refers to the DirectoryService resource with LDAP settings used by this cluster for authenticating clients. Optional. Mutable. |
false |
|
dnsNames |
[]string |
One or more DNS names / FQDNs for database access. These DNS names will be included in the SAN field of the TLS certificate if auto-generated by DSM. The first DNS name will also be included in the URL connection string displayed in DSM UI. If a custom TLS certificate is provided, it is important its SAN field to match the DNS names provided here, so clients can ensure a secure connection. Optional. Mutable. When updated, DSM will re-generate the TLS certificate if no custom certificate is provided. |
false |
extraClients |
[]string |
ExtraClients is a list of additional IPv4 addresses/ranges that should be allowed to access the database service. Use cases include: * having applications outside of the tenant organization namespace that need to access the database cluster. * configuring replication for the database cluster from a different region. * troubleshooting issues with the database cluster. Optional. Mutable. |
false |
object |
MaintenanceWindow refers to the System maintenance window. Enabled Maintenance Window will allow CVEs, bug fixes and new Lifecycle Management features for the VM, OS, any supporting software to be addressed. Automatic upgrades applied during this window should only result in minimum downtime of deployed databases for HA clusters. Database minor version upgrades might also be performed. Refer to engine-specific automatic upgrade details which are documented at the corresponding top-level API docs. Optional. Mutable. |
false |
|
members |
integer |
The number of members for cluster. Could be Default - Mutable.
|
false |
object |
PlacementSelector refers to a placement declared in the InfrastructurePolicy. Usually this field should be left empty to allow the system to determine it automatically.
A placement should be found in the Optional. Immutable. |
false |
|
supportAsynchReplicas |
boolean |
SupportAsynchReplicas controls whether the cluster is provisioned with features required for it to be used by replicas as a source. Optional. Mutable.
|
false |
object |
TLS refers to the SSL/TLS configuration of the database cluster. Optional. Mutable. |
false |
|
object |
UpgradeSafeguards configures the safeguards that need to pass before allowing a major/minor version upgrade to proceed. If specified, the .spec.upgradeSafeguards.targetVersion must match canonical .spec.Version. If not specified, either default safeguard values will be used or, if present, the values of the following legacy annotations may be applicable (for details, see engine-specific major/minor version upgrade documentation): dsm.vmware.com/skip-pre-upgrade-backup dsm.vmware.com/upgrade-cluster-without-backups dsm.vmware.com/upgrade-cluster-with-failing-backups dsm.vmware.com/upgrade-cluster-with-alerts UpgradeSafeguards cannot be used in combination with any of the deprecated annotations from the list above, regardless of the referenced target versions. Optional. Mutable. |
false |
|
[]object |
VSphereTags is the list of vSphere tags that the cluster’s deployed virtual machines should have assigned. The tags should exist in vSphere in order to be successfully assigned. Optional. Mutable. |
false |
MySQLSnapshot.status.sourceClusterSpec.infrastructurePolicy
InfrastructurePolicy refers to the infrastructure policy resource used to create this cluster.
Required - Must refer to a valid InfrastructurePolicy.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
kind |
string |
Kind of the referent. |
false |
name |
string |
The Name of the referent. |
false |
namespace |
string |
The Namespace of the referent. |
false |
MySQLSnapshot.status.sourceClusterSpec.vmClass
VMClass refers to the VM class that should be used to create this cluster. It must be part of the InfrastructurePolicy used by this cluster.
Required - Must refer to a valid VMClass.
Mutable - (Only increases in resources are allowed).
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MySQLSnapshot.status.sourceClusterSpec.adminPasswordRef
AdminPasswordRef refers to a v1.Secret containing the password which the privileged user will use to connect
to the database. The secret must be in the same namespace as the database cluster.
FieldPath field indicates which key in the secret contains the password. Default - password.
Providing inline value with Value field is not supported.
The owner of the Secret must be the same as the owner of the DB cluster. When the owner of the DB
cluster is changed the owner of the Secret is automatically changed to the new owner.
If the cluster is a replica with SyncUsersFromSource=true, this field has no effect until the replica is promoted.
Default - password is auto generated.
Mutable. It is possible to refer to a new Secret to update the admin password, but it is not required. Updates in the already referenced Secret will also lead to update of the password.
| Name | Type | Description | Required |
|---|---|---|---|
fieldPath |
string |
data.<key> for secrets. Optional. For most references there is a canonical key |
false |
name |
string |
The name of the secret |
false |
value |
string |
Deprecated. This field is never used by the Data Services Manager. |
false |
MySQLSnapshot.status.sourceClusterSpec.backupConfig
BackupConfig declares the cluster’s backup configuration details.
If specified a BackupLocation must also be specified.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
backupRetentionDays |
integer |
BackupRetentionDays indicates the number of days for which the database’s
Point-in-Time Recovery (PITR) is expected to be available.
Must be Required. Mutable.
|
true |
[]object |
Schedules determine the type and frequency of backups, with the latter defined by a cron expression. Required. Mutable. |
true |
|
uploadChunkSize |
int or string |
UploadChunkSize setting that allows for the user to override the default chunk size used in multipart uploads and specify the part size themselves, taking into account the specifics of their environment and the target backup storage. There are tradeoffs associated with tuning the value of the UploadChunkSize. On one hand side each part is a separate S3 PUT operation so chunking the backup in too small parts comes at a certain cost. On the other hand side, parts are buffered in memory and the larger the part, the greater the chance of an upload failure depending on the reliability of the network. Thus, a high chunk size value comes with a higher memory footprint and a higher risk for upload failure. The memory utilization of the backup routine may increase with up to 5 times the configured upload chunk size due to the parallel upload capability of the object uploader. Note that the backup doesn’t include all files in the MySQL data directory and the backup stream is compressed, which means that size of the backup object would vary significantly based on the type of data in the database. In general one can expect that the backup object size is around 1% to 10% of the disk utilization of the MySQL database instance (i.e. the MySQL data directory). The format of the specified value should be a Kubernetes resource quantity - https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/quantity/ Range - 5Mi - 5Gi Default - 10Mi Supported in Data Service Manager data plane version 2.2.2 and above. Optional. Mutable. |
false |
MySQLSnapshot.status.sourceClusterSpec.backupConfig.schedules[index]
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the schedule. Required. Immutable. |
true |
schedule |
string |
The schedule in the form of a cron schedule. Required. Mutable. |
true |
type |
string |
Type of schedule. Can be Required. Immutable. |
true |
MySQLSnapshot.status.sourceClusterSpec.backupLocation
BackupLocation, if specified, must point to an existing BackupLocation custom resource in the same namespace as the cluster or in the DSM system namespace. It will be used by the 'BackupConfig', which must be specified whenever BackupLocation is specified.
If specified, a backupConfig must also be specified.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MySQLSnapshot.status.sourceClusterSpec.basedOn
BasedOn identifies the source cluster on which this cluster will be based on.
Users cannot base their clusters on clusters owned by other users unless the user has DSM_Admin role. The new cluster will inherit the ownership from its source cluster. It can be changed if necessary after the cluster is created.
Field Cluster works both if the cluster is alive and if it is deleted, but we are still retaining its backups. To create a new MySQL cluster based on a live cluster pass the name of the cluster. To create a new MySQL cluster based on an archived cluster with retained backups pass the name of the ArchivedMySQLCluster
The only allowed mutation of the BasedOn field is to set it to nil if it was previously set to contain ReplicationSource. See MySQLBasedOnParams.ReplicationSource for details.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
backup specifies a MySQLClusterBackup to use as the restore source. Cannot be set if Cluster, ReplicationSource, or Snapshot is set, too. One of the four has to be set. Immutable. Once set, this field cannot be modified. Optional.
|
false |
|
object |
Cluster contains the name of the source cluster and timestamp to use as the restore point. Cannot be set if ReplicationSource, Snapshot, or Backup is set, too. One of the four has to be set. Optional. Immutable. |
false |
|
object |
ReplicationSource specifies that the cluster will be based on a source cluster from which this cluster will replicate asynchronously. Cannot be set if Cluster, Snapshot, or Backup is set, too. One of the four has to be set. When a cluster with previously configured basedOn.ReplicationSource field is updated to remove basedOn, the cluster will be decoupled from its source cluster and promoted to an independent read/write cluster. Promotion is irrevocable and doesn’t wait for in-flight data from the source to be flushed to the replica. The completion of promotion will be indicated by the removal of the IncomingReplicationStatus status field. If SyncUsersFromSource was previously true, the admin user credentials on the promoted cluster will be re-generated or, if AdminUser/AdminPasswordRef was populated, set to its value. In both cases, cluster connection status will be changed to refer to these admin user credentials as in any non-replica cluster. Optional. Immutable. |
false |
|
object |
Snapshot specifies that the cluster will be a linked clone of the snapshot to which this reference is pointing. Cannot be set if Cluster, ReplicationSource, or Backup is set, too. One of the four has to be set. A snapshot-based cluster will permanently depend on the existence of the snapshot on which it is based and thus, on the cluster from which the snapshot was taken and the storage used by it. A cluster must be using a SupervisorInfrastructurePolicy and a single availability zone to be a snapshot clone. Optional. Immutable.
|
false |
MySQLSnapshot.status.sourceClusterSpec.basedOn.backup
backup specifies a MySQLClusterBackup to use as the restore source. Cannot be set if Cluster, ReplicationSource, or Snapshot is set, too. One of the four has to be set.
Immutable. Once set, this field cannot be modified.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
name specifies the MySQLClusterBackup name Optional. |
false |
time |
string |
time is the point in time to restore to when the referenced MySQLClusterBackup has sourceBackup populated and its location pointing to an automated continuous backup set with binlogs that allow PITR. The restore will happen to the last available recovery time before the given time. If time is not provided, restore will be initiated to the latest available recovery time. Optional. Immutable.
|
false |
MySQLSnapshot.status.sourceClusterSpec.basedOn.cluster
Cluster contains the name of the source cluster and timestamp to use as the restore point. Cannot be set if ReplicationSource, Snapshot, or Backup is set, too. One of the four has to be set.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name is the name of the source cluster from which to restore. Required. Immutable. |
true |
timestamp |
string |
Timestamp is the point in time to restore from. The restore will happen to the last available recovery time before the given time. If timestamp is not provided restore will be initiated to the latest available recovery time. Optional. Immutable.
|
false |
MySQLSnapshot.status.sourceClusterSpec.basedOn.replicationSource
ReplicationSource specifies that the cluster will be based on a source cluster from which this cluster will replicate asynchronously. Cannot be set if Cluster, Snapshot, or Backup is set, too. One of the four has to be set.
When a cluster with previously configured basedOn.ReplicationSource field is updated to remove basedOn, the cluster will be decoupled from its source cluster and promoted to an independent read/write cluster. Promotion is irrevocable and doesn’t wait for in-flight data from the source to be flushed to the replica. The completion of promotion will be indicated by the removal of the IncomingReplicationStatus status field. If SyncUsersFromSource was previously true, the admin user credentials on the promoted cluster will be re-generated or, if AdminUser/AdminPasswordRef was populated, set to its value. In both cases, cluster connection status will be changed to refer to these admin user credentials as in any non-replica cluster.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
ClusterConnectionParams specifies connection parameters for connecting to the source cluster. This is currently the only option for specifying a source cluster. Required |
true |
|
syncUsersFromSource |
boolean |
SyncUsersFromSource specifies whether database users and their credentials are managed locally on the replica (false) or replicated from the source cluster (true). When set to true, all DB users on the replica and their credentials will be replicated from the source. Cluster connection status will refer to a replication user and its credentials. No local user management (CREATE, DROP, ALTER) should be performed on the replica database directly. If AdminUserName or AdminPasswordRef are set on the replica, they will be ignored until it is promoted or SyncUsersFromSource is switched to false. When set to false, the replica cluster users are managed the same way as in a non-replica cluster. The only permitted change of this field is from true to false, in which case existing replicated users are retained as the initial state of locally managed users, and then AdminUserName/AdminPasswordRef are applied. Required Mutable
|
true |
MySQLSnapshot.status.sourceClusterSpec.basedOn.replicationSource.clusterConnectionParams
ClusterConnectionParams specifies connection parameters for connecting to the source cluster. This is currently the only option for specifying a source cluster.
Required
| Name | Type | Description | Required |
|---|---|---|---|
object |
Credentials specifies a Kubernetes secret that contains the credentials needed to connect to the source cluster. Required fields of the secret are username and password. The referenced MySQL user must have connection, replication and clone privilege on the source cluster. This field is mutable. Changes to the secret will be automatically applied on the instance. Required. Mutable. |
true |
|
endpoints |
[]string |
Endpoints is a list of servers that are members of a single cluster, in host:port format. Connections to the servers will be tried in the order specified, and a server will be used only if connection attempts to those preceding it in the list have failed. The list can contain a sub-set of the source cluster members, in which case replication will depend on the health of this sub-set. Required. Mutable. |
true |
object |
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when validating the Servers connection.
Optional. By default, it will use the DSM globally trusted certificates ConfigMap. Mutable. |
false |
MySQLSnapshot.status.sourceClusterSpec.basedOn.replicationSource.clusterConnectionParams.credentials
Credentials specifies a Kubernetes secret that contains the credentials needed to connect to the source cluster. Required fields of the secret are username and password. The referenced MySQL user must have connection, replication and clone privilege on the source cluster. This field is mutable. Changes to the secret will be automatically applied on the instance.
Required.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MySQLSnapshot.status.sourceClusterSpec.basedOn.replicationSource.clusterConnectionParams.trustBundle
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when validating the Servers connection.
-
Well-known OS-trusted CA, or a DSM globally trusted certificate - TrustBundle can be omitted, or it should point to DSM globally trusted certificates ConfigMap.
-
Certificate signed by CA that should not be globally trusted by DSM - TrustBundle reference must point to ConfigMap with key
tls.crtthat contains only Issuer certificate(s). If an end-entity (i.e. server) certificate is provided it must be issued by itself, i.e. self-signed.
Optional. By default, it will use the DSM globally trusted certificates ConfigMap.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
MySQLSnapshot.status.sourceClusterSpec.basedOn.snapshot
Snapshot specifies that the cluster will be a linked clone of the snapshot to which this reference is pointing. Cannot be set if Cluster, ReplicationSource, or Backup is set, too. One of the four has to be set. A snapshot-based cluster will permanently depend on the existence of the snapshot on which it is based and thus, on the cluster from which the snapshot was taken and the storage used by it. A cluster must be using a SupervisorInfrastructurePolicy and a single availability zone to be a snapshot clone.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name refers to a MySQLSnapshot in the same namespace from which to clone this cluster. The snapshot must have Ready condition with status True, be from the same MySQL major and minor version as this cluster, have the same StorageSpace, and use the same vSphere storage and spec.infrastructurePolicy. Supported in Data Services Manager data plane version 9.1.0.0 and above. Immutable. Required.
|
true |
MySQLSnapshot.status.sourceClusterSpec.databaseConfig
DatabaseConfig refers to the database config object that will be applied to this cluster.
Database Config is used to apply custom params/configs to the database represented by this CR.
The provided parameters go into the mysql.cnf file.
DatabaseConfig Validation Rules:
-
Exclusivity: A DatabaseConfig can only be applied to a single cluster at a time. If a DatabaseConfig is already in use by another cluster, it cannot be assigned to a new cluster or changed to reference a different cluster.
-
Namespace: The DatabaseConfig must exist in the same namespace as the cluster.
-
Deletion Protection: A DatabaseConfig cannot be deleted while it is in use by a cluster.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MySQLSnapshot.status.sourceClusterSpec.directoryService
DirectoryService refers to the DirectoryService resource with LDAP settings used by this cluster for authenticating clients.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
MySQLSnapshot.status.sourceClusterSpec.maintenanceWindow
MaintenanceWindow refers to the System maintenance window. Enabled Maintenance Window will allow CVEs, bug fixes and new Lifecycle Management features for the VM, OS, any supporting software to be addressed. Automatic upgrades applied during this window should only result in minimum downtime of deployed databases for HA clusters. Database minor version upgrades might also be performed. Refer to engine-specific automatic upgrade details which are documented at the corresponding top-level API docs.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
duration |
string |
Duration describes the duration of the maintenance window. Required. Mutable. |
true |
startDay |
enum |
StartDay describes the day of the week the maintenance window will commence. Can be any of Required. Mutable.
|
true |
startTime |
string |
StartTime describes the time of the day (UTC time) to start the maintenance window. Required. Mutable. |
true |
startDayWeeksOfMonth |
[]enum |
StartDayWeeksOfMonth field specifies the weeks of the month in which the
maintenance window will commence. It accepts up to five distinct
values from {1, 2, 3, 4, L}, where each number represents the
occurrence of the designated StartDay within the month ("1" being
the first one that includes it and "L" being the last one).
For example, providing Optional. Mutable.
|
false |
MySQLSnapshot.status.sourceClusterSpec.placementSelector
PlacementSelector refers to a placement declared in the InfrastructurePolicy.
Usually this field should be left empty to allow the system to determine it automatically.
A placement should be found in the InfrastructurePolicy with the same datacenter,
cluster and resource pool to be considered valid.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
cluster |
string |
Cluster is the datacenter’s cluster name to be used when placing the data service workload. Use the full qualified name of the cluster, relative to the datacenter. A cluster "Cluster1" inside a folder "clusters", should be declared as "clusters/Cluster1". Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the cluster name. Required. Mutable. |
true |
datacenter |
string |
Datacenter is the vSphere Datacenter to be used when placing the data service workload. The full qualified path to the datacenter must be provided if the datacenter is placed inside a folder. Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the datacenter name. Required. Mutable. |
true |
resourcePool |
string |
ResourcePool is the Cluster’s resource pool to be used when placing the data service workload. If the resource pool is not provided, the whole cluster is used as the placement. Optional. Mutable. |
false |
MySQLSnapshot.status.sourceClusterSpec.tls
TLS refers to the SSL/TLS configuration of the database cluster.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
secretName |
string |
The name of a Secret resource present in the same namespace as the database cluster, describing a custom certificate. The expected format of the Secret is the same as the output Secrets created by cert-manager’s Certificate resource. It needs to have keys: tls.crt: PEM signed certificate chain tls.key: PEM private key ca.crt: PEM CA certificate The ca.crt is optional if there is at least one issuer certificate in the certificate chain (tls.crt key). That issuer can either be a self-signed leaf certificate, or an intermediate or root certificate authority. Optional. When omitted, DSM will auto-generate a certificate using its own internal certificate authority. When specified, DSM will override its auto-generated certificate and use the one described in the Secret. Mutable. To update a custom certificate, either refer to a new Secret, or update the already referenced one. If the database cluster will be accessed by IP, the TLS configuration needs to be applied after initial creation, because the IP can be retrieved only then, so it can be encoded in the certificate. |
false |
MySQLSnapshot.status.sourceClusterSpec.upgradeSafeguards
UpgradeSafeguards configures the safeguards that need to pass before allowing a major/minor version upgrade to proceed. If specified, the .spec.upgradeSafeguards.targetVersion must match canonical .spec.Version. If not specified, either default safeguard values will be used or, if present, the values of the following legacy annotations may be applicable (for details, see engine-specific major/minor version upgrade documentation): dsm.vmware.com/skip-pre-upgrade-backup dsm.vmware.com/upgrade-cluster-without-backups dsm.vmware.com/upgrade-cluster-with-failing-backups dsm.vmware.com/upgrade-cluster-with-alerts
UpgradeSafeguards cannot be used in combination with any of the deprecated annotations from the list above, regardless of the referenced target versions.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
targetVersion |
string |
TargetVersion must equal spec.version. If the cluster is to be upgraded again and its spec.version changes, either the outdated prior safeguard should be removed or it should be updated along with its TargetVersion. Required. |
true |
allowWithActiveAlerts |
boolean |
AllowWithActiveAlerts, if true, will allow further processing even if active alerts on the cluster exist. Optional. Mutable. Default: false
|
false |
allowWithoutBackup |
boolean |
AllowWithoutBackup, if true, will allow further processing for major version upgrade even if the backup that is taken as part of this safeguard could not be started or failed. An attempt to create such a backup will always be made, with further processing dependent on the value of this field. For minor version upgrade this value is not applicable, as no pre-upgrade backup will be made. Accepted values in this case are nil and true, false will be rejected. Optional. Mutable. |
false |
MySQLSnapshot.status.sourceClusterSpec.vSphereTags[index]
VSphereTag identifies a single vSphere tag by its tag category and tag name.
| Name | Type | Description | Required |
|---|---|---|---|
category |
string |
Category is the vSphere tag category Required. Mutable. |
true |
tag |
string |
Tag is the vSphere tag. It should be part of vSphere tag category Category. Required. Mutable. |
true |
MySQLSnapshot.status.sourceClusterStatus
SourceClusterStatus contains preserved, non-ephemeral information from the source cluster’s status at the time the snapshot was taken.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
databaseName |
string |
DatabaseName is the name of the primary database in the source cluster at the time of the snapshot. This is populated from the source MySQLCluster’s status.connection.dbName field. |
true |
PostgresClusterBackup
PostgresClusterBackup is the schema for the PostgresClusterBackup API.
A PostgresClusterBackup can be used in two ways:
-
To create a new backup: Set spec.sourceCluster to reference an existing PostgresCluster. The backup will be created from that cluster and stored in the specified backup location. The backup created has its own lifecycle and is independent of any backup configuration defined in the source cluster’s spec.backupConfig.
-
To reference an existing backup: Set spec.sourceBackup.path to reference an existing backup stored at a specific path in the backup location. This allows restoring from backups that were created outside of DSM or from backups in different namespaces.
Exactly one of spec.sourceBackup or spec.sourceCluster must be specified. They are mutually exclusive.
To create a new backup, provide a name and namespace for the object, and set: * spec.backupLocation.name to reference an existing backup location * spec.sourceCluster.name to reference the source cluster to back up
Example (creating a new backup):
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: PostgresClusterBackup
metadata:
name: new-postgres-backup
namespace: default
spec:
backupLocation:
name: "backup-storage"
sourceCluster:
name: "postgres-db"
Example (referencing an existing backup):
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: PostgresClusterBackup
metadata:
name: external-backup-reference
namespace: default
spec:
backupLocation:
name: "backup-storage"
sourceBackup:
path: "backups/postgres/cluster-1/2024-01-15"
Once completed or when referencing an existing backup, the PostgresClusterBackup can serve as a restoration point into a new cluster.
Selectable fields are defined to make operational querying easier:
* .spec.sourceCluster.name allows listing backups from a particular source cluster.
Example: kubectl get pgbackup --field-selector spec.sourceCluster.name=postgres-db
* .spec.backupLocation.name allows listing backups stored in a specific location.
Example: kubectl get pgbackup --field-selector spec.backupLocation.name=backup-storage
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
databases.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
PostgresClusterBackup |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
spec defines the desired state of the PostgresClusterBackup Required.
|
true |
|
object |
status defines the observed state of the PostgresClusterBackup Optional. |
false |
PostgresClusterBackup.spec
spec defines the desired state of the PostgresClusterBackup
Required.
| Name | Type | Description | Required |
|---|---|---|---|
object |
backupLocation must point to an existing BackupLocation resource. Immutable. Required.
|
true |
|
backupFilesDeletionPolicy |
enum |
backupFilesDeletionPolicy defines the behavior of the backup files cleanup process when a PostgresClusterBackup is deleted. Use this to facilitate deletion when the storage is inaccessible or the clean up is otherwise obstructed (which results in the backup’s Ready status condition being stuck in Reason=Deleting), or when you want to keep the backup files for other purposes. Delete: the backup files in the storage are deleted when the PostgresClusterBackup is deleted. Retain: the backup files in the storage are not deleted when the PostgresClusterBackup is deleted. Mutable. Default: * "Delete" when sourceCluster is specified (creating a new backup) * "Retain" when sourceBackup is specified (referencing an existing backup) Note: When sourceBackup is specified, only "Retain" is allowed. The "Delete" policy is not permitted for backups that reference existing backup files, as they may be used by other systems.
|
false |
object |
sourceBackup specifies the configuration for referencing an existing backup. This field should be set if the backup already exists and only needs a representation in DSM. Currently, only pgBackRest based backups are supported. The path should point to the root of a pgBackRest backup. The backup structure can be verified by checking for the expected layout: {path}/backup/{stanza}/… (required) {path}/backup/{stanza}/backup.info {path}/archive/{stanza}/… (only if wal archiving is enabled) Backup taken by DSM managed PostgresCluster will always have the needed layout and metadata. This field is mutually exclusive with sourceCluster. Exactly one of sourceBackup or sourceCluster must be specified. When sourceBackup is set, the PostgresClusterBackup references an existing backup at the specified path rather than creating a new backup from a source cluster. Immutable. Optional.
|
false |
|
object |
sourceCluster must point to an existing cluster resource in the same namespace as the PostgresClusterBackup. The full database backup will be performed on this cluster. This field is mutually exclusive with sourceBackup. Exactly one of sourceBackup or sourceCluster must be specified. When sourceCluster is set, a new backup will be created from the specified cluster. The created backup will be stored in the specified remote storage location under the ondemandbackups prefix (e.g., <bucket-path>/ondemandbackups). Immutable. Optional.
|
false |
PostgresClusterBackup.spec.backupLocation
backupLocation must point to an existing BackupLocation resource.
Immutable.
Required.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
PostgresClusterBackup.spec.sourceBackup
sourceBackup specifies the configuration for referencing an existing backup. This field should be set if the backup already exists and only needs a representation in DSM.
Currently, only pgBackRest based backups are supported. The path should point to the root of a pgBackRest backup. The backup structure can be verified by checking for the expected layout: {path}/backup/{stanza}/… (required) {path}/backup/{stanza}/backup.info {path}/archive/{stanza}/… (only if wal archiving is enabled)
Backup taken by DSM managed PostgresCluster will always have the needed layout and metadata.
This field is mutually exclusive with sourceCluster. Exactly one of sourceBackup or sourceCluster must be specified. When sourceBackup is set, the PostgresClusterBackup references an existing backup at the specified path rather than creating a new backup from a source cluster.
Immutable.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
path |
string |
Required. |
true |
backupId |
string |
backupId is an optional identifier used to locate a specific backup within the path. In case of a pgbackrest backup: * the backupId corresponds to the stanza name. * when specified, it is used as the stanza name to directly locate the backup.info file at {path}/backup/{backupId}/backup.info. If the backup.info file is not found at this location, reconciliation will fail with an error. When not specified: * If exactly one backup is found under the path, it will be used automatically. * If multiple backups are found under the path, reconciliation will fail with an error indicating that backupId must be specified to select which backup to use. Optional. |
false |
PostgresClusterBackup.spec.sourceCluster
sourceCluster must point to an existing cluster resource in the same namespace as the PostgresClusterBackup. The full database backup will be performed on this cluster.
This field is mutually exclusive with sourceBackup. Exactly one of sourceBackup or sourceCluster must be specified. When sourceCluster is set, a new backup will be created from the specified cluster.
The created backup will be stored in the specified remote storage location under the ondemandbackups prefix (e.g., <bucket-path>/ondemandbackups).
Immutable.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
PostgresClusterBackup.status
status defines the observed state of the PostgresClusterBackup
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
backupId |
string |
backupId is a Backup identifier for DSM internal identification purposes. Optional |
false |
backupStorageLocation |
string |
backupStorageLocation is the full path to the backup files in the backup location. For example, /ondemandbackup/<engine>/<namespace>/<cluster-name>/<backup-name>/<backup-uid> Optional |
false |
[]object |
conditions is an observed conditions list of a PostgresClusterBackup. Each condition provides detailed status information for a specific aspect of the resource lifecycle.
Optional |
false |
|
endTime |
string |
endTime indicates the time that this PostgresClusterBackup completed or failed. Transactions committed after this time will not be included in the backup. Transactions committed while the backup was in progress are expected to be included in the backup, although this is not strictly guaranteed. When using sourceBackup, this represents the latest completion time across all backups in the backup path. The StartTime/EndTime interval represents a time range across potentially multiple (full or incremental) backups. Note that if there are gaps in the backup history (e.g., continuous backup/archiving was disabled, backups were deleted, or there are time gaps between scheduled backups), the interval may not represent continuous coverage. Optional
|
false |
object |
postgresClusterMetadata contains the labels of the source cluster at the time when the backup was created Optional |
false |
|
postgresClusterSourceName |
string |
postgresClusterSourceName is the name of the source cluster that was backed up. If SourceCluster is set, it will be the same as SourceCluster.Name otherwise it will be extracted from the backup metadata if available or left as empty string. Optional |
false |
object |
postgresClusterSpec is the spec of the backed-up cluster at the time of the backup. Optional |
false |
|
startTime |
string |
startTime indicates the time that this PostgresClusterBackup was started. When using sourceBackup, this represents the earliest start time across all backups in the backup path. Optional
|
false |
PostgresClusterBackup.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
PostgresClusterBackup.status.postgresClusterMetadata
postgresClusterMetadata contains the labels of the source cluster at the time when the backup was created
Optional
| Name | Type | Description | Required |
|---|---|---|---|
labels |
map[string]string |
Optional |
false |
PostgresClusterBackup.status.postgresClusterSpec
postgresClusterSpec is the spec of the backed-up cluster at the time of the backup.
Optional
| Name | Type | Description | Required |
|---|---|---|---|
object |
InfrastructurePolicy refers to the infrastructure policy resource used to create this cluster. Required - Must refer to a valid Immutable. |
true |
|
storagePolicyName |
string |
StoragePolicyName declares the name of the storage policy that should be used to create this postgres cluster. It must be part of the InfrastructurePolicy used by this cluster. Required - Must refer to a valid Immutable. |
true |
storageSpace |
string |
StorageSpace declares the disk size allocated to each node hosting the workload. You can express storage as a plain integer or as a fixed-point number using one of these suffixes - E, P, T, G, M, k. You can also use the power-of-two equivalents - Ei, Pi, Ti, Gi, Mi, Ki Range - 20Gi - 32Ti. Required. Mutable - (increase only). |
true |
version |
string |
Version declares the version of the database engine to be used. To upgrade the database engine change this field. The list of supported engine versions can be found by inspecting the DataServiceVersion resources and in the VMware Data Services Manager UI. Version Validations for Cluster Restore Scenarios: When creating a new cluster based on an existing cluster or backup (via spec.basedOn), the following version validation rules apply at cluster creation time: General Rules (All Database Engines):
PostgreSQL-Specific Rules:
MySQL-Specific Rules:
Required. Mutable. |
true |
object |
VMClass refers to the VM class that should be used to create this cluster. It must be part of the InfrastructurePolicy used by this cluster. Required - Must refer to a valid Mutable - (Only increases in resources are allowed). |
true |
|
object |
AdminPasswordRef refers to a v1.Secret containing the password which the privileged user will use to connect
to the database. The secret must be in the same namespace as the database cluster.
FieldPath field indicates which key in the secret contains the password. Default - Read replicas (that is, clusters with Spec.BasedOn.ContinuousRecovery.Enabled set to true) do not support having their own privileged user. If this field is set on a read replica, it will only take effect after the read replica is promoted. Default - password is auto generated. Mutable. It is possible to refer to a new Secret to update the admin password, but it is not required. Updates in the already referenced Secret will also lead to update of the password. |
false |
|
adminUsername |
string |
AdminUserName is the desired name of the privileged user to be used when connecting to the database. AdminUserName should not be one of the following - pg_read_all_data, pg_write_all_data, pg_read_all_settings, pg_read_all_stats, pg_stat_scan_tables, pg_monitor, pg_database_owner, pg_signal_backend, pg_read_server_files, pg_write_server_files, pg_execute_server_program, pg_checkpoint, pg_use_reserved_connections, pg_create_subscription, postgres, template1, template0. Default - pgadmin. Immutable. |
false |
object |
BackupConfig declares the cluster’s backup configuration details. If specified a Optional. Mutable. |
false |
|
object |
BackupLocation, if specified, must point to an existing BackupLocation custom resource in the same namespace as the cluster or in the DSM system namespace. It will be used by the 'BackupConfig', which must be specified whenever BackupLocation is specified. If specified, a Optional. Mutable. |
false |
|
object |
BasedOn identifies the source (primary) cluster on which this cluster will be based on. Users cannot base their clusters on clusters owned by other users unless the user has DSM_Admin role. The new cluster will inherit the ownership from its source(primary) cluster. It can be changed if necessary after the cluster is created. Field Cluster works both if the cluster is alive and if it is deleted, but we are still retaining its backups. To create a new Postgres cluster based on a live one pass the name of the cluster. To create a new Postgres cluster based on an archived cluster with retained backups pass the name of the ArchivedPostgresCluster. Optional. Immutable. |
false |
|
blockDatabaseConnections |
boolean |
BlockDatabaseConnections restricts all external client access to the database. When set to true, the database forcibly terminates all existing client connections and prevents any new connection attempts, including those from administrative users such as pgadmin. When set to false or unset, client access to the database is permitted as normal. The Ready condition, in combination with the observedGeneration, can be used to verify that this setting has been applied. This field can be useful in disaster recovery (DR) scenarios to ensure no writes or new sessions occur on the original primary(source) during switchover or failover. Default - Optional. Mutable.
|
false |
object |
DatabaseConfig refers to the database config object that will be applied to this cluster. Database Config is used to apply custom params/configs to the database represented by this CR.
The provided parameters go into the Use of shared_preload_libraries key: The property determines which additional libraries are loaded during Postgres startup. Its value is a comma-separated list of libraries available in DSM. * If the parameter is omitted, the cluster applies the default library set (pg_stat_statements, pgaudit, pg_cron), equivalent to: "shared_preload_libraries": "pg_stat_statements,pgaudit,pg_cron" * pg_stat_statements is required by DSM and is always preloaded. Example values: * "pgaudit" - loads pgaudit and pg_stat_statements * "pg_cron" - loads pg_cron and pg_stat_statements * "" - no extra libraries beyond pg_stat_statements DatabaseConfig Validation Rules:
Optional. Mutable. |
false |
|
databaseName |
string |
If DatabaseName is set, database with that name will be created (if it doesn’t exist) and PostgresCluster.Status.Connection.DbName and ArchivedPostgresCluster.Status.DatabaseName will be set to that name. If the cluster is restored from another cluster (Spec.BasedOn.Cluster field is used) all databases from the source cluster are restored with preserved names and one additional database is created with name the given DatabaseName. This database is empty and PostgresCluster.Status.Connection.DbName and ArchivedPostgresCluster.Status.DatabaseName refer to it. If DatabaseName is equal to the name of database from the source cluster no additional database is created and PostgresCluster.Status.Connection.DbName and ArchivedPostgresCluster.Status.DatabaseName refer to the specified database with name the given DatabaseName. If DatabaseName is empty no additional database is created and PostgresCluster.Status.Connection.DbName and ArchivedPostgresCluster.Status.DatabaseName refer the same database the status connection info of the source cluster refers to. If the cluster is a read replica of a primary cluster and has DatabaseName different from the names of the databases in that primary cluster, the additional database with name DatabaseName will be created only after the read replica is promoted to a standalone cluster. DatabaseName should not be one of the following - pg_read_all_data, pg_write_all_data, pg_read_all_settings, pg_read_all_stats, pg_stat_scan_tables, pg_monitor, pg_database_owner, pg_signal_backend, pg_read_server_files, pg_write_server_files, pg_execute_server_program, pg_checkpoint, pg_use_reserved_connections, pg_create_subscription, postgres, template1, template0. It is recommended the length of DatabaseName to not exceed 63 characters, otherwise it will be truncated and only the first 63 characters will be used for database name. Default - if the cluster is restored one, the database name in the source cluster’s PostgresCluster.Status.Connection.DbName is used, otherwise DatabaseName is the same as the cluster’s name. Immutable. |
false |
description |
string |
Description contains the human-readable description of the cluster. Optional. Mutable. |
false |
object |
DirectoryService refers to the DirectoryService resource with LDAP settings used by this cluster for authenticating clients. Optional. Mutable. |
false |
|
dnsNames |
[]string |
One or more DNS names / FQDNs for database access. These DNS names will be included in the SAN field of the TLS certificate if auto-generated by DSM. The first DNS name will also be included in the URL connection string displayed in DSM UI. If a custom TLS certificate is provided, it is important its SAN field to match the DNS names provided here, so clients can ensure a secure connection. Optional. Mutable. When updated, DSM will re-generate the TLS certificate if no custom certificate is provided. |
false |
extraClients |
[]string |
ExtraClients is a list of additional IPv4 addresses/ranges that should be allowed to access the database service. Use cases include: * having applications outside of the tenant organization namespace that need to access the database cluster. * configuring replication for the database cluster from a different region. * troubleshooting issues with the database cluster. Optional. Mutable. |
false |
object |
HbaRef refers to a Secret containing custom The Secret must be in the same namespace as the database cluster. Once created, the HBA Secret cannot be modified. If you need to change the HBA configuration, create a new Secret and update the reference here. The Secret should contain the Only the authentication methods For example, to permit all users whose usernames end with @local to authenticate using their database passwords, you can add: kind: Secret
metadata:
name: db-cluster-1-custom-pg-hba
immutable: true
stringData:
pg_hba.conf: |
host all /^(.*)@local$ all scram-sha-256
Care should be taken to ensure that the custom entries do not interfere with the system-managed entries
or lock out users from accessing the cluster. This is because the order in which the HBA entries are defined matters.
The first record with a matching connection type, client address, requested database, and user name is used to perform authentication.
The final host all pgadmin all scram-sha-256 host all postgres_exporter all scram-sha-256 #<YOUR CUSTOM ENTRIES ARE ADDED HERE> host all all all ldap ... # This entry is added only if directory service is enabled for the cluster host all all all scram-sha-256 Note: Postgres clusters with versions from DSM release >= 9.0.2 require SSL connections for system users
(admin user, monitoring user). This can be overridden by DSM administrators by setting
|
false |
|
object |
Localization specifies the localization configuration for the database cluster. Optional. Immutable. |
false |
|
object |
MaintenanceWindow refers to the System maintenance window. Enabled Maintenance Window will allow CVEs, bug fixes and new Lifecycle Management features for the VM, OS, any supporting software to be addressed. Automatic upgrades applied during this window should only result in minimum downtime of deployed databases for HA clusters. Database minor version upgrades might also be performed. Refer to engine-specific automatic upgrade details which are documented at the corresponding top-level API docs. Optional. Mutable. |
false |
|
object |
PlacementSelector refers to a placement declared in the InfrastructurePolicy. Usually this field should be left empty to allow the system to determine it automatically.
A placement should be found in the Optional. Immutable. |
false |
|
replicas |
integer |
Represents the number of nodes that are replicating from the primary node. In event of a primary outage one of the replicas will be promoted to primary. Replicas can be set to 0 or 1. Starting with Data Services Manager 2.1, 3-replica clusters are no longer supported. If you have replicas set to 1, then you will have 1 primary node and 1 replica node. Read replicas (that is, clusters with Spec.BasedOn.ContinuousRecovery.Enabled set to true) do not support having their own replicas. If this field is set to a non-zero value on a read replica, it will only take effect after this replica is promoted. Default - Mutable.
|
false |
[]object |
ReplicationSlots configures a list of Postgres replication slots that will be created on this cluster for disaster recovery, read replication, or migration purposes. A replication slot can be removed if it is no longer needed and there is no active consumer of that replication slot. Read replicas (that is, clusters with Spec.BasedOn.ContinuousRecovery.Enabled set to true) do not support having replication slots. If this field is set on a read replica, it will only take effect after the read replica is promoted. When upgrading the primary cluster it is recommended to upgrade all read replicas to the same minor version before upgrading the primary cluster. |
false |
|
requestedSharedMemorySize |
int or string |
RequestedSharedMemorySize is the value we would try to assign for shared memory (/dev/shm) of the OS where the Postgres instance is running. No upper limit is enforced, but the system would apply one based on current VMClass memory. You can express RequestedSharedMemorySize as a fixed-point number using one of these suffixes - E, P, T, G, M, k. You can also use the power-of-two equivalents - Ei, Pi, Ti, Gi, Mi, Ki. Range - 64Mi - no limit. Default - Optional. Mutable.
|
false |
object |
TLS refers to the SSL/TLS configuration of the database cluster. Optional. Mutable. |
false |
|
object |
UpgradeSafeguards configures the safeguards that need to pass before allowing a major/minor version upgrade to proceed. If specified, the .spec.upgradeSafeguards.targetVersion must match canonical .spec.Version. If not specified, either default safeguard values will be used or, if present, the values of the following legacy annotations may be applicable (for details, see engine-specific major/minor version upgrade documentation): dsm.vmware.com/skip-pre-upgrade-backup dsm.vmware.com/upgrade-cluster-without-backups dsm.vmware.com/upgrade-cluster-with-failing-backups dsm.vmware.com/upgrade-cluster-with-alerts UpgradeSafeguards cannot be used in combination with any of the deprecated annotations from the list above, regardless of the referenced target versions. Optional. Mutable. |
false |
|
[]object |
VSphereTags is the list of vSphere tags that the cluster’s deployed virtual machines should have assigned. The tags should exist in vSphere in order to be successfully assigned. Optional. Mutable. |
false |
PostgresClusterBackup.status.postgresClusterSpec.infrastructurePolicy
InfrastructurePolicy refers to the infrastructure policy resource used to create this cluster.
Required - Must refer to a valid InfrastructurePolicy.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
kind |
string |
Kind of the referent. |
false |
name |
string |
The Name of the referent. |
false |
namespace |
string |
The Namespace of the referent. |
false |
PostgresClusterBackup.status.postgresClusterSpec.vmClass
VMClass refers to the VM class that should be used to create this cluster. It must be part of the InfrastructurePolicy used by this cluster.
Required - Must refer to a valid VMClass.
Mutable - (Only increases in resources are allowed).
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
PostgresClusterBackup.status.postgresClusterSpec.adminPasswordRef
AdminPasswordRef refers to a v1.Secret containing the password which the privileged user will use to connect
to the database. The secret must be in the same namespace as the database cluster.
FieldPath field indicates which key in the secret contains the password. Default - password.
Providing inline value with Value field is not supported.
The owner of the Secret must be the same as the owner of the DB cluster. When the owner of the DB
cluster is changed the owner of the Secret is automatically changed to the new owner.
Read replicas (that is, clusters with Spec.BasedOn.ContinuousRecovery.Enabled set to true) do not support having their own privileged user. If this field is set on a read replica, it will only take effect after the read replica is promoted.
Default - password is auto generated.
Mutable. It is possible to refer to a new Secret to update the admin password, but it is not required. Updates in the already referenced Secret will also lead to update of the password.
| Name | Type | Description | Required |
|---|---|---|---|
fieldPath |
string |
data.<key> for secrets. Optional. For most references there is a canonical key |
false |
name |
string |
The name of the secret |
false |
value |
string |
Deprecated. This field is never used by the Data Services Manager. |
false |
PostgresClusterBackup.status.postgresClusterSpec.backupConfig
BackupConfig declares the cluster’s backup configuration details.
If specified a BackupLocation must also be specified.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
backupRetentionDays |
integer |
BackupRetentionDays indicates the number of days for which the database’s
Point-in-Time Recovery (PITR) is expected to be available.
Must be Required. Mutable.
|
true |
[]object |
Schedules determine the type and frequency of backups, with the latter defined by a cron expression. Required. Mutable. |
true |
PostgresClusterBackup.status.postgresClusterSpec.backupConfig.schedules[index]
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the schedule. Required. Immutable. |
true |
schedule |
string |
The schedule in the form of a cron schedule. Required. Mutable. |
true |
type |
string |
Type of schedule. Can be Required. Immutable. |
true |
PostgresClusterBackup.status.postgresClusterSpec.backupLocation
BackupLocation, if specified, must point to an existing BackupLocation custom resource in the same namespace as the cluster or in the DSM system namespace. It will be used by the 'BackupConfig', which must be specified whenever BackupLocation is specified.
If specified, a backupConfig must also be specified.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
PostgresClusterBackup.status.postgresClusterSpec.basedOn
BasedOn identifies the source (primary) cluster on which this cluster will be based on.
Users cannot base their clusters on clusters owned by other users unless the user has DSM_Admin role. The new cluster will inherit the ownership from its source(primary) cluster. It can be changed if necessary after the cluster is created.
Field Cluster works both if the cluster is alive and if it is deleted, but we are still retaining its backups. To create a new Postgres cluster based on a live one pass the name of the cluster. To create a new Postgres cluster based on an archived cluster with retained backups pass the name of the ArchivedPostgresCluster.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
backup specifies a PostgresClusterBackup to use as the restore source. This field is mutually exclusive with Cluster. Immutable. Once set, this field cannot be modified. Optional.
|
false |
|
object |
cluster contains the name of the source(primary) cluster and timestamp to use as the restore point. This field is mutually exclusive with Backup. Immutable. Once set, this field cannot be modified. Optional.
|
false |
|
object |
ContinuousRecovery specifies the details of an external cluster that will be used as a source(primary) for continuous recovery. Once configured, this field can’t be unset. |
false |
PostgresClusterBackup.status.postgresClusterSpec.basedOn.backup
backup specifies a PostgresClusterBackup to use as the restore source. This field is mutually exclusive with Cluster.
Immutable. Once set, this field cannot be modified.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
name specifies the PostgresClusterBackup name Optional. |
false |
time |
string |
Time is the point in time to restore to. The restore will happen to the last available recovery time before the given time. If time is not provided restore will be initiated to the latest available recovery time. Optional. Immutable.
|
false |
PostgresClusterBackup.status.postgresClusterSpec.basedOn.cluster
cluster contains the name of the source(primary) cluster and timestamp to use as the restore point. This field is mutually exclusive with Backup.
Immutable. Once set, this field cannot be modified.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name is the name of the source cluster from which to restore. Required. Immutable. |
true |
timestamp |
string |
Timestamp is the point in time to restore from. The restore will happen to the last available recovery time before the given time. If timestamp is not provided restore will be initiated to the latest available recovery time. Optional. Immutable.
|
false |
PostgresClusterBackup.status.postgresClusterSpec.basedOn.continuousRecovery
ContinuousRecovery specifies the details of an external cluster that will be used as a source(primary) for continuous recovery. Once configured, this field can’t be unset.
| Name | Type | Description | Required |
|---|---|---|---|
object |
ReplicationSlot specifies the Postgres replication slot and remote cluster details from which this cluster will continuously recover. If the source (primary) cluster is a DSM managed Postgres cluster, the replication slot details can be retrieved from the status sub-resource of the source (primary) cluster’s PostgresCluster resource. When demoting a Postgres cluster with configured backups to act as a read replica to another cluster, the timeline of the demoted cluster must not exceed the timeline of the primary cluster. |
true |
|
enabled |
boolean |
Enabled specifies if this cluster should continuously retrieve activities from the source (primary) cluster. When Enabled is set to true, this cluster’s Ready condition implies that the cluster is now ready to serve read-only operations. During this period, WAL archiving and backups are paused until the cluster resumes read-write operations. When set to false, the Ready condition implies that the cluster is ready to serve read-write operations. |
false |
PostgresClusterBackup.status.postgresClusterSpec.basedOn.continuousRecovery.replicationSlot
ReplicationSlot specifies the Postgres replication slot and remote cluster details from which this cluster will continuously recover. If the source (primary) cluster is a DSM managed Postgres cluster, the replication slot details can be retrieved from the status sub-resource of the source (primary) cluster’s PostgresCluster resource.
When demoting a Postgres cluster with configured backups to act as a read replica to another cluster, the timeline of the demoted cluster must not exceed the timeline of the primary cluster.
| Name | Type | Description | Required |
|---|---|---|---|
object |
Credentials specifies a Kubernetes secret that contains the credentials needed to connect to the source cluster. Required fields of the secret are user, password, dbName. And the optional fields are ca.crt. The referenced Postgres user must have connect and replication privilege on the source cluster. This field is mutable. Changes to the secret will be automatically applied on the instance. |
true |
|
hostname |
string |
Hostname specifies the hostname or ip address that can be used to connect to the source cluster. |
true |
slotName |
string |
slotName specifies the Postgres replication slot name that will be used for streaming replication. Its length should not be more than 63 characters. |
true |
port |
integer |
Port specifies the port number that can be used to connect to the source cluster. This field is immutable.
|
false |
object |
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when validating the Servers connection.
Optional. By default, it will use the DSM globally trusted certificates ConfigMap. Mutable. |
false |
PostgresClusterBackup.status.postgresClusterSpec.basedOn.continuousRecovery.replicationSlot.credentials
Credentials specifies a Kubernetes secret that contains the credentials needed to connect to the source cluster. Required fields of the secret are user, password, dbName. And the optional fields are ca.crt. The referenced Postgres user must have connect and replication privilege on the source cluster. This field is mutable. Changes to the secret will be automatically applied on the instance.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
PostgresClusterBackup.status.postgresClusterSpec.basedOn.continuousRecovery.replicationSlot.trustBundle
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when validating the Servers connection.
-
Well-known OS-trusted CA, or a DSM globally trusted certificate - TrustBundle can be omitted, or it should point to DSM globally trusted certificates ConfigMap.
-
Certificate signed by CA that should not be globally trusted by DSM - TrustBundle reference must point to ConfigMap with key
tls.crtthat contains only Issuer certificate(s). If an end-entity (i.e. server) certificate is provided it must be issued by itself, i.e. self-signed.
Optional. By default, it will use the DSM globally trusted certificates ConfigMap.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
PostgresClusterBackup.status.postgresClusterSpec.databaseConfig
DatabaseConfig refers to the database config object that will be applied to this cluster.
Database Config is used to apply custom params/configs to the database represented by this CR.
The provided parameters go into the postgresql.conf file.
Use of shared_preload_libraries key: The property determines which additional libraries are loaded during Postgres startup. Its value is a comma-separated list of libraries available in DSM. * If the parameter is omitted, the cluster applies the default library set (pg_stat_statements, pgaudit, pg_cron), equivalent to: "shared_preload_libraries": "pg_stat_statements,pgaudit,pg_cron" * pg_stat_statements is required by DSM and is always preloaded. Example values: * "pgaudit" - loads pgaudit and pg_stat_statements * "pg_cron" - loads pg_cron and pg_stat_statements * "" - no extra libraries beyond pg_stat_statements
DatabaseConfig Validation Rules:
-
Exclusivity: A DatabaseConfig can only be applied to a single cluster at a time. If a DatabaseConfig is already in use by another cluster, it cannot be assigned to a new cluster or changed to reference a different cluster.
-
Namespace: The DatabaseConfig must exist in the same namespace as the cluster.
-
Deletion Protection: A DatabaseConfig cannot be deleted while it is in use by a cluster.
-
Restore Validation: When restoring a PostgreSQL cluster from a source cluster (via spec.basedOn.cluster) or from a PostgresClusterBackup created from a source cluster (via spec.basedOn.backup with sourceCluster), the following parameters are validated if present in either source or target DatabaseConfig:
-
max_connections
-
max_worker_processes
-
max_wal_senders
-
max_prepared_transactions
-
max_locks_per_transaction
-
shared_preload_libraries
For each numeric parameter above: * If the parameter exists in the source cluster's DatabaseConfig, it must also exist in the target cluster's DatabaseConfig and vice versa if the parameter exists in the target cluster's DatabaseConfig, it must also exist in the source cluster's DatabaseConfig. * The target cluster's parameter value must be greater than or equal to the source cluster's value.
For shared_preload_libraries, restore validation checks that the target cluster preloads every library that the source cluster preloads.
Note: This validation is skipped when restoring from a PostgresClusterBackup that references an external backup (via spec.basedOn.backup with sourceBackup), as the source DatabaseConfig parameters are not available. In case these rules are violated, the restored cluster will not start properly until the parameters are set correctly as per the requirements above.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
PostgresClusterBackup.status.postgresClusterSpec.directoryService
DirectoryService refers to the DirectoryService resource with LDAP settings used by this cluster for authenticating clients.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
PostgresClusterBackup.status.postgresClusterSpec.hbaRef
HbaRef refers to a Secret containing custom pg_hba.conf entries for user authentication.
See https://www.postgresql.org/docs/current/auth-pg-hba-conf.html
The Secret must be in the same namespace as the database cluster. Once created, the HBA Secret cannot be modified. If you need to change the HBA configuration, create a new Secret and update the reference here.
The Secret should contain the pg_hba.conf entries under a specific key pg_hba.conf.
These entries will be inserted into the pg_hba.conf file with a priority lower than system users
Only the authentication methods scram-sha-256,reject, cert are allowed in the custom entries.
When cert method is used spec.TLS field is used to supply the trusted CAs.
You cannot override the authentication method for the admin user specified with the AdminUserName field, e.g. pgadmin by default.
For this and any usernames reserved by DSM, the authentication is limited to password-based methods using SCRAM-SHA-256,
and you cannot enforce client certificate authentication.
For example, to permit all users whose usernames end with @local to authenticate using their database passwords, you can add:
kind: Secret
metadata:
name: db-cluster-1-custom-pg-hba
immutable: true
stringData:
pg_hba.conf: |
host all /^(.*)@local$ all scram-sha-256
Care should be taken to ensure that the custom entries do not interfere with the system-managed entries
or lock out users from accessing the cluster. This is because the order in which the HBA entries are defined matters.
The first record with a matching connection type, client address, requested database, and user name is used to perform authentication.
The final pg_hba.conf will functionally look like:
host all pgadmin all scram-sha-256 host all postgres_exporter all scram-sha-256 #<YOUR CUSTOM ENTRIES ARE ADDED HERE> host all all all ldap ... # This entry is added only if directory service is enabled for the cluster host all all all scram-sha-256
Note: Postgres clusters with versions from DSM release >= 9.0.2 require SSL connections for system users
(admin user, monitoring user). This can be overridden by DSM administrators by setting
postgrescluster-allow-non-ssl-system-users to true in the advanced-system-config ConfigMap in the
dsm-system namespace - the setting applies to new clusters and to existing clusters after
resource update. Custom hba entries are not affected.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
PostgresClusterBackup.status.postgresClusterSpec.localization
Localization specifies the localization configuration for the database cluster.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
encoding |
string |
Encoding specifies the character set of the default database created by DSM and all newly created databases unless the encoding of those databases is explicitly overridden when they are created. If not specified, Postgres attempts to determine the appropriate encoding to use based on the specified or default locale. This field is only applicable when creating a brand new database cluster and has no effect when cloning a database cluster, when restoring a database cluster from a backup, or when creating a read replica. In these cases this field must not be set; the encoding of the source database cluster will be used instead. If an invalid value is provided, the database cluster’s Ready condition will be set to Failed, and the TerminalFailure condition will indicate the invalid encoding. The specified encoding must be compatible with the selected locale. For supported character sets, see https://www.postgresql.org/docs/current/multibyte.html#MULTIBYTE-CHARSET-SUPPORTED. Immutable. This field cannot be changed after the database is created. Optional. |
false |
locale |
string |
Locale specifies the locale (cultural preferences respected by the database when handling alphabets, sorting, number formatting, etc.) of the default database created by DSM and all newly created databases unless the locale of those databases is explicitly overridden when they are created. If not specified, defaults to the locale of the database cluster’s operating system (typically C.utf8). This field is only applicable when creating a brand new database cluster and has no effect when cloning a database cluster, when restoring a database cluster from a backup, or when creating a read replica. In these cases this field must not be set; the locale of the source database cluster will be used instead. If an invalid value is provided, the database cluster’s Ready condition will be set to Failed, and the TerminalFailure condition will indicate the invalid locale. Common examples include: * C, C.utf8, POSIX (default/system locales) * en_US.utf8, en_GB.utf8 (English variants) * de_DE.utf8, fr_FR.utf8, es_ES.utf8 (European languages) * ja_JP.utf8, zh_CN.utf8, ko_KR.utf8 (Asian languages) * ar_SA.utf8, he_IL.utf8 (Middle Eastern languages) A more comprehensive list of available locales can be seen by querying an existing Postgres database: SELECT * FROM pg_collation WHERE provider = 'c'; Note: The drawback of using locales other than the default is its performance impact. It slows character handling and prevents ordinary indexes from being used by LIKE. For this reason use locales only if you actually need them. Immutable. This field cannot be changed after the database is created. Optional. |
false |
PostgresClusterBackup.status.postgresClusterSpec.maintenanceWindow
MaintenanceWindow refers to the System maintenance window. Enabled Maintenance Window will allow CVEs, bug fixes and new Lifecycle Management features for the VM, OS, any supporting software to be addressed. Automatic upgrades applied during this window should only result in minimum downtime of deployed databases for HA clusters. Database minor version upgrades might also be performed. Refer to engine-specific automatic upgrade details which are documented at the corresponding top-level API docs.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
duration |
string |
Duration describes the duration of the maintenance window. Required. Mutable. |
true |
startDay |
enum |
StartDay describes the day of the week the maintenance window will commence. Can be any of Required. Mutable.
|
true |
startTime |
string |
StartTime describes the time of the day (UTC time) to start the maintenance window. Required. Mutable. |
true |
startDayWeeksOfMonth |
[]enum |
StartDayWeeksOfMonth field specifies the weeks of the month in which the
maintenance window will commence. It accepts up to five distinct
values from {1, 2, 3, 4, L}, where each number represents the
occurrence of the designated StartDay within the month ("1" being
the first one that includes it and "L" being the last one).
For example, providing Optional. Mutable.
|
false |
PostgresClusterBackup.status.postgresClusterSpec.placementSelector
PlacementSelector refers to a placement declared in the InfrastructurePolicy.
Usually this field should be left empty to allow the system to determine it automatically.
A placement should be found in the InfrastructurePolicy with the same datacenter,
cluster and resource pool to be considered valid.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
cluster |
string |
Cluster is the datacenter’s cluster name to be used when placing the data service workload. Use the full qualified name of the cluster, relative to the datacenter. A cluster "Cluster1" inside a folder "clusters", should be declared as "clusters/Cluster1". Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the cluster name. Required. Mutable. |
true |
datacenter |
string |
Datacenter is the vSphere Datacenter to be used when placing the data service workload. The full qualified path to the datacenter must be provided if the datacenter is placed inside a folder. Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the datacenter name. Required. Mutable. |
true |
resourcePool |
string |
ResourcePool is the Cluster’s resource pool to be used when placing the data service workload. If the resource pool is not provided, the whole cluster is used as the placement. Optional. Mutable. |
false |
PostgresClusterBackup.status.postgresClusterSpec.replicationSlots[index]
| Name | Type | Description | Required |
|---|---|---|---|
slotName |
string |
SlotName specifies the Postgres replication slot name that will be created on the cluster. |
true |
description |
string |
Description specifies a human-readable description of this replication slot. |
false |
user |
string |
User specifies the name of the replication user that is associated with the configured replication slot. The lifecycle of this user is tied to the replication slot. If no value is provided, a replication user is auto generated using the resource name as prefix. User should not be one of the following - pg_read_all_data, pg_write_all_data, pg_read_all_settings, pg_read_all_stats, pg_stat_scan_tables, pg_monitor, pg_database_owner, pg_signal_backend, pg_read_server_files, pg_write_server_files, pg_execute_server_program, pg_checkpoint, pg_use_reserved_connections, pg_create_subscription, postgres, template1, template0. |
false |
PostgresClusterBackup.status.postgresClusterSpec.tls
TLS refers to the SSL/TLS configuration of the database cluster.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
ClientTrustBundle is a reference to a ConfigMap containing SSL certificate authority/ies (CA). If ClientTrustBundle is configured, trust for client certificate connections from these CAs can be enabled using pg hba rules. To require the client to supply a certificate for authentication, add the authentication option clientcert=verify-ca or clientcert=verify-full
to the appropriate hostssl line(s) in pg hba which must be done via the Secret referenced by spec.hbaRef,
and optionally add the certificates of additional certificate authorities (CAs) you trust in the ConfigMap
by appending it/them to the value of key Optional. When omitted, only the root certificate authority (CA) of the server certificate will be trusted. When set, all the CAs from the ConfigMap will be trusted in addition to the CA of the server certificate. The root CA of the server certificate is set using the Secret which is referred by the spec.tls field. Mutable. To update the custom client trust bundle, either refer to a new ConfigMap, or update the already referenced one. |
false |
|
secretName |
string |
The name of a Secret resource present in the same namespace as the database cluster, describing a custom certificate. The expected format of the Secret is the same as the output Secrets created by cert-manager’s Certificate resource. It needs to have keys: tls.crt: PEM signed certificate chain tls.key: PEM private key ca.crt: PEM CA certificate The ca.crt is optional if there is at least one issuer certificate in the certificate chain (tls.crt key). That issuer can either be a self-signed leaf certificate, or an intermediate or root certificate authority. Optional. When omitted, DSM will auto-generate a certificate using its own internal certificate authority. When specified, DSM will override its auto-generated certificate and use the one described in the Secret. Mutable. To update a custom certificate, either refer to a new Secret, or update the already referenced one. If the database cluster will be accessed by IP, the TLS configuration needs to be applied after initial creation, because the IP can be retrieved only then, so it can be encoded in the certificate. |
false |
PostgresClusterBackup.status.postgresClusterSpec.tls.clientTrustBundle
ClientTrustBundle is a reference to a ConfigMap containing SSL certificate authority/ies (CA). If ClientTrustBundle is configured, trust for client certificate connections from these CAs can be enabled using pg hba rules.
To require the client to supply a certificate for authentication, add the authentication option clientcert=verify-ca or clientcert=verify-full
to the appropriate hostssl line(s) in pg hba which must be done via the Secret referenced by spec.hbaRef,
and optionally add the certificates of additional certificate authorities (CAs) you trust in the ConfigMap
by appending it/them to the value of key ca-bundle.crt
Optional. When omitted, only the root certificate authority (CA) of the server certificate will be trusted. When set, all the CAs from the ConfigMap will be trusted in addition to the CA of the server certificate. The root CA of the server certificate is set using the Secret which is referred by the spec.tls field.
Mutable. To update the custom client trust bundle, either refer to a new ConfigMap, or update the already referenced one.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
PostgresClusterBackup.status.postgresClusterSpec.upgradeSafeguards
UpgradeSafeguards configures the safeguards that need to pass before allowing a major/minor version upgrade to proceed. If specified, the .spec.upgradeSafeguards.targetVersion must match canonical .spec.Version. If not specified, either default safeguard values will be used or, if present, the values of the following legacy annotations may be applicable (for details, see engine-specific major/minor version upgrade documentation): dsm.vmware.com/skip-pre-upgrade-backup dsm.vmware.com/upgrade-cluster-without-backups dsm.vmware.com/upgrade-cluster-with-failing-backups dsm.vmware.com/upgrade-cluster-with-alerts
UpgradeSafeguards cannot be used in combination with any of the deprecated annotations from the list above, regardless of the referenced target versions.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
targetVersion |
string |
TargetVersion must equal spec.version. If the cluster is to be upgraded again and its spec.version changes, either the outdated prior safeguard should be removed or it should be updated along with its TargetVersion. Required. |
true |
allowWithActiveAlerts |
boolean |
AllowWithActiveAlerts, if true, will allow further processing even if active alerts on the cluster exist. Optional. Mutable. Default: false
|
false |
allowWithoutBackup |
boolean |
AllowWithoutBackup, if true, will allow further processing for major version upgrade even if the backup that is taken as part of this safeguard could not be started or failed. An attempt to create such a backup will always be made, with further processing dependent on the value of this field. For minor version upgrade this value is not applicable, as no pre-upgrade backup will be made. Accepted values in this case are nil and true, false will be rejected. Optional. Mutable. |
false |
PostgresClusterBackup.status.postgresClusterSpec.vSphereTags[index]
VSphereTag identifies a single vSphere tag by its tag category and tag name.
| Name | Type | Description | Required |
|---|---|---|---|
category |
string |
Category is the vSphere tag category Required. Mutable. |
true |
tag |
string |
Tag is the vSphere tag. It should be part of vSphere tag category Category. Required. Mutable. |
true |
PostgresCluster
PostgresCluster is the schema for the postgresclusters API. A PostgresCluster represents the desired specification and the observed status of a PostgresCluster instance. A PostgresCluster is backed by one or more nodes containing the postgresql service and supporting services managed as a single object by the Data Services Manager.
### Custom Annotations:
#### Resource Locking: Protection from Updates or Deletes
dsm.vmware.com/locked-status: locked, unlocked-for-delete, unlocked-for-edit
locked : will not allow edit or delete on the resource unlocked-for-delete : allows the resource to be deleted but not edited, needs to be set together with dsm.vmware.com/unlock-reason annotation unlocked-for-edit : allows the resource to be edited but not deleted, needs to be set together with dsm.vmware.com/unlock-reason annotation. This is automatically reset to locked after the edit operation is applied.
dsm.vmware.com/unlock-reason: reason for unlock
<reason for unlock> : text to describe the reason for unlocking the resource. Used for audit purposes in DSM.
#### Force rolling update with active infra alert
dsm.vmware.com/modify-cluster-with-infra-alerts: generation of the resource
<generation of the resource> : The value of this annotation should match the current resource generation (.metadata.Generation). The system actively prevents edits to the Spec that induces a rolling update when there is an alert for the underlying infrastructure and this annotation can be used to bypass it. It should be used with caution as the System cannot guarantee the update will succeed under infra alert conditions. It is better to check with the Infra/DSM Admin prior to using this.
### Automatic upgrades during Maintenance Window:
If .spec.maintenanceWindow is configured, automatic upgrade will be performed accordingly when applicable Postgres version becomes available. Database minor version upgrade will be performed, if it is available.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
databases.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
PostgresCluster |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
PostgresClusterSpec defines the desired state of the PostgresCluster. Special notes about the Spec.Version field: Downgrades are not allowed. In case of major version upgrade when the cluster does not have automatic backups enabled annotation "dsm.vmware.com/upgrade-cluster-without-backups" with value the requested version has to be added to confirm that major version upgrade is requested without any backups to restore from. To opt-out of the backup that is automatically done before the upgrade starts, use the "dsm.vmware.com/skip-pre-upgrade-backup" annotation with value equal to the requested version. In case of major version upgrade when there are critical alerts for the cluster annotation "dsm.vmware.com/upgrade-cluster-with-alerts" with value the requested version has to be added to confirm that major version upgrade is requested and the critical alerts for the cluster should be ignored. |
true |
|
object |
PostgresClusterStatus describes the observed status of the PostgresCluster. In case of consumption through VMware Cloud Foundation Automation (VCFA) the status includes the following condition:
|
false |
PostgresCluster.spec
PostgresClusterSpec defines the desired state of the PostgresCluster.
Special notes about the Spec.Version field:
Downgrades are not allowed.
In case of major version upgrade when the cluster does not have automatic backups enabled annotation "dsm.vmware.com/upgrade-cluster-without-backups" with value the requested version has to be added to confirm that major version upgrade is requested without any backups to restore from.
To opt-out of the backup that is automatically done before the upgrade starts, use the "dsm.vmware.com/skip-pre-upgrade-backup" annotation with value equal to the requested version.
In case of major version upgrade when there are critical alerts for the cluster annotation "dsm.vmware.com/upgrade-cluster-with-alerts" with value the requested version has to be added to confirm that major version upgrade is requested and the critical alerts for the cluster should be ignored.
| Name | Type | Description | Required |
|---|---|---|---|
object |
InfrastructurePolicy refers to the infrastructure policy resource used to create this cluster. Required - Must refer to a valid Immutable. |
true |
|
storagePolicyName |
string |
StoragePolicyName declares the name of the storage policy that should be used to create this postgres cluster. It must be part of the InfrastructurePolicy used by this cluster. Required - Must refer to a valid Immutable. |
true |
storageSpace |
string |
StorageSpace declares the disk size allocated to each node hosting the workload. You can express storage as a plain integer or as a fixed-point number using one of these suffixes - E, P, T, G, M, k. You can also use the power-of-two equivalents - Ei, Pi, Ti, Gi, Mi, Ki Range - 20Gi - 32Ti. Required. Mutable - (increase only). |
true |
version |
string |
Version declares the version of the database engine to be used. To upgrade the database engine change this field. The list of supported engine versions can be found by inspecting the DataServiceVersion resources and in the VMware Data Services Manager UI. Version Validations for Cluster Restore Scenarios: When creating a new cluster based on an existing cluster or backup (via spec.basedOn), the following version validation rules apply at cluster creation time: General Rules (All Database Engines):
PostgreSQL-Specific Rules:
MySQL-Specific Rules:
Required. Mutable. |
true |
object |
VMClass refers to the VM class that should be used to create this cluster. It must be part of the InfrastructurePolicy used by this cluster. Required - Must refer to a valid Mutable - (Only increases in resources are allowed). |
true |
|
object |
AdminPasswordRef refers to a v1.Secret containing the password which the privileged user will use to connect
to the database. The secret must be in the same namespace as the database cluster.
FieldPath field indicates which key in the secret contains the password. Default - Read replicas (that is, clusters with Spec.BasedOn.ContinuousRecovery.Enabled set to true) do not support having their own privileged user. If this field is set on a read replica, it will only take effect after the read replica is promoted. Default - password is auto generated. Mutable. It is possible to refer to a new Secret to update the admin password, but it is not required. Updates in the already referenced Secret will also lead to update of the password. |
false |
|
adminUsername |
string |
AdminUserName is the desired name of the privileged user to be used when connecting to the database. AdminUserName should not be one of the following - pg_read_all_data, pg_write_all_data, pg_read_all_settings, pg_read_all_stats, pg_stat_scan_tables, pg_monitor, pg_database_owner, pg_signal_backend, pg_read_server_files, pg_write_server_files, pg_execute_server_program, pg_checkpoint, pg_use_reserved_connections, pg_create_subscription, postgres, template1, template0. Default - pgadmin. Immutable. |
false |
object |
BackupConfig declares the cluster’s backup configuration details. If specified a Optional. Mutable. |
false |
|
object |
BackupLocation, if specified, must point to an existing BackupLocation custom resource in the same namespace as the cluster or in the DSM system namespace. It will be used by the 'BackupConfig', which must be specified whenever BackupLocation is specified. If specified, a Optional. Mutable. |
false |
|
object |
BasedOn identifies the source (primary) cluster on which this cluster will be based on. Users cannot base their clusters on clusters owned by other users unless the user has DSM_Admin role. The new cluster will inherit the ownership from its source(primary) cluster. It can be changed if necessary after the cluster is created. Field Cluster works both if the cluster is alive and if it is deleted, but we are still retaining its backups. To create a new Postgres cluster based on a live one pass the name of the cluster. To create a new Postgres cluster based on an archived cluster with retained backups pass the name of the ArchivedPostgresCluster. Optional. Immutable. |
false |
|
blockDatabaseConnections |
boolean |
BlockDatabaseConnections restricts all external client access to the database. When set to true, the database forcibly terminates all existing client connections and prevents any new connection attempts, including those from administrative users such as pgadmin. When set to false or unset, client access to the database is permitted as normal. The Ready condition, in combination with the observedGeneration, can be used to verify that this setting has been applied. This field can be useful in disaster recovery (DR) scenarios to ensure no writes or new sessions occur on the original primary(source) during switchover or failover. Default - Optional. Mutable.
|
false |
object |
DatabaseConfig refers to the database config object that will be applied to this cluster. Database Config is used to apply custom params/configs to the database represented by this CR.
The provided parameters go into the Use of shared_preload_libraries key: The property determines which additional libraries are loaded during Postgres startup. Its value is a comma-separated list of libraries available in DSM. * If the parameter is omitted, the cluster applies the default library set (pg_stat_statements, pgaudit, pg_cron), equivalent to: "shared_preload_libraries": "pg_stat_statements,pgaudit,pg_cron" * pg_stat_statements is required by DSM and is always preloaded. Example values: * "pgaudit" - loads pgaudit and pg_stat_statements * "pg_cron" - loads pg_cron and pg_stat_statements * "" - no extra libraries beyond pg_stat_statements DatabaseConfig Validation Rules:
Optional. Mutable. |
false |
|
databaseName |
string |
If DatabaseName is set, database with that name will be created (if it doesn’t exist) and PostgresCluster.Status.Connection.DbName and ArchivedPostgresCluster.Status.DatabaseName will be set to that name. If the cluster is restored from another cluster (Spec.BasedOn.Cluster field is used) all databases from the source cluster are restored with preserved names and one additional database is created with name the given DatabaseName. This database is empty and PostgresCluster.Status.Connection.DbName and ArchivedPostgresCluster.Status.DatabaseName refer to it. If DatabaseName is equal to the name of database from the source cluster no additional database is created and PostgresCluster.Status.Connection.DbName and ArchivedPostgresCluster.Status.DatabaseName refer to the specified database with name the given DatabaseName. If DatabaseName is empty no additional database is created and PostgresCluster.Status.Connection.DbName and ArchivedPostgresCluster.Status.DatabaseName refer the same database the status connection info of the source cluster refers to. If the cluster is a read replica of a primary cluster and has DatabaseName different from the names of the databases in that primary cluster, the additional database with name DatabaseName will be created only after the read replica is promoted to a standalone cluster. DatabaseName should not be one of the following - pg_read_all_data, pg_write_all_data, pg_read_all_settings, pg_read_all_stats, pg_stat_scan_tables, pg_monitor, pg_database_owner, pg_signal_backend, pg_read_server_files, pg_write_server_files, pg_execute_server_program, pg_checkpoint, pg_use_reserved_connections, pg_create_subscription, postgres, template1, template0. It is recommended the length of DatabaseName to not exceed 63 characters, otherwise it will be truncated and only the first 63 characters will be used for database name. Default - if the cluster is restored one, the database name in the source cluster’s PostgresCluster.Status.Connection.DbName is used, otherwise DatabaseName is the same as the cluster’s name. Immutable. |
false |
description |
string |
Description contains the human-readable description of the cluster. Optional. Mutable. |
false |
object |
DirectoryService refers to the DirectoryService resource with LDAP settings used by this cluster for authenticating clients. Optional. Mutable. |
false |
|
dnsNames |
[]string |
One or more DNS names / FQDNs for database access. These DNS names will be included in the SAN field of the TLS certificate if auto-generated by DSM. The first DNS name will also be included in the URL connection string displayed in DSM UI. If a custom TLS certificate is provided, it is important its SAN field to match the DNS names provided here, so clients can ensure a secure connection. Optional. Mutable. When updated, DSM will re-generate the TLS certificate if no custom certificate is provided. |
false |
extraClients |
[]string |
ExtraClients is a list of additional IPv4 addresses/ranges that should be allowed to access the database service. Use cases include: * having applications outside of the tenant organization namespace that need to access the database cluster. * configuring replication for the database cluster from a different region. * troubleshooting issues with the database cluster. Optional. Mutable. |
false |
object |
HbaRef refers to a Secret containing custom The Secret must be in the same namespace as the database cluster. Once created, the HBA Secret cannot be modified. If you need to change the HBA configuration, create a new Secret and update the reference here. The Secret should contain the Only the authentication methods For example, to permit all users whose usernames end with @local to authenticate using their database passwords, you can add: kind: Secret
metadata:
name: db-cluster-1-custom-pg-hba
immutable: true
stringData:
pg_hba.conf: |
host all /^(.*)@local$ all scram-sha-256
Care should be taken to ensure that the custom entries do not interfere with the system-managed entries
or lock out users from accessing the cluster. This is because the order in which the HBA entries are defined matters.
The first record with a matching connection type, client address, requested database, and user name is used to perform authentication.
The final host all pgadmin all scram-sha-256 host all postgres_exporter all scram-sha-256 #<YOUR CUSTOM ENTRIES ARE ADDED HERE> host all all all ldap ... # This entry is added only if directory service is enabled for the cluster host all all all scram-sha-256 Note: Postgres clusters with versions from DSM release >= 9.0.2 require SSL connections for system users
(admin user, monitoring user). This can be overridden by DSM administrators by setting
|
false |
|
object |
Localization specifies the localization configuration for the database cluster. Optional. Immutable. |
false |
|
object |
MaintenanceWindow refers to the System maintenance window. Enabled Maintenance Window will allow CVEs, bug fixes and new Lifecycle Management features for the VM, OS, any supporting software to be addressed. Automatic upgrades applied during this window should only result in minimum downtime of deployed databases for HA clusters. Database minor version upgrades might also be performed. Refer to engine-specific automatic upgrade details which are documented at the corresponding top-level API docs. Optional. Mutable. |
false |
|
object |
PlacementSelector refers to a placement declared in the InfrastructurePolicy. Usually this field should be left empty to allow the system to determine it automatically.
A placement should be found in the Optional. Immutable. |
false |
|
replicas |
integer |
Represents the number of nodes that are replicating from the primary node. In event of a primary outage one of the replicas will be promoted to primary. Replicas can be set to 0 or 1. Starting with Data Services Manager 2.1, 3-replica clusters are no longer supported. If you have replicas set to 1, then you will have 1 primary node and 1 replica node. Read replicas (that is, clusters with Spec.BasedOn.ContinuousRecovery.Enabled set to true) do not support having their own replicas. If this field is set to a non-zero value on a read replica, it will only take effect after this replica is promoted. Default - Mutable.
|
false |
[]object |
ReplicationSlots configures a list of Postgres replication slots that will be created on this cluster for disaster recovery, read replication, or migration purposes. A replication slot can be removed if it is no longer needed and there is no active consumer of that replication slot. Read replicas (that is, clusters with Spec.BasedOn.ContinuousRecovery.Enabled set to true) do not support having replication slots. If this field is set on a read replica, it will only take effect after the read replica is promoted. When upgrading the primary cluster it is recommended to upgrade all read replicas to the same minor version before upgrading the primary cluster. |
false |
|
requestedSharedMemorySize |
int or string |
RequestedSharedMemorySize is the value we would try to assign for shared memory (/dev/shm) of the OS where the Postgres instance is running. No upper limit is enforced, but the system would apply one based on current VMClass memory. You can express RequestedSharedMemorySize as a fixed-point number using one of these suffixes - E, P, T, G, M, k. You can also use the power-of-two equivalents - Ei, Pi, Ti, Gi, Mi, Ki. Range - 64Mi - no limit. Default - Optional. Mutable.
|
false |
object |
TLS refers to the SSL/TLS configuration of the database cluster. Optional. Mutable. |
false |
|
object |
UpgradeSafeguards configures the safeguards that need to pass before allowing a major/minor version upgrade to proceed. If specified, the .spec.upgradeSafeguards.targetVersion must match canonical .spec.Version. If not specified, either default safeguard values will be used or, if present, the values of the following legacy annotations may be applicable (for details, see engine-specific major/minor version upgrade documentation): dsm.vmware.com/skip-pre-upgrade-backup dsm.vmware.com/upgrade-cluster-without-backups dsm.vmware.com/upgrade-cluster-with-failing-backups dsm.vmware.com/upgrade-cluster-with-alerts UpgradeSafeguards cannot be used in combination with any of the deprecated annotations from the list above, regardless of the referenced target versions. Optional. Mutable. |
false |
|
[]object |
VSphereTags is the list of vSphere tags that the cluster’s deployed virtual machines should have assigned. The tags should exist in vSphere in order to be successfully assigned. Optional. Mutable. |
false |
PostgresCluster.spec.infrastructurePolicy
InfrastructurePolicy refers to the infrastructure policy resource used to create this cluster.
Required - Must refer to a valid InfrastructurePolicy.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
kind |
string |
Kind of the referent. |
false |
name |
string |
The Name of the referent. |
false |
namespace |
string |
The Namespace of the referent. |
false |
PostgresCluster.spec.vmClass
VMClass refers to the VM class that should be used to create this cluster. It must be part of the InfrastructurePolicy used by this cluster.
Required - Must refer to a valid VMClass.
Mutable - (Only increases in resources are allowed).
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
PostgresCluster.spec.adminPasswordRef
AdminPasswordRef refers to a v1.Secret containing the password which the privileged user will use to connect
to the database. The secret must be in the same namespace as the database cluster.
FieldPath field indicates which key in the secret contains the password. Default - password.
Providing inline value with Value field is not supported.
The owner of the Secret must be the same as the owner of the DB cluster. When the owner of the DB
cluster is changed the owner of the Secret is automatically changed to the new owner.
Read replicas (that is, clusters with Spec.BasedOn.ContinuousRecovery.Enabled set to true) do not support having their own privileged user. If this field is set on a read replica, it will only take effect after the read replica is promoted.
Default - password is auto generated.
Mutable. It is possible to refer to a new Secret to update the admin password, but it is not required. Updates in the already referenced Secret will also lead to update of the password.
| Name | Type | Description | Required |
|---|---|---|---|
fieldPath |
string |
data.<key> for secrets. Optional. For most references there is a canonical key |
false |
name |
string |
The name of the secret |
false |
value |
string |
Deprecated. This field is never used by the Data Services Manager. |
false |
PostgresCluster.spec.backupConfig
BackupConfig declares the cluster’s backup configuration details.
If specified a BackupLocation must also be specified.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
backupRetentionDays |
integer |
BackupRetentionDays indicates the number of days for which the database’s
Point-in-Time Recovery (PITR) is expected to be available.
Must be Required. Mutable.
|
true |
[]object |
Schedules determine the type and frequency of backups, with the latter defined by a cron expression. Required. Mutable. |
true |
PostgresCluster.spec.backupConfig.schedules[index]
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the schedule. Required. Immutable. |
true |
schedule |
string |
The schedule in the form of a cron schedule. Required. Mutable. |
true |
type |
string |
Type of schedule. Can be Required. Immutable. |
true |
PostgresCluster.spec.backupLocation
BackupLocation, if specified, must point to an existing BackupLocation custom resource in the same namespace as the cluster or in the DSM system namespace. It will be used by the 'BackupConfig', which must be specified whenever BackupLocation is specified.
If specified, a backupConfig must also be specified.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
PostgresCluster.spec.basedOn
BasedOn identifies the source (primary) cluster on which this cluster will be based on.
Users cannot base their clusters on clusters owned by other users unless the user has DSM_Admin role. The new cluster will inherit the ownership from its source(primary) cluster. It can be changed if necessary after the cluster is created.
Field Cluster works both if the cluster is alive and if it is deleted, but we are still retaining its backups. To create a new Postgres cluster based on a live one pass the name of the cluster. To create a new Postgres cluster based on an archived cluster with retained backups pass the name of the ArchivedPostgresCluster.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
backup specifies a PostgresClusterBackup to use as the restore source. This field is mutually exclusive with Cluster. Immutable. Once set, this field cannot be modified. Optional.
|
false |
|
object |
cluster contains the name of the source(primary) cluster and timestamp to use as the restore point. This field is mutually exclusive with Backup. Immutable. Once set, this field cannot be modified. Optional.
|
false |
|
object |
ContinuousRecovery specifies the details of an external cluster that will be used as a source(primary) for continuous recovery. Once configured, this field can’t be unset. |
false |
PostgresCluster.spec.basedOn.backup
backup specifies a PostgresClusterBackup to use as the restore source. This field is mutually exclusive with Cluster.
Immutable. Once set, this field cannot be modified.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
name specifies the PostgresClusterBackup name Optional. |
false |
time |
string |
Time is the point in time to restore to. The restore will happen to the last available recovery time before the given time. If time is not provided restore will be initiated to the latest available recovery time. Optional. Immutable.
|
false |
PostgresCluster.spec.basedOn.cluster
cluster contains the name of the source(primary) cluster and timestamp to use as the restore point. This field is mutually exclusive with Backup.
Immutable. Once set, this field cannot be modified.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name is the name of the source cluster from which to restore. Required. Immutable. |
true |
timestamp |
string |
Timestamp is the point in time to restore from. The restore will happen to the last available recovery time before the given time. If timestamp is not provided restore will be initiated to the latest available recovery time. Optional. Immutable.
|
false |
PostgresCluster.spec.basedOn.continuousRecovery
ContinuousRecovery specifies the details of an external cluster that will be used as a source(primary) for continuous recovery. Once configured, this field can’t be unset.
| Name | Type | Description | Required |
|---|---|---|---|
object |
ReplicationSlot specifies the Postgres replication slot and remote cluster details from which this cluster will continuously recover. If the source (primary) cluster is a DSM managed Postgres cluster, the replication slot details can be retrieved from the status sub-resource of the source (primary) cluster’s PostgresCluster resource. When demoting a Postgres cluster with configured backups to act as a read replica to another cluster, the timeline of the demoted cluster must not exceed the timeline of the primary cluster. |
true |
|
enabled |
boolean |
Enabled specifies if this cluster should continuously retrieve activities from the source (primary) cluster. When Enabled is set to true, this cluster’s Ready condition implies that the cluster is now ready to serve read-only operations. During this period, WAL archiving and backups are paused until the cluster resumes read-write operations. When set to false, the Ready condition implies that the cluster is ready to serve read-write operations. |
false |
PostgresCluster.spec.basedOn.continuousRecovery.replicationSlot
ReplicationSlot specifies the Postgres replication slot and remote cluster details from which this cluster will continuously recover. If the source (primary) cluster is a DSM managed Postgres cluster, the replication slot details can be retrieved from the status sub-resource of the source (primary) cluster’s PostgresCluster resource.
When demoting a Postgres cluster with configured backups to act as a read replica to another cluster, the timeline of the demoted cluster must not exceed the timeline of the primary cluster.
| Name | Type | Description | Required |
|---|---|---|---|
object |
Credentials specifies a Kubernetes secret that contains the credentials needed to connect to the source cluster. Required fields of the secret are user, password, dbName. And the optional fields are ca.crt. The referenced Postgres user must have connect and replication privilege on the source cluster. This field is mutable. Changes to the secret will be automatically applied on the instance. |
true |
|
hostname |
string |
Hostname specifies the hostname or ip address that can be used to connect to the source cluster. |
true |
slotName |
string |
slotName specifies the Postgres replication slot name that will be used for streaming replication. Its length should not be more than 63 characters. |
true |
port |
integer |
Port specifies the port number that can be used to connect to the source cluster. This field is immutable.
|
false |
object |
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when validating the Servers connection.
Optional. By default, it will use the DSM globally trusted certificates ConfigMap. Mutable. |
false |
PostgresCluster.spec.basedOn.continuousRecovery.replicationSlot.credentials
Credentials specifies a Kubernetes secret that contains the credentials needed to connect to the source cluster. Required fields of the secret are user, password, dbName. And the optional fields are ca.crt. The referenced Postgres user must have connect and replication privilege on the source cluster. This field is mutable. Changes to the secret will be automatically applied on the instance.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
PostgresCluster.spec.basedOn.continuousRecovery.replicationSlot.trustBundle
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when validating the Servers connection.
-
Well-known OS-trusted CA, or a DSM globally trusted certificate - TrustBundle can be omitted, or it should point to DSM globally trusted certificates ConfigMap.
-
Certificate signed by CA that should not be globally trusted by DSM - TrustBundle reference must point to ConfigMap with key
tls.crtthat contains only Issuer certificate(s). If an end-entity (i.e. server) certificate is provided it must be issued by itself, i.e. self-signed.
Optional. By default, it will use the DSM globally trusted certificates ConfigMap.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
PostgresCluster.spec.databaseConfig
DatabaseConfig refers to the database config object that will be applied to this cluster.
Database Config is used to apply custom params/configs to the database represented by this CR.
The provided parameters go into the postgresql.conf file.
Use of shared_preload_libraries key: The property determines which additional libraries are loaded during Postgres startup. Its value is a comma-separated list of libraries available in DSM. * If the parameter is omitted, the cluster applies the default library set (pg_stat_statements, pgaudit, pg_cron), equivalent to: "shared_preload_libraries": "pg_stat_statements,pgaudit,pg_cron" * pg_stat_statements is required by DSM and is always preloaded. Example values: * "pgaudit" - loads pgaudit and pg_stat_statements * "pg_cron" - loads pg_cron and pg_stat_statements * "" - no extra libraries beyond pg_stat_statements
DatabaseConfig Validation Rules:
-
Exclusivity: A DatabaseConfig can only be applied to a single cluster at a time. If a DatabaseConfig is already in use by another cluster, it cannot be assigned to a new cluster or changed to reference a different cluster.
-
Namespace: The DatabaseConfig must exist in the same namespace as the cluster.
-
Deletion Protection: A DatabaseConfig cannot be deleted while it is in use by a cluster.
-
Restore Validation: When restoring a PostgreSQL cluster from a source cluster (via spec.basedOn.cluster) or from a PostgresClusterBackup created from a source cluster (via spec.basedOn.backup with sourceCluster), the following parameters are validated if present in either source or target DatabaseConfig:
-
max_connections
-
max_worker_processes
-
max_wal_senders
-
max_prepared_transactions
-
max_locks_per_transaction
-
shared_preload_libraries
For each numeric parameter above: * If the parameter exists in the source cluster's DatabaseConfig, it must also exist in the target cluster's DatabaseConfig and vice versa if the parameter exists in the target cluster's DatabaseConfig, it must also exist in the source cluster's DatabaseConfig. * The target cluster's parameter value must be greater than or equal to the source cluster's value.
For shared_preload_libraries, restore validation checks that the target cluster preloads every library that the source cluster preloads.
Note: This validation is skipped when restoring from a PostgresClusterBackup that references an external backup (via spec.basedOn.backup with sourceBackup), as the source DatabaseConfig parameters are not available. In case these rules are violated, the restored cluster will not start properly until the parameters are set correctly as per the requirements above.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
PostgresCluster.spec.directoryService
DirectoryService refers to the DirectoryService resource with LDAP settings used by this cluster for authenticating clients.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
PostgresCluster.spec.hbaRef
HbaRef refers to a Secret containing custom pg_hba.conf entries for user authentication.
See https://www.postgresql.org/docs/current/auth-pg-hba-conf.html
The Secret must be in the same namespace as the database cluster. Once created, the HBA Secret cannot be modified. If you need to change the HBA configuration, create a new Secret and update the reference here.
The Secret should contain the pg_hba.conf entries under a specific key pg_hba.conf.
These entries will be inserted into the pg_hba.conf file with a priority lower than system users
Only the authentication methods scram-sha-256,reject, cert are allowed in the custom entries.
When cert method is used spec.TLS field is used to supply the trusted CAs.
You cannot override the authentication method for the admin user specified with the AdminUserName field, e.g. pgadmin by default.
For this and any usernames reserved by DSM, the authentication is limited to password-based methods using SCRAM-SHA-256,
and you cannot enforce client certificate authentication.
For example, to permit all users whose usernames end with @local to authenticate using their database passwords, you can add:
kind: Secret
metadata:
name: db-cluster-1-custom-pg-hba
immutable: true
stringData:
pg_hba.conf: |
host all /^(.*)@local$ all scram-sha-256
Care should be taken to ensure that the custom entries do not interfere with the system-managed entries
or lock out users from accessing the cluster. This is because the order in which the HBA entries are defined matters.
The first record with a matching connection type, client address, requested database, and user name is used to perform authentication.
The final pg_hba.conf will functionally look like:
host all pgadmin all scram-sha-256 host all postgres_exporter all scram-sha-256 #<YOUR CUSTOM ENTRIES ARE ADDED HERE> host all all all ldap ... # This entry is added only if directory service is enabled for the cluster host all all all scram-sha-256
Note: Postgres clusters with versions from DSM release >= 9.0.2 require SSL connections for system users
(admin user, monitoring user). This can be overridden by DSM administrators by setting
postgrescluster-allow-non-ssl-system-users to true in the advanced-system-config ConfigMap in the
dsm-system namespace - the setting applies to new clusters and to existing clusters after
resource update. Custom hba entries are not affected.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
PostgresCluster.spec.localization
Localization specifies the localization configuration for the database cluster.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
encoding |
string |
Encoding specifies the character set of the default database created by DSM and all newly created databases unless the encoding of those databases is explicitly overridden when they are created. If not specified, Postgres attempts to determine the appropriate encoding to use based on the specified or default locale. This field is only applicable when creating a brand new database cluster and has no effect when cloning a database cluster, when restoring a database cluster from a backup, or when creating a read replica. In these cases this field must not be set; the encoding of the source database cluster will be used instead. If an invalid value is provided, the database cluster’s Ready condition will be set to Failed, and the TerminalFailure condition will indicate the invalid encoding. The specified encoding must be compatible with the selected locale. For supported character sets, see https://www.postgresql.org/docs/current/multibyte.html#MULTIBYTE-CHARSET-SUPPORTED. Immutable. This field cannot be changed after the database is created. Optional. |
false |
locale |
string |
Locale specifies the locale (cultural preferences respected by the database when handling alphabets, sorting, number formatting, etc.) of the default database created by DSM and all newly created databases unless the locale of those databases is explicitly overridden when they are created. If not specified, defaults to the locale of the database cluster’s operating system (typically C.utf8). This field is only applicable when creating a brand new database cluster and has no effect when cloning a database cluster, when restoring a database cluster from a backup, or when creating a read replica. In these cases this field must not be set; the locale of the source database cluster will be used instead. If an invalid value is provided, the database cluster’s Ready condition will be set to Failed, and the TerminalFailure condition will indicate the invalid locale. Common examples include: * C, C.utf8, POSIX (default/system locales) * en_US.utf8, en_GB.utf8 (English variants) * de_DE.utf8, fr_FR.utf8, es_ES.utf8 (European languages) * ja_JP.utf8, zh_CN.utf8, ko_KR.utf8 (Asian languages) * ar_SA.utf8, he_IL.utf8 (Middle Eastern languages) A more comprehensive list of available locales can be seen by querying an existing Postgres database: SELECT * FROM pg_collation WHERE provider = 'c'; Note: The drawback of using locales other than the default is its performance impact. It slows character handling and prevents ordinary indexes from being used by LIKE. For this reason use locales only if you actually need them. Immutable. This field cannot be changed after the database is created. Optional. |
false |
PostgresCluster.spec.maintenanceWindow
MaintenanceWindow refers to the System maintenance window. Enabled Maintenance Window will allow CVEs, bug fixes and new Lifecycle Management features for the VM, OS, any supporting software to be addressed. Automatic upgrades applied during this window should only result in minimum downtime of deployed databases for HA clusters. Database minor version upgrades might also be performed. Refer to engine-specific automatic upgrade details which are documented at the corresponding top-level API docs.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
duration |
string |
Duration describes the duration of the maintenance window. Required. Mutable. |
true |
startDay |
enum |
StartDay describes the day of the week the maintenance window will commence. Can be any of Required. Mutable.
|
true |
startTime |
string |
StartTime describes the time of the day (UTC time) to start the maintenance window. Required. Mutable. |
true |
startDayWeeksOfMonth |
[]enum |
StartDayWeeksOfMonth field specifies the weeks of the month in which the
maintenance window will commence. It accepts up to five distinct
values from {1, 2, 3, 4, L}, where each number represents the
occurrence of the designated StartDay within the month ("1" being
the first one that includes it and "L" being the last one).
For example, providing Optional. Mutable.
|
false |
PostgresCluster.spec.placementSelector
PlacementSelector refers to a placement declared in the InfrastructurePolicy.
Usually this field should be left empty to allow the system to determine it automatically.
A placement should be found in the InfrastructurePolicy with the same datacenter,
cluster and resource pool to be considered valid.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
cluster |
string |
Cluster is the datacenter’s cluster name to be used when placing the data service workload. Use the full qualified name of the cluster, relative to the datacenter. A cluster "Cluster1" inside a folder "clusters", should be declared as "clusters/Cluster1". Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the cluster name. Required. Mutable. |
true |
datacenter |
string |
Datacenter is the vSphere Datacenter to be used when placing the data service workload. The full qualified path to the datacenter must be provided if the datacenter is placed inside a folder. Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the datacenter name. Required. Mutable. |
true |
resourcePool |
string |
ResourcePool is the Cluster’s resource pool to be used when placing the data service workload. If the resource pool is not provided, the whole cluster is used as the placement. Optional. Mutable. |
false |
PostgresCluster.spec.replicationSlots[index]
| Name | Type | Description | Required |
|---|---|---|---|
slotName |
string |
SlotName specifies the Postgres replication slot name that will be created on the cluster. |
true |
description |
string |
Description specifies a human-readable description of this replication slot. |
false |
user |
string |
User specifies the name of the replication user that is associated with the configured replication slot. The lifecycle of this user is tied to the replication slot. If no value is provided, a replication user is auto generated using the resource name as prefix. User should not be one of the following - pg_read_all_data, pg_write_all_data, pg_read_all_settings, pg_read_all_stats, pg_stat_scan_tables, pg_monitor, pg_database_owner, pg_signal_backend, pg_read_server_files, pg_write_server_files, pg_execute_server_program, pg_checkpoint, pg_use_reserved_connections, pg_create_subscription, postgres, template1, template0. |
false |
PostgresCluster.spec.tls
TLS refers to the SSL/TLS configuration of the database cluster.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
ClientTrustBundle is a reference to a ConfigMap containing SSL certificate authority/ies (CA). If ClientTrustBundle is configured, trust for client certificate connections from these CAs can be enabled using pg hba rules. To require the client to supply a certificate for authentication, add the authentication option clientcert=verify-ca or clientcert=verify-full
to the appropriate hostssl line(s) in pg hba which must be done via the Secret referenced by spec.hbaRef,
and optionally add the certificates of additional certificate authorities (CAs) you trust in the ConfigMap
by appending it/them to the value of key Optional. When omitted, only the root certificate authority (CA) of the server certificate will be trusted. When set, all the CAs from the ConfigMap will be trusted in addition to the CA of the server certificate. The root CA of the server certificate is set using the Secret which is referred by the spec.tls field. Mutable. To update the custom client trust bundle, either refer to a new ConfigMap, or update the already referenced one. |
false |
|
secretName |
string |
The name of a Secret resource present in the same namespace as the database cluster, describing a custom certificate. The expected format of the Secret is the same as the output Secrets created by cert-manager’s Certificate resource. It needs to have keys: tls.crt: PEM signed certificate chain tls.key: PEM private key ca.crt: PEM CA certificate The ca.crt is optional if there is at least one issuer certificate in the certificate chain (tls.crt key). That issuer can either be a self-signed leaf certificate, or an intermediate or root certificate authority. Optional. When omitted, DSM will auto-generate a certificate using its own internal certificate authority. When specified, DSM will override its auto-generated certificate and use the one described in the Secret. Mutable. To update a custom certificate, either refer to a new Secret, or update the already referenced one. If the database cluster will be accessed by IP, the TLS configuration needs to be applied after initial creation, because the IP can be retrieved only then, so it can be encoded in the certificate. |
false |
PostgresCluster.spec.tls.clientTrustBundle
ClientTrustBundle is a reference to a ConfigMap containing SSL certificate authority/ies (CA). If ClientTrustBundle is configured, trust for client certificate connections from these CAs can be enabled using pg hba rules.
To require the client to supply a certificate for authentication, add the authentication option clientcert=verify-ca or clientcert=verify-full
to the appropriate hostssl line(s) in pg hba which must be done via the Secret referenced by spec.hbaRef,
and optionally add the certificates of additional certificate authorities (CAs) you trust in the ConfigMap
by appending it/them to the value of key ca-bundle.crt
Optional. When omitted, only the root certificate authority (CA) of the server certificate will be trusted. When set, all the CAs from the ConfigMap will be trusted in addition to the CA of the server certificate. The root CA of the server certificate is set using the Secret which is referred by the spec.tls field.
Mutable. To update the custom client trust bundle, either refer to a new ConfigMap, or update the already referenced one.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
PostgresCluster.spec.upgradeSafeguards
UpgradeSafeguards configures the safeguards that need to pass before allowing a major/minor version upgrade to proceed. If specified, the .spec.upgradeSafeguards.targetVersion must match canonical .spec.Version. If not specified, either default safeguard values will be used or, if present, the values of the following legacy annotations may be applicable (for details, see engine-specific major/minor version upgrade documentation): dsm.vmware.com/skip-pre-upgrade-backup dsm.vmware.com/upgrade-cluster-without-backups dsm.vmware.com/upgrade-cluster-with-failing-backups dsm.vmware.com/upgrade-cluster-with-alerts
UpgradeSafeguards cannot be used in combination with any of the deprecated annotations from the list above, regardless of the referenced target versions.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
targetVersion |
string |
TargetVersion must equal spec.version. If the cluster is to be upgraded again and its spec.version changes, either the outdated prior safeguard should be removed or it should be updated along with its TargetVersion. Required. |
true |
allowWithActiveAlerts |
boolean |
AllowWithActiveAlerts, if true, will allow further processing even if active alerts on the cluster exist. Optional. Mutable. Default: false
|
false |
allowWithoutBackup |
boolean |
AllowWithoutBackup, if true, will allow further processing for major version upgrade even if the backup that is taken as part of this safeguard could not be started or failed. An attempt to create such a backup will always be made, with further processing dependent on the value of this field. For minor version upgrade this value is not applicable, as no pre-upgrade backup will be made. Accepted values in this case are nil and true, false will be rejected. Optional. Mutable. |
false |
PostgresCluster.spec.vSphereTags[index]
VSphereTag identifies a single vSphere tag by its tag category and tag name.
| Name | Type | Description | Required |
|---|---|---|---|
category |
string |
Category is the vSphere tag category Required. Mutable. |
true |
tag |
string |
Tag is the vSphere tag. It should be part of vSphere tag category Category. Required. Mutable. |
true |
PostgresCluster.status
PostgresClusterStatus describes the observed status of the PostgresCluster.
In case of consumption through VMware Cloud Foundation Automation (VCFA) the status includes the following condition:
-
ResourceAvailable: Indicates if the external resources (such as Secrets and ConfigMaps configured in spec.adminPasswordRef, spec.clientTrustBundle) referenced by the cluster are available and successfully synchronized to the DSM appliance from the tenant namespace. Note: Only the first encountered failure is reported. There may be a delay of several minutes before any subsequent reference failures are discovered and reported after the initial fix.-
Status: "True" when all referenced resources are available and ready; "False" otherwise.
-
Reason includes:
-
"Ready": All referenced resources are accessible.
-
"Unavailable": One or more referenced resources (Secret or ConfigMap) could not be found or failed to synchronize.
-
-
| Name | Type | Description | Required |
|---|---|---|---|
alertLevel |
string |
AlertLevel indicates the level of the most severe alert raised for a database cluster. |
false |
[]object |
AvailableUpgrades lists the valid version upgrades for the database cluster. The information here may be stale: when a Data Services Release is enabled or disabled, the available upgrades for existing clusters are populated asynchronously. However, an actual upgrade attempt is always validated against the current system state and the service will accept valid upgrade paths even if they are not yet populated here. |
false |
|
backupId |
string |
BackupId is set only for clusters with enabled automatic backups. This is a unique ID that can be used to locate backup files in storage. For PostgreSQL, it is the stanzaName of the database cluster. For MySQL, it is the UID of the MySQL cluster object in the workload cluster. |
false |
clientTrustBundleResourceVersion |
string |
ClientTrustBundleResourceVersion is set only for clusters with custom client trust bundle It represents the resource version of the clientTrustBundle ConfigMap that was last applied for the DB cluster. |
false |
[]object |
Conditions contain the list of observed conditions of the cluster. The following statuses can occur.
|
false |
|
object |
Connection describes the details which can be used to connect to the database represented by CR. |
false |
|
databaseConfigResourceVersion |
string |
DatabaseConfigResourceVersion is set only for clusters that reference a DatabaseConfig CR. It represents the resourceVersion of the last applied DatabaseConfig for database cluster. |
false |
encoding |
string |
Encoding indicates the character encoding of the default database in the Postgres cluster, or nil for Postgres clusters with versions < 9.1.1. |
false |
lastSuccessfulBackup |
string |
LastSuccessfulBackup indicates the time when the last successful backup completed. The time may refer to an incremental or full backup depending on which completed most recently.
|
false |
lastUpdate |
string |
LastUpdate gives the timestamp of when the desired state was last applied.
|
false |
locale |
string |
Locale indicates the LC_COLLATE setting of the default database in the Postgres cluster, or nil for Postgres clusters with versions < 9.1.1. |
false |
[]object |
Nodes represents the underlying infrastructure of a database cluster. |
false |
|
postgresSystemID |
string |
PostgresSystemID indicates the Postgres database system identifier of this cluster. This is an identifier generated by Postgres during database initialization. Clusters with a shared origin, such as restored clusters or read replicas, will have the same identifier. |
false |
[]object |
RequestedReplicationSlots describes a list slot names and a reference to the credential for that slot name. |
false |
|
[]object |
RestorableTimeRanges describe chronologically ordered list of restorable time ranges for the cluster. Each range represents a continuous time window during which point-in-time restore can be performed using the specified backup id. In regular non-disaster recovery setup, this list contains a single range representing a continuous restore window. RestorableTimeRanges will contain multiple ranges when the cluster is demoted and later promoted again in a disaster recovery (DR) setup. |
false |
|
timeline |
string |
Timeline indicates the timeline of this Postgres cluster. See https://www.postgresql.org/docs/current/continuous-archiving.html#BACKUP-TIMELINES |
false |
tlsSecretResourceVersion |
string |
TLSSecretResourceVersion is set only for clusters with custom certificates. It represents the resource version of the Secret that was last applied for the DB cluster. |
false |
object |
UpgradeStatus represents that status of version upgrade |
false |
|
vcfaNetworkSecurityConfigResourceVersion |
string |
VCFANetworkSecurityConfigResourceVersion stores the resource version of the VCFANetworkSecurityConfig singleton after the last successful reconciliation. Used to detect any change in VCFANetworkSecurityConfig so reconciliation is not skipped. |
false |
PostgresCluster.status.availableUpgrades[index]
| Name | Type | Description | Required |
|---|---|---|---|
impact |
enum |
Impact indicates whether Virtual Machines backing the workload cluster’s kubernetes nodes will be replaced during the upgrade. When the impact is "RollingUpgrade" the upgrade is performed by adding a new node backed by a new Virtual Machine to the workload cluster, and one of the existing nodes is disabled, drained, and subsequently deleted. The process is repeated until all nodes are replaced. When the impact is "InPlace" the upgrade is performed by replacing the PODs running in the workload cluster, but without replacing the kubernetes nodes.
|
true |
version |
string |
Version indicates the target version of the upgrade path. The version is displayed in qualified canonical format i.e. engine version, followed by the string "+vmware.", followed by the release version. |
true |
autoUpgradeTarget |
boolean |
AutoUpgradeTarget indicates whether the cluster is eligible to be automatically upgraded to the specified version. Automatic upgrades are performed within the configured maintenance period.
|
false |
majorVersionUpgrade |
boolean |
MajorVersionUpgrade indicates whether the upgrade is to newer major version. MajorVersionUpgrade and AutoUpgradeTarget cannot be both true as major version upgrades are only manual.
|
false |
PostgresCluster.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
PostgresCluster.status.connection
Connection describes the details which can be used to connect to the database represented by CR.
| Name | Type | Description | Required |
|---|---|---|---|
dbname |
string |
Name of the Database |
true |
host |
string |
Host describes the IP address of the database cluster’s current primary node. |
true |
port |
integer |
Port describes the port on which the database cluster is listening. |
true |
[]object |
ClusterMemberConnectionDetails contains network connection details of individual servers within the cluster. This status will only be populated if the configuration of the server results in the exposure of individual cluster members to the external network. |
false |
|
object |
PasswordRef refers to a v1.Secret that clients can use when connecting to this database. The secret is in the same namespace as the database resource and contains: * "password": the last successfully applied database password. * "ca.crt": the CA certificate for verifying the server’s TLS identity. |
false |
|
username |
string |
Username for the admin account |
false |
PostgresCluster.status.connection.clusterMemberConnectionDetails[index]
ClusterMemberConnectionInfo contains cluster member identification and network connection details of a single member of a database cluster
| Name | Type | Description | Required |
|---|---|---|---|
clusterMemberId |
string |
ClusterMemberID contains an identification of the member server that will remain the same throughout the lifecycle of the cluster. E.g., for MySQL this will be the MySQL server ID. The cluster role of the member can change. Required. |
true |
host |
string |
Host contains the hostname or IP to connect to Required. |
true |
port |
integer |
Port contains the port to connect to Required.
|
true |
PostgresCluster.status.connection.passwordRef
PasswordRef refers to a v1.Secret that clients can use when connecting to this database. The secret is in the same namespace as the database resource and contains: * "password": the last successfully applied database password. * "ca.crt": the CA certificate for verifying the server’s TLS identity.
| Name | Type | Description | Required |
|---|---|---|---|
fieldPath |
string |
data.<key> for secrets. Optional. For most references there is a canonical key |
false |
name |
string |
The name of the secret |
false |
value |
string |
Deprecated. This field is never used by the Data Services Manager. |
false |
PostgresCluster.status.nodes[index]
Node represents the underlying infrastructure of a workload cluster
| Name | Type | Description | Required |
|---|---|---|---|
cpu |
string |
CPU defines the amount of vCPU that is allocated to this node. This is the actual value that the node is provisioned with. This may differ in WCP where it is possible to change the VMClass size after provisioning. Making VMClass an unreliable source of truth for the actual node size. |
false |
datacenter |
string |
Datacenter is the name or inventory path of the datacenter in which the virtual machine is created/located. |
false |
datastore |
string |
Datastore is the name or inventory path of the datastore in which the virtual machine is created/located. |
false |
folder |
string |
Folder is the name or inventory path of the folder in which the virtual machine is created/located. |
false |
host |
string |
Host is the name or inventory path of the ESXi host on which the virtual machine is running. |
false |
memory |
string |
Memory defines the amount of memory, in Gib that is allocated to this node. This is the actual value that the node is provisioned with. This may differ in WCP where it is possible to change the VMClass size after provisioning. Making VMClass an unreliable source of truth for the actual node size. |
false |
object |
Network is the network configuration for this VM. |
false |
|
resourcePool |
string |
ResourcePool is the name or inventory path of the resource pool in which the virtual machine is created/located. |
false |
server |
string |
Server is the IP address or FQDN of the vSphere server on which the virtual machine is created/located. |
false |
storagePolicyName |
string |
StoragePolicyName of the storage policy to use with this Virtual Machine |
false |
vmMoid |
string |
VmMoid is the VM’s Managed Object Reference on vSphere. |
false |
vmName |
string |
VmName is the name of the virtual machine on vSphere. |
false |
vmRole |
string |
VMRole identifies the role VM plays in the workload cluster. like ControlPlane, Worker. |
false |
PostgresCluster.status.nodes[index].network
Network is the network configuration for this VM.
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
Devices is the list of network devices used by the virtual machine. |
false |
PostgresCluster.status.nodes[index].network.devices[index]
NetworkDevice defines the network configuration for a virtual machine’s network device.
| Name | Type | Description | Required |
|---|---|---|---|
ipPool |
string |
IPPool is the name of the IP Pool that was used to claim an IP address for the VM. |
false |
networkName |
string |
NetworkName is the name of the vSphere network to which the device will be connected. |
false |
PostgresCluster.status.requestedReplicationSlots[index]
| Name | Type | Description | Required |
|---|---|---|---|
credentialsRef |
string |
CredentialsRef describes a reference to the kubernetes secret that contains the credentials for connecting to specified replication slot. The referenced secrets exist in the same namespace as the PostgresCluster resource. |
true |
slotName |
string |
SlotName describes the Postgres replication slot name that will be used for streaming replication. |
true |
clientHostname |
string |
ClientHostname indicates the host that is using the replication slot. Missing client hostname indicates that the slot is unused. |
false |
replicationStatus |
enum |
ReplicationStatus describes the replication connection status between this cluster and the read replica using the replication slot.
|
false |
PostgresCluster.status.restorableTimeRanges[index]
| Name | Type | Description | Required |
|---|---|---|---|
backupId |
string |
BackupId is a unique ID that can be used to locate backup files in storage. |
true |
startTime |
string |
StartTime marks the earliest timestamp from which PITR can be triggered for the associated BackupId. The value is inclusive, meaning a PITR may be requested using this exact timestamp. It is not updated when older backups expire due to the retention policy.
|
true |
endTime |
string |
EndTime marks the latest timestamp up to which PITR can be triggered for the associated BackupId. The value is inclusive, meaning a PITR may be requested using this exact timestamp. It is not updated when older backups expire due to the retention policy.
|
false |
PostgresCluster.status.upgradeStatus
UpgradeStatus represents that status of version upgrade
| Name | Type | Description | Required |
|---|---|---|---|
currentVersion |
string |
The actual current version of the data service cluster. This is going to be the same as spec.version, unless an upgrade has been requested. In the latter case, this field will be updated once the upgrade completes. |
false |
[]object |
Historical data of the upgrades performed. |
false |
|
lastTransitionTime |
string |
LastTransitionTime shows the last time the cluster’s upgradeStatus.Running field value changed
|
false |
running |
boolean |
Set to true to indicate that a data service cluster upgrade if currently running. Once the upgrade completes, the field will be reset to empty. |
false |
PostgresCluster.status.upgradeStatus.history[index]
| Name | Type | Description | Required |
|---|---|---|---|
complete |
string |
Timestamp of when the upgrade completed.
|
false |
fromVersion |
string |
The version from which the cluster was upgraded. |
false |
isMajorUpgrade |
boolean |
IsMajorUpgrade specifies whether the upgrade was a major or a minor version upgrade. |
false |
message |
string |
Message contains the reason for a failure or rejection. |
false |
start |
string |
Timestamp of when the upgrade started. This is the time right before the upgrade operations has started and restores are guaranteed to succeed at or before that time. The period after Start and before Complete is considered a blackout period and restores within this interval could lead to unexpected results.
|
false |
status |
enum |
Status indicates the status of the upgrade.
|
false |
toVersion |
string |
The version to which the cluster was upgraded. If the upgrade was aborted or has failed, this field will have the same value as FromVersion. |
false |
SQLServerCluster
SQLServerCluster represents the desired state and observed status of a Microsoft SQL Server cluster managed by Data Services Manager (DSM). A DSM-managed SQL Server can be either a single-node or a three-node cluster with High Availability (HA) capability fully managed by DSM.
DSM Admins create and manage a fleet of SQL Server clusters as "infrastructure" and make them available for self-service consumption to DSM users via Data Service Policies (DSPs) (see SQLServerDatabasePolicy in DataServicePolicy’s spec). A DSM user can consume the available SQL Server clusters by creating a SQLServerDatabase that is placed on one of the SQLServerCluster objects listed in the DataServicePolicyBinding status.
DSM Admins are expected to configure and manage the lifecycle of SQL Server clusters primarily through DSM API and UI. DSM also creates a server-level login with restricted privileges that DSM Admins can use to connect to the engine and use T-SQL queries to monitor, audit and troubleshoot health and performance issues, e.g. through the regular Dynamic Management Views (DMVs) and server audit specs.
### Automatic upgrades during Maintenance Window:
If .spec.maintenanceWindow is configured, automatic data plane upgrade will be performed accordingly when applicable SQL Server version becomes available. Engine version is not automatically upgraded during maintenance window. The data plane release is upgraded, only if the new release includes the current engine version.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
databases.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
SQLServerCluster |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
spec defines the desired state of the SQLServerCluster
|
true |
|
object |
status describes the observed status of the SQLServerCluster. The SQLServerCluster conditions can contain the following statuses:
|
false |
SQLServerCluster.spec
spec defines the desired state of the SQLServerCluster
| Name | Type | Description | Required |
|---|---|---|---|
object |
InfrastructurePolicy refers to the infrastructure policy resource used to create this cluster. Required - Must refer to a valid Immutable. |
true |
|
storagePolicyName |
string |
StoragePolicyName declares the name of the storage policy that should be used to create this postgres cluster. It must be part of the InfrastructurePolicy used by this cluster. Required - Must refer to a valid Immutable. |
true |
storageSpace |
string |
StorageSpace declares the disk size allocated to each node hosting the workload. You can express storage as a plain integer or as a fixed-point number using one of these suffixes - E, P, T, G, M, k. You can also use the power-of-two equivalents - Ei, Pi, Ti, Gi, Mi, Ki Range - 20Gi - 32Ti. Required. Mutable - (increase only). |
true |
version |
string |
Version declares the version of the database engine to be used. To upgrade the database engine change this field. The list of supported engine versions can be found by inspecting the DataServiceVersion resources and in the VMware Data Services Manager UI. Version Validations for Cluster Restore Scenarios: When creating a new cluster based on an existing cluster or backup (via spec.basedOn), the following version validation rules apply at cluster creation time: General Rules (All Database Engines):
PostgreSQL-Specific Rules:
MySQL-Specific Rules:
Required. Mutable. |
true |
object |
VMClass refers to the VM class that should be used to create this cluster. It must be part of the InfrastructurePolicy used by this cluster. Required - Must refer to a valid Mutable - (Only increases in resources are allowed). |
true |
|
object |
Configuration required to integrate this SQL Server cluster with a given Active Directory domain and enable Windows Authentication for machines part of this domain. Currently, the DSM user is required to perform the following steps upfront:
Some of the above steps can be automated by DSM - see the description of each field for more information. |
false |
|
object |
AdminPasswordPolicy configures whether SQL Server enforces its built-in password complexity rules (CHECK_POLICY) on the admin login. When enabled, DSM also pre-validates the referenced admin password Secret at admission time so that policy violations are reported early. Has no effect when adminUser.type is WindowsPrincipal. Windows-authenticated logins are managed by Active Directory and do not have a SQL Server-managed password, so CHECK_POLICY does not apply. Optional. For new clusters running DSM 9.1.1 or later, DSM defaults this to enabled. For clusters upgraded from an older release, this field is intentionally left unset (nil), which preserves the pre-upgrade CHECK_POLICY=OFF behavior. Users can opt in after upgrading by explicitly setting enabled=true; DSM will then validate the existing password at that point and reject the change if it does not meet the policy requirements. Mutable. |
false |
|
object |
AdminUser specifies the name for the initial administrator login of the server. The user name cannot be Data Services Manager will automatically create a database user for the administrator login of the server in every user database. That user is a member of the "db_owner" database role and can be used to execute various maintenance tasks on user databases, e.g. integrity checks, index optimization, etc. Optional. If not specified, DSM will automatically create a login of type SQLUser with default username "mssql_admin" and auto-generated password. The password can be retrieved from the Secret referenced by the cluster’s status.connection.passwordRef field. Mutable. Both the name and the type of the administrator login can be modified: * Changing the name of an adminUser of type SQLUser renames the existing administrator LOGIN. * Changing the name of an adminUser of type WindowsPrincipal renames the existing LOGIN if the new name refers to the same Active Directory account. Otherwise, it creates a new LOGIN. * Changing the login type creates a new administrator LOGIN with the new type. Special case must be taken in the cases where a new LOGIN is created: the old LOGIN and any database users created for that LOGIN remain in the SQL Server with their original administrative privileges, including the database users which the Data Services Manager itself created automatically for the admin LOGIN. If this is not desired, the (new) administrator must REVOKE any redundant privileges and/or DROP the objects manually. |
false |
|
description |
string |
Description contains the human-readable description of the cluster. Optional. Mutable. |
false |
dnsNames |
[]string |
One or more DNS names / FQDNs for database access. These DNS names will be included in the SAN field of the TLS certificate if auto-generated by DSM. The first DNS name will also be included in the URL connection string displayed in DSM UI. If a custom TLS certificate is provided, it is important its SAN field to match the DNS names provided here, so clients can ensure a secure connection. Optional. Mutable. When updated, DSM will re-generate the TLS certificate if no custom certificate is provided. |
false |
edition |
enum |
Edition specifies the SQL Server Edition to use. Possible values include: Evaluation, Developer, Express, Web, Standard, Enterprise, EnterpriseCore, or ProductKey. You must have a valid license obtained from Microsoft if you set a commercial edition. If ProductKey is specified then the actual edition is embedded in the product key which must be provided as a Secret referenced by the separate "productKey" field. Optional. Immutable.
|
false |
extraClients |
[]string |
ExtraClients is a list of additional IPv4 addresses/ranges that should be allowed to access the database service. Use cases include: * having applications outside of the tenant organization namespace that need to access the database cluster. * configuring replication for the database cluster from a different region. * troubleshooting issues with the database cluster. Optional. Mutable. |
false |
object |
MaintenanceWindow refers to the System maintenance window. Enabled Maintenance Window will allow CVEs, bug fixes and new Lifecycle Management features for the VM, OS, any supporting software to be addressed. Automatic upgrades applied during this window should only result in minimum downtime of deployed databases for HA clusters. Database minor version upgrades might also be performed. Refer to engine-specific automatic upgrade details which are documented at the corresponding top-level API docs. Optional. Mutable. |
false |
|
object |
NetworkConfig configures the infrastructure-level network settings for the cluster, such as the MTU of the primary network interface on workload-cluster nodes. Optional.
|
false |
|
object |
PlacementSelector refers to a placement declared in the InfrastructurePolicy. Usually this field should be left empty to allow the system to determine it automatically.
A placement should be found in the Optional. Immutable. |
false |
|
object |
ProductKey is a reference to a Secret with data field "productKey" whose value is in the form of #####-#####-#####-#####-#####, where '#' is a number or a letter. Should be set only if SQL Server should be activated with a Product Key. To set this field the edition field must be set to "ProductKey" Optional. Immutable. |
false |
|
replicas |
integer |
The number of Always On availability replicas that this SQL Server cluster supports. Each SQLServerDatabase placed on this cluster will have this number of availability replicas. Could be When using HA cluster (i.e. two synchronous replicas), DSM will automatically failover the primary to the secondary in case of planned maintenance operation or unplanned failure with minimal downtime. DSM also ensures that if the primary and configuration-only replica are available but the secondary is not available, read and write operations can still be performed while the writes are not protected with a second copy. Under normal circumstances, when the secondary is available, all writes are copied on both the primary and the secondary replicas before being acknowledged to the client. DSM also configures the Contained Availability Groups (CAGs) feature of SQL Server, so that any writes to the primary’s system databases (master and msdb) are also automatically replicated to the secondary. Immutable.
|
false |
object |
RestartNodeRequest is a request to restart a specific node in the cluster by role. This request executes unconditionally regardless of the current state of the server. This feature is intended as a rescue utility of last resort to recover a SQL Server left in a bad state, e.g. after OOM that can be recovered only by restarting the server. Use with extreme caution: on HA clusters, manually restarting a node while other nodes are undergoing updates or are unhealthy, i.e. the cluster is in degraded state, can lead to unexpected downtime. |
false |
|
object |
ServerConfig contains miscellaneous server-level settings such as supported TLS protocol versions, trace flags, and server configuration (sp_configure) options. Any changes to this configuration (except the majority of options in spConfigure field) will trigger a restart of the SQL Server. Optional. Mutable.
|
false |
|
[]object |
VSphereTags is the list of vSphere tags that the cluster’s deployed virtual machines should have assigned. The tags should exist in vSphere in order to be successfully assigned. Optional. Mutable. |
false |
SQLServerCluster.spec.infrastructurePolicy
InfrastructurePolicy refers to the infrastructure policy resource used to create this cluster.
Required - Must refer to a valid InfrastructurePolicy.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
kind |
string |
Kind of the referent. |
false |
name |
string |
The Name of the referent. |
false |
namespace |
string |
The Namespace of the referent. |
false |
SQLServerCluster.spec.vmClass
VMClass refers to the VM class that should be used to create this cluster. It must be part of the InfrastructurePolicy used by this cluster.
Required - Must refer to a valid VMClass.
Mutable - (Only increases in resources are allowed).
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
SQLServerCluster.spec.activeDirectory
Configuration required to integrate this SQL Server cluster with a given Active Directory domain and enable Windows Authentication for machines part of this domain.
Currently, the DSM user is required to perform the following steps upfront:
-
choose an FQDN for this SQL Server cluster
-
create DNS records (including PTR) in the domain’s DNS
-
create a regular domain user account in Active Directory for this SQL Server cluster (commonly referred to as privileged Active Directory account for SQL Server)
-
register Service Principal Names (SPNs) to this principal in Active Directory
-
create a keytab file that contains entries for each of the SPNs created above
Some of the above steps can be automated by DSM - see the description of each field for more information.
| Name | Type | Description | Required |
|---|---|---|---|
object |
The Active Directory domain that this SQL Server cluster is part of. The reference must point to an ActiveDirectoryDomain object. Changes to this field will trigger a restart of the SQL Server cluster. Required. |
true |
|
object |
The Active Directory domain user account that this SQL Server cluster
will use to perform group refresh (i.e. identify group membership of
users.) This is a regular Active Directory user member of the
This account name is used as the The reference must point to a Secret object with username field containing the unqualified name of the account. Changes to this field will trigger a restart of the SQL Server cluster. Required. |
true |
|
object |
A reference to a secret that contains Kerberos keytab file to be used by this SQL Server cluster. The secret’s data must contain a key named 'keytab' and value created from the actual keytab file. SQL Server uses this keytab to authenticate itself to other services in the domain and to decrypt the Kerberos service ticket of inbound directory users. The keytab file contains the long-term key of the associated SPNs for this SQL Server cluster in the domain’s Key Distribution Center (KDC). The client is responsible to rotate this keytab file when needed and update its reference here. Mutable. Optional. If no reference is provided, Data Services Manager will attempt to automatically register Service Principal Names in the Active Directory domain and generate the necessary keytab, which requires:
Changes to this field will not trigger a restart for SQLServerClusters with data services release version of 9.1.1.0 or newer. Clusters using older data services release will be restarted. |
false |
|
writeDNSNames |
enum |
If specified, enables writing of DNS records for this cluster’s dnsNames to the referenced ActiveDirectoryDomain’s primaryNameserver. The writes are performed using the "DNS UPDATE" protocol (RFC 2136) and are authenticated using the referenced domain’s privilegedAccountCredentials with the GSS-TSIG algorithm (RFC 3645.) Consequently, a non-empty value requires the privilegedAccountCredentials of the referenced domain to be non-empty. Writing the dnsNames is supported regardless whether the cluster is configured for automated keytab creation or a manually-created keytab is provided. The only currently valid value for the field is For each DNS name of the cluster, the Data Services Manager will create an A record pointing to the cluster’s IP address, and WILL DELETE all other A records for the same name. In addition, the Data Services Manager will create PTR records for the cluster’s IP address pointing to each configured DNS name, and WILL DELETE the records pointing to other DNS names. All created records have TTL of 600. For example, consider a SQLServerCluster with dnsNames configured to
DSM will create the following A records: my-cluster.db.example.org. 600 IN A 10.20.30.40 my-db.example.org. 600 IN A 10.20.30.40 and the following PTR records: 40.30.20.10.in-addr.arpa. 600 IN PTR my-cluster.db.example.org. 40.30.20.10.in-addr.arpa. 600 IN PTR my-db.example.org. All other A, AAAA, or PTR records for these names will be deleted. In the above example, any of the following will be DELETED: my-cluster.db.example.org. IN A 10.20.30.50 # Wrong address my-db.example.org. IN AAAA 2001::1 # Wrong address 40.30.20.10.in-addr.arpa. IN PTR other-db.example.org # Points to a wrong name This field controls how the Data Service Manager configures external systems (DNS); changes to this field will not trigger a restart of the SQL Server cluster.
|
false |
SQLServerCluster.spec.activeDirectory.domain
The Active Directory domain that this SQL Server cluster is part of. The reference must point to an ActiveDirectoryDomain object.
Changes to this field will trigger a restart of the SQL Server cluster.
Required.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
The Name of the referent. Required. |
true |
namespace |
string |
The Namespace of the referent. Optional. If not specified, it’s implied that the referent object resides in the same namespace as the referer. |
false |
SQLServerCluster.spec.activeDirectory.sqlServerAccount
The Active Directory domain user account that this SQL Server cluster
will use to perform group refresh (i.e. identify group membership of
users.) This is a regular Active Directory user member of the
Domain Users group. The account must support Kerberos AES 128 and
256-bit encryption.
This account name is used as the network.privilegedadaccount setting
of the SQL Server.
The reference must point to a Secret object with username field containing the unqualified name of the account.
Changes to this field will trigger a restart of the SQL Server cluster.
Required.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
The name of the Secret containing the unqualified username of the service account. When the account type is "User" and no keytab is provided in the SQLServerCluster, the Secret must also contain one or more passwords for the account. See the "type" field for more details on how to set up the account password. The Secret must reside in the same namespace as the SQLServerCluster resource. |
true |
type |
enum |
The type of the corresponding Active Directory account. The supported values are "User" and "GMSA". User: indicates the service account is a classic Active Directory user account. The cluster administrator can either provide a manually created keytab, or set the "password" field of the referenced Secret object to let the Data Service Manager create the keytab. When no keytab is provided, Data Services Manager will:
1. Attempt to automatically register Service Principal Names under
the sqlServerAccount user in the Active Directory domain. The cluster’s
associated ActiveDirectoryDomain must have a configured privilegedAccount,
and the account must have the privilege to modify the In addition, to support password rotation with a generated keytab, the referenced Secret MAY contain a "password-old" field holding an additional account password. The Data Services Manager will use it to generate an extra key version in the generated keytab, allowing SQL Server to authenticate users whose Kerberos service tickets are encrypted with either the "password" or the "password-old" value. To rotate the sqlServerAccount password, the administrator should: 1. Prepare the new password of the account, but do not set it in Active Directory yet. 2. Modify the sqlServerAccount Secret: move the account’s current password to "password-old", and the set the new account password in "password". The Data Services Manager will generate keytab entries for both passwords, and the new password's
entry will have Key Version Number equal to the old password's KVNO plus 1.
3. Wait for the modified Secret's resourceVersion to be reported as reconciled in the cluster's
status.activeDirectory.accountResourceVersion field.
4. Update the account password in Active Directory. It is IMPORTANT to only update the account password
ONCE so that the old and the new password have consecutive Key Version Numbers.
5. Security-conscious administrators SHOULD remove the old password ("password-old")
once the service tickets created with it expire (depending on the domain policy,
usually 10 hours).
Example Secret setup during a rotation: apiVersion: v1 kind: Secret stringData: username: "sqlserver" password: "account's new password" password-old: "account's current password" GMSA: indicates the service account is a Group Managed Service Account. The cluster administrator MUST NOT set a "password" in the referenced Secret, and MUST NOT configure keytab in SQLServerCluster. The cluster’s associated ActiveDirectoryDomain must have a configured privilegedAccount, and the account must have the privilege to read the GMSA managed password i.e. it must be present in the account’s msDS-GroupMSAMembership list. As with classic User accounts when no keytab is provided, the Data Service Manager will attempt to configure the servicePrincipalNames of the GMSA: * If the hostnames configured on the managed account (via the dNSHostname and msDS-AdditionalDnsHostName attributes) are a superset of the cluster’s DNS names, the Data Services Manager will attempt to use the managed account’s own credentials to "self-write" the required Service Principal Names under the account. For the self-write to work, the account must have the "Validate Write To SPNs on SELF" privilege in Active Directory; this privilege is granted by default and will be present unless an Active Directory administrator takes it away explicitly. * If the cluster has additional DNS names, or if the managed account doesn’t have the required privilege, the Data Services Manager will fall back to use the associated ActiveDirectoryDomain’s privilegedAccountCredentials. The field is optional. If no value is specified, the Data Service Manager will assume account of type "User".
|
false |
SQLServerCluster.spec.activeDirectory.keytab
A reference to a secret that contains Kerberos keytab file to be used by this SQL Server cluster. The secret’s data must contain a key named 'keytab' and value created from the actual keytab file.
SQL Server uses this keytab to authenticate itself to other services in the domain and to decrypt the Kerberos service ticket of inbound directory users. The keytab file contains the long-term key of the associated SPNs for this SQL Server cluster in the domain’s Key Distribution Center (KDC). The client is responsible to rotate this keytab file when needed and update its reference here.
Mutable.
Optional. If no reference is provided, Data Services Manager will attempt to automatically register Service Principal Names in the Active Directory domain and generate the necessary keytab, which requires:
-
The ActiveDirectoryDomain must have a valid privilegedAccountCredentials, and that privileged account must be able to write SPNs under the sqlServerAccount.
-
One or more DNS names must be provided in the dnsNames fields of the SQLServerCluster’s spec. While this is not strictly required from the Kerberos protocol perspective, in practice many tools including Microsoft SQL Server Management Studio and Azure Data Studio rely on the DNS to derive the server’s SPN, and they will not work without DNS records.
-
When the sqlServerAccount type is a "User", the referenced secret must contain a password.
-
When the sqlServerAccount type is a "GMSA", the ActiveDirectoryDomain’s privileged account must be able to retrieve the managed password from Active Directory.
Changes to this field will not trigger a restart for SQLServerClusters with data services release version of 9.1.1.0 or newer. Clusters using older data services release will be restarted.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
SQLServerCluster.spec.adminPasswordPolicy
AdminPasswordPolicy configures whether SQL Server enforces its built-in password complexity rules (CHECK_POLICY) on the admin login. When enabled, DSM also pre-validates the referenced admin password Secret at admission time so that policy violations are reported early.
Has no effect when adminUser.type is WindowsPrincipal. Windows-authenticated logins are managed by Active Directory and do not have a SQL Server-managed password, so CHECK_POLICY does not apply.
Optional. For new clusters running DSM 9.1.1 or later, DSM defaults this to enabled. For clusters upgraded from an older release, this field is intentionally left unset (nil), which preserves the pre-upgrade CHECK_POLICY=OFF behavior. Users can opt in after upgrading by explicitly setting enabled=true; DSM will then validate the existing password at that point and reject the change if it does not meet the policy requirements.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
enabled |
boolean |
Enabled controls whether SQL Server sets CHECK_POLICY = ON for the admin login, which requires the password to meet SQL Server’s built-in complexity rules. When true, DSM also pre-validates the referenced password Secret at admission time so that violations are reported immediately. Note: on Linux, SQL Server enforces its own built-in password complexity rules (minimum length, mixed case, digits, and symbols). These are SQL Server’s own rules and are not derived from any Windows domain password policy. When set to false, DSM skips pre-validation and SQL Server sets CHECK_POLICY = OFF on the login.
|
false |
SQLServerCluster.spec.adminUser
AdminUser specifies the name for the initial administrator login of the server.
The user name cannot be sa and must not start with prefix dsm_ which
are reserved by the SQL Server engine and by DSM.
Data Services Manager will automatically create a database user for the administrator login of the server in every user database. That user is a member of the "db_owner" database role and can be used to execute various maintenance tasks on user databases, e.g. integrity checks, index optimization, etc.
Optional. If not specified, DSM will automatically create a login of type SQLUser with default username "mssql_admin" and auto-generated password. The password can be retrieved from the Secret referenced by the cluster’s status.connection.passwordRef field.
Mutable. Both the name and the type of the administrator login can be modified: * Changing the name of an adminUser of type SQLUser renames the existing administrator LOGIN. * Changing the name of an adminUser of type WindowsPrincipal renames the existing LOGIN if the new name refers to the same Active Directory account. Otherwise, it creates a new LOGIN. * Changing the login type creates a new administrator LOGIN with the new type.
Special case must be taken in the cases where a new LOGIN is created: the old LOGIN and any database users created for that LOGIN remain in the SQL Server with their original administrative privileges, including the database users which the Data Services Manager itself created automatically for the admin LOGIN. If this is not desired, the (new) administrator must REVOKE any redundant privileges and/or DROP the objects manually.
| Name | Type | Description | Required |
|---|---|---|---|
type |
enum |
Type specifies the type of the login to create. Could be either 'WindowsPrincipal' or 'SQLUser'. Windows principal (WindowsPrincipal) can be used only if the SQL Server is integrated with Active Directory and represents the principal that will be able to use Windows Authentication to connect to the instance.
|
true |
username |
string |
Username is the name of the administrator login. In case of Windows principal, it can be either a Windows/Domain user or a group in the format <domainName>\<loginName> For example: DOMAINFOO\johndoe The username must not start with prefix |
true |
object |
PasswordRef refers to a v1.Secret containing the password for a user of type SQLUser.
The secret must be in the same namespace as the SQLServerCluster resource.
FieldPath field indicates which key in the secret contains the password. Default - Must be omitted in case of WindowsPrincipal user type. May be omitted in case of SQLUser user type, in which case Data Service Manager generates a random password. |
false |
SQLServerCluster.spec.adminUser.passwordRef
PasswordRef refers to a v1.Secret containing the password for a user of type SQLUser.
The secret must be in the same namespace as the SQLServerCluster resource.
FieldPath field indicates which key in the secret contains the password. Default - password.
Providing inline value with Value field is not supported.
Must be omitted in case of WindowsPrincipal user type. May be omitted in case of SQLUser user type, in which case Data Service Manager generates a random password.
| Name | Type | Description | Required |
|---|---|---|---|
fieldPath |
string |
data.<key> for secrets. Optional. For most references there is a canonical key |
false |
name |
string |
The name of the secret |
false |
value |
string |
Deprecated. This field is never used by the Data Services Manager. |
false |
SQLServerCluster.spec.maintenanceWindow
MaintenanceWindow refers to the System maintenance window. Enabled Maintenance Window will allow CVEs, bug fixes and new Lifecycle Management features for the VM, OS, any supporting software to be addressed. Automatic upgrades applied during this window should only result in minimum downtime of deployed databases for HA clusters. Database minor version upgrades might also be performed. Refer to engine-specific automatic upgrade details which are documented at the corresponding top-level API docs.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
duration |
string |
Duration describes the duration of the maintenance window. Required. Mutable. |
true |
startDay |
enum |
StartDay describes the day of the week the maintenance window will commence. Can be any of Required. Mutable.
|
true |
startTime |
string |
StartTime describes the time of the day (UTC time) to start the maintenance window. Required. Mutable. |
true |
startDayWeeksOfMonth |
[]enum |
StartDayWeeksOfMonth field specifies the weeks of the month in which the
maintenance window will commence. It accepts up to five distinct
values from {1, 2, 3, 4, L}, where each number represents the
occurrence of the designated StartDay within the month ("1" being
the first one that includes it and "L" being the last one).
For example, providing Optional. Mutable.
|
false |
SQLServerCluster.spec.networkConfig
NetworkConfig configures the infrastructure-level network settings for the cluster, such as the MTU of the primary network interface on workload-cluster nodes.
Optional.
| Name | Type | Description | Required | ||
|---|---|---|---|---|---|
mtu |
integer |
MTU sets the MTU on the primary network interface of every workload-cluster node. Accepted values are integers in the range [1600, 8800] inclusive. When nil, the cluster is deployed with the default MTU. This setting only takes effect when using a SupervisorInfrastructurePolicy as the sqlservercluster.spec.infrastructurePolicy and the vSphere namespace defined uses NSX topology. It has no effect in any other deployment type.
Optional. Immutable once set.
|
false |
SQLServerCluster.spec.placementSelector
PlacementSelector refers to a placement declared in the InfrastructurePolicy.
Usually this field should be left empty to allow the system to determine it automatically.
A placement should be found in the InfrastructurePolicy with the same datacenter,
cluster and resource pool to be considered valid.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
cluster |
string |
Cluster is the datacenter’s cluster name to be used when placing the data service workload. Use the full qualified name of the cluster, relative to the datacenter. A cluster "Cluster1" inside a folder "clusters", should be declared as "clusters/Cluster1". Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the cluster name. Required. Mutable. |
true |
datacenter |
string |
Datacenter is the vSphere Datacenter to be used when placing the data service workload. The full qualified path to the datacenter must be provided if the datacenter is placed inside a folder. Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the datacenter name. Required. Mutable. |
true |
resourcePool |
string |
ResourcePool is the Cluster’s resource pool to be used when placing the data service workload. If the resource pool is not provided, the whole cluster is used as the placement. Optional. Mutable. |
false |
SQLServerCluster.spec.productKey
ProductKey is a reference to a Secret with data field "productKey" whose value is in the form of #####-#####-#####-#####-#####, where '#' is a number or a letter. Should be set only if SQL Server should be activated with a Product Key. To set this field the edition field must be set to "ProductKey"
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
SQLServerCluster.spec.restartNodeRequest
RestartNodeRequest is a request to restart a specific node in the cluster by role. This request executes unconditionally regardless of the current state of the server.
This feature is intended as a rescue utility of last resort to recover a SQL Server left in a bad state, e.g. after OOM that can be recovered only by restarting the server. Use with extreme caution: on HA clusters, manually restarting a node while other nodes are undergoing updates or are unhealthy, i.e. the cluster is in degraded state, can lead to unexpected downtime.
| Name | Type | Description | Required |
|---|---|---|---|
nodeRole |
enum |
NodeRole is the role of the SQL Server node to restart, e.g. "primary" or "secondary". For single-node clusters, "primary" is the expected value to restart the node. If a node with this role is not found (e.g. "secondary" requested on a single-node cluster), the request is marked as processed and no action is taken.
|
true |
requestId |
string |
RequestID is a unique identifier for the restart request. |
true |
SQLServerCluster.spec.serverConfig
ServerConfig contains miscellaneous server-level settings such as supported TLS protocol versions, trace flags, and server configuration (sp_configure) options.
Any changes to this configuration (except the majority of options in spConfigure field) will trigger a restart of the SQL Server.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
Configuration of the SQL Server Agent. If omitted, the agent will be disabled. Limitations:
Data Services Manager will automatically create a database user for the administrator login of the server in every user database. That user is a member of the "db_owner" database role. As a result, agent jobs owned by the administrator login can execute various maintenance tasks on user databases, e.g. integrity checks, index optimization, etc. For example, the administrator of the server can configure Ola Hallengren’s Integrity Check to run as an agent job:
Optional. Mutable. |
false |
|
object |
auditing contains configuration settings related to the SQL Server’s auditing subsystem. System administrators configure the auditing by using the standard T-SQL "CREATE AUDIT" and "CREATE AUDIT SPECIFICATION" DDL. In addition, DSM supports the automatic creation of a simple AUDIT which only captures login events; see the spec.auditing.preset field for more information. DSM-managed SQL Server instances run on Linux and as such only support "TO FILE" targets: * The FILEPATH parameter should be set to "/var/opt/mssql/audit". * The "ON_FAILURE = SHUTDOWN" option should not be used. Optional. Mutable. |
false |
|
object |
BackupEncryptionCertificate specifies the certificate SQL Server uses to encrypt backups. When set, all databases on the cluster will have their backups encrypted with this certificate. Changing this field affects only subsequent backups; previously collected backups remain encrypted with the certificate that was active at collection time. To restore from encrypted backups, all certificates used to encrypt them must be present in the target cluster’s Certificates field. Restoring without a required certificate fails with "Cannot find server certificate with thumbprint". The referenced Secret must appear in the Certificates field and cannot be removed from it while this field is set. Requires DSM release version 9.1.1.0 or later. Optional. Mutable. |
false |
|
[]object |
Certificates references Secrets in the same namespace as the SQL Server cluster. For each referenced Secret, DSM creates a server-level certificate with the same name on every data node of the cluster. These certificates can be used for operations such as collecting encrypted backups and restoring them, or enabling Transparent Data Encryption (TDE). For HA clusters, DSM configures the Contained Availability Groups (CAG) feature of SQL Server. In the CAG context, certificates are not visible when querying the sys.certificates catalog view but remain available for backup and restore operations. For a Point-in-Time Recovery (PITR) restore to succeed, all certificates that were used to collect backups must be present on the restore target cluster. SQL Server automatically determines which certificate is required to decrypt each backup. Note: TDE is not managed by DSM. Administrators can import an encryption certificate and enable database encryption manually via SQL statements. Each Secret must contain the following keys: pfx: PFX file containing the certificate and its private key. password: Password protecting the PFX file. Requires DSM release version 9.1.1.0 or later. Optional. Mutable. |
false |
|
collation |
string |
Server collation. Default is The server collation becomes the default collation of the system
databases and all user databases. Database owners can change the
default collation of their database at any time via Warning: collation cannot be changed after the cluster is created. Optional. Immutable.
|
false |
object |
CoreDump configures the core dump settings for the SQL Server. Optional. Mutable.
|
false |
|
object |
ErrorLog configures the error log settings for the SQL Server. Optional. Mutable.
|
false |
|
object |
Language configures the SQL Server language settings such as locale. Optional. Mutable. |
false |
|
object |
Network configures the network settings for the SQL Server. Optional. Mutable.
|
false |
|
palLoggerIni |
string |
Logging configuration file for the SQL Server’s Platform Abstraction Layer (PAL). The contents shall be written verbatim to the SQL Server’s logger.ini . Requirements: for all File outputs in the configuration, the Filename should be an absolute path name to a file under the /var/opt/mssql/log/pal directory. The PAL logging is an advanced diagnostics feature which isn’t necessary during normal SQL Server operation. PAL logging generates detailed diagnostic output that can grow quickly and consume significant disk space over time. For this reason, it should not be enabled permanently. It is recommended to enable PAL logging only when actively debugging an issue or when requested by support. Changes to the PAL logging do not require restart of the DB engine. |
false |
[]object |
SpConfigure sets SQL Server instance-level configuration options via the DSM supports only the following options:
DSM does not allow unsetting/deleting an option that was once configured. To revert
a setting, the user must explicitly set the key back to its default value
(e.g. set Any failures encountered while applying SQL Server options are aggregated and reported in the cluster’s overall Ready condition. Some options require a SQL Server engine restart to take effect (e.g.
Requires DSM release version 9.1.1.0 or later. Optional. Mutable. |
false |
|
traceFlags |
[]integer |
Trace flags with global scope. For example, trace flag 3226 suppresses log messages for successful backups in the error log. Optional. Mutable. |
false |
SQLServerCluster.spec.serverConfig.agent
Configuration of the SQL Server Agent. If omitted, the agent will be disabled.
Limitations:
-
The agent is not supported on Express edition.
-
Only T-SQL job steps are supported. Cannot use job steps which run OS commands, PowerShell scripts, etc.
-
Alerts are not supported.
-
Jobs cannot write to the Windows Application event log.
-
Jobs cannot send e-mail notifications.
-
Job steps cannot write output to file.
Data Services Manager will automatically create a database user for the administrator login of the server in every user database. That user is a member of the "db_owner" database role. As a result, agent jobs owned by the administrator login can execute various maintenance tasks on user databases, e.g. integrity checks, index optimization, etc.
For example, the administrator of the server can configure Ola Hallengren’s Integrity Check to run as an agent job:
-
Create a dedicated database (e.g.
tools) to host the maintenance artifacts. -
Install the
DatabaseIntegrityCheckstored procedure in the dedicated database: run CommandLog.sql, CommandExecute.sql and DatabaseIntegrityCheck.sql from https://ola.hallengren.com/downloads.html -
Create agent job which executes the
DatabaseIntegrityCheckstored procedure on user databases.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
enabled |
boolean |
Enable the agent. The other fields of this configuration object are ignored if the agent is not enabled. Note: If the agent is enabled and then disabled, the agent extended
stored procedures remain available (i.e. server configuration option
Mutable. |
true |
jobHistoryMaxRows |
integer |
Maximum job history log size (in rows). Default is 1000. Note: job history increases the size of MSDB. Optional. Mutable.
|
false |
jobHistoryMaxRowsPerJob |
integer |
Maximum job history rows per job. Default is 100. Must not be greater than Note: job history increases the size of MSDB. Optional. Mutable.
|
false |
logMaxSize |
int or string |
LogMaxSize is a quantity defining a threshold after which the SQL Server agent log file is eligible for rotation. SQL Server Agent stores up to 9 archived agent log files not including the active one. The number of archived files is not configurable. The value should be in the range: 1Mi - 1Gi Defaults to 10Mi Mutable.
|
false |
startupWaitForAllDb |
boolean |
Whether on startup the agent should wait for all databases to be
recovered before it can start a job. Default is If set to When a database is not shut down cleanly, SQL Server performs crash recovery on startup. The recovery process ensures all committed transactions (as they appear in the transaction log) are applied on the data files of the database. For large databases, recovery may take a long time. Optional. Mutable. |
false |
SQLServerCluster.spec.serverConfig.auditing
auditing contains configuration settings related to the SQL Server’s auditing subsystem.
System administrators configure the auditing by using the standard T-SQL "CREATE AUDIT" and "CREATE AUDIT SPECIFICATION" DDL. In addition, DSM supports the automatic creation of a simple AUDIT which only captures login events; see the spec.auditing.preset field for more information.
DSM-managed SQL Server instances run on Linux and as such only support "TO FILE" targets: * The FILEPATH parameter should be set to "/var/opt/mssql/audit". * The "ON_FAILURE = SHUTDOWN" option should not be used.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
logRetentionHours |
integer |
The logRetention enables automatic cleanup of old .sqlaudit files after the specified time. The DSM automation removes old .sqlaudit files whose modification time is older than the current time minus the retention period. All .sqlaudit files are subject to clean up, including the files produced by administrator-created AUDITs. The latest log file of any active AUDIT is never cleaned up. The latest file of inactive audits is cleaned per the above rule. Optional. Mutable. If the field is not set, the .sqlaudit files are retained on the file system forever or until the SQL Server engine itself deletes them due to the MAX_ROLLOVER_FILES configuration.
|
false |
preset |
enum |
If set, the preset enables the creation of a basic DSM-managed audit which only captures login events from the server and from all of its databases. The audit is named "dsm_login_audit", and its audit logs are saved under "/var/opt/mssql/audit". Administrators can read these audit logs can with the standard T-SQL function sys.fn_get_audit_file, or using the Security → Audits → View Audit Logs feature of the SQL Server Management Studio. The following values are supported: * AllLogins : the audit captures all login attempts, including the successful attempts. * FailedLogins : the audit captures only the failed login attempts. The AUDIT’s file configuration has MAXSIZE = 1GB. Administrators can create custom AUDITs instead of or in addition to the DSM-created AUDIT, using the standard T-SQL "CREATE AUDIT" and "CREATE AUDIT SPECIFICATION" DDL. Optional. Mutable. If the field is cleared after being previously configured, DSM disables the AUDIT object, but it does not delete any already captured logs. The log cleanup is controlled via the logRetention field.
|
false |
SQLServerCluster.spec.serverConfig.backupEncryptionCertificate
BackupEncryptionCertificate specifies the certificate SQL Server uses to encrypt backups. When set, all databases on the cluster will have their backups encrypted with this certificate.
Changing this field affects only subsequent backups; previously collected backups remain encrypted with the certificate that was active at collection time.
To restore from encrypted backups, all certificates used to encrypt them must be present in the target cluster’s Certificates field. Restoring without a required certificate fails with "Cannot find server certificate with thumbprint".
The referenced Secret must appear in the Certificates field and cannot be removed from it while this field is set.
Requires DSM release version 9.1.1.0 or later.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
SQLServerCluster.spec.serverConfig.certificates[index]
LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
SQLServerCluster.spec.serverConfig.coreDump
CoreDump configures the core dump settings for the SQL Server.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
captureMiniAndFull |
boolean |
CaptureMiniAndFull configures the "coredump.captureminiandfull" setting passed
into the Optional. Mutable.
|
false |
coreDumpType |
enum |
CoreDumpType configures the "coredump.coredumptype" setting passed into the Defaults to miniplus. Optional. Mutable.
|
false |
disableCoreDump |
boolean |
DisableCoreDump disables the automatic core dump capture when an exception or crash occurs on the SQL Server engine. Administrators are free to create core dump files manually using the standard T-SQL when the automatic core dump capture is disabled. Optional. Mutable.
|
false |
retentionHours |
integer |
RetentionHours specifies the retention period for core dump files. Once the retention period is reached, the core dump files are deleted. The dump directory is included in the LogBundle for the SQLServerCluster which allows administrators to troubleshoot issues with the SQL Server engine. The default value is 168 hours (7 days). The value can be between 1 hour and 720 hours (30 days). Optional. Mutable.
|
false |
SQLServerCluster.spec.serverConfig.errorLog
ErrorLog configures the error log settings for the SQL Server.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
maxSize |
int or string |
MaxSize is a quantity defining a threshold after which the SQL Server error log file is eligible for rotation. The value should be in the range: 1Mi - 1Gi The total amount of space consumed by the logs calculated as MaxSize * (NumErrorLogs + 1) The plus one is accounting for the active log file. Defaults to 100Mi Optional. Mutable.
|
false |
numErrorLogs |
integer |
NumErrorLogs specifies the maximum number of archived log files to keep. This number does not include active error log file. Optional. Mutable.
|
false |
SQLServerCluster.spec.serverConfig.language
Language configures the SQL Server language settings such as locale.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
lcid |
integer |
LCID configures SQL Server locale to any supported Microsoft Windows language code ID (LCID). For example, 1033 for US - English Optional. Mutable.
|
false |
SQLServerCluster.spec.serverConfig.network
Network configures the network settings for the SQL Server.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
tlsProtocols |
[]string |
TLSProtocols list TLS protocols versions to be enabled on the SQL Server. TLS 1.2 is required as this is the latest TLS version supported by SQL Server. Optionally, TLS 1.0 and 1.1 can be enabled. Defaults to enabling only TLS 1.2. Optional. Mutable.
|
false |
tlsSecretName |
string |
TLSSecretName specifies the name of a Secret resource present in the same namespace as the SQL Server cluster, which contains a custom TLS certificate and private key. SQL Server will use this certificate to encrypt the network traffic between the SQL Server and the client applications. The expected format of the Secret is the same as the output Secrets created by cert-manager’s Certificate resource. It needs to have keys: tls.crt: PEM signed certificate chain tls.key: PEM private key ca.crt: PEM CA certificate The ca.crt is optional if there is at least one issuer certificate in the certificate chain (tls.crt key). That issuer can either be a self-signed leaf certificate, or an intermediate or root certificate authority. Optional. When omitted, DSM will auto-generate a certificate using its own internal certificate authority. When specified, DSM will override its auto-generated certificate and use the one described in the Secret. Mutable. To update a custom certificate, either refer to a new Secret, or update the already referenced one. If the SQL Server cluster will be accessed by IP, the TLS configuration needs to be applied after initial creation, because the IP can be retrieved only then, so it can be encoded in the certificate. |
false |
SQLServerCluster.spec.serverConfig.spConfigure[index]
SpConfigureOption represents a SQL Server configuration option value.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name is the server configuration option name as it appears in sys.configurations (e.g. "max degree of parallelism"). |
true |
value |
integer |
Value is the desired integer value for the option
|
true |
SQLServerCluster.spec.vSphereTags[index]
VSphereTag identifies a single vSphere tag by its tag category and tag name.
| Name | Type | Description | Required |
|---|---|---|---|
category |
string |
Category is the vSphere tag category Required. Mutable. |
true |
tag |
string |
Tag is the vSphere tag. It should be part of vSphere tag category Category. Required. Mutable. |
true |
SQLServerCluster.status
status describes the observed status of the SQLServerCluster. The SQLServerCluster conditions can contain the following statuses:
-
Ready: Indicates whether the cluster’s desired state has been reached.-
Status: "True" when the cluster state was successfully reconciled; "False" otherwise.
-
Reasons include:
-
"Ready": The cluster’s desired state has been reached.
-
"InProgress": The cluster is applying a new generation (spec update) or reconciling.
-
"NotOperational": The cluster is not operational and cannot accept queries.
-
-
DatabaseEngineReady: Reflects the operational status of the database engine.-
Status: "True" if the database engine is operational; "False" if there are errors.
-
Reason includes:
-
"Operational": The cluster is fully operational and accepting connections.
-
"Degraded": The cluster is ready to accept read and write queries, but a replica is down.
-
"NotOperational": The cluster is not operational and cannot accept queries.
-
| Name | Type | Description | Required |
|---|---|---|---|
object |
activeDirectory contains status related to the cluster’s Active Directory integration options. This field is set only for Active Directory integrated clusters. |
false |
|
alertLevel |
string |
AlertLevel indicates the level of the most severe alert raised for a database cluster. |
false |
[]object |
AvailableUpgrades lists the valid version upgrades for the database cluster. The information here may be stale: when a Data Services Release is enabled or disabled, the available upgrades for existing clusters are populated asynchronously. However, an actual upgrade attempt is always validated against the current system state and the service will accept valid upgrade paths even if they are not yet populated here. |
false |
|
[]object |
Conditions contain the list of observed conditions of the cluster. The following statuses can occur.
|
false |
|
object |
Connection describes the details which can be used to connect to the database represented by CR. |
false |
|
lastProcessedRestartRequestID |
string |
LastProcessedRestartRequestID is the ID of the last processed restart request. Note that this indicates that the restart request has been accepted but the actual restart may not have been completed yet. |
false |
lastUpdate |
string |
LastUpdate gives the timestamp of when the desired state was last applied.
|
false |
[]object |
Nodes represents the underlying infrastructure of a database cluster. |
false |
|
tlsSecretResourceVersion |
string |
TLSSecretResourceVersion is set only for clusters with custom certificates. It represents the resource version of the Secret that was last applied for the DB cluster. |
false |
object |
UpgradeStatus represents that status of version upgrade |
false |
|
vcfaNetworkSecurityConfigResourceVersion |
string |
VCFANetworkSecurityConfigResourceVersion stores the resource version of the VCFANetworkSecurityConfig singleton after the last successful reconciliation. Used to detect any change in VCFANetworkSecurityConfig so reconciliation is not skipped. |
false |
SQLServerCluster.status.activeDirectory
activeDirectory contains status related to the cluster’s Active Directory integration options.
