Skip to content

PMM-15151: make PG and ClickHouse operators watch all namespaces#868

Open
theTibi wants to merge 5 commits into
percona:mainfrom
theTibi:PMM-15151
Open

PMM-15151: make PG and ClickHouse operators watch all namespaces#868
theTibi wants to merge 5 commits into
percona:mainfrom
theTibi:PMM-15151

Conversation

@theTibi

@theTibi theTibi commented Jun 12, 2026

Copy link
Copy Markdown
Contributor

The pmm-ha-dependencies chart installed the PostgreSQL (Percona PGO) and ClickHouse (Altinity) operators scoped to their own namespace, so they did not reconcile PerconaPGCluster / ClickHouseInstallation CRs created in other namespaces. Installing pmm-ha into a second namespace (e.g. a DR restore target) left PostgreSQL and ClickHouse with no pods, while only VictoriaMetrics came up — its operator is already cluster-scoped.

  • pg-operator: set watchAllNamespaces=true. This renders WATCH_NAMESPACE="" (all namespaces) and switches the operator RBAC from a namespaced Role/RoleBinding to ClusterRole/ClusterRoleBinding.
  • altinity-clickhouse-operator: RBAC is already cluster-wide, but the operator only watched its own namespace; set WATCH_NAMESPACES=.* so it watches every namespace. (An empty watch list, documented as "all", did not take effect in 0.25.4.)

The pmm-ha-dependencies chart installed the PostgreSQL (Percona PGO) and
ClickHouse (Altinity) operators scoped to their own namespace, so they did
not reconcile PerconaPGCluster / ClickHouseInstallation CRs created in other
namespaces. Installing pmm-ha into a second namespace (e.g. a DR restore
target) left PostgreSQL and ClickHouse with no pods, while only
VictoriaMetrics came up — its operator is already cluster-scoped.

- pg-operator: set watchAllNamespaces=true. This renders WATCH_NAMESPACE=""
  (all namespaces) and switches the operator RBAC from a namespaced
  Role/RoleBinding to ClusterRole/ClusterRoleBinding.
- altinity-clickhouse-operator: RBAC is already cluster-wide, but the
  operator only watched its own namespace; set WATCH_NAMESPACES=.* so it
  watches every namespace. (An empty watch list, documented as "all", did
  not take effect in 0.25.4.)

Lets a DR/secondary namespace be added without manual operator edits.
Validated by upgrading pmm-operators with these values: the PG and
ClickHouse operators then reconciled CRs in a second namespace, with no
disruption to the existing namespace.

Signed-off-by: theTibi <tkorocz@gmail.com>
Copilot AI review requested due to automatic review settings June 12, 2026 15:05
@theTibi
theTibi requested a review from ademidoff June 12, 2026 15:05

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the pmm-ha-dependencies Helm chart defaults so the PostgreSQL (Percona PGO) and ClickHouse (Altinity) operators reconcile custom resources across all namespaces, enabling multi-namespace PMM HA deployments (e.g., DR restore targets) to function correctly.

Changes:

  • Configure altinity-clickhouse-operator to watch all namespaces by setting WATCH_NAMESPACES=.*.
  • Configure pg-operator for cluster-wide operation by setting watchAllNamespaces: true (which also switches RBAC to cluster-scoped in the subchart).
  • Add inline documentation in values to explain the rationale and behavioral details.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…elease name

The pmm.haPeers helper built the HA memberlist peer FQDNs from .Release.Name
(<release>-<ordinal>.monitoring-service...), but the PMM pods are named after the
StatefulSet (pmm.fullname): <release>-pmm-ha-<ordinal>. These only coincide when the
release is named "pmm-ha". With any other release name (e.g. a DR install named
"pmm-dr"), every peer name resolved to a non-existent host, the memberlist could not
form, and pmm-managed panicked on startup ("cannot start high availability service:
failed to join memberlist cluster ... no such host") — so PMM-HA never came up.

Build the peers from include "pmm.fullname" so they match the actual pod hostnames for
any release name. No change for a release named "pmm-ha" (fullname == release name).

Part of multi-namespace support: lets pmm-ha be installed under any release name (e.g. a
secondary/DR namespace) with a working HA cluster.

Signed-off-by: theTibi <tkorocz@gmail.com>
@theTibi
theTibi requested a review from a team as a code owner June 18, 2026 11:10
@theTibi
theTibi requested review from 4nte and JiriCtvrtka and removed request for a team June 18, 2026 11:10
…, not the release name

The HAProxy init script (haproxy-init-configmap.yaml) probes each PMM instance at
<release>-<ordinal>.monitoring-service..., but the PMM pods are named after the StatefulSet
(pmm.fullname): <release>-pmm-ha-<ordinal>. As with pmm.haPeers, these only coincide when the
release is named "pmm-ha". With any other release name the probe targets non-existent hosts
(HTTPS status 000), wait-for-pmm-ready never passes, and HAProxy never starts — even though PMM
itself is healthy.

Build pmm_host from include "pmm.fullname" so it matches the actual pod hostnames for any
release name. Companion to the pmm.haPeers fix; completes multi-namespace support for PMM-HA.

Signed-off-by: theTibi <tkorocz@gmail.com>
Copilot AI review requested due to automatic review settings June 18, 2026 11:47

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Comment thread charts/pmm-ha/templates/_helpers.tpl
Copilot AI review requested due to automatic review settings July 3, 2026 16:10

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

Comment on lines +98 to +101
{{- /* Peers must use the StatefulSet name (pmm.fullname), not Release.Name: the pods are
<fullname>-<ordinal> (e.g. pmm-dr-pmm-ha-0). <release>-<ordinal> only coincides with the
pod name when the release is named "pmm-ha"; any other release name yields peers that
don't resolve and the HA memberlist panics on startup. */}}
Comment on lines +19 to +29
# The operator's RBAC is already cluster-wide (rbac.namespaceScoped defaults to false),
# but it only watches its own namespace unless told otherwise — so ClickHouseInstallations
# in other namespaces (e.g. a DR restore target) are never reconciled. Make it watch all
# namespaces. NOTE: an empty watch list ("all namespaces" per the docs) did NOT take
# effect in 0.25.4 during testing (the operator stayed on its own namespace), so use a
# regexp that matches every namespace. Validate after deploy; alternatively set this to a
# comma-separated list/regexp of specific DR target namespaces. [PMM-15151]
operator:
env:
- name: WATCH_NAMESPACES
value: ".*"
Comment on lines +36 to +41
# Watch ALL namespaces so PostgreSQL clusters created in other namespaces — e.g. a
# cross-namespace DR restore target — are reconciled. This also switches the operator
# RBAC from a namespaced Role/RoleBinding to a ClusterRole/ClusterRoleBinding. Matches
# the VictoriaMetrics operator, which is already cluster-scoped. (Subchart default is
# false = the operator watches only its own namespace.) [PMM-15151]
watchAllNamespaces: true
Comment on lines 49 to 51
for i in $(seq 0 $(({{ .Values.replicas }} - 1))); do
pmm_host="{{ .Release.Name }}-$i.{{ .Values.service.name | default "monitoring-service" }}.{{ .Release.Namespace }}.svc.cluster.local"
pmm_host="{{ include "pmm.fullname" . }}-$i.{{ .Values.service.name | default "monitoring-service" }}.{{ .Release.Namespace }}.svc.cluster.local"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants