API Samples

API Samples

This document provides YAML examples for VMware Data Services Manager (DSM) Kubernetes APIs. Use these samples as templates for creating and managing database resources, infrastructure policies, and system configurations.

API Packages:

authorization.dataservices.vmware.com/v1alpha1

This package contains resources for managing user authorization and role bindings.

Resources in this package:
DsmRoleBinding
For DSM Admin Role
apiVersion: authorization.dataservices.vmware.com/v1alpha1
kind: DsmRoleBinding
metadata:
  name: dsmadmin
role: DSM_ADMIN
subjects:
  - kind: User
    name: [email protected]
↑ Back to top

databases.dataservices.vmware.com/v1alpha1

This package contains resources for creating and managing PostgreSQL, MySQL, and SQL Server databases.

Resources in this package:
DatabaseConfig
With a custom db param
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: DatabaseConfig
metadata:
  name: db-config-i4c35-1721685809783
  namespace: default
spec:
  params:
    max_connections: "300"
PostgresCluster
Policy configuration which allows users to create Postgres Database
# NOTE: These samples expect that a DSM user `[email protected]` exists.
# You can create a local DSM user via the DSM UI `Permissions` tab.
#
# NOTE: All objects in this file need to be created by a DSM admin.
#
# Namespace for the sample Postgres cluster.
apiVersion: v1
kind: Namespace
metadata:
  name: postgres-user-namespace
  labels:
    dsm.vmware.com/created-in: dsm
    dsm.vmware.com/ns-type: dsm-managed
---
# Binding grants the user access to the sample namespace.
apiVersion: authorization.dataservices.vmware.com/v1alpha1
kind: DSMUserNamespaceBinding
metadata:
  name: postgres-user-namespace-bind
  namespace: postgres-user-namespace
subjects:
  - kind: User
    name: [email protected]
---
# Policy allows to use InfrastructurePolicy `infra-policy-01` or SupervisorInfrastructurePolicy
# `dsm-test`, BackupLocation `default-backup-storage`, any replicas (0 or 1), and version
# `16` or `17`to create Postgres clusters in the sample namespace.
apiVersion: infrastructure.dataservices.vmware.com/v1alpha1
kind: DataServicePolicy
metadata:
  labels:
    dsm.vmware.com/created-in: dsm
  name: postgres-policy
  namespace: dsm-system
spec:
  matchCriteria:
    - key: kubernetes.io/metadata.name
      operator: in
      values:
      - postgres-user-namespace
    - key: dsm.vmware.com/created-in
      operator: in
      values:
      - dsm
  serviceType: vmware-sql-postgres
  postgresPolicy:
    allowedReplicas:
    - -1
    allowedVersions:
    - "16"
    - "17"
    common:
      allowedBackupLocations:
      - default-backup-storage
      allowedInfrastructurePolicies:
      - infra-policy-01
      - dsm-test
---
# Binding applies all relevant policies to a namespace.
apiVersion: infrastructure.dataservices.vmware.com/v1alpha1
kind: DataServicePolicyBinding
metadata:
  name: binding
  namespace: postgres-user-namespace
spec:
  namespaceProperties:
    # Property `dsm.vmware.com/created-in: dsm` and `kubernetes.io/metadata.name: mysql-user-namespace`
    # match the `matchCriteria` in the above DataServicePolicy
    dsm.vmware.com/created-in: dsm
    kubernetes.io/metadata.name: postgres-user-namespace
    # This property makes the namespace visible in the namespace list on the database creation page
    # of the DSM portal.
    dsm.vmware.com/ns-type: dsm-managed
With custom db param, backup config & 1 replica
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: DatabaseConfig
metadata:
  name: test-config
  namespace: postgres-user-namespace
spec:
  params:
    "max_connections": "100"
    "max_worker_processes": "10"
---
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: PostgresCluster
metadata:
  name: test-pg-with-cfg
  namespace: postgres-user-namespace
spec:
  replicas: 1
  version: "17"
  vmClass:
    name: medium
  storageSpace: 25G
  backupConfig:
    backupRetentionDays: 91
    schedules:
      - name: full-weekly
        type: full
        schedule: "0 0 * * 0"
      - name: incremental-daily
        type: incremental
        schedule: "0 0 * * *"
  infrastructurePolicy:
    name: infra-policy-01
  storagePolicyName: dsm-test
  databaseConfig:
    name: test-config
  backupLocation:
    name: default-backup-storage
Restore Postgres Database
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: PostgresCluster
metadata:
  name: test-pg-restore
  namespace: postgres-user-namespace
spec:
  replicas: 1
  version: "17"
  vmClass:
    name: medium
  storageSpace: 25G
  backupConfig:
    backupRetentionDays: 91
    schedules:
      - name: full-weekly
        type: full
        schedule: "0 0 * * 0"
      - name: incremental-daily
        type: incremental
        schedule: "0 0 * * *"
  infrastructurePolicy:
    name: infra-policy-01
  storagePolicyName: dsm-test
  backupLocation:
    name: default-backup-storage
  basedOn:
    cluster:
      name: test-pg-cluster # should be changed to the source cluster's name
With a secondary replica (Disaster Recovery)
# Primary
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: PostgresCluster
metadata:
  name: my-pg-cluster
  namespace: postgres-user-namespace
spec:
  adminUsername: pgadmin
  backupLocation:
    name: default-backup-storage
  backupConfig:
    backupRetentionDays: 91
    schedules:
      - name: schedule
        schedule: '0 0 * * *'
        type: full
  databaseName: test-primary
  infrastructurePolicy:
    name: infra-policy-01
  maintenanceWindow:
    duration: 6h0m0s
    startDay: SATURDAY
    startTime: "04:59"
  replicas: 0
  replicationSlots:
    - slotName: test_rep_slot
      user: test-rep-slot
      description: "The replication slot to be used by the secondary cluster my-pg-secondary"
  storagePolicyName: dsm-test
  storageSpace: 60Gi
  version: 17.7+vmware.v9.0.2.0
  vmClass:
    name: medium
---
# Secondary
apiVersion: v1
data:
  user: dGVzdC1yZXAtc2xvdA== # This is the username of the replication user encoded in base64
  password: SWFGZnh6SDZaOU5raDZoUzFyNnE4MTBJOUpVMHhw # This is the password of the replication user encoded in Base64.
  dbName: dGVzdC1wcmltYXJ5 # This is the database of the remote cluster encoded in Base64.
kind: Secret
metadata:
  name: my-pg-secondary-rep-secret
  namespace: postgres-user-namespace
type: Opaque
---
apiVersion: v1
data:
  tls.crt: |-
    -----BEGIN CERTIFICATE-----
    MIIC7TCCAdWgAwIBAgIGAZRCYKIkMA0GCSqGSIb3DQEBCwUAMCgxFTATBgNVBAMM
    DFZNd2FyZS1EQi1DQTEPMA0GA1UECgwGVk13YXJlMB4XDTI1MDEwNDIwMDY1NloX
    DTM1MDEwNzIwMDY1NlowKDEVMBMGA1UEAwwMVk13YXJlLURCLUNBMQ8wDQYDVQQK
    DAZWTXdhcmUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDBTP4Vj8/j
    FFuQ9cmg4KqavYghsoNTuEs0DOmwKD+zZLVEhfWpdiaMZDaG5JvCVig1rGu5Z3LU
    rfN/FGEEW6ixrYRdFpdFdcdWqctyY/POED0fjV1kU2XCRSTpy3OGtytGVY9rWJkl
    G0kPuyqKYNK/hX1OBUn6ANfmlhZKR4rkZxBjFsDpGyQDHmkl+Zzu5hIy88uALxtT
    VDNLljtsW/DBMtvSN5owiAJ9gLjzZSLA9ySocEjdgS60c8AwRoVcN8UTTyvMSTUW
    WyLG+s8cCNxRqyyn9ZoRR4tUaDTSFbwiCK2ejJ+coZ0Sxi0U23TKxrqnOhFSHilJ
    /9scNDd+h2CNAgMBAAGjHTAbMAsGA1UdDwQEAwIBBjAMBgNVHRMEBTADAQH/MA0G
    CSqGSIb3DQEBCwUAA4IBAQAcFdNFhBl0ZpGxj2Tzqjr8hUm2fr/F3yikmrnvwchO
    /4PZHUGb1cPAqTF8nvnI0CvxCYIH3assg+5qWwgPLjpuYY3LC1y7P5EDvlOYpux8
    OIJkcVX9AxTsm8lKDXoZcsJVb6s/pxjJ74jIfPtOInU6gErV12aHzuHtjLTdCN2F
    RlDqSVczJC4sqKrw8He/nzH35+vFDWgmxvoDo2n/6EEeymwaGWhQTjaF3mvUYcO5
    fRbO+OAGi+kPwgtj5PJH8l3Ou7A+88CUz3I3+GU6QaIj3dnPrgf9pwLurU+kpru9
    tIQF6AjyEL5tmnIwF9hQxEL9v7tYDFanpc9EjhQF3/oE
    -----END CERTIFICATE-----
kind: ConfigMap
metadata:
  name: sample-my-pg-primary-ca
  namespace: postgres-user-namespace
---
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: PostgresCluster
metadata:
  name: my-pg-secondary
  namespace: postgres-user-namespace
spec:
  adminUsername: pgadmin
  basedOn:
    continuousRecovery:
      enabled: true
      replicationSlot:
        credentials:
          name: my-pg-secondary-rep-secret
        hostname: 192.168.111.45 # This is the public IP of the primary "my-pg-cluster" obtained from its status.connection.host
        port: 5432
        slotName: test_rep_slot
        trustBundle:
          name: sample-my-pg-primary-ca
          namespace: postgres-user-namespace
  databaseName: test-primary
  infrastructurePolicy:
    name: infra-policy-01
  maintenanceWindow:
    duration: 6h0m0s
    startDay: SATURDAY
    startTime: "04:59"
  replicas: 0
  storagePolicyName: dsm-test
  storageSpace: 60Gi
  version: 17.7+vmware.v9.0.2.0
  vmClass:
    name: medium
PostgresClusterBackup
Backup Postgres Cluster
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: PostgresClusterBackup
metadata:
  name: pg-backup
  namespace: postgres-user-namespace
spec:
  backupFilesDeletionPolicy: Delete
  backupLocation:
    name: default-backup-storage
  sourceCluster:
    name: test-pg-cluster
MySQLCluster
Policy configuration which allows users to create MYSQL Database
# NOTE: These samples expect that a DSM user `[email protected]` exists.
# You can create a local DSM user via the DSM UI `Permissions` tab.
#
# NOTE: All objects in this file need to be created by a DSM admin.
#
# Namespace for the sample MySQL cluster.
apiVersion: v1
kind: Namespace
metadata:
  name: mysql-user-namespace
  labels:
    dsm.vmware.com/created-in: dsm
    dsm.vmware.com/ns-type: dsm-managed
---
# Binding grants the user access to the sample namespace.
apiVersion: authorization.dataservices.vmware.com/v1alpha1
kind: DSMUserNamespaceBinding
metadata:
  name: mysql-user-namespace-bind
  namespace: mysql-user-namespace
subjects:
  - kind: User
    name: [email protected]
---
# Policy allows to use InfrastructurePolicy `infra-policy-01` or SupervisorInfrastructurePolicy
# `dsm-test`, BackupLocation `default-backup-storage`, any number of members (1 or 3),
# and version `8.0.41` or `8.0.40` to create MySQL clusters in the sample namespace.
apiVersion: infrastructure.dataservices.vmware.com/v1alpha1
kind: DataServicePolicy
metadata:
  labels:
    dsm.vmware.com/created-in: dsm
  name: mysql-policy
  namespace: dsm-system
spec:
  matchCriteria:
    - key: kubernetes.io/metadata.name
      operator: in
      values:
      - mysql-user-namespace
    - key: dsm.vmware.com/created-in
      operator: in
      values:
      - dsm
  serviceType: vmware-sql-mysql
  mysqlPolicy:
    allowedMembers:
    - -1
    allowedVersions:
    - "8.0.40"
    - "8.0.41"
    common:
      allowedBackupLocations:
      - default-backup-storage
      allowedInfrastructurePolicies:
      - infra-policy-01
      - dsm-test
---
# Binding applies all relevant policies to a namespace.
apiVersion: infrastructure.dataservices.vmware.com/v1alpha1
kind: DataServicePolicyBinding
metadata:
  name: binding
  namespace: mysql-user-namespace
spec:
  namespaceProperties:
    # Property `dsm.vmware.com/created-in: dsm` and `kubernetes.io/metadata.name: mysql-user-namespace`
    # match the `matchCriteria` in the above DataServicePolicy
    dsm.vmware.com/created-in: dsm
    kubernetes.io/metadata.name: mysql-user-namespace
    # This property makes the namespace visible in the namespace list on the database creation page
    # of the DSM portal.
    dsm.vmware.com/ns-type: dsm-managed
With a custom backup config and 1 replica.
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: DatabaseConfig
metadata:
  name: test-mysql-config
  namespace: mysql-user-namespace
spec:
  params:
    "max_connections": "100"
    "max_binlog_size": "1073741824"
---
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: MySQLCluster
metadata:
  name: test-mysql-with-cfg
  namespace: mysql-user-namespace
spec:
  members: 1
  version: "8.0.41"
  vmClass:
    name: medium
  storageSpace: 25G
  backupConfig:
    backupRetentionDays: 90
    schedules:
      - name: full-30mins
        type: full
        schedule: "*/30 * * * *"
  infrastructurePolicy:
    name: infra-policy-01
  storagePolicyName: dsm-test
  databaseConfig:
    name: test-mysql-config
  backupLocation:
    name: default-backup-storage
Restore MySQL Database
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: MySQLCluster
metadata:
  name: test-mysql-restore
  namespace: mysql-user-namespace
spec:
  members: 1
  version: "8.0.41"
  vmClass:
    name: medium
  storageSpace: 25G
  backupConfig:
    backupRetentionDays: 90
    schedules:
      - name: full-30mins
        type: full
        schedule: "*/30 * * * *"
  infrastructurePolicy:
    name: infra-policy-01
  storagePolicyName: dsm-test
  backupLocation:
    name: default-backup-storage
  basedOn:
    cluster:
      name: test-mysql-cluster # should be changed to the source cluster's name
MySQLClusterBackup
Backup MySQL Cluster
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: MySQLClusterBackup
metadata:
  name: mysql-backup
  namespace: mysql-user-namespace
spec:
  backupFilesDeletionPolicy: Delete
  backupLocation:
    name: default-backup-storage
  sourceCluster:
    name: test-mysql-cluster
SQLServerCluster
apiVersion: v1
kind: Secret
metadata:
  name: sqlserver-tls
  namespace: dsm-system
type: kubernetes.io/tls
stringData:
  # Certificate chain of the server. In PEM format.
  # Starts with the end-entity (i.e. leaf) certificate of the server.
  # Followed by certificates of intermediate CA(s), if any.
  # Ends with the certificate of the root CA.
  tls.crt: |-
    -----BEGIN CERTIFICATE-----
    ... End-entity (i.e. leaf) certificate of the server.
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
    ... Certificate of intermediate CA, if any.
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
    ... Certificate of root CA.
    -----END CERTIFICATE-----
  # The private key of the server. In PEM format.
  tls.key: |-
    -----BEGIN PRIVATE KEY-----
    ... Private key of the server.
    -----END PRIVATE KEY-----
---
apiVersion: v1
kind: Secret
metadata:
  name: sqlserver-encrypt
  namespace: dsm-system
data:
  pfx: <PFX file contents>
  password: <PFX file password>
---
apiVersion: v1
kind: Secret
metadata:
  name: sqladmin-pass
  namespace: dsm-system
stringData:
  password: "<admin's password>"
---
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: SQLServerCluster
metadata:
  name: mssql-with-config
  namespace: dsm-system
spec:
  edition: "Developer"
  serverConfig:
    collation: "Latin1_General_CI_AS"
    traceFlags: [3226]
    agent:
      enabled: true
      jobHistoryMaxRows: 2000
      jobHistoryMaxRowsPerJob: 200
      startupWaitForAllDb: true
      logMaxSize: 20Mi
    auditing:
      preset: "AllLogins"
      logRetentionHours: 720
    errorLog:
      maxSize: 50Mi
      numErrorLogs: 10
    coreDump:
      disableCoreDump: true
      retentionHours: 48
    network:
      tlsProtocols: ["1.2"]
      # If custom TLS is not configured, DSM will automatically generate
      # private key and certificate for the server and will sign the
      # certificate with the DSM system CA.
      tlsSecretName: sqlserver-tls
    spConfigure:
      - name: 'cost threshold for parallelism'
        value: 50
      - name: 'remote access'
        value: 0
    # These certificates will be loaded into SQL Server. Can be used for backup
    # encryption/decryption, Transparent Data Encryption (TDE), etc.
    certificates:
      - name: 'sqlserver-encrypt'
    # All databases on the cluster will have their backups encrypted with this
    # certificate.
    backupEncryptionCertificate:
      name: 'sqlserver-encrypt'
  adminUser:
    type: SQLUser
    username: 'sqladmin'
    passwordRef:
      name: sqladmin-pass
      fieldPath: password
  infrastructurePolicy:
    name: infra-policy-01
  placementSelector:
    cluster: dbaas-cluster
    datacenter: dbaas-dc
  storagePolicyName: dsm-test
  storageSpace: 20Gi
  # Could be one of the versions supported by the Data Services Manager.
  # For example `2025.CU6.GDR1`.
  version: "2022.CU25.GDR1"
  vmClass:
    name: medium
Onboard External Database
# To onboard an external database to the Data Services Manager, take a full
# backup of the database and upload it to one of the configured backup
# locations. Then create a SQLServerDatabase based on the uploaded backup.
#
# To onboard on HA cluster, the original database must use FULL recovery model.
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: SQLServerDatabaseBackup
metadata:
  namespace: sqlserver-user-namespace
  name: mssql-db-onboard-backup
spec:
  backupLocation:
    name: trusted-root-backup-storage
  # Specify the path of the uploaded backup on the backup location.
  # If the backup is striped over multiple files, specify a path prefix which
  # matches all backup files. See the API docs for details.
  sourceBackup:
    path: '/brownfield/example.bak'
---
apiVersion: v1
kind: Secret
metadata:
  name: mssql-db-onboard-owner-pass
  namespace: sqlserver-user-namespace
stringData:
  password: <dbOwner's password>
---
# Create a SQLServerDatabase based on the uploaded backup.
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: SQLServerDatabase
metadata:
  name: mssql-db-onboard
  namespace: sqlserver-user-namespace
spec:
  basedOn:
    backup:
      name: mssql-db-onboard-backup
  placement:
    sqlServer: 
      name: mssql-with-config
      namespace: dsm-system
  backupConfig:
    checksumEnabled: true
    backupRetentionDays: 30
    logBackupFrequency: 5
    schedules:
    - name: default-full-backup
      schedule: 59 23 * * 6
      type: full
    - name: default-differential-backup
      schedule: 59 23 1/1 * *
      type: differential
  backupLocation:
    name: trusted-root-backup-storage
  dbOwner:
    type: SQLUser
    username: sqluser
    passwordRef:
      name: mssql-db-onboard-owner-pass
      fieldPath: password
SQL Server Cluster with ActiveDirectory
apiVersion: v1
kind: Secret
metadata:
  name: test-sqlserver-account
  namespace: dsm-system
stringData:
  username: "sqlsvc01"
  # See the API docs for instructions how to rotate the service account
  # password without interrupting SQL users.
  # If the service account is of type `GMSA`, this Secret must not contain
  # password.
  password: "<sqlsvc01's password>"
---
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: SQLServerCluster
metadata:
  name: mssql-with-ad
  namespace: dsm-system
spec:
  edition: "Developer"
  dnsNames:
    - mssql01.example.org
  activeDirectory:
    domain:
      name: test-example-domain
    sqlServerAccount:
      name: test-sqlserver-account
      # Use type `User` (the default) if the service account is a regular AD
      # user account.
      # Use type `GMSA` for Group Managed Service Account. See the API docs for
      # details.
      type: User
    # This setting asks DSM to create DNS records (both A and PTR) in the
    # primary nameserver configured on the ActiveDirectoryDomain.
    writeDNSNames: ForwardAndReverse
  adminUser:
    type: WindowsPrincipal
    username: 'EXAMPLE\test-server-admin'
  serverConfig:
    # Enable PAL logging to troubleshoot AD integration (advanced diagnostics).
    # Do not keep it permanently enabled - it produces lots of logs.
    palLoggerIni: |-
      [Output:security]
      Type = File
      Filename = /var/opt/mssql/log/pal/security.log
      Maxfilesizemb = 100
      Maxrolloverfiles = 2
      [Logger]
      Level = Silent
      [Logger:security.kerberos]
      Level = Debug
      Outputs = security
      [Logger:security.ldap]
      Level = Debug
      Outputs = security
  infrastructurePolicy:
    name: infra-policy-01
  storagePolicyName: dsm-test
  storageSpace: 20Gi
  version: "2022.CU25.GDR1"
  vmClass:
    name: medium
SQL Server Cluster with ActiveDirectory manual configuration
apiVersion: v1
kind: Secret
metadata:
  name: test-sqlserver-account-02
  namespace: dsm-system
stringData:
  # When using keytab, this Secret does not need to contain password because
  # the keytab contains keys derived from the password
  username: "sqlsvc02"
---
apiVersion: v1
kind: Secret
metadata:
  name: test-sqlserver-keytab
  namespace: dsm-system
data:
  # Keytab (binary) file for the service account and the chosen DNS name(s) of
  # the SQL Server cluster.
  # On Windows could create keytab via the ktpass tool.
  # On Linux could create keytab via ktutil or adutil.
  keytab: BQI=
---
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: SQLServerCluster
metadata:
  name: mssql-with-ad-02
  namespace: dsm-system
spec:
  edition: "Developer"
  dnsNames:
    # Optional, but strongly recommended for compatibility with the SQL Server Management Studio
    - mssql02.example.org
  activeDirectory:
    domain:
      name: test-example-domain-manual-cfg
    # When using keytab, the service account must have appropriate Service
    # Principal Names (SPNs) for the DNS name(s) of the SQL Server cluster.
    # SPNs could be configured via the setspn Windows tool, via the adutil
    # Linux tool or by directly modifying the servicePrincipalName LDAP
    # attribute on the service account.
    sqlServerAccount:
      name: test-sqlserver-account-02
    keytab:
      name: test-sqlserver-keytab
  infrastructurePolicy:
    name: infra-policy-01
  storagePolicyName: dsm-test
  storageSpace: 20Gi
  version: "2022.CU25.GDR1"
  vmClass:
    name: medium
SQL Server Cluster with High Availability
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: SQLServerCluster
metadata:
  name: mssql-ha
  namespace: dsm-system
spec:
  # HA is only supported on Enterprise edition and its equivalents (i.e.
  # EnterpriseCore, Developer, Evaluation).
  edition: "Enterprise"
  # HA has two synchronous data replicas : primary and secondary.
  replicas: 2
  infrastructurePolicy:
    name: infra-policy-01
  storagePolicyName: dsm-test
  storageSpace: 20Gi
  version: "2022.CU25.GDR1"
  vmClass:
    name: medium
SQL Server Cluster with Supervisor
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: SQLServerCluster
metadata:
  name: mssql-on-supervisor
  namespace: dsm-system
spec:
  edition: "Developer"
  infrastructurePolicy:
    name: dsm-test
  storagePolicyName: dsm-test
  storageSpace: 20Gi
  version: "2022.CU25.GDR1"
  vmClass:
    name: best-effort-large
DataServicePolicy
Policy configuration which allows users to create databases on the sample SQL Server clusters
# NOTE: These samples expect that a DSM user `[email protected]` exists.
# You can create a local DSM user via the DSM UI `Permissions` tab.
#
# NOTE: All objects in this file need to be created by a DSM admin.
#
# Namespace for the sample SQL Server databases.
apiVersion: v1
kind: Namespace
metadata:
  name: sqlserver-user-namespace
  labels:
    dsm.vmware.com/created-in: dsm
    dsm.vmware.com/ns-type: dsm-managed
---
# Binding grants the user access to the sample namespace.
apiVersion: authorization.dataservices.vmware.com/v1alpha1
kind: DSMUserNamespaceBinding
metadata:
  name: sqlserver-user-namespace-bind
  namespace: sqlserver-user-namespace
subjects:
  - kind: User
    name: [email protected]
---
# Policy allows SQL Server databases in the sample namespace to be placed on
# the sample SQL Server clusters and to use `trusted-root-backup-storage`.
apiVersion: infrastructure.dataservices.vmware.com/v1alpha1
kind: DataServicePolicy
metadata:
  labels:
    dsm.vmware.com/created-in: dsm
  name: sqlserver-policy
  namespace: dsm-system
spec:
  matchCriteria:
    - key: kubernetes.io/metadata.name
      operator: in
      values:
        - sqlserver-user-namespace
    - key: dsm.vmware.com/created-in
      operator: in
      values:
        - dsm
  serviceType: vmware-sql-sqlserver-database
  sqlServerDatabasePolicy:
    allowedBackupLocations:
      - trusted-root-backup-storage
    allowedPlacements:
      - sqlServer:
          name: mssql-with-config
          namespace: dsm-system
