Skip to content

Commit bf00328

Browse files
github-actions[bot]github-actions[bot]
committed
Sync docs from Discourse
1 parent 9fb223b commit bf00328

File tree

4 files changed

+470
-0
lines changed

4 files changed

+470
-0
lines changed

‎docs/how-to/h-enable-ldap.md‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
[note]
2+
**Note**: All commands are written for `juju >= v.3.0`
3+
4+
If you are using an earlier version, check the [Juju 3.0 Release Notes](https://juju.is/docs/juju/roadmap#heading--juju-3-0-0---22-oct-2022).
5+
[/note]
6+
7+
[note]
8+
LDAP is available on channels: `14/edge` and `16/edge`, from revision `600`.
9+
[/note]
10+
11+
12+
# How to enable LDAP authentication
13+
14+
LDAP (*Lightweight Directory Access Protocol*) enables centralized authentication for PostgreSQL clusters, reducing the overhead of managing local credentials and access policies.
15+
16+
This guide goes over the steps to integrate LDAP as an authentication method with the PostgreSQL charm, all within the Juju ecosystem.
17+
18+
## Deploy an LDAP server in a K8s environment
19+
20+
[note type="caution"]
21+
**Disclaimer:** In this guide, we use [self-signed certificates](https://en.wikipedia.org/wiki/Self-signed_certificate) provided by the [`self-signed-certificates` operator](https://github.com/canonical/self-signed-certificates-operator).
22+
23+
**This is not recommended for a production environment.**
24+
25+
For production environments, check the collection of [Charmhub operators](https://charmhub.io/?q=tls-certificates) that implement the `tls-certificate` interface, and choose the most suitable for your use-case.
26+
[/note]
27+
28+
Switch to the Kubernetes controller:
29+
30+
```shell
31+
juju switch <k8s_controller>
32+
```
33+
34+
Deploy the [GLAuth charm](https://charmhub.io/glauth-k8s):
35+
```shell
36+
juju add-model glauth
37+
juju deploy self-signed-certificates
38+
juju deploy postgresql-k8s --channel 14/stable --trust
39+
juju deploy glauth-k8s --channel edge --trust
40+
```
41+
42+
Integrate (formerly known as "relate") the three applications:
43+
```shell
44+
juju integrate glauth-k8s self-signed-certificates
45+
juju integrate glauth-k8s postgresql-k8s
46+
```
47+
48+
Deploy the [GLAuth-utils charm](https://charmhub.io/glauth-utils), in order to manage LDAP users:
49+
50+
```shell
51+
juju deploy glauth-utils --channel edge --trust
52+
```
53+
54+
Integrate (formerly known as "relate") the two applications:
55+
56+
```shell
57+
juju integrate glauth-k8s glauth-utils
58+
```
59+
60+
## Expose cross-controller URLs
61+
62+
Enable the required micro-k8s plugin:
63+
64+
```shell
65+
IPADDR=$(ip -4 -j route get 2.2.2.2 | jq -r '.[] | .prefsrc')
66+
sudo microk8s enable metallb $IPADDR-$IPADDR
67+
```
68+
69+
Deploy the [Traefik charm](https://charmhub.io/traefik-k8s), in order to expose endpoints from the K8s cluster:
70+
71+
```shell
72+
juju deploy traefik-k8s --trust
73+
```
74+
75+
Integrate (formerly known as "relate") the two applications:
76+
77+
```shell
78+
juju integrate traefik-k8s glauth-k8s:ingress
79+
```
80+
81+
## Expose cross-model relations
82+
83+
To offer the GLAuth interfaces, run:
84+
85+
```shell
86+
juju offer glauth-k8s:ldap ldap
87+
juju offer glauth-k8s:send-ca-cert send-ca-cert
88+
```
89+
90+
## Enable LDAP
91+
92+
Switch to the VM controller:
93+
94+
```shell
95+
juju switch <lxd_controller>:postgresql
96+
```
97+
98+
To have LDAP offers consumed:
99+
100+
```shell
101+
juju consume <k8s_controller>:admin/glauth.ldap
102+
juju consume <k8s_controller>:admin/glauth.send-ca-cert
103+
```
104+
105+
To have LDAP authentication enabled, integrate the PostgreSQL charm with the GLAuth charm:
106+
107+
```shell
108+
juju integrate postgresql:ldap ldap
109+
juju integrate postgresql:receive-ca-cert send-ca-cert
110+
```
111+
112+
## Map LDAP users to PostgreSQL
113+
114+
To have LDAP users available in PostgreSQL, provide a comma separated list of LDAP groups to already created PostgreSQL authorization groups. To create those groups before hand, refer to the Data Integrator charm [page](https://charmhub.io/data-integrator).
115+
116+
```shell
117+
juju config postgresql ldap_map="<ldap_group>=<psql_group>"
118+
```
119+
120+
## Disable LDAP
121+
122+
You can disable LDAP removing the following relations:
123+
124+
```shell
125+
juju remove-relation postgresql.receive-ca-cert send-ca-cert
126+
juju remove-relation postgresql.ldap ldap
127+
```