This field is set only for Active Directory integrated clusters.
| Name | Type | Description | Required |
|---|---|---|---|
accountResourceVersion |
string |
accountResourceVersion contains the last reconciled resource version of the Secret referenced by the spec.activeDirectory.sqlServerAccount property. |
true |
keytabResourceVersion |
string |
keytabResourceVersion contains the last reconciled resource version of the Secret referenced by the spec.activeDirectory.keytab property. This field is set only for clusters configured with a user-provided keytab. |
false |
object |
managedPassword contains information about the latest retrieved managed password of the cluster’s service account. The field is populated only when the service account is of type "GMSA" and therefore it has a managed password. |
false |
SQLServerCluster.status.activeDirectory.managedPassword
managedPassword contains information about the latest retrieved managed password of the cluster’s service account. The field is populated only when the service account is of type "GMSA" and therefore it has a managed password.
| Name | Type | Description | Required |
|---|---|---|---|
expiresAt |
string |
The time when the last retrieved password will expire. This field is provided for informational and debuggability purposes. The Data Services Manager automatically updates the SQL Server’s keytab with the latest managed password version after it rotates and before it expires.
|
true |
lastUpdatedAt |
string |
The time of the last successful update of the SQL Server cluster’s keytab file with the latest retrieved managed password of the cluster’s service account.
|
true |
rotatesAt |
string |
The time when the last retrieved password will become eligible for rotation. This field is provided for informational and debuggability purposes. The Data Services Manager automatically updates the SQL Server’s keytab with the latest managed password version after it rotates and before it expires.
|
true |
SQLServerCluster.status.availableUpgrades[index]
| Name | Type | Description | Required |
|---|---|---|---|
impact |
enum |
Impact indicates whether Virtual Machines backing the workload cluster’s kubernetes nodes will be replaced during the upgrade. When the impact is "RollingUpgrade" the upgrade is performed by adding a new node backed by a new Virtual Machine to the workload cluster, and one of the existing nodes is disabled, drained, and subsequently deleted. The process is repeated until all nodes are replaced. When the impact is "InPlace" the upgrade is performed by replacing the PODs running in the workload cluster, but without replacing the kubernetes nodes.
|
true |
version |
string |
Version indicates the target version of the upgrade path. The version is displayed in qualified canonical format i.e. engine version, followed by the string "+vmware.", followed by the release version. |
true |
autoUpgradeTarget |
boolean |
AutoUpgradeTarget indicates whether the cluster is eligible to be automatically upgraded to the specified version. Automatic upgrades are performed within the configured maintenance period.
|
false |
majorVersionUpgrade |
boolean |
MajorVersionUpgrade indicates whether the upgrade is to newer major version. MajorVersionUpgrade and AutoUpgradeTarget cannot be both true as major version upgrades are only manual.
|
false |
SQLServerCluster.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
SQLServerCluster.status.connection
Connection describes the details which can be used to connect to the database represented by CR.
| Name | Type | Description | Required |
|---|---|---|---|
dbname |
string |
Name of the Database |
true |
host |
string |
Host describes the IP address of the database cluster’s current primary node. |
true |
port |
integer |
Port describes the port on which the database cluster is listening. |
true |
[]object |
ClusterMemberConnectionDetails contains network connection details of individual servers within the cluster. This status will only be populated if the configuration of the server results in the exposure of individual cluster members to the external network. |
false |
|
object |
PasswordRef refers to a v1.Secret that clients can use when connecting to this database. The secret is in the same namespace as the database resource and contains: * "password": the last successfully applied database password. * "ca.crt": the CA certificate for verifying the server’s TLS identity. |
false |
|
username |
string |
Username for the admin account |
false |
SQLServerCluster.status.connection.clusterMemberConnectionDetails[index]
ClusterMemberConnectionInfo contains cluster member identification and network connection details of a single member of a database cluster
| Name | Type | Description | Required |
|---|---|---|---|
clusterMemberId |
string |
ClusterMemberID contains an identification of the member server that will remain the same throughout the lifecycle of the cluster. E.g., for MySQL this will be the MySQL server ID. The cluster role of the member can change. Required. |
true |
host |
string |
Host contains the hostname or IP to connect to Required. |
true |
port |
integer |
Port contains the port to connect to Required.
|
true |
SQLServerCluster.status.connection.passwordRef
PasswordRef refers to a v1.Secret that clients can use when connecting to this database. The secret is in the same namespace as the database resource and contains: * "password": the last successfully applied database password. * "ca.crt": the CA certificate for verifying the server’s TLS identity.
| Name | Type | Description | Required |
|---|---|---|---|
fieldPath |
string |
data.<key> for secrets. Optional. For most references there is a canonical key |
false |
name |
string |
The name of the secret |
false |
value |
string |
Deprecated. This field is never used by the Data Services Manager. |
false |
SQLServerCluster.status.nodes[index]
Node represents the underlying infrastructure of a workload cluster
| Name | Type | Description | Required |
|---|---|---|---|
cpu |
string |
CPU defines the amount of vCPU that is allocated to this node. This is the actual value that the node is provisioned with. This may differ in WCP where it is possible to change the VMClass size after provisioning. Making VMClass an unreliable source of truth for the actual node size. |
false |
datacenter |
string |
Datacenter is the name or inventory path of the datacenter in which the virtual machine is created/located. |
false |
datastore |
string |
Datastore is the name or inventory path of the datastore in which the virtual machine is created/located. |
false |
folder |
string |
Folder is the name or inventory path of the folder in which the virtual machine is created/located. |
false |
host |
string |
Host is the name or inventory path of the ESXi host on which the virtual machine is running. |
false |
memory |
string |
Memory defines the amount of memory, in Gib that is allocated to this node. This is the actual value that the node is provisioned with. This may differ in WCP where it is possible to change the VMClass size after provisioning. Making VMClass an unreliable source of truth for the actual node size. |
false |
object |
Network is the network configuration for this VM. |
false |
|
resourcePool |
string |
ResourcePool is the name or inventory path of the resource pool in which the virtual machine is created/located. |
false |
server |
string |
Server is the IP address or FQDN of the vSphere server on which the virtual machine is created/located. |
false |
storagePolicyName |
string |
StoragePolicyName of the storage policy to use with this Virtual Machine |
false |
vmMoid |
string |
VmMoid is the VM’s Managed Object Reference on vSphere. |
false |
vmName |
string |
VmName is the name of the virtual machine on vSphere. |
false |
vmRole |
string |
VMRole identifies the role VM plays in the workload cluster. like ControlPlane, Worker. |
false |
SQLServerCluster.status.nodes[index].network
Network is the network configuration for this VM.
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
Devices is the list of network devices used by the virtual machine. |
false |
SQLServerCluster.status.nodes[index].network.devices[index]
NetworkDevice defines the network configuration for a virtual machine’s network device.
| Name | Type | Description | Required |
|---|---|---|---|
ipPool |
string |
IPPool is the name of the IP Pool that was used to claim an IP address for the VM. |
false |
networkName |
string |
NetworkName is the name of the vSphere network to which the device will be connected. |
false |
SQLServerCluster.status.upgradeStatus
UpgradeStatus represents that status of version upgrade
| Name | Type | Description | Required |
|---|---|---|---|
currentVersion |
string |
The actual current version of the data service cluster. This is going to be the same as spec.version, unless an upgrade has been requested. In the latter case, this field will be updated once the upgrade completes. |
false |
[]object |
Historical data of the upgrades performed. |
false |
|
lastTransitionTime |
string |
LastTransitionTime shows the last time the cluster’s upgradeStatus.Running field value changed
|
false |
running |
boolean |
Set to true to indicate that a data service cluster upgrade if currently running. Once the upgrade completes, the field will be reset to empty. |
false |
SQLServerCluster.status.upgradeStatus.history[index]
| Name | Type | Description | Required |
|---|---|---|---|
complete |
string |
Timestamp of when the upgrade completed.
|
false |
fromVersion |
string |
The version from which the cluster was upgraded. |
false |
isMajorUpgrade |
boolean |
IsMajorUpgrade specifies whether the upgrade was a major or a minor version upgrade. |
false |
message |
string |
Message contains the reason for a failure or rejection. |
false |
start |
string |
Timestamp of when the upgrade started. This is the time right before the upgrade operations has started and restores are guaranteed to succeed at or before that time. The period after Start and before Complete is considered a blackout period and restores within this interval could lead to unexpected results.
|
false |
status |
enum |
Status indicates the status of the upgrade.
|
false |
toVersion |
string |
The version to which the cluster was upgraded. If the upgrade was aborted or has failed, this field will have the same value as FromVersion. |
false |
SQLServerDatabaseBackup
SQLServerDatabaseBackup represents a full database backup.
If .spec.sourceDatabase is set, DSM takes a new backup from an existing database managed by DSM The collected backup is fully independent from the automated backups (if any) and does not affect the PITR capabilities of the source database.
If .spec.sourceBackup is set, DSM registers an existing external backup instead of taking a new one. This allows you to onboard external backups into DSM, which can then be restored by creating a new SQLServerDatabase based on this resource.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
databases.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
SQLServerDatabaseBackup |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
Spec defines the desired state of the SQLServerDatabaseBackup Required. |
true |
|
object |
Status defines the observed state of the SQLServerDatabaseBackup Optional. |
false |
SQLServerDatabaseBackup.spec
Spec defines the desired state of the SQLServerDatabaseBackup
Required.
| Name | Type | Description | Required |
|---|---|---|---|
object |
BackupLocation must point to an existing BackupLocation custom resource that uses the system trusted root certificates. Immutable. Required.
|
true |
|
backupFilesDeletionPolicy |
enum |
BackupFilesDeletionPolicy defines the behavior of the backup files cleanup process when a SQLServerDatabaseBackup is deleted. Use this to facilitate deletion when the storage is inaccessible or the clean up is otherwise obstructed (which results in the SQLServerDatabaseBackup’s Ready status condition being stuck in Reason=Deleting), or when you want to keep the backup files for other purposes. Delete: the backup files in the storage are deleted when the SQLServerDatabaseBackup is deleted. Retain: the backup files in the storage are not deleted when the SQLServerDatabaseBackup is deleted. Mutable. Default: * "Delete" when sourceDatabase is specified (creating a new backup) * "Retain" when sourceBackup is specified (referencing an existing backup) Note: When sourceBackup is specified, only "Retain" is allowed. The "Delete" policy is not permitted for backups that reference existing backup files, as they may be used by other systems.
|
false |
checksumEnabled |
boolean |
ChecksumEnabled specifies whether to use the CHECKSUM option to verify backup file integrity. Optional. Immutable.
|
false |
object |
SourceBackup specifies the configuration for referencing an existing backup that could be a backup taken outside of DSM. This field should be set if the backup already exists and only needs a representation in DSM. This field is mutually exclusive with sourceDatabase. Exactly one of sourceBackup or sourceDatabase must be specified. Immutable. Optional.
|
false |
|
object |
SourceDatabase must point to an existing database resource in the same namespace as the SQLServerDatabaseBackup. A full database backup will be performed on this database. The backup is independent from the automated backups (if any) but it could be delayed if an automated backup is already in progress. This field is mutually exclusive with sourceBackup. Exactly one of sourceBackup or sourceDatabase must be specified. Immutable. Optional.
|
false |
SQLServerDatabaseBackup.spec.backupLocation
BackupLocation must point to an existing BackupLocation custom resource that uses the system trusted root certificates.
Immutable.
Required.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
SQLServerDatabaseBackup.spec.sourceBackup
SourceBackup specifies the configuration for referencing an existing backup that could be a backup taken outside of DSM. This field should be set if the backup already exists and only needs a representation in DSM.
This field is mutually exclusive with sourceDatabase. Exactly one of sourceBackup or sourceDatabase must be specified.
Immutable.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
path |
string |
Path is a prefix in the BackupLocation that is used to match all backups. All files that match the path and have ".bak" file extension will be considered part of the same backup and will be used on restore. For a backup that is contained a in single file, the path points to the file name as illustrated below.
For a striped backup that has the following files: * /ondemandbackup/…/my-database-name/full-backup_01.bak * /ondemandbackup/…/my-database-name/full-backup_02.bak * /ondemandbackup/…/my-database-name/full-backup_03.bak can be referenced with the following paths: * /ondemandbackup/…/my-database-name * /ondemandbackup/…/my-database-name/full-backup Either a sub-directory can be specified or a full path that includes the backup name prefix. The provided path should unambiguously point to one logical backup that might be striped over multiple physical files. If the backup contains SQL Server files and/or filegroups, the logical names are preserved and the physical file names are updated to fall under the data directory of the placement server. Required. |
true |
SQLServerDatabaseBackup.spec.sourceDatabase
SourceDatabase must point to an existing database resource in the same namespace as the SQLServerDatabaseBackup. A full database backup will be performed on this database. The backup is independent from the automated backups (if any) but it could be delayed if an automated backup is already in progress.
This field is mutually exclusive with sourceBackup. Exactly one of sourceBackup or sourceDatabase must be specified.
Immutable.
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
SQLServerDatabaseBackup.status
Status defines the observed state of the SQLServerDatabaseBackup
Optional.
| Name | Type | Description | Required |
|---|---|---|---|
backupStorageLocation |
string |
BackupStorageLocation is a prefix to the backup files in the backup location. For onboarded backups, this will point to the path specified in the sourceBackup.path field. For backups based on a source database, the path will be based on the database name and id, example: /ondemandbackup/<engine>/<namespace>/<database-name>/<database-backup-name>-<database-backup-uid> For striped backups the longest common prefix will be exposed to reduce collision chance with other backups. Optional |
false |
[]object |
Conditions is an observed list of conditions of a SQLServerDatabaseBackup. Each condition provides detailed status information for a specific aspect of the resource lifecycle.
Optional |
false |
|
object |
DbOwner is the database owner when the backup was created. It is only available when the backup was created from a source database. For backups onboarded to DSM, it is left blank and it is up to the new owner to delete any database users that are no longer needed but present in the backup. Optional |
false |
|
endTime |
string |
EndTime indicates the time that this SQLServerDatabaseBackup completed or failed. Transactions committed after this time will not be included in the backup. Transactions committed while the backup was in progress are expected to be included in the backup. For backups taken outside of DSM this will be the same time as the StartTime. Optional
|
false |
sourceDatabaseName |
string |
SourceDatabaseName is the name of the source database that was backed up. If sourceDatabase is set, it will be the same as sourceDatabase.name otherwise it is left as empty. Optional |
false |
startTime |
string |
StartTime indicates the time that this SQLServerDatabaseBackup was started. When using sourceBackup, this represents the earliest start time across all backups in the backup path. Optional
|
false |
SQLServerDatabaseBackup.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
SQLServerDatabaseBackup.status.dbOwner
DbOwner is the database owner when the backup was created. It is only available when the backup was created from a source database. For backups onboarded to DSM, it is left blank and it is up to the new owner to delete any database users that are no longer needed but present in the backup.
Optional
| Name | Type | Description | Required |
|---|---|---|---|
type |
enum |
Type specifies the type of the user to create. Could be either 'WindowsPrincipal' or 'SQLUser'. Windows principal (WindowsPrincipal) can be used only if the SQL Server that hosts the database is integrated with Active Directory, and represents the principal that will be able to use Windows Authentication to connect to the database instance. Immutable.
|
true |
username |
string |
Username is the name of the database user. In case of Windows principal, it can be either a Windows/Domain user or a group in the format <domainName>\<loginName> For example: DOMAINFOO\johndoe The user name must not start with prefix |
true |
object |
PasswordRef refers to a v1.Secret containing the password for a user of type SQLUser.
The secret must be in the same namespace as the database resource.
FieldPath field indicates which key in the secret contains the password. Default - Must be omitted in case of WindowsPrincipal user type. |
false |
SQLServerDatabaseBackup.status.dbOwner.passwordRef
PasswordRef refers to a v1.Secret containing the password for a user of type SQLUser.
The secret must be in the same namespace as the database resource.
FieldPath field indicates which key in the secret contains the password. Default - password.
Providing inline value with Value field is not supported.
Must be omitted in case of WindowsPrincipal user type.
| Name | Type | Description | Required |
|---|---|---|---|
fieldPath |
string |
data.<key> for secrets. Optional. For most references there is a canonical key |
false |
name |
string |
The name of the secret |
false |
value |
string |
Deprecated. This field is never used by the Data Services Manager. |
false |
SQLServerDatabase
SQLServerDatabase represents the desired state and observed status of a single Microsoft SQL Server Database instance managed by Data Services Manager. Each database instance is managed separately from the actual SQL Server that hosts the database. A DSM User can create SQLServerDatabase by placing it on an existing SQLServerCluster that DSM Admins have made available for consumption through Data Service Policy (see SQLServerDatabasePolicy in DataServicePolicy’s spec).
The database instance is isolated from the SQL Server that hosts it through the use of the "Partially Contained Database" feature of SQL Server. For more information read Microsoft SQL Server official documentation for it.
The name of this resource (as specified in metadata.name field) becomes the name of the database that SQL clients must use when creating a connection to it.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
databases.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
SQLServerDatabase |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
spec defines the desired state of the SQLServerDatabase |
false |
|
object |
status describes the observed status of the SQLServerDatabase |
false |
SQLServerDatabase.spec
spec defines the desired state of the SQLServerDatabase
| Name | Type | Description | Required |
|---|---|---|---|
object |
DbOwner specifies the contained database user with role 'db_owner' to create. The user can be either a Windows/Domain principal or a SQL user with password. In both cases, the user is a database level security principal that does not have an associated login in the master database. In addition to the DbOwner, Data Services Manager will automatically create a database user for the administrator login of the server. That database user allows administrators to run various maintenance tasks, e.g. integrity checks, index optimization, updating statistics, etc. |
true |
|
object |
Placement determines the SQL Server cluster instance where this databases should be placed on. Immutable.
|
true |
|
object |
BackupConfig declares the database’s automated backups configuration details. If specified, the system will perform automatic database backups as per the configured schedule, and additionally it will continuously perform backups of the database transaction logs so that it can offer Point-in-Time Restore (PITR) capability. If specified a Warning: Do not use backup locations with the same host name but different ports on the same SQLServerCluster instance. SQL Server does not take into account the port difference when taking backups for different databases concurrently. As a result, backup intended for one backup location might end up on another one that has the same host name. Optional. Mutable. |
false |
|
object |
BackupLocation, if specified, must point to an existing BackupLocation custom resource that uses the system trusted root certificates. It will be used by the 'BackupConfig', which must be specified whenever BackupLocation is specified. If specified, a Optional. Mutable. |
false |
|
object |
BasedOn identifies the source to restore from. The source can be a live or archived SQLServerDatabase resource, or a SQLServerDatabaseBackup resource which refers to a full database backup taken outside of DSM or within DSM. Optional. Immutable. |
false |
|
name |
string |
Name specifies the name of database in the SQL Server engine. Must be unique in the placement SQLServerCluster, but two different SQLServerDatabase resources in the same DSM API namespace can use the same database name if their placement SQLServerClusters are different. The name is used as a delimited identifier, accepting any non-empty string up to 128 characters and cannot be one of the system database names - master, model, msdb, tempdb. Using this field to set the database name offers more flexibility, as the kubernetes resource Name must comply with subdomain standards as defined in RFC 1123: https://datatracker.ietf.org/doc/html/rfc1123 The primary application of the name field is to clone/restore a database with an identical name within a different SQLServerCluster. Immutable.
|
false |
SQLServerDatabase.spec.dbOwner
DbOwner specifies the contained database user with role 'db_owner' to create. The user can be either a Windows/Domain principal or a SQL user with password. In both cases, the user is a database level security principal that does not have an associated login in the master database.
In addition to the DbOwner, Data Services Manager will automatically create a database user for the administrator login of the server. That database user allows administrators to run various maintenance tasks, e.g. integrity checks, index optimization, updating statistics, etc.
| Name | Type | Description | Required |
|---|---|---|---|
type |
enum |
Type specifies the type of the user to create. Could be either 'WindowsPrincipal' or 'SQLUser'. Windows principal (WindowsPrincipal) can be used only if the SQL Server that hosts the database is integrated with Active Directory, and represents the principal that will be able to use Windows Authentication to connect to the database instance. Immutable.
|
true |
username |
string |
Username is the name of the database user. In case of Windows principal, it can be either a Windows/Domain user or a group in the format <domainName>\<loginName> For example: DOMAINFOO\johndoe The user name must not start with prefix |
true |
object |
PasswordRef refers to a v1.Secret containing the password for a user of type SQLUser.
The secret must be in the same namespace as the database resource.
FieldPath field indicates which key in the secret contains the password. Default - Must be omitted in case of WindowsPrincipal user type. |
false |
SQLServerDatabase.spec.dbOwner.passwordRef
PasswordRef refers to a v1.Secret containing the password for a user of type SQLUser.
The secret must be in the same namespace as the database resource.
FieldPath field indicates which key in the secret contains the password. Default - password.
Providing inline value with Value field is not supported.
Must be omitted in case of WindowsPrincipal user type.
| Name | Type | Description | Required |
|---|---|---|---|
fieldPath |
string |
data.<key> for secrets. Optional. For most references there is a canonical key |
false |
name |
string |
The name of the secret |
false |
value |
string |
Deprecated. This field is never used by the Data Services Manager. |
false |
SQLServerDatabase.spec.placement
Placement determines the SQL Server cluster instance where this databases should be placed on.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
SQLServer is a reference to a SQLServerCluster resource that will host the database. Immutable. |
true |
SQLServerDatabase.spec.placement.sqlServer
SQLServer is a reference to a SQLServerCluster resource that will host the database.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
The Name of the referent. Required. |
true |
namespace |
string |
The Namespace of the referent. Optional. If not specified, it’s implied that the referent object resides in the same namespace as the referer. |
false |
SQLServerDatabase.spec.backupConfig
BackupConfig declares the database’s automated backups configuration details. If specified, the system will perform automatic database backups as per the configured schedule, and additionally it will continuously perform backups of the database transaction logs so that it can offer Point-in-Time Restore (PITR) capability.
If specified a BackupLocation must also be specified.
If specified the database will run in full recovery model.
If not specified, the database will not be protected with any backups and cannot be restored.
Warning: Do not use backup locations with the same host name but different ports on the same SQLServerCluster instance. SQL Server does not take into account the port difference when taking backups for different databases concurrently. As a result, backup intended for one backup location might end up on another one that has the same host name.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
Schedules determine the type and frequency of backups, with the latter defined by a cron expression.
At least one backup schedule with type Required. Mutable. |
true |
|
backupRetentionDays |
integer |
BackupRetentionDays indicates the number of days for which the database’s Point-in-Time Recovery (PITR) is expected to be available. Optional. Mutable.
|
false |
checksumEnabled |
boolean |
ChecksumEnabled specifies whether to use the CHECKSUM option to verify backup file integrity across all backup types (full, differential, and transaction log). By default, checksum verification is disabled. Optional. Mutable. |
false |
logBackupFrequency |
integer |
LogBackupFrequency defines the interval, in minutes, between transaction log backups. If it is not specified, transaction log backups are taken every 5 minutes. Transaction log backup frequency is directly related to the Recovery Point Objective (RPO) and also to the growth of the transaction log file, so it should be carefully configured following Microsoft’s SQL Sever best practices. Optional. Mutable.
|
false |
SQLServerDatabase.spec.backupConfig.schedules[index]
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the schedule. Required. Immutable. |
true |
schedule |
string |
true |
|
type |
enum |
Type of schedule. Possible values are: Type For more information check out the official Microsoft SQL Server documentation. Required. Immutable.
|
true |
SQLServerDatabase.spec.backupLocation
BackupLocation, if specified, must point to an existing BackupLocation custom resource that uses the system trusted root certificates. It will be used by the 'BackupConfig', which must be specified whenever BackupLocation is specified.
If specified, a backupConfig must also be specified.
Optional.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
SQLServerDatabase.spec.basedOn
BasedOn identifies the source to restore from. The source can be a live or archived SQLServerDatabase resource, or a SQLServerDatabaseBackup resource which refers to a full database backup taken outside of DSM or within DSM.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
Backup provides the SQLServerDatabaseBackup resource to restore from. The database will be restored using the full backup associated with this resource. This field is mutually exclusive with Database field. Optional. Immutable. |
false |
|
object |
Database contains the name of the source database and timestamp to use as the restore point. The source database must be live, i.e. the SQLServerDatabase resource representing it must exist in Data Services Manager and must be accessible to the user performing the restore operation. The source database may be hosted in a different SQL Server cluster instance than the target database. This field is mutually exclusive with Backup field. Optional. Immutable. |
false |
SQLServerDatabase.spec.basedOn.backup
Backup provides the SQLServerDatabaseBackup resource to restore from. The database will be restored using the full backup associated with this resource.
This field is mutually exclusive with Database field.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
SQLServerDatabase.spec.basedOn.database
Database contains the name of the source database and timestamp to use as the restore point. The source database must be live, i.e. the SQLServerDatabase resource representing it must exist in Data Services Manager and must be accessible to the user performing the restore operation. The source database may be hosted in a different SQL Server cluster instance than the target database.
This field is mutually exclusive with Backup field.
Optional.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name is the metadata.name of the source SQLServerDatabase/ArchivedSQLServerDatabase resource from which to restore. Required. Immutable. |
true |
timestamp |
string |
Timestamp is the point in time to restore from. The restore will happen to the last available recovery time before the given time. If timestamp is not provided restore will be initiated to the latest available recovery time. Optional. Immutable.
|
false |
type |
enum |
Type specifies the type of the source database resource to be use as a base for the restored database. Could be 'SQLServerDatabase' or 'ArchivedSQLServerDatabase'. Optional.
|
false |
SQLServerDatabase.status
status describes the observed status of the SQLServerDatabase
| Name | Type | Description | Required |
|---|---|---|---|
alertLevel |
string |
AlertLevel indicates the level of the most severe alert raised for this database. |
false |
backupId |
string |
BackupId is set only for Databases with enabled automatic backups. This is a unique ID that can be used to locate backup files in storage. |
false |
[]object |
Status conditions represent the latest available observations of the Database’s current state. The following statuses can occur.
In case of consumption through VMware Cloud Foundation Automation (VCFA) the status includes the following condition:
|
false |
|
object |
Connection describes the details which can be used to connect to the database represented by CR. For Windows Integrated Authentication, the SQL client should use a DNS
name and not the IP address contained in the |
false |
|
earliestRestoreTime |
string |
EarliestRestoreTime is the earliest point in time to which the database can be restored. As automated backup retention removes backups whose retention period has expired, the oldest remaining backup changes. When that happens, the earliest possible restore point advances accordingly. Once backups older than the retention window are deleted, restoring to a time before the oldest remaining backup is no longer possible.
|
false |
lastSuccessfulBackup |
string |
LastSuccessfulBackup indicates the time when the last successful Database backup completed.
|
false |
SQLServerDatabase.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
SQLServerDatabase.status.connection
Connection describes the details which can be used to connect to the database represented by CR.
For Windows Integrated Authentication, the SQL client should use a DNS
name and not the IP address contained in the host field of the
connection object.
| Name | Type | Description | Required |
|---|---|---|---|
dbname |
string |
Name of the Database |
true |
host |
string |
Host describes the IP address of the database cluster’s current primary node. |
true |
port |
integer |
Port describes the port on which the database cluster is listening. |
true |
[]object |
ClusterMemberConnectionDetails contains network connection details of individual servers within the cluster. This status will only be populated if the configuration of the server results in the exposure of individual cluster members to the external network. |
false |
|
dnsNames |
[]string |
The DNS names configured on the cluster which hosts this database. |
false |
object |
PasswordRef refers to a v1.Secret that clients can use when connecting to this database. The secret is in the same namespace as the database resource and contains: * "password": the last successfully applied database password. * "ca.crt": the CA certificate for verifying the server’s TLS identity. |
false |
|
username |
string |
Username for the admin account |
false |
SQLServerDatabase.status.connection.clusterMemberConnectionDetails[index]
ClusterMemberConnectionInfo contains cluster member identification and network connection details of a single member of a database cluster
| Name | Type | Description | Required |
|---|---|---|---|
clusterMemberId |
string |
ClusterMemberID contains an identification of the member server that will remain the same throughout the lifecycle of the cluster. E.g., for MySQL this will be the MySQL server ID. The cluster role of the member can change. Required. |
true |
host |
string |
Host contains the hostname or IP to connect to Required. |
true |
port |
integer |
Port contains the port to connect to Required.
|
true |
SQLServerDatabase.status.connection.passwordRef
PasswordRef refers to a v1.Secret that clients can use when connecting to this database. The secret is in the same namespace as the database resource and contains: * "password": the last successfully applied database password. * "ca.crt": the CA certificate for verifying the server’s TLS identity.
| Name | Type | Description | Required |
|---|---|---|---|
fieldPath |
string |
data.<key> for secrets. Optional. For most references there is a canonical key |
false |
name |
string |
The name of the secret |
false |
value |
string |
Deprecated. This field is never used by the Data Services Manager. |
false |
infrastructure.dataservices.vmware.com/v1alpha1
Resource Types:
ActiveDirectoryDomain
ActiveDirectoryDomain provides a way to enable Kerberos authentication for DSM managed database clusters by using Microsoft Active Directory.
The feature is currently available for use only by SQL Server clusters (i.e. SQLServerCluster resources) to enable Windows Authentication for domain users.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
infrastructure.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
ActiveDirectoryDomain |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
spec defines the desired state of the ActiveDirectoryDomain |
true |
|
object |
status describes the observed status of the ActiveDirectoryDomain |
false |
ActiveDirectoryDomain.spec
spec defines the desired state of the ActiveDirectoryDomain
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
The DNS name of the domain. Required. To ensure the ActiveDirectoryDomain is discovered correctly by the Data Services Manager and the Windows authentication feature works with the associated clusters:
Immutable: cannot be changed after the object is created.
|
true |
primaryNameserver |
string |
The IP address of a "primary" (or "master") nameserver of the Active Directory domain, from which record changes are replicated to all other nameservers. When dynamic DNS updates are requested for a cluster, the updates will execute against this server. The server must support the "DNS UPDATE" protocol (RFC 2136) and the GSS-TSIG algorithm (RFC 3645) for authentication. Optional. If not specified, the Data Services Manager will use the system-wide DNS server configured in DsmSystemConfig. |
false |
object |
Credentials of a user account which will be used to perform automated Active Directory configuration when requested. If provided, the reference must point to a Secret object with "username" and "password" fields where the username contains the unqualified account name of the user. To support automatic creation of keytabs, the account must have the following privileges:
To support dynamic DNS updates, the account must have the following privileges over each DNS zone which will contain cluster DNS names:
Either set of privileges is only required for its respective automation function. I.e. Data Service Manager will successfully use the account to create Service Principal Names even if the account does not have DNS privileges, and vice versa. The credentials are optional. If not provided, the Data Service Manager will not support automated configuration for this domain. |
false |
|
object |
Reference to a Configmap containing a set of certificates to be trusted when validating LDAPS connections. If the domain’s LDAP servers are configured with:
Can be configured only if Optional. If not provided, the Data Services Manager uses the
|
false |
ActiveDirectoryDomain.spec.privilegedAccountCredentials
Credentials of a user account which will be used to perform automated Active Directory configuration when requested.
If provided, the reference must point to a Secret object with "username" and "password" fields where the username contains the unqualified account name of the user.
To support automatic creation of keytabs, the account must have the following privileges:
-
Write servicePrincipalName to all service accounts
-
In addition, the account must support AES encryption for its Kerberos tickets.
To support dynamic DNS updates, the account must have the following privileges over each DNS zone which will contain cluster DNS names:
-
Create children of type dnsNode
-
If the zone already contains records created by other users that need to be overwritten by the Data Services Manager, the user must have "Change owner" in addition to the above.
Either set of privileges is only required for its respective automation function. I.e. Data Service Manager will successfully use the account to create Service Principal Names even if the account does not have DNS privileges, and vice versa.
The credentials are optional. If not provided, the Data Service Manager will not support automated configuration for this domain.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
The Name of the referent. Required. |
true |
namespace |
string |
The Namespace of the referent. Optional. If not specified, it’s implied that the referent object resides in the same namespace as the referer. |
false |
ActiveDirectoryDomain.spec.trustBundle
Reference to a Configmap containing a set of certificates to be trusted when validating LDAPS connections.
If the domain’s LDAP servers are configured with:
-
certificate signed by DSM-trusted CA, TrustBundle must point to the predefined ConfigMap called
trusted-root-cain thedsm-systemnamespace. By default, DSM trusts all well-known OS-trusted CAs. If the certificate is signed by a custom CA then as a prerequisite the custom CA certificate must be added totrusted-root-caby appending it to the value of keyca-bundle.crt. -
certificate signed by authority that should not be globally trusted by DSM, TrustBundle reference must point to Configmap with key
tls.crtthat contains only Issuer certificate(s). If an end-entity (i.e. server) certificate is provided it must be issued by itself, i.e. self-signed.
Can be configured only if spec.privilegedAccountCredentials is set.
Optional. If not provided, the Data Services Manager uses the
trusted-root-ca bundle in the dsm-system namespace.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
The Name of the referent. Required. |
true |
namespace |
string |
The Namespace of the referent. Optional. If not specified, it’s implied that the referent object resides in the same namespace as the referer. |
false |
ActiveDirectoryDomain.status
status describes the observed status of the ActiveDirectoryDomain
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
Conditions contain the list of observed conditions of the ActiveDirectoryDomain. The following statuses can occur.
|
false |
ActiveDirectoryDomain.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
DataServicePolicy
DataServicePolicy refers to a DataService type. Is a set of rules/constraints that can be applied to a set of Data Service instances and apply to each one individually. That is also how it differs from Quota, which is about the aggregation of resources across multiple instances. The infra related references to InfrastructurePolicy and BackupLocation have to be specified in each DataServicePolicy as that controls at the most basic level when that infrastructure can be used. Most other fields can be left empty and default to "allow all". DataServicePolicy also has a matchCriteria field which matches it to a set of namespaces, where those namespaces must have a DataServicePolicyBinding object. That Binding object contains attributes of the namespace that the matchCriteria can match against.
The name of the policy must be unique in the system. The namespace always needs to be dsm-system.
Mutation is allowed. If mutation takes away choices previously allowed, the data service instances that now violate the policy are tracked as "non compliant". The system doesn’t take any action to remediate the non compliance, and that is left to the admins and users. That’s because remediation can be impactful, like a major version upgrade. It shouldn’t be taken lightly. Non compliance with the latest requirements is a standard issue for enterprises. The policy helps by ensuring new instances comply with the new requirements, and that existing instances that are now non-compliant are tracked and reported.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
infrastructure.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
DataServicePolicy |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
DataServicePolicySpec defines the desired state of DataServicePolicy |
false |
|
object |
DataServicePolicyStatus defines the observed state of DataServicePolicy. |
false |
DataServicePolicy.spec
DataServicePolicySpec defines the desired state of DataServicePolicy
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
matchCriteria is used to match to a set of namespaces. On these namespaces the policy will be enforced. For example, an admin may say a policy should be enforced on all namespaces in all projects of a specific org. Or all namespaces with a specific suffix in the name, in a specific project in a specific org. Each namespace may have multiple matching policies and then all of them apply. This is particularly useful when multiple personas each express their policy. An infra admin may make high level policy decisions and then a tenant admin makes further policy decisions within their tenancy, and ultimately the combination of them apply. Mutable. |
true |
|
serviceType |
string |
Service Type of the Policy. Immutable. |
true |
description |
string |
Description contains the human-readable description of the policy. Optional. Mutable. |
false |
object |
DocumentDBPolicy being set means this Policy is about DocumentDB. All other DB types must have a nil spec and ServiceType must be DocumentDB. Mutable. |
false |
|
object |
MysqlPolicy being set means this Policy is about MySQL. All other DB types must have a nil spec and ServiceType must be MySQL. Mutable. |
false |
|
object |
PostgresPolicy being set means this Policy is about Postgres. All other DB types must have a nil spec and ServiceType must be Postgres. Mutable. |
false |
|
object |
SQLServerDatabasePolicy being set means this Policy is about SQL Server Databases. All other DB types must have a nil spec and ServiceType must be SQLServerDatabase. Mutable. |
false |
DataServicePolicy.spec.matchCriteria[index]
PolicyMatchCriteria captures one criteria for matching against the namespaceProperties of DataServicePolicyBinding.
| Name | Type | Description | Required |
|---|---|---|---|
key |
string |
Key relates to the key inside the namespaceProperties of DataServicePolicyBinding Mutable. |
true |
operator |
enum |
Operator Mutable.
|
true |
values |
[]string |
Values relates to the value inside the namespaceProperties of DataServicePolicyBinding Mutable. |
true |
DataServicePolicy.spec.documentDBPolicy
DocumentDBPolicy being set means this Policy is about DocumentDB. All other DB types must have a nil spec and ServiceType must be DocumentDB.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
CommonPolicySpec capures policy elements which are universal across all data service types |
true |
|
allowedReplicas |
[]enum |
allowedReplicas is a list of allowed replica values. Unspecified defaults to "allow all", which can also be expressed with [-1]. An empty list means no replica value is allowed. Mutable.
|
false |
allowedVersions |
[]string |
allowedVersions is a list of allowed version prefixes. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no version is allowed. As they are prefixes, it is possible to express "all version 0.108, regardless of DSM version" via "0.108", or "specifically DSM provided 0.108+vmware.v9.2.0" to specify exact versions. The more specific the versions, the more often the policy will need to be updated to allow users to keep up with critical security and functional patches. Mutable.
|
false |
object |
BackupConfig is the backup config rules for the databases. Mutable. |
false |
DataServicePolicy.spec.documentDBPolicy.common
CommonPolicySpec capures policy elements which are universal across all data service types
| Name | Type | Description | Required |
|---|---|---|---|
allowedBackupLocations |
[]string |
allowedBackupLocations is a list of allowed Backup Locations. For Infra Admins this is a madatory field in all policies, while for tenant admins it may be left unspecified. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list essentially means backup is disallowed. Mutable. |
false |
allowedInfrastructurePolicies |
[]string |
allowedInfrastructurePolicies is a list of allowed Infrastructure Policies. For Infra Admins this is a madatory field in all policies, while for tenant admins it may be left unspecified. Unspecified defaults to "allow all", which can also be expressed with ["*"]. Mutable. |
false |
allowedMaintenanceWindowStates |
[]enum |
AllowedMaintenanceWindowStates is a list of "on"/"off" values that determine whether the maintenance window should be enabled or not. "on" indicates that the maintenance window is required; "off" indicates that maintenance is disallowed. If both "on" and "off" are allowed, it means the maintenance window can be enabled or disabled. Unspecified defaults to "allow all", which can also be expressed with["*"]. An empty list means no option is allowed, which also implies that database provision is not permitted. Mutable.
|
false |
object |
AllowedStorageSpace is a range of allowed storage space of the database. You can express storage as a plain integer or as a fixed-point number using one of these suffixes: E, P, T, G, M, k. You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki. Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values. Mutable. |
false |
|
object |
DatabaseConfig is the database config rules for the databases. Mutable. |
false |
DataServicePolicy.spec.documentDBPolicy.common.allowedStorageSpace
AllowedStorageSpace is a range of allowed storage space of the database. You can express storage as a plain integer or as a fixed-point number using one of these suffixes: E, P, T, G, M, k. You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki.
Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
max |
string |
Max is the maximum value. Unspecified defaults to "no limit". |
false |
min |
string |
Min is the minimum value. Unspecified defaults to "no limit". |
false |
DataServicePolicy.spec.documentDBPolicy.common.databaseConfig
DatabaseConfig is the database config rules for the databases.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
allowedParameters |
[]string |
AllowedParameters is a list of allowed parameters in the database config. The items in the list shouldn’t duplicate with the items in the requiredParameters. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no parameter other than those in the requiredParameters is allowed. Mutable.
|
false |
[]object |
RequiredParameters is a list of required parameters in the database config. The aggregation of multiple policies is the union set of their required parameters. If a required parameter has been specified in multiple policies: a) Their valueType must be the same; otherwise, a conflict occurs, and database provision is not permitted until the dispute is resolved; b) The allowed values in the aggregate policy are the intersection of their allowed values. Mutable. |
false |
DataServicePolicy.spec.documentDBPolicy.common.databaseConfig.requiredParameters[index]
DatabaseParameter defines the allowed values for a custom params/config of the database. The corresponding database parameter specified in the database config of a database CR, for example, the .spec.databaseConfig field of a PostgresCluster CR, will be enforced by the policy. Refer to
for more details about database parameters.
Some examples of database parameters are:
* max_connections and long_query_time for MySQL
* shared_buffers and wal_sync_method for PostgreSQL
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the database parameter. Mutable. |
true |
valueType |
enum |
ValueType of the database parameter. Mutable.
|
true |
allowedValues |
[]string |
AllowedValues is a list of allowed values. Unspecified defaults to "allow all". An empty list means no value is allowed, which also implies that database provision is not permitted. Mutable. |
false |
DataServicePolicy.spec.documentDBPolicy.backupConfig
BackupConfig is the backup config rules for the databases.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
AllowedRetentionDays is a range of allowed retention days of backups. Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values. Mutable. |
false |
|
allowedStates |
[]enum |
AllowedStates is a list of "on"/"off" values that determine whether the database backup should be enabled or not. "on" indicates that the backup configuration is required; "off" indicates that the backup configuration is disallowed. If both "on" and "off" are allowed, it means the backup config can be enabled or disabled. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no option is allowed, which also implies that database provision is not permitted. Mutable.
|
false |
[]object |
RequiredSchedules is a list of required backup schedules. The aggregation of multiple policies is the union set of their required backup schedules. Two backup schedules are identical only if both their type and schedule are equal. Mutable. |
false |
DataServicePolicy.spec.documentDBPolicy.backupConfig.allowedRetentionDays
AllowedRetentionDays is a range of allowed retention days of backups.
Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
max |
integer |
Max is the maximum value. Unspecified defaults to "no limit".
|
false |
min |
integer |
Min is the minimum value. Unspecified defaults to "no limit".
|
false |
DataServicePolicy.spec.documentDBPolicy.backupConfig.requiredSchedules[index]
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the schedule. Required. Immutable. |
true |
schedule |
string |
The schedule in the form of a cron schedule. Required. Mutable. |
true |
type |
string |
Type of schedule. Can be Required. Immutable. |
true |
DataServicePolicy.spec.mysqlPolicy
MysqlPolicy being set means this Policy is about MySQL. All other DB types must have a nil spec and ServiceType must be MySQL.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
CommonPolicySpec capures policy elements which are universal across all data service types |
true |
|
allowedMembers |
[]enum |
allowedMembers is a list of allowed member values. Unspecified defaults to "allow all", which can also be expressed with [-1]. An empty list means no member value is allowed. Mutable.
|
false |
allowedVersions |
[]string |
allowedVersions is a list of allowed version prefixes. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no version is allowed. As they are prefixes, it is possible to express "all version 17, regardless of minor version" via "17.", or "all version 17.9, regardless of DSM version" via "17.9", or "specifically DSM provided 17.9+vmware.2.0" to specify exact versions. The more specific the versions, the more often the policy will need to be updated to allow users to keep up with critical security and functional patches. Mutable.
|
false |
object |
BackupConfig is the backup config rules for the databases. Mutable. |
false |
DataServicePolicy.spec.mysqlPolicy.common
CommonPolicySpec capures policy elements which are universal across all data service types
| Name | Type | Description | Required |
|---|---|---|---|
allowedBackupLocations |
[]string |
allowedBackupLocations is a list of allowed Backup Locations. For Infra Admins this is a madatory field in all policies, while for tenant admins it may be left unspecified. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list essentially means backup is disallowed. Mutable. |
false |
allowedInfrastructurePolicies |
[]string |
allowedInfrastructurePolicies is a list of allowed Infrastructure Policies. For Infra Admins this is a madatory field in all policies, while for tenant admins it may be left unspecified. Unspecified defaults to "allow all", which can also be expressed with ["*"]. Mutable. |
false |
allowedMaintenanceWindowStates |
[]enum |
AllowedMaintenanceWindowStates is a list of "on"/"off" values that determine whether the maintenance window should be enabled or not. "on" indicates that the maintenance window is required; "off" indicates that maintenance is disallowed. If both "on" and "off" are allowed, it means the maintenance window can be enabled or disabled. Unspecified defaults to "allow all", which can also be expressed with["*"]. An empty list means no option is allowed, which also implies that database provision is not permitted. Mutable.
|
false |
object |
AllowedStorageSpace is a range of allowed storage space of the database. You can express storage as a plain integer or as a fixed-point number using one of these suffixes: E, P, T, G, M, k. You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki. Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values. Mutable. |
false |
|
object |
DatabaseConfig is the database config rules for the databases. Mutable. |
false |
DataServicePolicy.spec.mysqlPolicy.common.allowedStorageSpace
AllowedStorageSpace is a range of allowed storage space of the database. You can express storage as a plain integer or as a fixed-point number using one of these suffixes: E, P, T, G, M, k. You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki.
Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
max |
string |
Max is the maximum value. Unspecified defaults to "no limit". |
false |
min |
string |
Min is the minimum value. Unspecified defaults to "no limit". |
false |
DataServicePolicy.spec.mysqlPolicy.common.databaseConfig
DatabaseConfig is the database config rules for the databases.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
allowedParameters |
[]string |
AllowedParameters is a list of allowed parameters in the database config. The items in the list shouldn’t duplicate with the items in the requiredParameters. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no parameter other than those in the requiredParameters is allowed. Mutable.
|
false |
[]object |
RequiredParameters is a list of required parameters in the database config. The aggregation of multiple policies is the union set of their required parameters. If a required parameter has been specified in multiple policies: a) Their valueType must be the same; otherwise, a conflict occurs, and database provision is not permitted until the dispute is resolved; b) The allowed values in the aggregate policy are the intersection of their allowed values. Mutable. |
false |
DataServicePolicy.spec.mysqlPolicy.common.databaseConfig.requiredParameters[index]
DatabaseParameter defines the allowed values for a custom params/config of the database. The corresponding database parameter specified in the database config of a database CR, for example, the .spec.databaseConfig field of a PostgresCluster CR, will be enforced by the policy. Refer to
for more details about database parameters.
Some examples of database parameters are:
* max_connections and long_query_time for MySQL
* shared_buffers and wal_sync_method for PostgreSQL
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the database parameter. Mutable. |
true |
valueType |
enum |
ValueType of the database parameter. Mutable.
|
true |
allowedValues |
[]string |
AllowedValues is a list of allowed values. Unspecified defaults to "allow all". An empty list means no value is allowed, which also implies that database provision is not permitted. Mutable. |
false |
DataServicePolicy.spec.mysqlPolicy.backupConfig
BackupConfig is the backup config rules for the databases.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
AllowedRetentionDays is a range of allowed retention days of backups. Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values. Mutable. |
false |
|
allowedStates |
[]enum |
AllowedStates is a list of "on"/"off" values that determine whether the database backup should be enabled or not. "on" indicates that the backup configuration is required; "off" indicates that the backup configuration is disallowed. If both "on" and "off" are allowed, it means the backup config can be enabled or disabled. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no option is allowed, which also implies that database provision is not permitted. Mutable.
|
false |
[]object |
RequiredSchedules is a list of required backup schedules. The aggregation of multiple policies is the union set of their required backup schedules. Two backup schedules are identical only if both their type and schedule are equal. Mutable. |
false |
DataServicePolicy.spec.mysqlPolicy.backupConfig.allowedRetentionDays
AllowedRetentionDays is a range of allowed retention days of backups.
Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
max |
integer |
Max is the maximum value. Unspecified defaults to "no limit".
|
false |
min |
integer |
Min is the minimum value. Unspecified defaults to "no limit".
|
false |
DataServicePolicy.spec.mysqlPolicy.backupConfig.requiredSchedules[index]
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the schedule. Required. Immutable. |
true |
schedule |
string |
The schedule in the form of a cron schedule. Required. Mutable. |
true |
type |
string |
Type of schedule. Can be Required. Immutable. |
true |
DataServicePolicy.spec.postgresPolicy
PostgresPolicy being set means this Policy is about Postgres. All other DB types must have a nil spec and ServiceType must be Postgres.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
CommonPolicySpec capures policy elements which are universal across all data service types |
true |
|
allowedReplicas |
[]enum |
allowedReplicas is a list of allowed replica values. Unspecified defaults to "allow all", which can also be expressed with [-1]. An empty list means no replica value is allowed. Mutable.
|
false |
allowedVersions |
[]string |
allowedVersions is a list of allowed version prefixes. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no version is allowed. As they are prefixes, it is possible to express "all version 17, regardless of minor version" via "17.", or "all version 17.9, regardless of DSM version" via "17.9", or "specifically DSM provided 17.9+vmware.2.0" to specify exact versions. The more specific the versions, the more often the policy will need to be updated to allow users to keep up with critical security and functional patches. Mutable.
|
false |
object |
BackupConfig is the backup config rules for the databases. Mutable. |
false |
DataServicePolicy.spec.postgresPolicy.common
CommonPolicySpec capures policy elements which are universal across all data service types
| Name | Type | Description | Required |
|---|---|---|---|
allowedBackupLocations |
[]string |
allowedBackupLocations is a list of allowed Backup Locations. For Infra Admins this is a madatory field in all policies, while for tenant admins it may be left unspecified. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list essentially means backup is disallowed. Mutable. |
false |
allowedInfrastructurePolicies |
[]string |
allowedInfrastructurePolicies is a list of allowed Infrastructure Policies. For Infra Admins this is a madatory field in all policies, while for tenant admins it may be left unspecified. Unspecified defaults to "allow all", which can also be expressed with ["*"]. Mutable. |
false |
allowedMaintenanceWindowStates |
[]enum |
AllowedMaintenanceWindowStates is a list of "on"/"off" values that determine whether the maintenance window should be enabled or not. "on" indicates that the maintenance window is required; "off" indicates that maintenance is disallowed. If both "on" and "off" are allowed, it means the maintenance window can be enabled or disabled. Unspecified defaults to "allow all", which can also be expressed with["*"]. An empty list means no option is allowed, which also implies that database provision is not permitted. Mutable.
|
false |
object |
AllowedStorageSpace is a range of allowed storage space of the database. You can express storage as a plain integer or as a fixed-point number using one of these suffixes: E, P, T, G, M, k. You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki. Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values. Mutable. |
false |
|
object |
DatabaseConfig is the database config rules for the databases. Mutable. |
false |
DataServicePolicy.spec.postgresPolicy.common.allowedStorageSpace
AllowedStorageSpace is a range of allowed storage space of the database. You can express storage as a plain integer or as a fixed-point number using one of these suffixes: E, P, T, G, M, k. You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki.
Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
max |
string |
Max is the maximum value. Unspecified defaults to "no limit". |
false |
min |
string |
Min is the minimum value. Unspecified defaults to "no limit". |
false |
DataServicePolicy.spec.postgresPolicy.common.databaseConfig
DatabaseConfig is the database config rules for the databases.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
allowedParameters |
[]string |
AllowedParameters is a list of allowed parameters in the database config. The items in the list shouldn’t duplicate with the items in the requiredParameters. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no parameter other than those in the requiredParameters is allowed. Mutable.
|
false |
[]object |
RequiredParameters is a list of required parameters in the database config. The aggregation of multiple policies is the union set of their required parameters. If a required parameter has been specified in multiple policies: a) Their valueType must be the same; otherwise, a conflict occurs, and database provision is not permitted until the dispute is resolved; b) The allowed values in the aggregate policy are the intersection of their allowed values. Mutable. |
false |
DataServicePolicy.spec.postgresPolicy.common.databaseConfig.requiredParameters[index]
DatabaseParameter defines the allowed values for a custom params/config of the database. The corresponding database parameter specified in the database config of a database CR, for example, the .spec.databaseConfig field of a PostgresCluster CR, will be enforced by the policy. Refer to
for more details about database parameters.
Some examples of database parameters are:
* max_connections and long_query_time for MySQL
* shared_buffers and wal_sync_method for PostgreSQL
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the database parameter. Mutable. |
true |
valueType |
enum |
ValueType of the database parameter. Mutable.
|
true |
allowedValues |
[]string |
AllowedValues is a list of allowed values. Unspecified defaults to "allow all". An empty list means no value is allowed, which also implies that database provision is not permitted. Mutable. |
false |
DataServicePolicy.spec.postgresPolicy.backupConfig
BackupConfig is the backup config rules for the databases.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
AllowedRetentionDays is a range of allowed retention days of backups. Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values. Mutable. |
false |
|
allowedStates |
[]enum |
AllowedStates is a list of "on"/"off" values that determine whether the database backup should be enabled or not. "on" indicates that the backup configuration is required; "off" indicates that the backup configuration is disallowed. If both "on" and "off" are allowed, it means the backup config can be enabled or disabled. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no option is allowed, which also implies that database provision is not permitted. Mutable.
|
false |
[]object |
RequiredSchedules is a list of required backup schedules. The aggregation of multiple policies is the union set of their required backup schedules. Two backup schedules are identical only if both their type and schedule are equal. Mutable. |
false |
DataServicePolicy.spec.postgresPolicy.backupConfig.allowedRetentionDays
AllowedRetentionDays is a range of allowed retention days of backups.
Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
max |
integer |
Max is the maximum value. Unspecified defaults to "no limit".
|
false |
min |
integer |
Min is the minimum value. Unspecified defaults to "no limit".
|
false |
DataServicePolicy.spec.postgresPolicy.backupConfig.requiredSchedules[index]
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the schedule. Required. Immutable. |
true |
schedule |
string |
The schedule in the form of a cron schedule. Required. Mutable. |
true |
type |
string |
Type of schedule. Can be Required. Immutable. |
true |
DataServicePolicy.spec.sqlServerDatabasePolicy
SQLServerDatabasePolicy being set means this Policy is about SQL Server Databases. All other DB types must have a nil spec and ServiceType must be SQLServerDatabase.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
allowedBackupLocations |
[]string |
allowedBackupLocations is a list of allowed Backup Locations. For Infra Admins this is a madatory field in all policies, while for tenant admins it may be left unspecified. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list essentially means backup is disallowed. Mutable. |
false |
allowedOwnerTypes |
[]enum |
AllowedOwnerTypes is a list of allowed database user types for database owners. The database user type can be "WindowsPrincipal" or "SQLUser". "WindowsPrincipal" can be used only when the allowed placement clusters have Active Directory integration. Otherwise, database provisioning won’t be possible. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no option is allowed, which also implies that database provision is not permitted. Mutable.
|
false |
[]object |
AllowedPlacements is a list of allowed placements, i.e. of SQL Server Clusters onto which SQL Server databases can be placed. An explicit list has to be provided, wildcard is not allowed. Mutable. |
false |
|
object |
BackupConfig is the backup config rules for the databases. Mutable. |
false |
DataServicePolicy.spec.sqlServerDatabasePolicy.allowedPlacements[index]
DatabasePlacement is used to determine the SQL Server to host the database.
| Name | Type | Description | Required |
|---|---|---|---|
object |
SQLServer is a reference to a SQLServerCluster resource that will host the database. Immutable. |
true |
DataServicePolicy.spec.sqlServerDatabasePolicy.allowedPlacements[index].sqlServer
SQLServer is a reference to a SQLServerCluster resource that will host the database.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
The Name of the referent. Required. |
true |
namespace |
string |
The Namespace of the referent. Optional. If not specified, it’s implied that the referent object resides in the same namespace as the referer. |
false |
DataServicePolicy.spec.sqlServerDatabasePolicy.backupConfig
BackupConfig is the backup config rules for the databases.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
AllowedRetentionDays is a range of allowed retention days of backups. Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values. Mutable. |
false |
|
allowedStates |
[]enum |
AllowedStates is a list of "on"/"off" values that determine whether the database backup should be enabled or not. "on" indicates that the backup configuration is required; "off" indicates that the backup configuration is disallowed. If both "on" and "off" are allowed, it means the backup config can be enabled or disabled. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no option is allowed, which also implies that database provision is not permitted. Mutable.
|
false |
[]object |
RequiredSchedules is a list of required backup schedules. The aggregation of multiple policies is the union set of their required backup schedules. Two backup schedules are identical only if both their type and schedule are equal. Mutable. |
false |
DataServicePolicy.spec.sqlServerDatabasePolicy.backupConfig.allowedRetentionDays
AllowedRetentionDays is a range of allowed retention days of backups.
Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
max |
integer |
Max is the maximum value. Unspecified defaults to "no limit".
|
false |
min |
integer |
Min is the minimum value. Unspecified defaults to "no limit".
|
false |
DataServicePolicy.spec.sqlServerDatabasePolicy.backupConfig.requiredSchedules[index]
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the schedule. Required. Immutable. |
true |
schedule |
string |
true |
|
type |
enum |
Type of schedule. Possible values are: Type For more information check out the official Microsoft SQL Server documentation. Required. Immutable.
|
true |
DataServicePolicy.status
DataServicePolicyStatus defines the observed state of DataServicePolicy.
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
Conditions contain the list of observed conditions of the policy. So far no statuses have been defined |
false |
|
[]object |
Captures any non-compliance of data services for which this policy applies but its spec is violated. |
false |
DataServicePolicy.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
DataServicePolicy.status.nonCompliance[index]
NonCompliance is the non-compliance of a single data service instance
| Name | Type | Description | Required |
|---|---|---|---|
dsName |
string |
The name of the data service that is not in compliance |
true |
dsType |
string |
The Type of the data service that is not in compliance |
true |
nsProps |
map[string]string |
NamespaceProperties mirrors the DSPolicyBinding.Spec.NamespaceProperties for the namespace in which the data service resides. Depending on scenario, this allows retriving namespace, and org/project information. |
true |
[]object |
The error that explains the non-compliance |
true |
DataServicePolicy.status.nonCompliance[index].violations[index]
NonComplianceViolation is the a single violation. One data service may have multiple.
| Name | Type | Description | Required |
|---|---|---|---|
category |
string |
Category of the violation for coarse grained sorting and filtering |
true |
err |
string |
Err is the error string with the exact violation |
true |
DataServicePolicyBinding
DataServicePolicyBinding has two jobs. First, it supplies information such as Organization, Project and Namespace about the namespace for which it was created, which allows DSM to lookup all matching DataServicePolicies. Second, DataServicePolicyBinding computes the effective policy a logical AND of all applicable policies.
If a DataServicePolicyBinding’s spec.namespaceProperties match all the criteria of a DataServicePolicy, as defined in its spec.matchCriteria, the DataServicePolicy will be enforced in the namespace of the DataServicePolicyBinding.
There can only be one DataServicePolicyBinding per namespace, and its name is well-known as "binding".
Mutation is allowed. If such a change would lead to existing PostgresCluster or MySQL instances being in violation of the matching policies, it would be rejected though. The same notes about the Consumption Operator as documented on the Data Service types themselves apply.
In the overall flow, we expect that first an infra admin creates Policies. Then a tenant admin may also make their own Policies. The tenant also creates projects and namespaces. Finally, when a namespace gets created, the Consumption Operator sees the new namespace, reads the organization/project/namespace information, and creates a DataServicePolicyBinding in DSM using the metadata.namespace field that follows the Consumption Operator convention of <k8s-cluster-prefix>-<co-nsname>, and populates the namespaceProperties field. DSM computes the effective policy on that namespace by looking up all matching Policies. Then the namespace is ready, and Data Service instances can be created.
In the case that DSM works without VMware Cloud Foundation Automation and the Consumption Operator, we expect the DSM admin to create the DataServicePolicyBinding in each namespace where DataServicePolicies should be enforced. The DSM admin can define any meaningful key-value pairs in a DataServicePolicyBinding as its namespaceProperties and the same keys and values in a DataServicePolicy as its matchCriteria. If a DataServicePolicyBinding includes all keys defined in a DataServicePolicy and their values can be matched by the matchCriteria operator, the DataServicePolicy will be enforced in the namespace of the DataServicePolicyBinding. For example, the DSM admin can use the namespace labels as the key-value pairs mentioned above so that they can assign DataServicePolicy to namespaces by namespace labels.
If a namespace is created from the DSM portal, the DataServicePolicyBinding will be automatically created in the namespace.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
infrastructure.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
DataServicePolicyBinding |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
DataServicePolicyBindingSpec defines the desired state of DataServicePolicyBinding |
false |
|
object |
DataServicePolicyBindingStatus defines the observed state of DataServicePolicyBinding. |
false |
DataServicePolicyBinding.spec
DataServicePolicyBindingSpec defines the desired state of DataServicePolicyBinding
| Name | Type | Description | Required |
|---|---|---|---|
namespaceProperties |
map[string]string |
NamespaceProperties is a list of key value pairs, e.g. to hold tenancy information like org/project/namespace, but its key flexible intentionally. |
true |
DataServicePolicyBinding.status
DataServicePolicyBindingStatus defines the observed state of DataServicePolicyBinding.
| Name | Type | Description | Required |
|---|---|---|---|
object |
AggregatePostresPolicy is the effective policy for PostgresCluster based on a logical AND of all matching policies. |
true |
|
object |
AggregatePostresPolicy is the effective policy for PostgresCluster based on a logical AND of all matching policies. |
true |
|
object |
AggregateSQLServerDatabasePolicy is the effective policy for SQLServerDatabase based on a logical AND of all matching policies. |
true |
|
[]object |
Policies are the matching policies that apply with a logical AND. |
true |
|
object |
AggregateDocumentDBPolicy is the effective policy for DocumentDBCluster based on a logical AND of all matching policies. |
false |
|
[]object |
Conditions contain the list of observed conditions of the policybinding. XXX: List types |
false |
|
[]object |
List of data service versions that are allowed in aggregateMysqlPolicy and aggregatePostgresPolicy |
false |
|
[]object |
List of global directory services |
false |
|
[]object |
List of all infrastructure policies that are referenced in the aggregate policies, so the possible values are known to the consumer. |
false |
|
[]object |
Captures any non-compliance of data services in this namespace with the AggregatePolicy |
false |
|
[]object |
List of all sqlservers that are referenced in the aggregate policies, so the possible values are known to the consumer. |
false |
DataServicePolicyBinding.status.aggregateMysqlPolicy
AggregatePostresPolicy is the effective policy for PostgresCluster based on a logical AND of all matching policies.
| Name | Type | Description | Required |
|---|---|---|---|
object |
CommonPolicySpec capures policy elements which are universal across all data service types |
true |
|
allowedMembers |
[]enum |
allowedMembers is a list of allowed member values. Unspecified defaults to "allow all", which can also be expressed with [-1]. An empty list means no member value is allowed. Mutable.
|
false |
allowedVersions |
[]string |
allowedVersions is a list of allowed version prefixes. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no version is allowed. As they are prefixes, it is possible to express "all version 17, regardless of minor version" via "17.", or "all version 17.9, regardless of DSM version" via "17.9", or "specifically DSM provided 17.9+vmware.2.0" to specify exact versions. The more specific the versions, the more often the policy will need to be updated to allow users to keep up with critical security and functional patches. Mutable.
|
false |
object |
BackupConfig is the backup config rules for the databases. Mutable. |
false |
DataServicePolicyBinding.status.aggregateMysqlPolicy.common
CommonPolicySpec capures policy elements which are universal across all data service types
| Name | Type | Description | Required |
|---|---|---|---|
allowedBackupLocations |
[]string |
allowedBackupLocations is a list of allowed Backup Locations. For Infra Admins this is a madatory field in all policies, while for tenant admins it may be left unspecified. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list essentially means backup is disallowed. Mutable. |
false |
allowedInfrastructurePolicies |
[]string |
allowedInfrastructurePolicies is a list of allowed Infrastructure Policies. For Infra Admins this is a madatory field in all policies, while for tenant admins it may be left unspecified. Unspecified defaults to "allow all", which can also be expressed with ["*"]. Mutable. |
false |
allowedMaintenanceWindowStates |
[]enum |
AllowedMaintenanceWindowStates is a list of "on"/"off" values that determine whether the maintenance window should be enabled or not. "on" indicates that the maintenance window is required; "off" indicates that maintenance is disallowed. If both "on" and "off" are allowed, it means the maintenance window can be enabled or disabled. Unspecified defaults to "allow all", which can also be expressed with["*"]. An empty list means no option is allowed, which also implies that database provision is not permitted. Mutable.
|
false |
object |
AllowedStorageSpace is a range of allowed storage space of the database. You can express storage as a plain integer or as a fixed-point number using one of these suffixes: E, P, T, G, M, k. You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki. Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values. Mutable. |
false |
|
object |
DatabaseConfig is the database config rules for the databases. Mutable. |
false |
DataServicePolicyBinding.status.aggregateMysqlPolicy.common.allowedStorageSpace
AllowedStorageSpace is a range of allowed storage space of the database. You can express storage as a plain integer or as a fixed-point number using one of these suffixes: E, P, T, G, M, k. You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki.
Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
max |
string |
Max is the maximum value. Unspecified defaults to "no limit". |
false |
min |
string |
Min is the minimum value. Unspecified defaults to "no limit". |
false |
DataServicePolicyBinding.status.aggregateMysqlPolicy.common.databaseConfig
DatabaseConfig is the database config rules for the databases.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
allowedParameters |
[]string |
AllowedParameters is a list of allowed parameters in the database config. The items in the list shouldn’t duplicate with the items in the requiredParameters. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no parameter other than those in the requiredParameters is allowed. Mutable.
|
false |
[]object |
RequiredParameters is a list of required parameters in the database config. The aggregation of multiple policies is the union set of their required parameters. If a required parameter has been specified in multiple policies: a) Their valueType must be the same; otherwise, a conflict occurs, and database provision is not permitted until the dispute is resolved; b) The allowed values in the aggregate policy are the intersection of their allowed values. Mutable. |
false |
DataServicePolicyBinding.status.aggregateMysqlPolicy.common.databaseConfig.requiredParameters[index]
DatabaseParameter defines the allowed values for a custom params/config of the database. The corresponding database parameter specified in the database config of a database CR, for example, the .spec.databaseConfig field of a PostgresCluster CR, will be enforced by the policy. Refer to
for more details about database parameters.
Some examples of database parameters are:
* max_connections and long_query_time for MySQL
* shared_buffers and wal_sync_method for PostgreSQL
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the database parameter. Mutable. |
true |
valueType |
enum |
ValueType of the database parameter. Mutable.
|
true |
allowedValues |
[]string |
AllowedValues is a list of allowed values. Unspecified defaults to "allow all". An empty list means no value is allowed, which also implies that database provision is not permitted. Mutable. |
false |
DataServicePolicyBinding.status.aggregateMysqlPolicy.backupConfig
BackupConfig is the backup config rules for the databases.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
AllowedRetentionDays is a range of allowed retention days of backups. Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values. Mutable. |
false |
|
allowedStates |
[]enum |
AllowedStates is a list of "on"/"off" values that determine whether the database backup should be enabled or not. "on" indicates that the backup configuration is required; "off" indicates that the backup configuration is disallowed. If both "on" and "off" are allowed, it means the backup config can be enabled or disabled. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no option is allowed, which also implies that database provision is not permitted. Mutable.
|
false |
[]object |
RequiredSchedules is a list of required backup schedules. The aggregation of multiple policies is the union set of their required backup schedules. Two backup schedules are identical only if both their type and schedule are equal. Mutable. |
false |
DataServicePolicyBinding.status.aggregateMysqlPolicy.backupConfig.allowedRetentionDays
AllowedRetentionDays is a range of allowed retention days of backups.
Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
max |
integer |
Max is the maximum value. Unspecified defaults to "no limit".
|
false |
min |
integer |
Min is the minimum value. Unspecified defaults to "no limit".
|
false |
DataServicePolicyBinding.status.aggregateMysqlPolicy.backupConfig.requiredSchedules[index]
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the schedule. Required. Immutable. |
true |
schedule |
string |
The schedule in the form of a cron schedule. Required. Mutable. |
true |
type |
string |
Type of schedule. Can be Required. Immutable. |
true |
DataServicePolicyBinding.status.aggregatePostgresPolicy
AggregatePostresPolicy is the effective policy for PostgresCluster based on a logical AND of all matching policies.
| Name | Type | Description | Required |
|---|---|---|---|
object |
CommonPolicySpec capures policy elements which are universal across all data service types |
true |
|
allowedReplicas |
[]enum |
allowedReplicas is a list of allowed replica values. Unspecified defaults to "allow all", which can also be expressed with [-1]. An empty list means no replica value is allowed. Mutable.
|
false |
allowedVersions |
[]string |
allowedVersions is a list of allowed version prefixes. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no version is allowed. As they are prefixes, it is possible to express "all version 17, regardless of minor version" via "17.", or "all version 17.9, regardless of DSM version" via "17.9", or "specifically DSM provided 17.9+vmware.2.0" to specify exact versions. The more specific the versions, the more often the policy will need to be updated to allow users to keep up with critical security and functional patches. Mutable.
|
false |
object |
BackupConfig is the backup config rules for the databases. Mutable. |
false |
DataServicePolicyBinding.status.aggregatePostgresPolicy.common
CommonPolicySpec capures policy elements which are universal across all data service types
| Name | Type | Description | Required |
|---|---|---|---|
allowedBackupLocations |
[]string |
allowedBackupLocations is a list of allowed Backup Locations. For Infra Admins this is a madatory field in all policies, while for tenant admins it may be left unspecified. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list essentially means backup is disallowed. Mutable. |
false |
allowedInfrastructurePolicies |
[]string |
allowedInfrastructurePolicies is a list of allowed Infrastructure Policies. For Infra Admins this is a madatory field in all policies, while for tenant admins it may be left unspecified. Unspecified defaults to "allow all", which can also be expressed with ["*"]. Mutable. |
false |
allowedMaintenanceWindowStates |
[]enum |
AllowedMaintenanceWindowStates is a list of "on"/"off" values that determine whether the maintenance window should be enabled or not. "on" indicates that the maintenance window is required; "off" indicates that maintenance is disallowed. If both "on" and "off" are allowed, it means the maintenance window can be enabled or disabled. Unspecified defaults to "allow all", which can also be expressed with["*"]. An empty list means no option is allowed, which also implies that database provision is not permitted. Mutable.
|
false |
object |
AllowedStorageSpace is a range of allowed storage space of the database. You can express storage as a plain integer or as a fixed-point number using one of these suffixes: E, P, T, G, M, k. You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki. Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values. Mutable. |
false |
|
object |
DatabaseConfig is the database config rules for the databases. Mutable. |
false |
DataServicePolicyBinding.status.aggregatePostgresPolicy.common.allowedStorageSpace
AllowedStorageSpace is a range of allowed storage space of the database. You can express storage as a plain integer or as a fixed-point number using one of these suffixes: E, P, T, G, M, k. You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki.
Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
max |
string |
Max is the maximum value. Unspecified defaults to "no limit". |
false |
min |
string |
Min is the minimum value. Unspecified defaults to "no limit". |
false |
DataServicePolicyBinding.status.aggregatePostgresPolicy.common.databaseConfig
DatabaseConfig is the database config rules for the databases.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
allowedParameters |
[]string |
AllowedParameters is a list of allowed parameters in the database config. The items in the list shouldn’t duplicate with the items in the requiredParameters. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no parameter other than those in the requiredParameters is allowed. Mutable.
|
false |
[]object |
RequiredParameters is a list of required parameters in the database config. The aggregation of multiple policies is the union set of their required parameters. If a required parameter has been specified in multiple policies: a) Their valueType must be the same; otherwise, a conflict occurs, and database provision is not permitted until the dispute is resolved; b) The allowed values in the aggregate policy are the intersection of their allowed values. Mutable. |
false |
DataServicePolicyBinding.status.aggregatePostgresPolicy.common.databaseConfig.requiredParameters[index]
DatabaseParameter defines the allowed values for a custom params/config of the database. The corresponding database parameter specified in the database config of a database CR, for example, the .spec.databaseConfig field of a PostgresCluster CR, will be enforced by the policy. Refer to
for more details about database parameters.
Some examples of database parameters are:
* max_connections and long_query_time for MySQL
* shared_buffers and wal_sync_method for PostgreSQL
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the database parameter. Mutable. |
true |
valueType |
enum |
ValueType of the database parameter. Mutable.
|
true |
allowedValues |
[]string |
AllowedValues is a list of allowed values. Unspecified defaults to "allow all". An empty list means no value is allowed, which also implies that database provision is not permitted. Mutable. |
false |
DataServicePolicyBinding.status.aggregatePostgresPolicy.backupConfig
BackupConfig is the backup config rules for the databases.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
AllowedRetentionDays is a range of allowed retention days of backups. Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values. Mutable. |
false |
|
allowedStates |
[]enum |
AllowedStates is a list of "on"/"off" values that determine whether the database backup should be enabled or not. "on" indicates that the backup configuration is required; "off" indicates that the backup configuration is disallowed. If both "on" and "off" are allowed, it means the backup config can be enabled or disabled. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no option is allowed, which also implies that database provision is not permitted. Mutable.
|
false |
[]object |
RequiredSchedules is a list of required backup schedules. The aggregation of multiple policies is the union set of their required backup schedules. Two backup schedules are identical only if both their type and schedule are equal. Mutable. |
false |
DataServicePolicyBinding.status.aggregatePostgresPolicy.backupConfig.allowedRetentionDays
AllowedRetentionDays is a range of allowed retention days of backups.
Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
max |
integer |
Max is the maximum value. Unspecified defaults to "no limit".
|
false |
min |
integer |
Min is the minimum value. Unspecified defaults to "no limit".
|
false |
DataServicePolicyBinding.status.aggregatePostgresPolicy.backupConfig.requiredSchedules[index]
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the schedule. Required. Immutable. |
true |
schedule |
string |
The schedule in the form of a cron schedule. Required. Mutable. |
true |
type |
string |
Type of schedule. Can be Required. Immutable. |
true |
DataServicePolicyBinding.status.aggregateSQLServerDatabasePolicy
AggregateSQLServerDatabasePolicy is the effective policy for SQLServerDatabase based on a logical AND of all matching policies.
| Name | Type | Description | Required |
|---|---|---|---|
allowedBackupLocations |
[]string |
allowedBackupLocations is a list of allowed Backup Locations. For Infra Admins this is a madatory field in all policies, while for tenant admins it may be left unspecified. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list essentially means backup is disallowed. Mutable. |
false |
allowedOwnerTypes |
[]enum |
AllowedOwnerTypes is a list of allowed database user types for database owners. The database user type can be "WindowsPrincipal" or "SQLUser". "WindowsPrincipal" can be used only when the allowed placement clusters have Active Directory integration. Otherwise, database provisioning won’t be possible. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no option is allowed, which also implies that database provision is not permitted. Mutable.
|
false |
[]object |
AllowedPlacements is a list of allowed placements, i.e. of SQL Server Clusters onto which SQL Server databases can be placed. An explicit list has to be provided, wildcard is not allowed. Mutable. |
false |
|
object |
BackupConfig is the backup config rules for the databases. Mutable. |
false |
DataServicePolicyBinding.status.aggregateSQLServerDatabasePolicy.allowedPlacements[index]
DatabasePlacement is used to determine the SQL Server to host the database.
| Name | Type | Description | Required |
|---|---|---|---|
object |
SQLServer is a reference to a SQLServerCluster resource that will host the database. Immutable. |
true |
DataServicePolicyBinding.status.aggregateSQLServerDatabasePolicy.allowedPlacements[index].sqlServer
SQLServer is a reference to a SQLServerCluster resource that will host the database.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
The Name of the referent. Required. |
true |
namespace |
string |
The Namespace of the referent. Optional. If not specified, it’s implied that the referent object resides in the same namespace as the referer. |
false |
DataServicePolicyBinding.status.aggregateSQLServerDatabasePolicy.backupConfig
BackupConfig is the backup config rules for the databases.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
AllowedRetentionDays is a range of allowed retention days of backups. Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values. Mutable. |
false |
|
allowedStates |
[]enum |
AllowedStates is a list of "on"/"off" values that determine whether the database backup should be enabled or not. "on" indicates that the backup configuration is required; "off" indicates that the backup configuration is disallowed. If both "on" and "off" are allowed, it means the backup config can be enabled or disabled. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no option is allowed, which also implies that database provision is not permitted. Mutable.
|
false |
[]object |
RequiredSchedules is a list of required backup schedules. The aggregation of multiple policies is the union set of their required backup schedules. Two backup schedules are identical only if both their type and schedule are equal. Mutable. |
false |
DataServicePolicyBinding.status.aggregateSQLServerDatabasePolicy.backupConfig.allowedRetentionDays
AllowedRetentionDays is a range of allowed retention days of backups.
Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
max |
integer |
Max is the maximum value. Unspecified defaults to "no limit".
|
false |
min |
integer |
Min is the minimum value. Unspecified defaults to "no limit".
|
false |
DataServicePolicyBinding.status.aggregateSQLServerDatabasePolicy.backupConfig.requiredSchedules[index]
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the schedule. Required. Immutable. |
true |
schedule |
string |
true |
|
type |
enum |
Type of schedule. Possible values are: Type For more information check out the official Microsoft SQL Server documentation. Required. Immutable.
|
true |
DataServicePolicyBinding.status.policies[index]
DataServicePolicyReference references a data service policy. For convenience, the type of the data service is provided.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the data service policy |
true |
serviceType |
string |
DataServiceType describes the supported data service types. Each data service represents a specific kind of database. |
true |
DataServicePolicyBinding.status.aggregateDocumentDBPolicy
AggregateDocumentDBPolicy is the effective policy for DocumentDBCluster based on a logical AND of all matching policies.
| Name | Type | Description | Required |
|---|---|---|---|
object |
CommonPolicySpec capures policy elements which are universal across all data service types |
true |
|
allowedReplicas |
[]enum |
allowedReplicas is a list of allowed replica values. Unspecified defaults to "allow all", which can also be expressed with [-1]. An empty list means no replica value is allowed. Mutable.
|
false |
allowedVersions |
[]string |
allowedVersions is a list of allowed version prefixes. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no version is allowed. As they are prefixes, it is possible to express "all version 0.108, regardless of DSM version" via "0.108", or "specifically DSM provided 0.108+vmware.v9.2.0" to specify exact versions. The more specific the versions, the more often the policy will need to be updated to allow users to keep up with critical security and functional patches. Mutable.
|
false |
object |
BackupConfig is the backup config rules for the databases. Mutable. |
false |
DataServicePolicyBinding.status.aggregateDocumentDBPolicy.common
CommonPolicySpec capures policy elements which are universal across all data service types
| Name | Type | Description | Required |
|---|---|---|---|
allowedBackupLocations |
[]string |
allowedBackupLocations is a list of allowed Backup Locations. For Infra Admins this is a madatory field in all policies, while for tenant admins it may be left unspecified. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list essentially means backup is disallowed. Mutable. |
false |
allowedInfrastructurePolicies |
[]string |
allowedInfrastructurePolicies is a list of allowed Infrastructure Policies. For Infra Admins this is a madatory field in all policies, while for tenant admins it may be left unspecified. Unspecified defaults to "allow all", which can also be expressed with ["*"]. Mutable. |
false |
allowedMaintenanceWindowStates |
[]enum |
AllowedMaintenanceWindowStates is a list of "on"/"off" values that determine whether the maintenance window should be enabled or not. "on" indicates that the maintenance window is required; "off" indicates that maintenance is disallowed. If both "on" and "off" are allowed, it means the maintenance window can be enabled or disabled. Unspecified defaults to "allow all", which can also be expressed with["*"]. An empty list means no option is allowed, which also implies that database provision is not permitted. Mutable.
|
false |
object |
AllowedStorageSpace is a range of allowed storage space of the database. You can express storage as a plain integer or as a fixed-point number using one of these suffixes: E, P, T, G, M, k. You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki. Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values. Mutable. |
false |
|
object |
DatabaseConfig is the database config rules for the databases. Mutable. |
false |
DataServicePolicyBinding.status.aggregateDocumentDBPolicy.common.allowedStorageSpace
AllowedStorageSpace is a range of allowed storage space of the database. You can express storage as a plain integer or as a fixed-point number using one of these suffixes: E, P, T, G, M, k. You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki.
Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
max |
string |
Max is the maximum value. Unspecified defaults to "no limit". |
false |
min |
string |
Min is the minimum value. Unspecified defaults to "no limit". |
false |
DataServicePolicyBinding.status.aggregateDocumentDBPolicy.common.databaseConfig
DatabaseConfig is the database config rules for the databases.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
allowedParameters |
[]string |
AllowedParameters is a list of allowed parameters in the database config. The items in the list shouldn’t duplicate with the items in the requiredParameters. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no parameter other than those in the requiredParameters is allowed. Mutable.
|
false |
[]object |
RequiredParameters is a list of required parameters in the database config. The aggregation of multiple policies is the union set of their required parameters. If a required parameter has been specified in multiple policies: a) Their valueType must be the same; otherwise, a conflict occurs, and database provision is not permitted until the dispute is resolved; b) The allowed values in the aggregate policy are the intersection of their allowed values. Mutable. |
false |
DataServicePolicyBinding.status.aggregateDocumentDBPolicy.common.databaseConfig.requiredParameters[index]
DatabaseParameter defines the allowed values for a custom params/config of the database. The corresponding database parameter specified in the database config of a database CR, for example, the .spec.databaseConfig field of a PostgresCluster CR, will be enforced by the policy. Refer to
for more details about database parameters.