      - sqlServer:
          name: mssql-with-ad
          namespace: dsm-system
    backupConfig:
      allowedRetentionDays:
        max: 365
        min: 7
      allowedStates:
        - 'on'
        - 'off'
      requiredSchedules:
        - name: default-full-backup
          schedule: 59 23 * * 6
          type: full
        - name: default-differential-backup
          schedule: 59 23 1/1 * *
          type: differential
---
# Binding applies all relevant policies to a namespace.
apiVersion: infrastructure.dataservices.vmware.com/v1alpha1
kind: DataServicePolicyBinding
metadata:
  name: binding
  namespace: sqlserver-user-namespace
spec:
  namespaceProperties:
    # Property `dsm.vmware.com/created-in: dsm` and `kubernetes.io/metadata.name: mysql-user-namespace`
    # match the `matchCriteria` in the above DataServicePolicy
    dsm.vmware.com/created-in: dsm
    kubernetes.io/metadata.name: sqlserver-user-namespace
    # This property makes the namespace visible in the namespace list on the database creation page 
    # of the DSM portal.
    dsm.vmware.com/ns-type: dsm-managed
SQLServerDatabase
SQL Server Database with SQL User
apiVersion: v1
kind: Secret
metadata:
  name: mssql-db-owner-pass
  namespace: sqlserver-user-namespace
stringData:
  password: <dbOwner's password>
---
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: SQLServerDatabase
metadata:
  name: mssql-db
  namespace: sqlserver-user-namespace
spec:
  # The name of the database in SQL Server. May differ from `metadata.name`
  # which is the name of the database within the DSM API.
  # Use `spec.name` when you need extra flexibility which `metadata.name` does
  # not have:
  # - `metadata.name` must be a valid DNS subdomain name per RFC 1123.
  # - `metadata.name` must be unique within the DSM namespace. `spec.name`
  # allows you to clone/restore a database with the same name on another SQL
  # Server in the same DSM namespace.
  name: "MS SQL Database"
  placement:
    sqlServer: 
      name: mssql-with-config
      namespace: dsm-system
  backupConfig:
    checksumEnabled: true
    backupRetentionDays: 30
    logBackupFrequency: 5
    schedules:
    - name: default-full-backup
      schedule: 59 23 * * 6
      type: full
    - name: default-differential-backup
      schedule: 59 23 1/1 * *
      type: differential
  backupLocation:
    name: trusted-root-backup-storage
  dbOwner:
    type: SQLUser
    username: sqluser
    passwordRef:
      name: mssql-db-owner-pass
      fieldPath: password
Restore SQL Server Database with SQL User
apiVersion: v1
kind: Secret
metadata:
  name: mssql-db-clone-owner-pass
  namespace: sqlserver-user-namespace
stringData:
  password: <dbOwner's password>
---
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: SQLServerDatabase
metadata:
  name: mssql-db-clone
  namespace: sqlserver-user-namespace
spec:
  basedOn:
    database:
      name: mssql-db
      # Use type `SQLServerDatabase` (the default) to restore a backup of a live database.
      # Use type `ArchivedSQLServerDatabase` to restore a backup of a deleted
      # database.
      type: SQLServerDatabase
      # Set field `timestamp` if you want to restore to a point in time.
  placement:
    sqlServer: 
      name: mssql-with-config
      namespace: dsm-system
  backupConfig:
    backupRetentionDays: 30
    logBackupFrequency: 5
    schedules:
    - name: default-full-backup
      schedule: 59 23 * * 6
      type: full
    - name: default-differential-backup
      schedule: 59 23 1/1 * *
      type: differential
  backupLocation:
    name: trusted-root-backup-storage
  dbOwner:
    type: SQLUser
    username: sqluser
    passwordRef:
      name: mssql-db-clone-owner-pass
      fieldPath: password
SQL Server Database with AD User
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: SQLServerDatabase
metadata:
  name: mssql-db-with-ad
  namespace: sqlserver-user-namespace
spec:
  placement:
    sqlServer:
      name: mssql-with-ad
      namespace: dsm-system
  backupConfig:
    backupRetentionDays: 30
    logBackupFrequency: 5
    schedules:
    - name: default-full-backup
      schedule: 59 23 * * 6
      type: full
    - name: default-differential-backup
      schedule: 59 23 1/1 * *
      type: differential
  backupLocation:
    name: trusted-root-backup-storage
  dbOwner:
    type: WindowsPrincipal
    username: 'EXAMPLE\test-db-owner-user'
SQLServerDatabaseBackup
Backup SQL Server Database
apiVersion: databases.dataservices.vmware.com/v1alpha1
kind: SQLServerDatabaseBackup
metadata:
  namespace: sqlserver-user-namespace
  name: mssql-db-backup
spec:
  backupLocation:
    name: trusted-root-backup-storage
  sourceDatabase:
    name: mssql-db
  checksumEnabled: true
↑ Back to top