‎docs/overview.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ PostgreSQL is a trademark or registered trademark of PostgreSQL Global Developme
6565
| 2 | h-external-access | [External network access](/t/15802) |
6666
| 2 | h-scale | [Scale replicas](/t/9689) |
6767
| 2 | h-enable-tls | [Enable TLS](/t/9685) |
68+
| 2 | h-enable-ldap | [Enable LDAP](/t/17361) |
6869
| 2 | h-enable-plugins-extensions | [Enable plugins/extensions](/t/10906) |
6970
| 2 | h-backup | [Back up and restore]() |
7071
| 3 | h-configure-s3-aws | [Configure S3 AWS](/t/9681) |
@@ -91,11 +92,13 @@ PostgreSQL is a trademark or registered trademark of PostgreSQL Global Developme
9192
| 3 | h-migrate-backup-restore | [Migrate data via backup/restore](/t/12164) |
9293
| 1 | reference | [Reference](/t/13976) |
9394
| 2 | r-releases | [Releases](/t/11875) |
95+
| 2 | r-channels | [Channels](/t/17405) |
9496
| 2 | r-system-requirements | [System requirements](/t/11743) |
9597
| 2 | r-software-testing | [Software testing](/t/11773) |
9698
| 2 | r-performance | [Performance and resources](/t/11974) |
9799
| 2 | r-troubleshooting | [Troubleshooting](/t/11864) |
98100
| 3 | r-sos-report | [SOS report](/t/17228) |
101+
| 3 | r-cli-helpers | [CLI helpers](/t/17406) |
99102
| 2 | r-plugins-extensions | [Plugins/extensions](/t/10946) |
100103
| 2 | r-alert-rules | [Alert rules](/t/15841) |
101104
| 2 | r-statuses | [Statuses](/t/10844) |

‎docs/reference/r-channels.md‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# PostgreSQL major versions
2+
3+
Charmed PostgreSQL is shipped in following [tracks](https://documentation.ubuntu.com/juju/3.6/reference/charm/#track):
4+
5+
* [PostgreSQL 16](https://charmhub.io/postgresql?channel=16/beta) (channel `16/candidate`)
6+
* [PostgreSQL 14](https://charmhub.io/postgresql?channel=14/stable) (channel `14/stable`)
7+
* [Legacy PostgreSQL charm](https://charmhub.io/postgresql?channel=latest/stable) (channel `latest/stable`) -> **deprecated**
8+
9+
This includes two major PostgreSQL versions, `14` and `16`, matching [Ubuntu versioning](https://packages.ubuntu.com/postgresql) for PostgreSQL.
10+
11+
## PostgreSQL 16
12+
13+
PostgreSQL 16 is shipped in track `16` and is available for testing in the channel `16/candidate`.
14+
15+
**Base:** Noble (Ubuntu 24.04)
16+
17+
**Supported architectures:** `arm64` and `amd64`.
18+
19+
### Supported features
20+
21+
* [LDAP integration](/t/17361) (also supported by PostgreSQL `14`)
22+
* [SoS report integration](/t/17228) (also supported by PostgreSQL `14`)
23+
* Recovery improvements (also supported by PostgreSQL `14`)
24+
* All members are sync nodes now
25+
* Switchover the Primary unit via `promote-to-primary scope=unit`
26+
* Raft re-init helper: `promote-to-primary scope=unit force=yes`
27+
* Juju user secrets for system password rotation
28+
* Timescale Community Edition
29+
* Extended [COS integration](/t/10600)
30+
* [Profiling via Parca](/t/17172)
31+
* [Tracing via Tempo](/t/14521)
32+
* Improved [security hardening](/t/16852)
33+
* (WIP) Multiple Juju storages support
34+
* (WIP) Juju Spaces
35+
* (WIP) Refresh v3 lib support <!--VM only-->
36+
* (WIP) Improved built-in roles
37+
38+
<!--
39+
Saving the following items for release notes:
40+
* PgBouncer and Data Integrator@24.04
41+
* [Released slim PostgreSQL SNAP](https://snapcraft.io/postgresql)
42+
-->
43+
44+
See the detailed features list on [the release notes](/t/11875) page.
45+
46+
### Deprecated
47+
* Legacy interface `psql` (endpoints `db` and `db-admin`).
48+
* See more about supported interfaces in [Interfaces and endpoints](/t/10251).
49+
* Support for Juju < `v3.6`
50+
* Charmed PostgreSQL 16 requires Juju `3.6+ LTS` due to [Juju secrets](https://documentation.ubuntu.com/juju/3.6/reference/secret/index.html) support.
51+
* Juju actions `get-password` and `set-password`.
52+
* For security reasons, these actions are replaced by [Juju secrets](https://documentation.ubuntu.com/juju/3.6/reference/secret/index.html).
53+
* [Timescape Apache 2 edition](https://docs.timescale.com/about/latest/timescaledb-editions/) has been replaced by [Timescape Community edition](https://docs.timescale.com/about/latest/timescaledb-editions/)
54+
55+
56+
## PostgreSQL 14
57+
58+
PostgreSQL 14 is shipped in track `14` and available for production in the channel `14/stable`.
59+
60+
**Base:** Jammy (Ubuntu 22.04)
61+
62+
**Supported architectures:** `arm64` and `amd64`.
63+
64+
### Supported features
65+
66+
* [Deployment](/t/16811) on multiple cloud services
67+
* [Backup and restore](/t/9683)
68+
* Including point-in-time recovery (PITR)
69+
* [COS integration](/t/10600)
70+
* [TLS integration](/t/9685)
71+
* [LDAP integration](/t/17361)
72+
* [`arm64` architecture](/t/11743)
73+
74+
See the detailed features list on [the release notes](/t/11875) page.
75+
76+
### Deprecated
77+
78+
* Features that are new to Charmed PostgreSQL `16` are not backwards compatible with `14`
79+
* Charmed PostgreSQL 14 ships [Timescape Apache 2 edition](https://docs.timescale.com/about/latest/timescaledb-editions/) only.
80+
81+
## Legacy PostgreSQL charm
82+
83+
The legacy charm in the track `latest` has been deprecated and is **not supported.** It is still available here for the historical and comparative reasons only.
84+
85+
Please use the supported tracks of the modern charm: `14/` and `16/`.
86+
87+
Learn more in the [legacy charm explanation page](/t/10690).

0 commit comments

Comments
 (0)