Some examples of database parameters are:
* max_connections and long_query_time for MySQL
* shared_buffers and wal_sync_method for PostgreSQL
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the database parameter. Mutable. |
true |
valueType |
enum |
ValueType of the database parameter. Mutable.
|
true |
allowedValues |
[]string |
AllowedValues is a list of allowed values. Unspecified defaults to "allow all". An empty list means no value is allowed, which also implies that database provision is not permitted. Mutable. |
false |
DataServicePolicyBinding.status.aggregateDocumentDBPolicy.backupConfig
BackupConfig is the backup config rules for the databases.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
object |
AllowedRetentionDays is a range of allowed retention days of backups. Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values. Mutable. |
false |
|
allowedStates |
[]enum |
AllowedStates is a list of "on"/"off" values that determine whether the database backup should be enabled or not. "on" indicates that the backup configuration is required; "off" indicates that the backup configuration is disallowed. If both "on" and "off" are allowed, it means the backup config can be enabled or disabled. Unspecified defaults to "allow all", which can also be expressed with ["*"]. An empty list means no option is allowed, which also implies that database provision is not permitted. Mutable.
|
false |
[]object |
RequiredSchedules is a list of required backup schedules. The aggregation of multiple policies is the union set of their required backup schedules. Two backup schedules are identical only if both their type and schedule are equal. Mutable. |
false |
DataServicePolicyBinding.status.aggregateDocumentDBPolicy.backupConfig.allowedRetentionDays
AllowedRetentionDays is a range of allowed retention days of backups.
Unspecified defaults to "no limit". The aggregation of multiple policies is the intersection of their values.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
max |
integer |
Max is the maximum value. Unspecified defaults to "no limit".
|
false |
min |
integer |
Min is the minimum value. Unspecified defaults to "no limit".
|
false |
DataServicePolicyBinding.status.aggregateDocumentDBPolicy.backupConfig.requiredSchedules[index]
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the schedule. Required. Immutable. |
true |
schedule |
string |
The schedule in the form of a cron schedule. Required. Mutable. |
true |
type |
string |
Type of schedule. Can be Required. Immutable. |
true |
DataServicePolicyBinding.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
DataServicePolicyBinding.status.dataServiceVersions[index]
DataServiceVersionBindingStatus includes enough information about a DataServiceVersion which is in the allowedVersions of aggregated policy.
It lists all the allowed and enabled (Enabled or Preview) DSV versions in DSP binding’s allowedVersions. For example, aggregatePostgresPolicy.allowedVersions is [15, 16], then the Versions will contains all the enabled 15.* and 16.* of PG versions.
The Versions will be refreshed by DSPB reconcilier to reflect the DSV changes. When a DSV is created and enabled, it will be added to all the bindings which allowedVersions match with this DSV version; When a enabled DSV is deleted, it will be deleted from all the bindings which Versions contains this DSV version; When a DSV is enabled and listed, and now it is changed to disabled, then it will be removed from the list; When a DSV is disabled, and now it is changed to enabled, then it will be added to all the DSP binding’s Versions list if its allowedVersions match with this DSV version.
| Name | Type | Description | Required |
|---|---|---|---|
serviceType |
string |
Service type |
true |
[]object |
List of data service version info |
false |
DataServicePolicyBinding.status.dataServiceVersions[index].versions[index]
DataServiceVersionBindingInfo includes the key information about the DataServiceVersion
| Name | Type | Description | Required |
|---|---|---|---|
releaseNotesLink |
string |
Link (URL) to the release notes for the version’s corresponding release. |
true |
version |
string |
The full data service version string |
true |
DataServicePolicyBinding.status.directoryServices[index]
DirectoryServiceBindingStatus includes enough information about a DirectoryService which is set up in directory services settings.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the directory service |
true |
DataServicePolicyBinding.status.infrastructurePolicies[index]
InfrastructurePolicyBindingStatus includes enough information about an InfrastructurePolicy such that a consumer knows which values are allowed during Data Service Instance CRUD.
| Name | Type | Description | Required |
|---|---|---|---|
isSupervisor |
boolean |
Is this a SupervisorInfrastructurePolicy |
false |
name |
string |
Name of the InfrastructurePolicy |
false |
status |
string |
The status of the InfrastructurePolicy/SupervisorInfrastructurePolicy. It is populated from the reason of the 'Ready' condition of the InfrastructurePolicy/SupervisorInfrastructurePolicy |
false |
storagePolicies |
[]string |
StoragePolicies are the list of StoragePolicyReference configurations that can be used to deploy a data service workload |
false |
[]object |
VMClasses is a list of VMClasses available for use by a data service workload They are listed directly here, as names and values are only unique within a single infrastructure policy. |
false |
|
zoneCount |
integer |
ZoneCount refers to the count of zones available within this infrastructure policy. For non-supervisor InfrastructurePolicy in DSM, crossClusterHA enabled is equivalent to zoneCount=3, while with it disabled it is zoneCount=1. For supervisor based InfrastructurePolicy the zoneCount can also be higher numbers. |
false |
DataServicePolicyBinding.status.infrastructurePolicies[index].vmClasses[index]
VMClassBindingInfo includes the key information about the VMClass such that a consumer user can understand what they will get with this VMClass.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the VMClass |
false |
object |
Requests defines the amount of resources that should be allocated and reserved when this class is consumed |
false |
DataServicePolicyBinding.status.infrastructurePolicies[index].vmClasses[index].requests
Requests defines the amount of resources that should be allocated and reserved when this class is consumed
| Name | Type | Description | Required |
|---|---|---|---|
cpu |
string |
CPU defines the amount of vCPU that should be used when this class is consumed. Once a cluster is created this resource will be reserved on the underlying ESXI host.
It should be represented as an integer, like |
false |
memory |
string |
Memory defines the amount of memory, in Gib that should be used when this class is
consumed. Once a cluster is created this resource will be reserved on the underlying ESXI host.
It should be represented as an integer, like |
false |
DataServicePolicyBinding.status.nonCompliance[index]
NonCompliance is the non-compliance of a single data service instance
| Name | Type | Description | Required |
|---|---|---|---|
dsName |
string |
The name of the data service that is not in compliance |
true |
dsType |
string |
The Type of the data service that is not in compliance |
true |
nsProps |
map[string]string |
NamespaceProperties mirrors the DSPolicyBinding.Spec.NamespaceProperties for the namespace in which the data service resides. Depending on scenario, this allows retriving namespace, and org/project information. |
true |
[]object |
The error that explains the non-compliance |
true |
DataServicePolicyBinding.status.nonCompliance[index].violations[index]
NonComplianceViolation is the a single violation. One data service may have multiple.
| Name | Type | Description | Required |
|---|---|---|---|
category |
string |
Category of the violation for coarse grained sorting and filtering |
true |
err |
string |
Err is the error string with the exact violation |
true |
DataServicePolicyBinding.status.sqlServers[index]
SQLServerClusterBindingStatus captures the set of fields about a SQLServerCluster required for consumers, i.e. for users who wish to create SQLServerDatabases that are placed onto SQLServerClusters.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the SQLServerCluster |
true |
namespace |
string |
Namespace of the SQLServerCluster |
true |
version |
string |
The DSM version of the SQLServerCluster |
true |
domain |
string |
The Active Directory domain that this SQL Server cluster is part of, if any. |
false |
edition |
string |
Edition specifies the SQL Server edition. Possible values include: Evaluation, Developer, Express, Web, Standard, Enterprise, EnterpriseCore |
false |
replicas |
integer |
The number of Always On availability replicas that this SQL Server cluster supports.
Could be
|
false |
status |
string |
The status of the SQLServerCluster. It is populated from the reason of the 'Ready' condition of the SQLServerCluster |
false |
DataServicePolicyComplianceReportRequest
DataServicePolicyComplianceReportRequest is in not a normal CRD for which instances are created in the API server. Instead, it is a REST API request body for the /compliance subresource of a DataServicePolicy. As such, this request happens in the context of a DataServicePolicy, and a DataServicePolicyComplianceReportResponse is syncronously returned from the REST API, and the response is also not stored in the API server. The REST API is supposed to be used for the UI which wants to show the impact of policy Create/Update, or wants to present reports with summaries and progressive disclosure. Those don’t fit well with the normal K8s CR model, and hence this Request → Response style is used instead.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
infrastructure.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
DataServicePolicyComplianceReportRequest |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
includeComplianceDetails |
boolean |
IncludeComplianceDetails requests the compliance report to include details of the data service instances are in violation. The Filter field controls which data services are included. |
true |
includeComplianceSummary |
boolean |
IncludeComplianceSummary requests a compliance summary to be included in the response. Summary table of policy violation counts, grouped by type of violation. Individual data service instances aren’t included, just their count. |
true |
object |
Filter applies to the returned details view only. Even if a filter is applied, the summary includes all data service instances. |
false |
|
whatIfObject |
object |
WhatIfObject can be supplied to express that instead of the current state of the object this new one should be used. Can also be used for objects that don’t exist yet. |
false |
DataServicePolicyComplianceReportRequest.filter
Filter applies to the returned details view only. Even if a filter is applied, the summary includes all data service instances.
| Name | Type | Description | Required |
|---|---|---|---|
category |
string |
Only match against this specific category |
false |
[]object |
Only data service instances are considered that are in a namespace that has a DataServicePolicyBinding.Spec.NamespaceProperties that matches this MatchCriteria |
false |
|
violation |
string |
Only match when the violation is exactly this string |
false |
DataServicePolicyComplianceReportRequest.filter.matchCriteria[index]
PolicyMatchCriteria captures one criteria for matching against the namespaceProperties of DataServicePolicyBinding.
| Name | Type | Description | Required |
|---|---|---|---|
key |
string |
Key relates to the key inside the namespaceProperties of DataServicePolicyBinding Mutable. |
true |
operator |
enum |
Operator Mutable.
|
true |
values |
[]string |
Values relates to the value inside the namespaceProperties of DataServicePolicyBinding Mutable. |
true |
DataServicePolicyComplianceReportResponse
DataServicePolicyComplianceReportResponse is the response to a DataServicePolicyComplianceReportRequest.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
infrastructure.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
DataServicePolicyComplianceReportResponse |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
[]object |
Details of the violations, if requested, with the requested filter applied. |
false |
|
object |
Summary of the violations, if requested |
false |
DataServicePolicyComplianceReportResponse.details[index]
NonCompliance is the non-compliance of a single data service instance
| Name | Type | Description | Required |
|---|---|---|---|
dsName |
string |
The name of the data service that is not in compliance |
true |
dsType |
string |
The Type of the data service that is not in compliance |
true |
nsProps |
map[string]string |
NamespaceProperties mirrors the DSPolicyBinding.Spec.NamespaceProperties for the namespace in which the data service resides. Depending on scenario, this allows retriving namespace, and org/project information. |
true |
[]object |
The error that explains the non-compliance |
true |
DataServicePolicyComplianceReportResponse.details[index].violations[index]
NonComplianceViolation is the a single violation. One data service may have multiple.
| Name | Type | Description | Required |
|---|---|---|---|
category |
string |
Category of the violation for coarse grained sorting and filtering |
true |
err |
string |
Err is the error string with the exact violation |
true |
DataServicePolicyComplianceReportResponse.summary
Summary of the violations, if requested
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
Entries is a list of violations with their category and data service instance count |
false |
DataServicePolicyComplianceReportResponse.summary.entries[index]
DataServicePolicyComplianceSummaryEntry is one entry in the summary
| Name | Type | Description | Required |
|---|---|---|---|
category |
string |
Category of the violation |
true |
numNonCompliant |
integer |
NumNonCompliant is the number of data service instances that have this specific violation. |
true |
violation |
string |
Violation is an error message capturing the actual violation |
true |
DirectoryService
DirectoryService provides a flexible way to integrate with LDAP directory services like Microsoft Active Directory and OpenLDAP. It facilitates authentication against DSM managed database clusters and DSM Appliance, offering a centralized authentication strategy.
In order to enable DSM Appliance LDAP Authentication a well-known DirectoryService named "ldap-default" in dsm-system namespace needs to be created. This ldap-default DirectoryService can also be adopted by any DSM-managed database cluster.
Note: Here Active Directory is considered only as an LDAP server. This is not a mechanism to configure Kerberos or NTLM authentication against Active Directory.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
infrastructure.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
DirectoryService |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
DirectoryServiceSpec defines the desired state of DirectoryService |
false |
|
object |
DirectoryServiceStatus describes the observed status of the DirectoryService |
false |
DirectoryService.spec
DirectoryServiceSpec defines the desired state of DirectoryService
| Name | Type | Description | Required |
|---|---|---|---|
object |
Secret reference for the bind user credentials (user and password) of type 'kubernetes.io/basic-auth' The user should have at least read access to the base DN for users ID of a user in the domain who has read-only access to Base DN for users . The ID should be in the format: * determined by userSearchAttribute, default is using UPN ([email protected]). * DN (cn=user,cn=Users,dc=domain,dc=com) Mutable. |
true |
|
domain |
string |
The fully qualified domain name (FQDN) of the domain. For example, companydomain.company.com. Mutable. |
true |
primaryServerUrl |
string |
Primary domain controller LDAP server for the domain. You can use either the host name or the IP address. Use the format ldaps://hostname_or_IPAddress:port. The port is typically 636 for LDAPS connections with OpenLDAP. For Active Directory multi-domain controller deployments, the port is typically 3269 for LDAPS. Mutable.
|
true |
baseDnUsers |
string |
Base Distinguished Name for users. Enter the DN from which to start user searches. For example, cn=Users,dc=myCorp,dc=com. If not set Search will start from root DN Mutable. |
false |
secondaryServerUrls |
[]string |
List of URLs for secondary LDAP/AD servers used as a fallback. The application of these URLs is client-specific and some or all them may not be used PostgresSQL supports specifying multiple secondary servers. MySQL supports specifying only single secondary server. DSM Appliance supports specifying only primary and will ignore any secondary servers set. Mutable. |
false |
object |
TrustBundle is a reference to a Configmap containing a set of certificates to be trusted when validating
the Servers connection.
If the provided servers are configured with:
* certificate signed by DSM trusted CA, TrustBundle must point to the predefined ConfigMap called Mutable. |
false |
|
type |
enum |
Type specifies the directory type, either Mutable.
|
false |
userSearchAttribute |
string |
The user search attribute to use when doing search+bind authentication. The default is set to userPrincipalName which in most Active Directory setups correspond to user’s corporate email. So people would log in with '[email protected]' as username. Other common options are "uid", "sAMAccountName" which correspond to user id only: "user" Mutable
|
false |
DirectoryService.spec.bindCredentials
Secret reference for the bind user credentials (user and password) of type 'kubernetes.io/basic-auth'
The user should have at least read access to the base DN for users ID of a user in the domain who has read-only access to Base DN for users . The ID should be in the format: * determined by userSearchAttribute, default is using UPN ([email protected]). * DN (cn=user,cn=Users,dc=domain,dc=com)
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
DirectoryService.spec.trustBundle
TrustBundle is a reference to a Configmap containing a set of certificates to be trusted when validating
the Servers connection.
If the provided servers are configured with:
* certificate signed by DSM trusted CA, TrustBundle must point to the predefined ConfigMap called trusted-root-ca in the dsm-system namespace. By default, DSM trusts all well-known OS-trusted CAs. If the certificate is signed by a custom CA then as a prerequisite the custom CA certificate must be added to trusted-root-ca by appending it to the value of key ca-bundle.crt.
* certificate signed by authority that should not be globally trusted by DSM, TrustBundle reference must point to Configmap with key tls.crt that contains only Issuer certificate(s). If an end-entity (i.e. server) certificate is provided it must be issued by itself, i.e. self-signed.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
DirectoryService.status
DirectoryServiceStatus describes the observed status of the DirectoryService
| Name | Type | Description | Required |
|---|---|---|---|
alertLevel |
string |
AlertLevel indicates the level of the most severe alert raised for a database cluster. |
false |
[]object |
Conditions contain the list of observed conditions of the DirectoryService. The following statuses can occur.
|
false |
DirectoryService.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
InfrastructurePolicy
InfrastructurePolicy defines constraints on which vSphere infrastructure resources to expose for usage by data service workloads
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
infrastructure.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
InfrastructurePolicy |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
Spec is the desired state of the InfrastructurePolicy |
false |
|
object |
Status reports the observed state of the InfrastructurePolicy |
false |
InfrastructurePolicy.spec
Spec is the desired state of the InfrastructurePolicy
| Name | Type | Description | Required |
|---|---|---|---|
enableCrossClusterHA |
boolean |
EnableCrossClusterHA specifies if the InfrastructurePolicy is configured to support Cross vSphere Cluster HA. Setting this to "true" will trigger several context specific validations on this resource. Defaults to false.
Required.
|
true |
enabled |
boolean |
Enabled specifies if the InfrastructurePolicy is available for use. Must be Required. Mutable. |
true |
[]object |
IPRanges are the list of IPRange configurations available for use by data service workloads. Once a cluster is using the policy IPRanges can only be added to this list, not removed. Required. Mutable. |
true |
|
[]object |
Placements are the list of Placement configurations available for use by the InfrastructurePolicy. Once a cluster is using the policy Placements can only be added to this list, not removed Required. Mutable. |
true |
|
storagePolicies |
[]string |
StoragePolicies are the list of StoragePolicyReference configurations that can be used to deploy a data service workload. Once a cluster is using the policy StoragePolicies can only be added to this list, not removed. Required. Mutable. |
true |
[]object |
VMClasses are the list of VMClass references available for use by a data service workload. Once a cluster is using the policy VMClasses can only be added to this list, not removed. Required. Mutable. |
true |
|
description |
string |
Human-readable description of the infrastructure policy. Optional. Mutable. |
false |
InfrastructurePolicy.spec.ipRanges[index]
IPRange associates an IP Pool name with the PortGroups that can use the IP Pool.
| Name | Type | Description | Required |
|---|---|---|---|
poolName |
string |
PoolName is the name of the IP Pool to be associated with specified PortGroups. Required. Mutable. |
true |
[]object |
PortGroups is the list of IPRangePortGroups associated with the specified Required. Mutable. |
true |
InfrastructurePolicy.spec.ipRanges[index].portGroups[index]
IPRangePortGroup specifies which datacenters' distributed port groups can be used by the data service workloads.
| Name | Type | Description | Required |
|---|---|---|---|
datacenter |
string |
Datacenter is the datacenter where the distributed port group is defined |
true |
moid |
string |
MOID is the managed object ID of a distributed port group. This must be used when NSX manages portgroups that have the same name. If the MOID is provided, then Name is ignored. Optional. Mutable. |
false |
name |
string |
Name is the name of a distributed port group Optional. Mutable. |
false |
InfrastructurePolicy.spec.placements[index]
Placement is the set of resources within a single vSphere cluster
| Name | Type | Description | Required |
|---|---|---|---|
cluster |
string |
Cluster is the datacenter’s cluster name to be used when placing the data service workload. Use the full qualified name of the cluster, relative to the datacenter. A cluster "Cluster1" inside a folder "clusters", should be declared as "clusters/Cluster1". Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the cluster name. Required. Mutable. |
true |
datacenter |
string |
Datacenter is the vSphere Datacenter to be used when placing the data service workload. The full qualified path to the datacenter must be provided if the datacenter is placed inside a folder. Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the datacenter name. Required. Mutable. |
true |
portGroups |
[]string |
PortGroups are the PortGroup names or MOIDs that can be used by the data service workload. Required. Mutable. |
true |
folder |
string |
Folder is the VM and Template Folder name to be used to organize VMs in the vSphere UI. Optional, VMs will be created in the root datacenter folder if not provided. Provide the full qualified path of the folder starting from the Datacenter. Any slash in the name is considered a path delimiter, use the literal '%2f' if need to represent a slash in the folder name. Optional. Mutable. |
false |
resourcePool |
string |
ResourcePool is the Cluster’s resource pool to be used when placing the data service workload. If the resource pool is not provided, the whole cluster is used as the placement. Optional. Mutable. |
false |
InfrastructurePolicy.spec.vmClasses[index]
LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
InfrastructurePolicy.status
Status reports the observed state of the InfrastructurePolicy
| Name | Type | Description | Required |
|---|---|---|---|
alertLevel |
string |
AlertLevel indicates the level of the most severe alert raised for an infrastructure policy. |
false |
[]object |
Conditions contain the list of observed conditions of the InfrastructurePolicy. The following statuses can occur.
|
false |
|
object |
false |
InfrastructurePolicy.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
InfrastructurePolicy.status.resources
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
IPRanges is the list of IPRanges configurations available for use by the InfrastructurePolicy. These are realized versions of the placement object from spec.ipRanges. MOIDs have been retrieved and saved for all paths to make infra polices resilient to files being renamed or moved |
false |
|
[]object |
PlacementsStatus is the list of Placement configurations available for use by the InfrastructurePolicy. These are realized versions of the placement object from spec.placement. Moids have been retrieved and saved for all paths to make infra polices resilient to files being renamed or moved |
false |
InfrastructurePolicy.status.resources.ipRanges[index]
IPRangeStatus is a realized version of IPRange from the spec.
| Name | Type | Description | Required |
|---|---|---|---|
poolName |
string |
true |
|
[]object |
true |
InfrastructurePolicy.status.resources.ipRanges[index].portGroups[index]
IPRangePortGroupStatus is a realized version of IPRangePortGroup from the spec. All paths have been converted to MOIDs to make them resilient to rename and moves. For details on any single field please look at the details for the same object in spec.IPRangePortGroup
| Name | Type | Description | Required |
|---|---|---|---|
object |
Datacenter is the datacenter where the distributed port group is defined |
true |
|
moid |
string |
false |
|
name |
string |
false |
InfrastructurePolicy.status.resources.ipRanges[index].portGroups[index].datacenter
Datacenter is the datacenter where the distributed port group is defined
| Name | Type | Description | Required |
|---|---|---|---|
inventoryPath |
string |
InventoryPath is the up to date location of this resource. In the case where a resource has been moved/renamed since the spec was submitted this path will not match what is in the spec and a condition may be raised The information contained on this field will be used to provision infrastructure resources. |
true |
moid |
string |
MOID the vSphere Managed Object ID of the resource |
true |
InfrastructurePolicy.status.resources.placements[index]
PlacementStatus is a realized version of placement from the spec. All paths have been converted to MOIDs to make them resilient to rename and moves. For details on any single field please look at the details for the same object in spec.placements
| Name | Type | Description | Required |
|---|---|---|---|
object |
Resource represents an object with inventory path and moid |
true |
|
object |
Resource represents an object with inventory path and moid |
true |
|
object |
Resource represents an object with inventory path and moid |
true |
|
[]object |
true |
||
object |
Resource represents an object with inventory path and moid |
false |
InfrastructurePolicy.status.resources.placements[index].cluster
Resource represents an object with inventory path and moid
| Name | Type | Description | Required |
|---|---|---|---|
inventoryPath |
string |
InventoryPath is the up to date location of this resource. In the case where a resource has been moved/renamed since the spec was submitted this path will not match what is in the spec and a condition may be raised The information contained on this field will be used to provision infrastructure resources. |
true |
moid |
string |
MOID the vSphere Managed Object ID of the resource |
true |
InfrastructurePolicy.status.resources.placements[index].datacenter
Resource represents an object with inventory path and moid
| Name | Type | Description | Required |
|---|---|---|---|
inventoryPath |
string |
InventoryPath is the up to date location of this resource. In the case where a resource has been moved/renamed since the spec was submitted this path will not match what is in the spec and a condition may be raised The information contained on this field will be used to provision infrastructure resources. |
true |
moid |
string |
MOID the vSphere Managed Object ID of the resource |
true |
InfrastructurePolicy.status.resources.placements[index].folder
Resource represents an object with inventory path and moid
| Name | Type | Description | Required |
|---|---|---|---|
inventoryPath |
string |
InventoryPath is the up to date location of this resource. In the case where a resource has been moved/renamed since the spec was submitted this path will not match what is in the spec and a condition may be raised The information contained on this field will be used to provision infrastructure resources. |
true |
moid |
string |
MOID the vSphere Managed Object ID of the resource |
true |
InfrastructurePolicy.status.resources.placements[index].portGroups[index]
Resource represents an object with inventory path and moid
| Name | Type | Description | Required |
|---|---|---|---|
inventoryPath |
string |
InventoryPath is the up to date location of this resource. In the case where a resource has been moved/renamed since the spec was submitted this path will not match what is in the spec and a condition may be raised The information contained on this field will be used to provision infrastructure resources. |
true |
moid |
string |
MOID the vSphere Managed Object ID of the resource |
true |
InfrastructurePolicy.status.resources.placements[index].resourcePool
Resource represents an object with inventory path and moid
| Name | Type | Description | Required |
|---|---|---|---|
inventoryPath |
string |
InventoryPath is the up to date location of this resource. In the case where a resource has been moved/renamed since the spec was submitted this path will not match what is in the spec and a condition may be raised The information contained on this field will be used to provision infrastructure resources. |
true |
moid |
string |
MOID the vSphere Managed Object ID of the resource |
true |
IPPool
IPPool defines the details of an IP Pool that can be used to deploy workload/database clusters
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
infrastructure.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
IPPool |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
Spec is the desired state of an IPPool |
false |
|
object |
Status reports the observed state of the IPPool |
false |
IPPool.spec
Spec is the desired state of an IPPool
| Name | Type | Description | Required |
|---|---|---|---|
addresses |
[]string |
Addresses is a list of IP addresses that can be assigned. This set of addresses can be non-contiguous. Please note that if multiple IPPools are created which contain the same IP addresses no cross validation between pools is performed. Only IPs which are not in use can be removed from pools. Example
Required. Mutable. |
true |
gateway |
string |
Gateway is the network gateway to use. Example
Required. Mutable. |
true |
prefix |
integer |
Prefix is the network prefix to use. It refers to the number of leading bits in the IP address. Example
Required. Mutable.
|
true |
IPPool.status
Status reports the observed state of the IPPool
| Name | Type | Description | Required |
|---|---|---|---|
alertLevel |
string |
AlertLevel indicates the level of the most severe alert raised for an IP Pool. |
false |
[]object |
Conditions contain the list of observed conditions of the IPPool.
using the IP Pool |
false |
|
object |
IpAddresses reports the count of total, free, used and out of range IPs in the pool. |
false |
IPPool.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
IPPool.status.ipAddresses
IpAddresses reports the count of total, free, used and out of range IPs in the pool.
| Name | Type | Description | Required |
|---|---|---|---|
free |
integer |
Free is the count of unallocated IPs in the pool. |
true |
outOfRange |
integer |
Out of Range is the count of allocated IPs in the pool that is not contained within spec.Addresses. Legacy field |
true |
total |
integer |
Total is the total number of IPs configured for the pool. |
true |
used |
integer |
Used is the count of allocated IPs in the pool. |
true |
SupervisorInfrastructurePolicy
SupervisorInfrastructurePolicy defines which vSphere namespace resources to expose for usage by data service workloads
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
infrastructure.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
SupervisorInfrastructurePolicy |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
Status reports the observed state of the SupervisorInfrastructurePolicy |
false |
SupervisorInfrastructurePolicy.status
Status reports the observed state of the SupervisorInfrastructurePolicy
| Name | Type | Description | Required |
|---|---|---|---|
alertLevel |
string |
AlertLevel indicates the level of the most severe alert raised for an infrastructure policy. |
false |
[]object |
Conditions contain the list of observed conditions of the SupervisorInfrastructurePolicyStatus. |
false |
|
description |
string |
Human-readable description of the supervisor infrastructure policy. Optional. Mutable. |
false |
[]object |
DiscoveredZones contains the list of discovered zones from Supervisor namespace. |
false |
|
networkProvider |
string |
NetworkProvider contains the name of the Network Provider of the SupervisorInfrastructurePolicyStatus |
false |
object |
Resources show the overall resource usage and limits for the vsphere namespace |
false |
|
[]object |
StoragePolicies contains a list of storage policies that are enabled for the corresponding vsphere namespace |
false |
|
[]object |
VMClasses contains a list of VM classes that are enabled for the corresponding vsphere namespace |
false |
|
zoneCount |
integer |
ZoneCount refers to the count of zones available within this supervisor infrastructure policy. For supervisor InfrastructurePolicy in DSM, if crossClusterHA is disabled the zoneCount is 1. |
false |
SupervisorInfrastructurePolicy.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
SupervisorInfrastructurePolicy.status.discoveredZones[index]
SupervisorDiscoveredZone represents a discovered zone from Supervisor namespace
| Name | Type | Description | Required |
|---|---|---|---|
lastVerified |
string |
LastVerified timestamp when the zone was last verified
|
true |
name |
string |
Name denotes the zone name |
true |
SupervisorInfrastructurePolicy.status.resources
Resources show the overall resource usage and limits for the vsphere namespace
| Name | Type | Description | Required |
|---|---|---|---|
cpuUsed |
string |
CpuUsed is the overall CPU usage of the namespace, in MHz. This is the sum of CPU usage across all pods in the Kubernetes namespace. |
true |
memoryUsed |
string |
Overall memory usage of the namespace (in mebibytes). This is the sum of memory usage across all pods. |
true |
storageUsed |
string |
StorageUsed is the overall storage used by the namespace (in mebibytes). This is the sum of storage used by pods across all datastores in the cluster associated with storage policies configured for the namespace. |
true |
cpuLimit |
string |
CpuLimit is the maximum amount of CPU (in MHz) which can be utilized by the namespace. If unset, no limits are placed. |
false |
memoryLimit |
string |
MemoryLimit is the maximum amount of memory (in mebibytes) which can be utilized by the namespace. If unset, no limits are placed. |
false |
storageLimit |
string |
StorageLimit is the maximum amount of storage (in mebibytes) which can be utilized by the namespace. If unset, no limits are placed. |
false |
SupervisorInfrastructurePolicy.status.storagePolicies[index]
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name indicates the storage policy name |
true |
limit |
string |
Limit is the maximum amount of storage (in mebibytes) which can be utilized by the namespace using the corresponding storage policy. If unset, no limits are placed. |
false |
SupervisorInfrastructurePolicy.status.vmClasses[index]
| Name | Type | Description | Required |
|---|---|---|---|
object |
CPU contains the CPU count and reservation for this vmclass |
true |
|
object |
Memory contains the memory count and reservation for this vmclass |
true |
|
name |
string |
Name denotes the VMClass name |
true |
SupervisorInfrastructurePolicy.status.vmClasses[index].cpu
CPU contains the CPU count and reservation for this vmclass
| Name | Type | Description | Required |
|---|---|---|---|
count |
string |
Count denotes the number of CPUs or amount of memory in Gib configured for virtual machine of this class. |
true |
reservation |
string |
Reservation denotes the percentage of total available CPUs or available memory reserved for a virtual machine. If unset, no reservation is requested for virtual machine. |
true |
SupervisorInfrastructurePolicy.status.vmClasses[index].memory
Memory contains the memory count and reservation for this vmclass
| Name | Type | Description | Required |
|---|---|---|---|
count |
string |
Count denotes the number of CPUs or amount of memory in Gib configured for virtual machine of this class. |
true |
reservation |
string |
Reservation denotes the percentage of total available CPUs or available memory reserved for a virtual machine. If unset, no reservation is requested for virtual machine. |
true |
VMClass
VMClass defines VMs which are available to host dataservice workloads
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
infrastructure.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
VMClass |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
Spec is the desired state of the VMClass |
false |
|
object |
Status reports the observed state of the VMClass |
false |
VMClass.spec
Spec is the desired state of the VMClass
| Name | Type | Description | Required |
|---|---|---|---|
object |
Requests defines the amount of resources that should be allocated and reserved when this class is consumed |
false |
VMClass.spec.requests
Requests defines the amount of resources that should be allocated and reserved when this class is consumed
| Name | Type | Description | Required |
|---|---|---|---|
cpu |
string |
CPU defines the amount of vCPU that should be used when this class is consumed. Once a cluster is created this resource will be reserved on the underlying ESXI host.
It should be represented as an integer, like |
false |
memory |
string |
Memory defines the amount of memory, in Gib that should be used when this class is
consumed. Once a cluster is created this resource will be reserved on the underlying ESXI host.
It should be represented as an integer, like |
false |
VMClass.status
Status reports the observed state of the VMClass
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
Conditions contain the list of observed conditions of the VMClass. |
false |
VMClass.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
networksecurity.dataservices.vmware.com/v1alpha1
Resource Types:
LoadBalancerNetworkSecurityConfig
LoadBalancerNetworkSecurityConfig defines network security configuration for load balancer services associated with a database cluster. These resource are created by DSM when a database cluster is created. DSM will create 2 LoadBalancerNetworkSecurityConfig resources for a database cluster: * One for the Kubernetes API server * One for the database LB services (this will include all read-only replicas IPs) Only the Disabled and ExtraClients fields are configurable by the Provider (Infra) Admin. All other fields are immutable.
This resource captures all of the details required to identify the tenant that created the database cluster, the location of the database within the DSM provider organization, and the load balancer IP addresses. Further, it enables admins to disable the underyling firewall rules for the load balancer IPs and to add additional client IPs for access to the database cluster.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
networksecurity.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
LoadBalancerNetworkSecurityConfig |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
LoadBalancerNetworkSecurityConfigSpec defines the desired state of LoadBalancerNetworkSecurityConfig |
false |
|
object |
LoadBalancerNetworkSecurityConfigStatus defines the observed state of LoadBalancerNetworkSecurityConfig |
false |
LoadBalancerNetworkSecurityConfig.spec
LoadBalancerNetworkSecurityConfigSpec defines the desired state of LoadBalancerNetworkSecurityConfig
| Name | Type | Description | Required |
|---|---|---|---|
databaseClusterName |
string |
DatabaseClusterName is the database cluster name (required for identification) as known to the DSM API. Required. Immutable. |
true |
databaseClusterNamespace |
string |
DatabaseClusterNamespace is the database cluster namespace (required for identification) as known to the DSM API. This is the namespace within the DSM API that is associated with the tenant organization that was used to create the database cluster. Required. Immutable. |
true |
disabled |
boolean |
Disabled provides the ability for a Provider (Infra) Admin to disable the firewall rules associated with this LB network security configuration. When disabled, the firewall rules are simply toggled off and network access to the provided LoadBalancerIPs is allowed. This is useful for troubleshooting connectivity issues or for allowing temporary access to the database cluster Kubernetes API Server or database LB services. Required. Mutable.
|
true |
serviceType |
enum |
ServiceType is the type of service (k8s or db) for this LoadBalancerNetworkSecurityConfig * k8s is for the Kubernetes API server * db is for the database LB services Required. Immutable.
|
true |
extraClients |
[]string |
ExtraClients is a list of additional IPv4 addresses/ranges that should be allowed to access the database cluster beyond the default allowed IP addresses. See the database cluster spec for more details on the default allowed IP addresses. This field allows Provider (Infra) Admins to add additional client IPs that can be used for troubleshooting connectivity issues or for allowing temporary access to the database cluster. Users cannot see these values configured by the Provider (Infra) Admin. Optional. Mutable. |
false |
LoadBalancerNetworkSecurityConfig.status
LoadBalancerNetworkSecurityConfigStatus defines the observed state of LoadBalancerNetworkSecurityConfig
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
Conditions contain the list of observed conditions * Ready: indicates the LB network security configuration is applied as expected. * ConfigurationLookup: indicates the status of configuration lookup * FirewallPolicies: indicates the status of applying the TGW firewall policies |
false |
|
dsmOrganizationNamespace |
string |
DSMOrganizationNamespace is the namespace within the DSM organization in VCFA that the database is actually located in. This is the namespace that maps to a DSM Supervisor Infrastructure Policy that contains the database cluster. This field is populated by the controller. |
false |
[]object |
ExtraClients contains the merged list of extra client IPs from both the database and the spec field ExtraClients |
false |
|
loadBalancerIPs |
[]string |
LoadBalancerIPs are IPv4 addresses of the database cluster load balancer services. When the ServiceType is k8s, the load balancer IP will be the Kubernetes API server of the workload cluster running the database cluster. When the ServiceType is db, the load balancer IPs will be the external public IP addresses associated with the database cluster. This will include the primary database LB IP and the IP addresses of any replicas that may be exposed as part of the database cluster specification. This field is populated by the controller. |
false |
[]object |
SourceInfos contains detailed information about the source IPs allowed to access the database cluster, including their associated tenant organization and namespaces. |
false |
LoadBalancerNetworkSecurityConfig.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
LoadBalancerNetworkSecurityConfig.status.extraClients[index]
ExtraClient represents an extra client with metadata
| Name | Type | Description | Required |
|---|---|---|---|
createdAt |
string |
CreatedAt is the timestamp when this extra client was created
|
true |
extraClientIP |
string |
ExtraClientIP is the IP address of the extra client |
true |
user |
string |
User is the user who created this extra client. This will either be "Admin" or the name of the tenant organization that created the extra client. |
true |
LoadBalancerNetworkSecurityConfig.status.sourceInfos[index]
SourceInfo represents the source IP and its associated tenant information
| Name | Type | Description | Required |
|---|---|---|---|
ip |
string |
IP is the source IPv4 address or CIDR |
true |
tenantOrganizationName |
string |
TenantOrganizationName is the name of the tenant organization associated with this IP |
false |
tenantOrganizationNamespaces |
[]string |
TenantOrganizationNamespaces is the list of namespaces associated with this IP |
false |
VCFANetworkSecurityConfig
VCFANetworkSecurityConfig is a singleton resource in the dsm-system namespace with the name "config". It manages network security configuration for VCFA. The resource provides visibility into VPCs, load balancers, and network security settings for the DSM environment.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
networksecurity.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
VCFANetworkSecurityConfig |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
Spec is the desired state of the VCFANetworkSecurityConfig |
false |
|
object |
Status reports the observed state of the VCFANetworkSecurityConfig |
false |
VCFANetworkSecurityConfig.spec
Spec is the desired state of the VCFANetworkSecurityConfig
| Name | Type | Description | Required |
|---|---|---|---|
enabled |
boolean |
Enabled indicates whether network security configuration is enabled Required. Mutable. |
true |
organizationURN |
string |
OrganizationURN is the URN of the DSM organization in VCFA. This is the organization that the Provider (Infra) Admin creates to contain all DSM database clusters. Namespaces created in this organization are used for Supervisor Infrastructure Policies for creating the DSM database clusters. Required. Immutable. |
true |
regionURN |
string |
RegionURN is the URN of the region in VCFA in which network security configuration is applied. The DSM appliance is deployed into a single region and we need to know that region URN to apply the firewall rules correctly. Required. Immutable. |
true |
transitGatewayName |
string |
TransitGatewayName is the name of the Transit Gateway in the DSM Organization that needs to be programmed with the firewall rules. This gateway is where external access is allowed to database clusters that are created in the DSM Organization. Required. Immutable. |
true |
VCFANetworkSecurityConfig.status
Status reports the observed state of the VCFANetworkSecurityConfig
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
Conditions contain the list of observed conditions * Ready: indicates the VCFA network security configuration is applied as expected. * VCFAConnectivity: indicates the status of VCFA connectivity * VPCs: indicates the status of VPC detection |
false |
|
organizationName |
string |
OrganizationName is the display name of the DSM organization in VCFA resolved from spec.organizationURN. Populated by the controller after validating the organization URN. |
false |
regionName |
string |
RegionName is the display name of the region in VCFA resolved from spec.regionURN. Populated by the controller after validating the region URN. |
false |
[]object |
VPCs is the list of detected VPCs in the DSM Organization. It is shown for informational purposes to help the Provider (Infra) Admin understand the network topology of the DSM Organization. |
false |
VCFANetworkSecurityConfig.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
VCFANetworkSecurityConfig.status.vpcs[index]
VPCInfo represents information about a VPC
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name is the name of the VPC |
true |
gatewayName |
string |
GatewayName is the name of the VPC gateway |
false |
loadBalancerIP |
string |
LoadBalancerIP is the load balancer IP address allocated to this VPC |
false |
namespaceNames |
[]string |
NamespaceNames is a list of namespace names in this VPC |
false |
observability.dataservices.vmware.com/v1alpha1
Resource Types:
LogBundle
LogBundle defines a database engine log collection request to DSM. It provides self-service capabilities for diagnosing and resolving database engine–specific issues. A database engine log collection contains the object specific logs (e.g. DB engine logs for databases). LogBundle CR cannot be modified after creation. LogBundle cannot have a name longer than 52 characters
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
observability.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
LogBundle |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
LogBundleSpec defines the details, such as the RetentionPeriod and TargetRef of the database engine logs which will be collected |
false |
|
object |
LogBundleStatus reports the observed state of the LogBundle |
false |
LogBundle.spec
LogBundleSpec defines the details, such as the RetentionPeriod and TargetRef of the database engine logs which will be collected
| Name | Type | Description | Required |
|---|---|---|---|
object |
TargetRef refers to the resource for which the logs are collected.
The resource needs to be in the same namespace as the LogBundle.
Only the Example: targetRef: kind: "PostgresCluster" name: "example-db" Required. Immutable.
|
true |
|
retentionPeriod |
string |
RetentionPeriod determines the duration of time until the collected log gets expired. The retention period starts from the collection completion time. After it expires, DSM will change log collection status to Expired, and the collected log will be deleted from storage. Duration is a wrapper around Go style time.Duration. Example: "48h10m" The default retention period is 6 hours, the minimum is 10 minutes, and the maximum is 7 days. Any value out of those limit will result in validation failure. Immutable.
|
false |
LogBundle.spec.targetRef
TargetRef refers to the resource for which the logs are collected.
The resource needs to be in the same namespace as the LogBundle.
Only the Kind - the type of data service resource (for example PostgresCluster, MySqlCluster,etc) and
Name (name of the resource) fields are required.
Example:
targetRef: kind: "PostgresCluster" name: "example-db"
Required.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
LogBundle.status
LogBundleStatus reports the observed state of the LogBundle
| Name | Type | Description | Required |
|---|---|---|---|
collectionCompletedAt |
string |
CollectionCompletedAt indicates the time when the database engine log collection has completed
|
false |
collectionStartedAt |
string |
CollectionStartedAt indicates the time when the database engine log collection has started
|
false |
[]object |
Conditions contain the list of observed conditions of the LogBundle. The following statuses can occur.
|
false |
|
expiresAt |
string |
ExpiresAt indicates the time when the database engine log will expire and be deleted from the output storage
|
false |
object |
LogSecretRef is a reference to the v1.Secret living in the same namespace holding the output LogBundle if such exists The download URL for the LogBundle can be found in stringData section of the secret with key "downloadURL" |
false |
LogBundle.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
LogBundle.status.logSecretRef
LogSecretRef is a reference to the v1.Secret living in the same namespace holding the output LogBundle if such exists The download URL for the LogBundle can be found in stringData section of the secret with key "downloadURL"
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MetricsTarget
MetricsTarget CRs provide a way to Bring Your Own Monitoring (BYOM) stack to monitor DSM-managed data services. Each MetricsTarget defines 1 additional metrics server / monitoring system and enables all DSM-managed data services within its scope to report Database metrics to it.
A MetricsTarget can be defined on 3 scopes: 1. A global MetricsTarget within the DSM system namespace named "metrics-default". It applies to all DSM data services. 2. Local MetricsTarget within each tenant namespace named "metrics-namespace". It applies to all DSM data services in that namespace. 3. Additional global MetricsTarget within the DSM system namespace named "metrics-additional". It applies to all DSM data services. Use this in addition to metrics-default (#1 above) when you need to deliver all DSM metrics to two endpoints simultaneously. (e.g. two separate Prometheus instances, or one Prometheus and one VCF Operations).
The MetricsTarget within these scopes work together and metrics are delivered to all applicable MetricsTarget objects. Individual data services cannot opt out of the MetricsTarget objects defined for their scope.
|
Note
|
The metrics reporting works for data services versions from Data Services Manager release version 9.0 and above. If you have older data services, you need to upgrade them to use this feature. |
|
Note
|
The metrics reporting works for PostgresCluster and MySQLCluster data services. |
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
observability.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
MetricsTarget |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
MetricsTargetSpec defines the desired state of a MetricsTarget. |
false |
|
object |
MetricsTargetStatus reports the observed state of a MetricsTarget. |
false |
MetricsTarget.spec
MetricsTargetSpec defines the desired state of a MetricsTarget.
| Name | Type | Description | Required |
|---|---|---|---|
endpoint |
string |
Endpoint is the network endpoint to connect to the MetricsTarget server. The endpoints must be HTTP/S and typically hosts the APIs on the MetricsTarget servers that accept metrics from DSM. Each supported Type has its own API specifics and requirements. Examples:
Required. Mutable.
|
true |
type |
enum |
Type is the type of the MetricsTarget server. Supported values are Required. Mutable.
|
true |
advancedConfiguration |
map[string]string |
AdvancedConfiguration is a map of key value pairs which are predefined set of configurations that DSM will apply when configuring the MetricsTarget. Supported advanced configurations for VCFOps type are:
* Optional. Mutable. |
false |
object |
Secret reference for the user credentials (username and password) of type 'kubernetes.io/basic-auth'. Used for authentication against the MetricsTarget server when that is required. Optional. Some MetricsTarget servers don’t require / support basic authentication. Mutable. |
false |
|
headers |
map[string]string |
Headers is a map of key value pairs which are static values sent with each HTTP request from DSM to the MetricsTarget server. It can contain actual HTTP headers, or additional static metadata. A default set of headers is automatically populated by DSM for each MetricsTarget Type. If specified, the Headers parameters override the default headers for any key. Optional. Typically, this parameter should not be required, but can be useful for additional metadata propagation. Mutable. |
false |
timeout |
string |
Timeout specifies the timeout for each HTTP request from DSM to the MetricsTarget server. If the MetricsTarget server fails to respond within the Timeout metrics delivery is not guaranteed. Optional. The default timeout is The timeout value should be higher than Mutable.
|
false |
object |
TLS refers to TLS configuration for the MetricsTarget. Used for MetricsTarget server certificate verification, and TLS authentication. Optional. Some MetricsTarget server certificate is improper and cannot be verified. Some MetricsTarget servers don’t support / require TLS auth. |
false |
MetricsTarget.spec.credentials
Secret reference for the user credentials (username and password) of type 'kubernetes.io/basic-auth'. Used for authentication against the MetricsTarget server when that is required.
Optional. Some MetricsTarget servers don’t require / support basic authentication.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MetricsTarget.spec.tls
TLS refers to TLS configuration for the MetricsTarget. Used for MetricsTarget server certificate verification, and TLS authentication.
Optional. Some MetricsTarget server certificate is improper and cannot be verified. Some MetricsTarget servers don’t support / require TLS auth.
| Name | Type | Description | Required |
|---|---|---|---|
object |
ClientCertificate is a reference to a Secret holding the DSM client certificate used to do TLS auth to a MetricsTarget server. The client certificate is typically issued by a CA that the MetricsTarget server uses and verifies with. The secret must follow the format of 'kubernetes.io/tls' Secrets, but it can also be of type Opaque, as long as it holds a valid certificate private-key pair in tls.crt and tls.key Data fields. When specified, the client certificate is sent along with the requests from DSM to MetricsTarget server which enables DSM TLS auth to the MetricsTarget server. MetricsTarget servers can have different requirements and support for TLS auth / client certificates. In some cases it can be required. In some cases it is strictly verified on the MetricsTarget server against its CA. Optional. Some MetricsTarget servers don’t require / support TLS auth. Mutable. |
false |
|
insecureSkipVerify |
boolean |
!!! WARNING !!! This setting is not recommended to be set. Use with caution as it can have security impact. InsecureSkipVerify skips the server certificate and issuers verification against the DSM MetricsTarget TrustBundle. It should only be set when the MetricsTarget server certificate issuer path cannot be trusted for example when the server certificate doesn’t contain the necessary SAN IP addresses / DNS names. Optional. By default, this setting is False, and all TLS verifications are performed. Mutable.
|
false |
object |
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when verifying the MetricsTarget server certificate chain. When InsecureSkipVerify is set to False, the contents are ignored as no verification is done. If the provided MetricsTarget server is configured with:
* Well-known OS-trusted CA, or a DSM globally trusted certificate - TrustBundle can be omitted, or it should point to DSM globally trusted certificates ConfigMap.
* Certificate signed by CA that should not be globally trusted by DSM - TrustBundle reference must point to ConfigMap with key Optional. By default, it will use the DSM globally trusted certificates ConfigMap if InsecureSkipVerify is false. It is not needed and will remain nil if InsecureSkipVerify is true. Mutable. |
false |
MetricsTarget.spec.tls.clientCertificate
ClientCertificate is a reference to a Secret holding the DSM client certificate used to do TLS auth to a MetricsTarget server. The client certificate is typically issued by a CA that the MetricsTarget server uses and verifies with. The secret must follow the format of 'kubernetes.io/tls' Secrets, but it can also be of type Opaque, as long as it holds a valid certificate private-key pair in tls.crt and tls.key Data fields.
When specified, the client certificate is sent along with the requests from DSM to MetricsTarget server which enables DSM TLS auth to the MetricsTarget server.
MetricsTarget servers can have different requirements and support for TLS auth / client certificates. In some cases it can be required. In some cases it is strictly verified on the MetricsTarget server against its CA.
Optional. Some MetricsTarget servers don’t require / support TLS auth.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
MetricsTarget.spec.tls.trustBundle
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when verifying the MetricsTarget server certificate chain. When InsecureSkipVerify is set to False, the contents are ignored as no verification is done.
If the provided MetricsTarget server is configured with:
* Well-known OS-trusted CA, or a DSM globally trusted certificate - TrustBundle can be omitted, or it should point to DSM globally trusted certificates ConfigMap.
* Certificate signed by CA that should not be globally trusted by DSM - TrustBundle reference must point to ConfigMap with key tls.crt that contains only Issuer certificate(s). If an end-entity (i.e. server) certificate is provided it must be issued by itself, i.e. self-signed.
Optional. By default, it will use the DSM globally trusted certificates ConfigMap if InsecureSkipVerify is false. It is not needed and will remain nil if InsecureSkipVerify is true.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
MetricsTarget.status
MetricsTargetStatus reports the observed state of a MetricsTarget.
| Name | Type | Description | Required |
|---|---|---|---|
alertLevel |
string |
AlertLevel indicates the level of the most severe alert raised for a Metrics Target. |
false |
[]object |
Conditions contain the list of observed conditions of the MetricsTarget. The following statuses can occur.
In case of consumption through VMware Cloud Foundation Automation (VCFA) the status includes the following condition:
|
false |
MetricsTarget.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
releases.dataservices.vmware.com/v1alpha2
Resource Types:
DataServiceVersion
DataServiceVersion is a single supported version of a data service.
The DataServiceVersion resources are exclusively created by the Data Services Manager in response to the release of a new version, to provide semi-structured information about the supported versions to API clients.
Only the spec.approval field can be modified, and only by DSM Administrators. All other fields are read-only.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
releases.dataservices.vmware.com.v1alpha2 |
true |
kind |
string |
DataServiceVersion |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
DataServiceVersionSpec represents the spec of the Data Service |
true |
|
object |
DataServiceVersionStatus represents the status of the Data Service |
false |
DataServiceVersion.spec
DataServiceVersionSpec represents the spec of the Data Service
| Name | Type | Description | Required |
|---|---|---|---|
approval |
enum |
Indicates what operations is this version enabled for. The valid values are:
Administrators can modify this field to enable or disable users to create clusters from this version.
|
true |
engineVersion |
string |
The engine version corresponding to this DataServiceVersion. The field is read-only. |
true |
release |
string |
The Data Services Manager release that this version is part of. The field is read-only. |
true |
releaseDate |
string |
The date the version’s corresponding release was assembled. This is not necessarily the date when it was made generally available. The field is read-only. |
true |
releaseNotesLink |
string |
Link (URL) to the release notes for the version’s corresponding release. The field is read-only. |
true |
serviceType |
string |
The engine type of the data service corresponding to this version. The Data Services Manager supports:
The field is read-only. |
true |
version |
string |
The full version string that the users need to use when creating clusters of this version. The field is read-only. |
true |
[]object |
The kubernetes releases which are compatible with this data service version This field is read-only |
false |
DataServiceVersion.spec.kubernetesReleaseVersions[index]
| Name | Type | Description | Required |
|---|---|---|---|
type |
enum |
Kubernetes cluster type. Can be dsmManaged or supervisorManaged
|
true |
version |
string |
The version of this kubernetes release |
true |
DataServiceVersion.status
DataServiceVersionStatus represents the status of the Data Service
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
Conditions represent the state of the Data Service Version |
false |
|
[]object |
LinkedRegistries show the ImageRegistries that are linked to this DataServiceVersion It is updated when the selector rules in the ImageRegistry match / unmatch the labels in the DataServiceVersion |
false |
|
[]object |
RequiredImages contains information about the container images that apply to this data service version. |
false |
|
requiredReleases |
[]string |
Additional DSV that must be present and enabled for creation of this DSV to occur |
false |
DataServiceVersion.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
DataServiceVersion.status.linkedRegistries[index]
TypedObjectReference is a utility datatype which can be used to refer to an object by name, namespace, and kind. It is intentionally narrower than corev1.ObjectReference — APIVersion, UID, ResourceVersion, and FieldPath are omitted since nothing in DSM resolves a reference using them, and carrying them around only muddies the API.
| Name | Type | Description | Required |
|---|---|---|---|
kind |
string |
Kind of the referent. |
false |
name |
string |
The Name of the referent. |
false |
namespace |
string |
The Namespace of the referent. |
false |
DataServiceVersion.status.requiredImages[index]
Image provides the information regarding a specific Container Image
example: docker pull <registry-endpoint>/repo/relativePath/name:version
| Name | Type | Description | Required |
|---|---|---|---|
checksum |
string |
Checksum of the container image |
false |
fileName |
string |
FileName of the container image |
false |
relativePath |
string |
Relative path of the container image |
false |
status |
string |
Status of the container image Ready: Image is ready for provisioning SyncFailed: Image failed to sync |
false |
tag |
string |
Tag of the container image |
false |
system.dataservices.vmware.com/v1alpha1
Resource Types:
DsmSystemConfig
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
system.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
DsmSystemConfig |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
DsmSystemConfigSpec defines the desired state of the DsmSystemConfig. Spec holds the DSM appliance configurations. Only one instance of this Resource exists with the name 'dsm-system-config' |
false |
|
object |
DsmSystemConfigStatus describes the observed status of the DsmSystemConfig. |
false |
DsmSystemConfig.spec
DsmSystemConfigSpec defines the desired state of the DsmSystemConfig. Spec holds the DSM appliance configurations. Only one instance of this Resource exists with the name 'dsm-system-config'
| Name | Type | Description | Required |
|---|---|---|---|
dsmProviderId |
string |
DSMProviderId defines the unique id of the DSM appliance. Immutable |
true |
gateway |
string |
GATEWAY defines the IPv4 gateway of the DSM appliance. Immutable Note: This field is configurable only by updating the |
true |
ip |
string |
IP defines the management network IPv4 address of the DSM appliance. This is the address used as the default value for spec.externalIp when spec.externalIp is not set. Immutable Note: This field is configurable only by updating the |
true |
netmask |
string |
NETMASK defines the IPv4 netmask of the DSM appliance. Immutable Note: This field is configurable only by updating the |
true |
ceipConsent |
boolean |
Deprecated: Customer Experience Improvement Program (CEIP) participation is now managed through vSphere CEIP configuration. This field is not synchronised with vCenter: any value set here is ignored, and changes to the CEIP setting in vSphere are not reflected back in this field. It will be removed in the next version. |
false |
dnsNames |
[]string |
One or more DNS names / FQDNs of the DSM appliance. These DNS names will be included in the SAN field of the TLS certificate if auto-generated by DSM and in the Provider settings displayed in DSM UI. If a custom TLS certificate is provided, it is important its SAN field to match the DNS names provided here, so clients can ensure a secure connection. Mutable. When updated, DSM will re-generate the TLS certificate if no custom certificate is provided. If Custom certificate via spec.tls.secretName with DNS only Subject Alternative Name (SAN) is specified then the first entry of DNSNames cannot be changed if there are created data services (see TLS.SecretName API doc) In that case this DNS Name will be used by DSM workloads and must be resolvable to the DSM appliance VM IP within all networks where DSM data services are deployed and any client/application networks that need to access DSM appliance (DSM APIs) |
false |
dnsServers |
[]string |
DNSServers defines the IP address(es) of the DNS server(s) used by DSM. The same DNS servers must be used by any Supervisors configured for use by DSM infrastructure policies. Refer to vSphere Supervisor technical documentation for information about its DNS configuration. Example
Mutable
|
false |
externalIp |
string |
ExternalIP property is the external IPv4 address used when there is a Load Balancer in front of the appliance. If not provided, it is automatically set to the management network IP (spec.ip). This field is set automatically from the |
false |
object |
ExternalLogDestination contains details required to setup external log forwarding. Mutable. |
false |
|
ntpServers |
[]string |
NTPServers defines the NTP server(s) used by DSM. Although the value is optional the value must be set for DSM to work properly. Example
Mutable
|
false |
object |
TLS refers to the SSL/TLS configuration of the DSM appliance. Mutable. |
false |
|
vcfManaged |
boolean |
VCFManaged indicates whether the DSM appliance is deployed in VCF-Managed mode. This field is set during initial deployment based on the appliance.vcf_managed OVF property. Immutable. Default: false
|
false |
workloadNetworkCidr |
string |
WorkloadNetworkCIDR defines the CIDR range for the workload clusters network reserved for DSM use. This range must not clash with any other networks used by non-DSM components. This setting is global across all workload clusters created by DSM. The value must be in CIDR notation, e.g. 192.168.0.0/21 Mutable. Can be set or modified irrespective of existing data services workloads. Only new workloads will reflect any changes to the configurations, existing workloads will not be changed. They can be cloned via backup-restore workflows to pick up the new configuration.
|
false |
workloadServiceCidr |
string |
WorkloadServiceCIDR defines the CIDR range for the workload clusters network reserved for DSM use. This will be used for cluster IPs in workload cluster. This range must not clash with any other networks used by non-DSM components. This setting is global across all workload clusters created by DSM. The value must be in CIDR notation, e.g. 10.96.0.0/24 Mutable. Can be set or modified irrespective of existing data services workloads. Only new workloads will reflect any changes to the configurations, existing workloads will not be changed. They can be cloned via backup-restore workflows to pick up the new configuration.
|
false |
DsmSystemConfig.spec.externalLogDestination
ExternalLogDestination contains details required to setup external log forwarding.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
enabled |
boolean |
Enabled is a boolean which indicates whether log forwarding is currently active. Mutable.
|
false |
remoteLogDestinationProvider |
string |
RemoteLogDestinationProvider is the remote logging storage provider. Supported values are Required when Enabled is true. Mutable. |
false |
remoteLogUrl |
string |
RemoteLogUrl is a connection string required by logging service. It is usually a combination of line protocol, host, port and uri (protocol)://(host):(port)(uri) Example syslog
Example cfapi Depending on the logging service, the type of information it expects can be different. Required when Enabled is true. Mutable. |
false |
object |
TrustBundle is a reference to a v1.ConfigMap containing a set of certificates to be trusted when validating the log forwarding endpoint TLS connection.
If the provided RemoteLogUrl is configured with:
* certificate signed by DSM trusted CA, TrustBundle must point to the predefined ConfigMap called Mutable. |
false |
DsmSystemConfig.spec.externalLogDestination.trustBundle
TrustBundle is a reference to a v1.ConfigMap containing a set of certificates to be trusted when validating the log forwarding endpoint TLS connection.
If the provided RemoteLogUrl is configured with:
* certificate signed by DSM trusted CA, TrustBundle must point to the predefined ConfigMap called trusted-root-ca in the dsm-system namespace. By default, DSM trusts all well-known OS-trusted CAs. If the certificate is signed by a custom CA then as a prerequisite the custom CA certificate must be added to trusted-root-ca by appending it to the value of key ca-bundle.crt.
* certificate signed by authority that should not be globally trusted by DSM, TrustBundle reference must point to Configmap with key tls.crt that contains only Issuer certificate(s). If an end-entity (i.e. server) certificate is provided it must be issued by itself, i.e. self-signed.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
DsmSystemConfig.spec.tls
TLS refers to the SSL/TLS configuration of the DSM appliance.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
secretName |
string |
The name of a Secret resource present in the 'dsm-system' namespace, describing a custom certificate. The expected format of the Secret is the same as the output Secrets created by cert-manager’s Certificate resource. It needs to have keys: tls.crt: PEM signed certificate chain tls.key: PEM private key ca.crt: PEM CA certificate The ca.crt is optional if there is at least one issuer certificate in the certificate chain (tls.crt key). That issuer can either be a self-signed leaf certificate, or an intermediate or root certificate authority. There are specific requirements for how Subject Alternative Name (SAN) is set. Two mutually-exclusive styles are accepted: 1. IP-inclusive – SAN lists at least one IPAddress (one must equal the DSM appliance VM IP) and may list DNS Names (FQDNs). In this case DSM will use internally the VM IP to connect to DSM appliance 2. DNS-only – SAN lists at least one DNS Name and no IPAddress. At least one of the SAN DNS Names must equal spec.dnsNames[0] and resolve to the DSM appliance VM IP (spec.IP) within all networks where DSM data services are deployed. DSM will use internally that DNS name (FQDN) to connect to DSM appliance. After any data service has been deployed, you cannot: * switch between IP-inclusive and DNS-only certificates, or * change the primary DNS Name of a DNS-only certificate. These changes are supported only on a fresh DSM appliance with no data services present. Optional. When omitted, DSM auto-generates a certificate via its internal CA. When specified, DSM overrides the auto-generated certificate with the one in the Secret. Mutable. To update a custom certificate, either refer to a new Secret, or update the already referenced one. Updating any certificate causes a restart of the provider, making the DSM UI inaccessible for few seconds. Updating the CA is an intrusive operation which causes a rolling restart of all database clusters. CA updates might cause DB metrics loss for a few minutes. To avoid any impact it is recommended to set the CA before creating any database clusters. |
false |
DsmSystemConfig.status
DsmSystemConfigStatus describes the observed status of the DsmSystemConfig.
| Name | Type | Description | Required |
|---|---|---|---|
alertLevel |
enum |
|
false |
applianceCa |
string |
ApplianceCa contains the PEM-encoded trust anchor for the appliance. Clients use this certificate to verify the appliance’s identity when establishing a trusted TLS connection. |
false |
applianceCertificateThumbprint |
string |
applianceCertificateThumbprint holds the SHA-256 thumbprint of the current DSM appliance leaf certificate. Updated automatically when the appliance certificate is rotated, and used to detect certificate changes. |
false |
appliancePublicAddress |
string |
AppliancePublicAddress is the external address (IP or FQDN) that all DSM data-service workloads use to reach the DSM appliance. It is set automatically based the configured TLS certificate, spec.dnsNames and spec.ip. The value must be reachable from every network where DSM data services run and, if it is an FQDN, must resolve to the DSM appliance External IP (spec.externalIp). The value must also be reachable and resolvable by client/application networks that need to access DSM appliance (DSM APIs) See spec.tls.secretName doc for certificate/SAN rules and how the address is determined. |
false |
applianceSnatIp |
string |
ApplianceSNATIP is the VPC SNAT (source NAT) IP address of the supervisor service namespace hosting the DSM appliance VM. Only set when spec.vcfManaged is true. In VCF-managed mode the appliance’s outbound traffic is source-NAT’d at that namespace’s VPC gateway, so this is the address other systems (e.g. TGW firewall rules) see as the source of the appliance’s traffic, rather than the VM’s own management IP. |
false |
[]object |
Conditions contain the list of observed conditions of the DsmSystemConfig. The following statuses can occur.
|
false |
|
dsmVersion |
string |
DsmVersion represents the current version of the DSM appliance. Format: X.Y.Z.W.abcdedfg (e.g., "9.1.0.0.12345678") |
false |
minDataServiceRelease |
string |
MinDataServiceRelease is set when the DSM Provider starts successfully after a fresh install, and updated when the DSM Provider upgrade is successfully completed. Represents the minimum release version of data services (identified by the 'release' field of each DataServiceVersion) compatible with current DSM Provider version. DataServiceVersion whose release is lower than this value are not compatible with current version of DSM Provider. |
false |
rootUserExpiryDate |
string |
RootUserExpiryDate indicates the time when the DSM appliance root password is expected to expire.
|
false |
tlsSecretResourceVersion |
string |
TLSSecretResourceVersion is set only for DSM appliances with custom certificates. It represents the resource version of the Secret that was last applied for the DSM appliance. |
false |
DsmSystemConfig.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
ImageRegistry
ImageRegistry is the Schema for the imageRegistry API Certain Data Services in DSM do not come with the container images bundled and instead rely on an external registry for the images. The ImageRegistry API offers a way to register an external registry in DSM and associate it with different Data Service Versions. The ImageRegistry must be compliant with Open Container Initiative Spec and Docker V2 API.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
system.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
ImageRegistry |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
ImageRegistrySpec defines the spec of the ImageRegistry |
true |
|
object |
ImageRegistryStatus contains the status of the ImageRegistry |
false |
ImageRegistry.spec
ImageRegistrySpec defines the spec of the ImageRegistry
| Name | Type | Description | Required |
|---|---|---|---|
endpoint |
string |
Endpoint specifies the URL of the external image registry. Mutable |
true |
object |
Credentials contain the name of the secret object containing the credentials to access the images. Supported authentication type: * basic auth: username/password (secret should have data.username and data.password) Mutable |
false |
|
object |
DataServiceSelector contains the kubernetes label selector rules that are used to map Data Service Versions to the ImageRegistry. This can be configured to be a many:many relationship, as in * multiple imageRegistries can be configured to link to one Data Service Version (Redundancy) * one ImageRegistry can target multiple Data Service Versions (Single Source). Mutable |
false |
|
repo |
string |
Repo specifies the repository/project/namespace inside the image registry that contains the images. Example: endpoint: registry.example.com / 10.10.10.10:9000 repo: dsm-images image: operator:v1.2.3 (from DataServiceVersion) Image will be located at registry.example.com/dsm-images/operator:v1.2.3 / 10.10.10.10:9000/dsm-images/operator:v1.2.3 Mutable |
false |
object |
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when validating
the Endpoint TLS connection.
If the provided Endpoint is configured with:
* certificate signed by DSM trusted CA, TrustBundle must point to the predefined ConfigMap called Mutable. |
false |
ImageRegistry.spec.credentials
Credentials contain the name of the secret object containing the credentials to access the images. Supported authentication type: * basic auth: username/password (secret should have data.username and data.password)
Mutable
| Name | Type | Description | Required |
|---|---|---|---|
name |
string |
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
false |
ImageRegistry.spec.dataServiceSelector
DataServiceSelector contains the kubernetes label selector rules that are used to map Data Service Versions to the ImageRegistry. This can be configured to be a many:many relationship, as in * multiple imageRegistries can be configured to link to one Data Service Version (Redundancy) * one ImageRegistry can target multiple Data Service Versions (Single Source).
Mutable
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
matchExpressions is a list of label selector requirements. The requirements are ANDed. |
false |
|
matchLabels |
map[string]string |
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. |
false |
ImageRegistry.spec.dataServiceSelector.matchExpressions[index]
A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
| Name | Type | Description | Required |
|---|---|---|---|
key |
string |
key is the label key that the selector applies to. |
true |
operator |
string |
operator represents a key’s relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. |
true |
values |
[]string |
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. |
false |
ImageRegistry.spec.trustBundle
TrustBundle is a reference to a ConfigMap containing a set of certificates to be trusted when validating
the Endpoint TLS connection.
If the provided Endpoint is configured with:
* certificate signed by DSM trusted CA, TrustBundle must point to the predefined ConfigMap called trusted-root-ca in the dsm-system namespace. By default, DSM trusts all well-known OS-trusted CAs. If the certificate is signed by a custom CA then as a prerequisite the custom CA certificate must be added to trusted-root-ca by appending it to the value of key ca-bundle.crt.
* certificate signed by authority that should not be globally trusted by DSM, TrustBundle reference must point to Configmap with key tls.crt that contains only Issuer certificate(s). If an end-entity (i.e. server) certificate is provided it must be issued by itself, i.e. self-signed.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
ImageRegistry.status
ImageRegistryStatus contains the status of the ImageRegistry
| Name | Type | Description | Required |
|---|---|---|---|
alertLevel |
string |
AlertLevel indicates the level of the most severe alert raised for a database cluster. |
false |
[]object |
Conditions represent the status of image registry object and associated operations. |
false |
ImageRegistry.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
SupportBundle
SupportBundle defines a support bundle request to DSM.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
system.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
SupportBundle |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
SupportBundleSpec defines the desired state of the support bundle. Immutable. If there was any mistake, delete the old SupportBundle and create a new one. |
false |
|
object |
SupportBundleStatus defines the observed state of SupportBundle. |
false |
SupportBundle.spec
SupportBundleSpec defines the desired state of the support bundle.
Immutable. If there was any mistake, delete the old SupportBundle and create a new one.
| Name | Type | Description | Required | ||||||
|---|---|---|---|---|---|---|---|---|---|
object |
DataServiceTargetRef refers to the single data service instance for which the support bundle is requested.
It is only applicable when IncludedDataServices= The Example: dataServiceTargetRef: kind: "PostgresCluster" name: "example-db" namespace: "default" Optional. It is required and should be specified only when IncludedDataServices= Immutable. |
false |
|||||||
includedDataServices |
enum |
IncludedDataServices specifies the data service instances included in the support bundle. DSM system information is always included in the support bundle. Additionally, it can include information about 0, 1 or all data service instances in DSM. Supported values:
Optional. By default, Immutable.
|
false |
||||||
retentionPeriod |
string |
RetentionPeriod determines the duration of time until the support bundle gets expired. The retention period starts from the collection completion time (status.CollectionCompletedAt). After it expires (status.ExpiresAt is met), DSM will change support bundle status to Expired, and the support bundle will be deleted from storage. Duration is a wrapper around Go style time.Duration. Example: "48h10m" The default retention period is 3 days, the minimum is 1 hour, and the maximum is 7 days. Any value out of those limit will result in validation failure. Immutable.
|
false |
SupportBundle.spec.dataServiceTargetRef
DataServiceTargetRef refers to the single data service instance for which the support bundle is requested.
It is only applicable when IncludedDataServices=Single and SupportBundle will not be allowed otherwise.
The Kind, Namespace and Name fields are required and identify the data service instance.
Allowed kinds are: PostgresCluster, MySQLCluster and SQLServerCluster.
Example:
dataServiceTargetRef: kind: "PostgresCluster" name: "example-db" namespace: "default"
Optional. It is required and should be specified only when IncludedDataServices=Single.
For any other IncludedDataServices value it should not be specified.
Immutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
SupportBundle.status
SupportBundleStatus defines the observed state of SupportBundle.
| Name | Type | Description | Required |
|---|---|---|---|
collectionCompletedAt |
string |
CollectionCompletedAt indicates the time when the support bundle collection has completed
|
false |
collectionStartedAt |
string |
CollectionStartedAt indicates the time when the support bundle collection has started
|
false |
[]object |
Conditions contain the list of observed conditions of the SupportBundle. The following statuses can occur.
|
false |
|
dataServiceCount |
integer |
DataServiceCount indicates the number of data service instances with information included in the support bundle.
|
false |
downloadURL |
string |
DownloadURL indicates the download URL for the support bundle can be found. |
false |
expiresAt |
string |
ExpiresAt indicates the time when the support bundle will expire and be deleted from the output storage
|
false |
SupportBundle.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
VCenterBinding
VCenterBinding defines a binding configuration for vCenter.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
system.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
VCenterBinding |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
VCenterBindingSpec defines the details, such as the Host, Thumbprint, and VCenterAdminSecret of the target vCenter where DSM workload clusters will be deployed and managed. |
false |
|
object |
VCenterBindingStatus describes the observed status of the VCenterBinding. |
false |
VCenterBinding.spec
VCenterBindingSpec defines the details, such as the Host, Thumbprint, and VCenterAdminSecret of the target vCenter where DSM workload clusters will be deployed and managed.
| Name | Type | Description | Required |
|---|---|---|---|
host |
string |
Host is the FQDN or IP address of the target vCenter where DSM workload clusters will be deployed. Must be present in the vCenter server’s certificate SAN extension. Required Mutable. Note: Host updates are restricted to the bootstrap phase (before service accounts creation) primarily to correct FQDN issues. Once service accounts are created and VCenterBinding reaches the Ready state, Host updates are not allowed. |
true |
thumbprint |
string |
Thumbprint represents the SHA-256 Thumbprint of the target vCenter’s server leaf certificate, where the workload clusters are managed. This field is optional and is only necessary for the initial vCenter trust setup. Subsequently, DSM will fetch the root CA bundle from vCenter and use it to establish secure connections to vCenter. Mutable. |
false |
object |
VCenterAdminSecret refers to the v1.Secret containing the administrator credentials for the vCenter where the workload clusters are managed.
The data field of this Secret must contain both 'username' and 'password' keys as base64 encoded strings.
This secret may be deleted by the client after successful creation of the DSM Service account and registration of the DSM Plugin in vCenter as indicated by this resource status condition Mutable. |
false |
VCenterBinding.spec.vcenterAdminSecret
VCenterAdminSecret refers to the v1.Secret containing the administrator credentials for the vCenter where the workload clusters are managed.
The data field of this Secret must contain both 'username' and 'password' keys as base64 encoded strings.
This secret may be deleted by the client after successful creation of the DSM Service account and registration of the DSM Plugin in vCenter as indicated by this resource status condition Ready.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
VCenterBinding.status
VCenterBindingStatus describes the observed status of the VCenterBinding.
| Name | Type | Description | Required |
|---|---|---|---|
alertLevel |
string |
AlertLevel indicates the level of the most severe alert raised for a vCenter Binding. |
false |
[]object |
Conditions contain the list of observed conditions of the VCenterBinding. The following statuses can occur.
|
false |
|
lastServiceAccountRotationTime |
string |
LastServiceAccountRotationTime indicates the time when the last service account password was rotated. Mutable.
|
false |
object |
RootCA is a reference to the v1.ConfigMap named 'vcenter-ca' containing the vCenter’s root certificate in the key named 'ca-bundle'. Mutable. |
false |
|
vcenterInstanceUuid |
string |
VcenterInstanceUuid defines the target vCenter instance uuid. Immutable |
false |
version |
string |
Version is the version of vCenter Mutable |
false |
VCenterBinding.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |
VCenterBinding.status.rootCa
RootCA is a reference to the v1.ConfigMap named 'vcenter-ca' containing the vCenter’s root certificate in the key named 'ca-bundle'.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
VCFABinding
VCFABinding is the Schema for the vcfabindings API.
The VCFABinding spec defines the VCFA connection details, including the endpoint URL, optional root CA reference, and service account reference. These details are validated against the VCFA, with results recorded in the VCFABinding status. Any changes to the connection details will trigger a revalidation, and resource versions of the references will be recorded in annotations. Consumers can simply watch the VCFABinding CR to be notified of any changes to the VCFA connection status.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
system.dataservices.vmware.com.v1alpha1 |
true |
kind |
string |
VCFABinding |
true |
object |
Refer to the Kubernetes API documentation for the fields of the |
true |
|
object |
VCFABindingSpec defines the VCFA connection information, including the endpoint URL, the optional root CA reference, and the service account reference.
|
false |
|
object |
VCFABindingStatus defines the observed status of the VCFABinding. |
false |
VCFABinding.spec
VCFABindingSpec defines the VCFA connection information, including the endpoint URL, the optional root CA reference, and the service account reference.
| Name | Type | Description | Required |
|---|---|---|---|
phoneHomeToken |
string |
PhoneHomeToken is an unique system identifier generated for the Phone Home/CEIP program. It’s used to uniquely identify an instance of the VCFA. It can be retrieved via VCFA API(GET /cloudapi/1.0.0/site/configurations/urn:vcloud:configuration:phonehome.token) or from any VCFA API response header with key "x-vmware-vcloud-ceip-id" if the user accepts the CEIP program. Required Immutable. |
true |
object |
ServiceAccountSecret refers to the v1.Secret containing the API token for the target VCFA. The data field of this Secret must contain key 'refresh-token' as base64 encoded strings. Mutable. |
true |
|
url |
string |
URL is the address of the target VCFA. Its host must be present in the VCFA’s certificate SAN extension. Required Mutable. |
true |
disableInfrastructurePolicies |
boolean |
DisableInfrastructurePolicies when set to true, prevents the creation of traditional InfrastructurePolicies. This is intended to guide customers towards creation of Namespaces in the DSM Provider Organization, which will in turn result in automatic registration as Supervisor Infrastructure Policies. Existing Infrastructure Policies are unaffected and can be used without issue. This setting does not govern SupervisorInfraPolicies. Optional Mutable. |
false |
dsmOrganizationURN |
string |
DSMOrganizationURN is the URN of the DSM organization in the VCFA. This is the organization that the Provider (Infra) Admin creates to contain all DSM database clusters. Namespaces created in this organization can host DSM database clusters, which is enabled by auto-created a Supervisor Infrastructure Policy for each Namespace. Once this field is set, it cannot be modified or cleared if any of the auto-created Supervisor Infrastructure Policies are currently in use by DSM database clusters. This restriction is enforced by a validation webhook. It doesn’t take effect if the VCFA version is less than 9.1.1. We expect this field to be auto-configured by the DSM VCF Service. Optional Mutable. |
false |
regionURN |
string |
RegionURN is the VCFA region URN (Uniform Resource Name) identifier. This field tells the DSM appliance which region it is responsible for. Features like the network security configuration leverage this field to configure firewall rules in the right VCFA region. The Supervisor Infrastructure Policies are created for Namespaces in this region, etc. This is the unique ID of the region (e.g., "urn:vcloud:region:e7034bde-88fc-445e-893d-624404c709df"), not the human-readable region name. We expect this field to be auto-configured by the DSM VCF Service. Optional Immutable. Once set to a non-empty value, this field cannot be modified or cleared. |
false |
object |
RootCA refers to the v1.ConfigMap containing the VCFA’s root certificate in the key named 'tls.crt'. Mutable. |
false |
VCFABinding.spec.serviceAccountSecret
ServiceAccountSecret refers to the v1.Secret containing the API token for the target VCFA. The data field of this Secret must contain key 'refresh-token' as base64 encoded strings.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
VCFABinding.spec.rootCa
RootCA refers to the v1.ConfigMap containing the VCFA’s root certificate in the key named 'tls.crt'.
Mutable.
| Name | Type | Description | Required |
|---|---|---|---|
apiVersion |
string |
API version of the referent. |
false |
fieldPath |
string |
If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. |
false |
kind |
string |
Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
false |
name |
string |
Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
false |
namespace |
string |
Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ |
false |
resourceVersion |
string |
Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency |
false |
uid |
string |
UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids |
false |
VCFABinding.status
VCFABindingStatus defines the observed status of the VCFABinding.
| Name | Type | Description | Required |
|---|---|---|---|
[]object |
Conditions contains the list of observed conditions of the VCFABinding. The following statuses can occur:
* Consumers should monitor the |
false |
|
organizationName |
string |
OrganizationName is the resolved human-readable name of the DSM organization configured in spec.dsmOrganizationURN. This is populated when the organization is successfully validated against the VCFA API. |
false |
regionName |
string |
RegionName is the resolved human-readable name of the VCFA region configured in spec.regionURN. This is populated when the region is successfully validated against the VCFA API. |
false |
VCFABinding.status.conditions[index]
Condition contains details for one aspect of the current state of this API Resource.
| Name | Type | Description | Required |
|---|---|---|---|
lastTransitionTime |
string |
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
true |
message |
string |
message is a human readable message indicating details about the transition. This may be an empty string. |
true |
reason |
string |
reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. |
true |
status |
enum |
status of the condition, one of True, False, Unknown.
|
true |
type |
string |
type of condition in CamelCase or in foo.example.com/CamelCase. |
true |
observedGeneration |
integer |
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
|
false |