infrastructure.dataservices.vmware.com/v1alpha1

This package contains resources for managing infrastructure policies, IP pools, VM classes, directory services, and Active Directory domains.

Resources in this package:
IPPool
With 2 IP ranges
apiVersion: infrastructure.dataservices.vmware.com/v1alpha1
kind: IPPool
metadata:
  name: mgmt-network-pool
spec:
  addresses:
    - 1.1.1.1
    - 1.1.1.12-1.1.1.50
    - 1.1.1.65-1.1.1.90
  gateway: 1.1.1.254
  prefix: 24
VMClass
With 8 vCPU and 16 Gi memory.
apiVersion: infrastructure.dataservices.vmware.com/v1alpha1
kind: VMClass
metadata:
  name: large
spec:
  requests:
    cpu: "8"
    memory: "16"
InfrastructurePolicy
With a resource pool.
apiVersion: infrastructure.dataservices.vmware.com/v1alpha1
kind: InfrastructurePolicy
metadata:
  name: infra-policy-02-rp
spec:
  enableCrossClusterHA: false
  enabled: true
  ipRanges:
    - poolName: mgmt-network-pool
      portGroups:
        - datacenter: dbaas-dc
          name: Mgmt
  placements:
    - cluster: dbaas-cluster
      datacenter: dbaas-dc
      folder: DSM
      portGroups:
        - Mgmt
      resourcePool: rp1
  storagePolicies:
    - dsm-test
  vmClasses:
    - name: small
    - name: medium
    - name: large
DirectoryService
With ldap configured.
apiVersion: v1
kind: ConfigMap
metadata:
  name: sample-ldap-ca
  namespace: dsm-system
data:
  tls.crt: |
    -----BEGIN CERTIFICATE-----
    MIIDPTCCAiWgAwIBAgIUOLVUtlG6xWK2D+ezIi2b9uTPvtowDQYJKoZIhvcNAQEL
    BQAwLjEbMBkGA1UEAwwSRFNNLUxEQVAtU2FtcGxlLUNBMQ8wDQYDVQQKDAZWTXdh
    cmUwHhcNMjYwNzEzMDczOTAxWhcNMzYwNzEwMDczOTAxWjAuMRswGQYDVQQDDBJE
    U00tTERBUC1TYW1wbGUtQ0ExDzANBgNVBAoMBlZNd2FyZTCCASIwDQYJKoZIhvcN
    AQEBBQADggEPADCCAQoCggEBAIq1knPW9h+nOhsF9fhS6KvZ2KmKWkj1YDMC3BPi
    cLDHWMVUwzF7FSf2SmlpjMcaOChWW+Ioc7KgLWmVYrLK5hgf4yOEyxfm0RClF/Gh
    i8ZZgY7JNGHNdCLQ54zjaqx2j1EQb4jVta9zOqtAivHCN1S8SrDWM9LvTgK1am/6
    E9x7sx0+EAqkMhCVmT+kW2HbPdFlDhDD2bE1BuokWWFG9qBLbnL6EzdF6C7NYUK/
    B+rIiqaHU74uT1lv9YR38A9aVJJHMm+QfvIU3JtuxOdHV41upQsKGvSyTE26dtrj
    yporLbVZL1FABTvLoKy6bjgm5y61YWTSHyF2bSbnOxs1qgUCAwEAAaNTMFEwHQYD
    VR0OBBYEFMILt9rPAO6ECnCMeYbaF7A2rtB/MB8GA1UdIwQYMBaAFMILt9rPAO6E
    CnCMeYbaF7A2rtB/MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
    AH0e2DPmyPRBLjDZcqDWNaM2a4xFFlICXNAMk97VdQGJYjyoU4FmdlRYoK67dkcV
    fDSvirLULLeMOlDaS2z2wMQcmZY4Tp05oHTwbvFJiNxaTYbAt1Ewnv9gCNOlBHG4
    BbARlMadyQtKEPLQn8AL6+jwH1pDZYhQtzvTF8N8rngRNvVASoYy79fpL+jvbJ1S
    YGJnR2QIxb9jVlw5tuDriRkbEeoyr5c5TUcD1Yv0fwiUygU6l6yzezkZj5otQuur
    75H/5WcVY5uYUrefr5autynowLRkLs4WbDLVOBZOSP8e74Z0Et4kuPEjqI6H5XxJ
    srroxdyIun3SjKxEClXKeoQ=
    -----END CERTIFICATE-----
---
apiVersion: v1
kind: Secret
metadata:
  name: sample-ldap-credentials
  namespace: dsm-system
type: "kubernetes.io/basic-auth"
data:
  username: bGRhcGFkbWlu  # This is 'ldapadmin' encoded in Base64
  password: cGFzc3dvcmQ=  # This is 'password' encoded in Base64
---
apiVersion: infrastructure.dataservices.vmware.com/v1alpha1
kind: DirectoryService
metadata:
  name: ldap-default
  namespace: dsm-system
spec:
  type: "ActiveDirectory"
  domain: vmware.com
  baseDnUsers: dc=vmware,dc=com
  bindCredentials:
    name: sample-ldap-credentials
  primaryServerUrl: ldaps://ldap.vmware.com:3269
  secondaryServerUrls:
    - ldaps://scrootdc1.vmware.com:3269
    - ldaps://scdc2rootdc04.vmware.com:3269
  trustBundle:
    name: sample-ldap-ca
    namespace: dsm-system
  userSearchAttribute: "userPrincipalName"
ActiveDirectoryDomain
apiVersion: v1
kind: ConfigMap
metadata:
  name: example-domain-trust-bundle
  namespace: dsm-system
data:
  tls.crt: |
    -----BEGIN CERTIFICATE-----
    ... The PEM-encoded CA certificate of the domain's LDAP services.
    -----END CERTIFICATE-----
---
apiVersion: v1
kind: Secret
metadata:
  name: example-domain-priv-account
  namespace: dsm-system
stringData:
  username: "test-user"
  password: "<test-user's password>"
---
apiVersion: infrastructure.dataservices.vmware.com/v1alpha1
kind: ActiveDirectoryDomain
metadata:
  name: test-example-domain
  namespace: dsm-system
spec:
  # The DNS servers configured in the system settings of DSM must be able to
  # resolve the Active Directory domain name and the names of the domain
  # controllers.
  # When using infrastructure policy based on vSphere Supervisor, the DNS
  # servers configured on the Supervisor must be able to resolve the Active
  # Directory domain name and the names of the domain controllers.
  name: example.org
  trustBundle:
    # Needed for DSM to be able to talk with the LDAP services of the
    # selected domain. When manually providing keytabs, DSM doesn't need to
    # talk to the LDAP and this trust bundle is not required.
    name: example-domain-trust-bundle
  privilegedAccountCredentials:
    # Like above, this is only needed for DSM to be able to talk with the LDAP
    # services of the selected domain. Refer to the documentation about what
    # privileges this account needs to have.
    name: example-domain-priv-account
  # Writable DNS server where DSM will create DNS names for SQL Servers
  # clusters with configured `spec.activeDirectory.writeDNSNames`.
  # The DNS server must support the "DNS UPDATE" protocol (RFC 2136) and the
  # GSS-TSIG algorithm (RFC 3645) for authentication.
  primaryNameserver: 10.20.30.40
Manual configuration
apiVersion: infrastructure.dataservices.vmware.com/v1alpha1
kind: ActiveDirectoryDomain
metadata:
  name: test-example-domain-manual-cfg
  namespace: dsm-system
spec:
  name: example.org
↑ Back to top

