diff --git a/docs/.custom_wordlist.txt b/docs/.custom_wordlist.txt index 2d5f845ae9..59978d4e27 100644 --- a/docs/.custom_wordlist.txt +++ b/docs/.custom_wordlist.txt @@ -29,6 +29,7 @@ CSR CSRs databag databags +DDL dev dvipng eks @@ -69,6 +70,7 @@ LDAP libs lifecycle MinIO +misconfiguration Multipass nameserver nameservers @@ -77,6 +79,7 @@ otf Parca Patroni Patroni* +pgAudit pgbackrest pgBackRest pgbouncer diff --git a/docs/conf.py b/docs/conf.py index 418d8fa262..159c515a11 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -208,7 +208,9 @@ linkcheck_ignore = [ "http://127.0.0.1:8000", "https://github.com/canonical/ACME/*", - "https://matrix.to/*" + "https://matrix.to/*", + "https://developer.hashicorp.com/*", + "https://www.terraform.io/*" ] # A regex list of URLs where anchors are ignored by 'make linkcheck' diff --git a/docs/explanation/legacy-charm.md b/docs/explanation/legacy-charm.md index a9b199d403..b66bcddc1a 100644 --- a/docs/explanation/legacy-charm.md +++ b/docs/explanation/legacy-charm.md @@ -2,8 +2,8 @@ There are [two types of charms](https://documentation.ubuntu.com/juju/3.6/reference/charm/#by-generation) stored under the same charm name `postgresql-k8s`: -1. [Reactive](https://documentation.ubuntu.com/juju/3.6/reference/charm/#reactive) charm in the channel `latest/stable` (called `legacy`) -2. [Ops-based](https://documentation.ubuntu.com/juju/3.6/reference/charm/#ops) charm in the channel `14/stable` (called `modern`) +1. [Reactive](https://documentation.ubuntu.com/juju/3.6/reference/charm/#reactive-charm) charm in the channel `latest/stable` (called `legacy`) +2. [Ops-based](https://documentation.ubuntu.com/juju/3.6/reference/charm/#ops-charm) charm in the channel `14/stable` (called `modern`) The legacy charm provided endpoints `db` and `db-admin` (for the interface `pgsql`). The modern charm provides old endpoints as well + new endpoint `database` (for the interface `postgresql_client`). Read more details about the available [endpoints/interfaces](/explanation/interfaces-and-endpoints). diff --git a/docs/explanation/security/index.md b/docs/explanation/security/index.md index 98b8829c82..630f756d5c 100644 --- a/docs/explanation/security/index.md +++ b/docs/explanation/security/index.md @@ -23,7 +23,7 @@ Charmed PostgreSQL K8s can be deployed on top of several Kubernetes distribution ### Juju -Juju is the component responsible for orchestrating the entire lifecycle, from deployment to Day 2 operations. For more information on Juju security hardening, see the [Juju security page](https://documentation.ubuntu.com/juju/latest/explanation/juju-security/index.html) and the [How to harden your deployment](https://documentation.ubuntu.com/juju/3.6/howto/manage-your-deployment/#harden-your-deployment) guide. +Juju is the component responsible for orchestrating the entire lifecycle, from deployment to Day 2 operations. For more information on Juju security hardening, see the [Juju security page](https://documentation.ubuntu.com/juju/latest/explanation/juju-security/index.html) and the [How to harden your deployment](https://documentation.ubuntu.com/juju/3.6/howto/manage-your-juju-deployment/harden-your-juju-deployment/#harden-your-deployment) guide. #### Cloud credentials @@ -91,6 +91,21 @@ Charmed PostgreSQL K8s provides native integration with the [Canonical Observabi PostgreSQL logs are stored in `/var/log/postgresql` within the postgresql container of each unit. It’s recommended to integrate the charm with [COS](https://canonical.com/data/docs/postgresql/k8s/h-enable-monitoring), from where the logs can be easily persisted and queried using [Loki](https://charmhub.io/loki-k8s)/[Grafana](https://charmhub.io/grafana). +### Security event logging + +Charmed PostgreSQL K8s provides [PostgreSQL Audit Extension (or pgAudit)](https://www.pgaudit.org/) enabled by default. These logs are stored in the `/var/log/postgresql/` directory of each unit along with the regular workload logs, and rotated minutely. If COS is enabled, audit logs are also persisted there. + +The following information is configured to be logged: + +* Statements related to roles and privileges, such as GRANT, REVOKE, CREATE, ALTER, and DROP ROLE. +* Data Definition Language (DDL) statements. +* Miscellaneous commands like DISCARD, FETCH, CHECKPOINT, VACUUM, SET. +* Miscellaneous SET commands. + +Other events, like connections and disconnections, are logged depending on the value of the charm configuration options related to them. For more information, check the configuration options with the `logging` prefix in the [configuration reference](https://charmhub.io/postgresql-k8s/configurations#logging_log_connections). + +No secrets are logged. + ## Additional Resources For details on the cryptography used by Charmed PostgreSQL K8s, see the [Cryptography](/explanation/security/cryptography) explanation page. diff --git a/docs/reference/alert-rules.md b/docs/reference/alert-rules.md index faf048131d..fb3804a252 100644 --- a/docs/reference/alert-rules.md +++ b/docs/reference/alert-rules.md @@ -50,12 +50,12 @@ This page contains a markdown version of the alert rules described in the `postg ## `PgbackrestExporterK8s` -| Alert | Severity | Notes | -| ----- | -------- | ----- | -| `PgBackRestBackupError` | ![critical] | Backup failed for a stanza.
The last pgBackRest backup ended with error status > 0.
Check the pgBackRest logs for the stanza. | -| `PgBackRestBackupTooOld` | ![warning] | No recent backup available.
The last pgBackRest backup is older than 7 days.
Consider checking your backup schedule, capacity, and logs. | -| `PgBackRestStanzaError` | ![warning] | A stanza has reported errors.
Status > 0 indicates problems such as missing stanza path or no valid backups.
Check pgBackRest logs for details. | -| `PgBackRestRepoError` | ![warning] | A repository has reported errors.
Status > 0 indicates the repo may be inaccessible, out of space, or otherwise unhealthy.
Check pgBackRest logs and storage system. | +| Alert | Severity | Notes | +| ----- | -------- |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `PgBackRestBackupError` | ![critical] | Backup failed for a stanza.
The last pgBackRest backup ended with error status > 0.
Check the pgBackRest logs for the stanza. | +| `PgBackRestBackupTooOld` | ![warning] | No recent backup available.
The last pgBackRest backup is older than 7 days.
Consider checking your backup schedule, capacity, and logs. | +| `PgBackRestStanzaError` | ![warning] | A stanza has reported errors.
Status > 0 indicates problems such as missing stanza path or no valid backups.
Check pgBackRest logs for details. | +| `PgBackRestRepoError` | ![warning] | A repository has reported errors.
Status > 0 indicates the repository may be inaccessible, out of space, or otherwise unhealthy.
Check pgBackRest logs and storage system. | | `PgBackRestExporterError` | ![critical] | The pgBackRest exporter failed to fetch data.
Metric `pgbackrest_exporter_status == 0` indicates exporter-side issues.
This may be a misconfiguration or runtime error; check exporter logs. |