K8SPG-1057: Allow using etcd as patroni DCS

build/crd/percona/generated/pgv2.percona.com_perconapgclusters.yaml

@@ -22038,6 +22038,66 @@ spec:
                       - pgbackrest
                       type: string
                     type: array
+                  dcs:
+                    description: |-
+                      DCS configures the distributed configuration store backend.
+                      Defaults to the Kubernetes-native backend (Endpoints).
+                      N.B. Changing the DCS type causes downtime; all instances must restart simultaneously.
+                    properties:
+                      etcd:
+                        description: |-
+                          Etcd holds settings for the external etcd DCS backend.
+                          Required when type is "etcd".
+                        properties:
+                          authSecret:
+                            description: |-
+                              AuthSecret is the name of a Secret in the same namespace with keys
+                              username and password for etcd authentication.
+                            type: string
+                          endpoints:
+                            description: |-
+                              Endpoints is the list of etcd endpoints including scheme and port.
+                              Example: ["https://etcd.etcd-cluster.svc:2379"]
+                              The scheme of the first endpoint determines the protocol used.
+                              All endpoints must use the same scheme.
+                            items:
+                              pattern: ^https?://[^/]
+                              type: string
+                            maxItems: 7
+                            minItems: 1
+                            type: array
+                            x-kubernetes-validations:
+                            - message: all endpoints must use the same scheme (http
+                                or https)
+                              rule: self.all(e, url(e).getScheme() == 'http') || self.all(e,
+                                url(e).getScheme() == 'https')
+                          tlsSecret:
+                            description: |-
+                              TLSSecret is the name of a Secret in the same namespace with keys
+                              ca.crt, tls.crt, and tls.key for mutual TLS with etcd.
+                            type: string
+                        required:
+                        - endpoints
+                        type: object
+                      type:
+                        allOf:
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        default: kubernetes
+                        description: PatroniDCSType identifies which DCS backend Patroni
+                          should use.
+                        type: string
+                    type: object
+                    x-kubernetes-validations:
+                    - message: etcd.endpoints must be non-empty when type is etcd
+                      rule: self.type != 'etcd' || (has(self.etcd) && size(self.etcd.endpoints)
+                        > 0)
+                    - message: DCS type is immutable after cluster creation
+                      rule: '!has(oldSelf.type) || oldSelf.type == self.type'
                   dynamicConfiguration:
                     description: |-
                       Patroni dynamic configuration settings. Changes to this value will be

build/postgres-operator/Dockerfile

@@ -70,6 +70,7 @@ COPY build/postgres-operator/postgres-entrypoint.sh /usr/local/bin
 COPY build/postgres-operator/postgres-liveness-check.sh /usr/local/bin
 COPY build/postgres-operator/postgres-readiness-check.sh /usr/local/bin
 COPY build/postgres-operator/restore-command-wrapper.sh /usr/local/bin
+COPY build/postgres-operator/patroni-role-change.sh /usr/local/bin
 COPY hack/tools/queries /opt/crunchy/conf
 
 RUN chgrp -R 0 /opt/crunchy/conf && chmod -R g=u opt/crunchy/conf

build/postgres-operator/init-entrypoint.sh

@@ -11,3 +11,4 @@ install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "/usr/local/bin/postgres-liveness
 install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "/usr/local/bin/postgres-readiness-check.sh" "${CRUNCHY_BINDIR}/bin/postgres-readiness-check.sh"
 install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "/usr/local/bin/relocate-extensions.sh" "${CRUNCHY_BINDIR}/bin/relocate-extensions.sh"
 install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "/usr/local/bin/restore-command-wrapper.sh" "${CRUNCHY_BINDIR}/bin/restore-command-wrapper.sh"
+install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "/usr/local/bin/patroni-role-change.sh" "${CRUNCHY_BINDIR}/bin/patroni-role-change.sh"

build/postgres-operator/patroni-role-change.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+# Patroni on_role_change / on_start callback.
+# Called by Patroni as: <script> <event> <role> <scope>
+# With etcd DCS, Patroni does not update pod labels or annotations.
+# This script patches both so that:
+#   - Service selectors work (role label)
+#   - IsWritable() works (status annotation read by the operator)
+
+ROLE=${2}
+
+NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
+TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
+CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+POD=${HOSTNAME}
+
+case "${ROLE}" in
+    master|primary)  LABEL="primary" ;;
+    replica)         LABEL="replica" ;;
+    *)               LABEL="${ROLE}" ;;
+esac
+
+PATCH_BODY="{\"metadata\":{\"labels\":{\"postgres-operator.crunchydata.com/role\":\"${LABEL}\"},\"annotations\":{\"status\":\"{\\\"role\\\":\\\"${LABEL}\\\"}\"}}}"
+
+curl -sf -X PATCH \
+    --retry 3 --retry-delay 1 --retry-connrefused \
+    --cacert "${CA}" \
+    -H "Authorization: Bearer ${TOKEN}" \
+    -H "Content-Type: application/strategic-merge-patch+json" \
+    "https://kubernetes.default.svc/api/v1/namespaces/${NAMESPACE}/pods/${POD}" \
+    -d "${PATCH_BODY}"

cmd/postgres-operator/main.go

@@ -185,6 +185,15 @@ func addControllersToManager(ctx context.Context, mgr manager.Manager) error {
 		return err
 	}
 