observability.dataservices.vmware.com/v1alpha1

This package contains resources for collecting logs and configuring metrics targets for monitoring and troubleshooting.

Resources in this package:
  • LogBundle - Database log collection for troubleshooting
  • MetricsTarget - Metrics export configuration for monitoring systems
LogBundle
Log bundle for Postgres
apiVersion: observability.dataservices.vmware.com/v1alpha1
kind: LogBundle
metadata:
  name: test-pg-logs
  namespace: postgres-user-namespace
spec:
  retentionPeriod: 48h
  targetRef:
    kind: PostgresCluster
    name: test-pg-cluster
MetricsTarget
Metrics Target for VCFOps
apiVersion: observability.dataservices.vmware.com/v1alpha1
kind: MetricsTarget
metadata:
  name: metrics-default
  namespace: dsm-system
spec:
  type: VCFOps
  endpoint: "https://10.84.1.1:8443/opensource/default/metric"
  tls:
    insecureSkipVerify: false
    trustBundle:
      name: trusted-root-ca
      namespace: dsm-system
    clientCertificate:
      name: client-cert-secret
  credentials:
    name: basic-auth-secret
  timeout: 7s
  headers:
    Content-Type: "text/plain; charset=utf-8"
    additional-static-metadata: my-value
↑ Back to top

system.dataservices.vmware.com/v1alpha1

This package contains resources for system-level configuration, support bundles, and image registry management.

Resources in this package:
DsmSystemConfig
With ntp configured.
apiVersion: system.dataservices.vmware.com/v1alpha1
kind: DsmSystemConfig
metadata:
  name: dsm-system-config
spec:
  dnsServers:
    - 1.2.3.4
  dsmProviderId: f9b039f9-2683-43b1-aae0-5602614cde0b
  externalLogDestination:
    enabled: false
    trustBundle: {}
  gateway: 10.20.32.1
  ip: 10.20.32.10
  netmask: 255.255.224.0
  ntpServers:
    - time.vmware.com
With external log destination - udp configured.
apiVersion: system.dataservices.vmware.com/v1alpha1
kind: DsmSystemConfig
metadata:
  name: dsm-system-config
spec:
  dsmProviderId: f9b039f9-2683-43b1-aae0-5602614cde0b
  gateway: 10.20.32.1
  ip: 10.20.32.10
  netmask: 255.255.224.0
  externalLogDestination:
    enabled: true
    remoteLogDestinationProvider: syslog server
    remoteLogUrl: udp://0.0.1.1:514
    trustBundle: {}
With external log destination - tls configured.
apiVersion: system.dataservices.vmware.com/v1alpha1
kind: DsmSystemConfig
metadata:
  name: dsm-system-config
spec:
  dsmProviderId: f9b039f9-2683-43b1-aae0-5602614cde0b
  gateway: 10.20.32.1
  ip: 10.20.32.10
  netmask: 255.255.224.0
  externalLogDestination:
    enabled: true
    remoteLogDestinationProvider: syslog server
    remoteLogUrl: ssl://0.0.1.1:1514
    trustBundle:
      name: trusted-root-ca
      namespace: dsm-system
SupportBundle
Support bundle for single data service
apiVersion: system.dataservices.vmware.com/v1alpha1
kind: SupportBundle
metadata:
  name: test-logs
  annotations:
    dsm.vmware.com/owner: [email protected]
  namespace: dsm-system
spec:
  includedDataServices: Single
  retentionPeriod: 48h
  dataServiceTargetRef:
    kind: PostgresCluster
    name: test-pg-cluster
    namespace: postgres-user-namespace
ImageRegistry
Pointing to a public repo (mcr.microsoft.com/mssql/server)
# This is a reference to an external image registry that contains the official SQL Server container images published by Microsoft.
# Required only if you intend to use DSM Data Service for Microsoft SQL Server.
apiVersion: system.dataservices.vmware.com/v1alpha1
kind: ImageRegistry
metadata:
  name: sql-sqlserver-registry
  namespace: dsm-system
spec:
  endpoint: mcr.microsoft.com
  repo: mssql
  dataServiceSelector:
    matchExpressions:
      - key: dsm.vmware.com/data-service-type
        operator: In
        values:
          - vmware-sql-sqlserver
↑ Back to top