+	if err := mgr.GetFieldIndexer().IndexField(
+		context.Background(),
+		&v2.PerconaPGCluster{},
+		v2.IndexFieldPatroniEtcdSecrets,
+		v2.PatroniEtcdSecretsIndexerFunc,
+	); err != nil {
+		return err
+	}
+
 	externalEvents := make(chan event.GenericEvent)
 	stopChan := make(chan event.DeleteEvent)
 

config/crd/bases/pgv2.percona.com_perconapgclusters.yaml

@@ -22736,6 +22736,66 @@ spec:
                       - pgbackrest
                       type: string
                     type: array
+                  dcs:
+                    description: |-
+                      DCS configures the distributed configuration store backend.
+                      Defaults to the Kubernetes-native backend (Endpoints).
+                      N.B. Changing the DCS type causes downtime; all instances must restart simultaneously.
+                    properties:
+                      etcd:
+                        description: |-
+                          Etcd holds settings for the external etcd DCS backend.
+                          Required when type is "etcd".
+                        properties:
+                          authSecret:
+                            description: |-
+                              AuthSecret is the name of a Secret in the same namespace with keys
+                              username and password for etcd authentication.
+                            type: string
+                          endpoints:
+                            description: |-
+                              Endpoints is the list of etcd endpoints including scheme and port.
+                              Example: ["https://etcd.etcd-cluster.svc:2379"]
+                              The scheme of the first endpoint determines the protocol used.
+                              All endpoints must use the same scheme.
+                            items:
+                              pattern: ^https?://[^/]
+                              type: string
+                            maxItems: 7
+                            minItems: 1
+                            type: array
+                            x-kubernetes-validations:
+                            - message: all endpoints must use the same scheme (http
+                                or https)
+                              rule: self.all(e, url(e).getScheme() == 'http') || self.all(e,
+                                url(e).getScheme() == 'https')
+                          tlsSecret:
+                            description: |-
+                              TLSSecret is the name of a Secret in the same namespace with keys
+                              ca.crt, tls.crt, and tls.key for mutual TLS with etcd.
+                            type: string
+                        required:
+                        - endpoints
+                        type: object
+                      type:
+                        allOf:
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        default: kubernetes
+                        description: PatroniDCSType identifies which DCS backend Patroni
+                          should use.
+                        type: string
+                    type: object
+                    x-kubernetes-validations:
+                    - message: etcd.endpoints must be non-empty when type is etcd
+                      rule: self.type != 'etcd' || (has(self.etcd) && size(self.etcd.endpoints)
+                        > 0)
+                    - message: DCS type is immutable after cluster creation
+                      rule: '!has(oldSelf.type) || oldSelf.type == self.type'
                   dynamicConfiguration:
                     description: |-
                       Patroni dynamic configuration settings. Changes to this value will be

config/crd/bases/upstream.pgv2.percona.com_postgresclusters.yaml

@@ -22382,6 +22382,66 @@ spec:
                       - pgbackrest
                       type: string
                     type: array
+                  dcs:
+                    description: |-
+                      DCS configures the distributed configuration store backend.
+                      Defaults to the Kubernetes-native backend (Endpoints).
+                      N.B. Changing the DCS type causes downtime; all instances must restart simultaneously.
+                    properties:
+                      etcd:
+                        description: |-
+                          Etcd holds settings for the external etcd DCS backend.
+                          Required when type is "etcd".
+                        properties:
+                          authSecret:
+                            description: |-
+                              AuthSecret is the name of a Secret in the same namespace with keys
+                              username and password for etcd authentication.
+                            type: string
+                          endpoints:
+                            description: |-
+                              Endpoints is the list of etcd endpoints including scheme and port.
+                              Example: ["https://etcd.etcd-cluster.svc:2379"]
+                              The scheme of the first endpoint determines the protocol used.
+                              All endpoints must use the same scheme.
+                            items:
+                              pattern: ^https?://[^/]
+                              type: string
+                            maxItems: 7
+                            minItems: 1
+                            type: array
+                            x-kubernetes-validations:
+                            - message: all endpoints must use the same scheme (http
+                                or https)
+                              rule: self.all(e, url(e).getScheme() == 'http') || self.all(e,
+                                url(e).getScheme() == 'https')
+                          tlsSecret:
+                            description: |-
+                              TLSSecret is the name of a Secret in the same namespace with keys
+                              ca.crt, tls.crt, and tls.key for mutual TLS with etcd.
+                            type: string
+                        required:
+                        - endpoints
+                        type: object
+                      type:
+                        allOf:
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        default: kubernetes
+                        description: PatroniDCSType identifies which DCS backend Patroni
+                          should use.
+                        type: string
+                    type: object
+                    x-kubernetes-validations:
+                    - message: etcd.endpoints must be non-empty when type is etcd
+                      rule: self.type != 'etcd' || (has(self.etcd) && size(self.etcd.endpoints)
+                        > 0)
+                    - message: DCS type is immutable after cluster creation
+                      rule: '!has(oldSelf.type) || oldSelf.type == self.type'
                   dynamicConfiguration:
                     description: |-
                       Patroni dynamic configuration settings. Changes to this value will be