Merge branch 'main' into PMM-14109-improve-advisor-ux

Author: ademidoff

build/ansible/roles/postgres/files/postgres-migration

@@ -3,6 +3,7 @@ set -o errexit
 set -o pipefail
 
 declare POSTGRES_DATA_DIR="${POSTGRES_DATA_DIR:?must be exported by the entrypoint}"
+declare POSTGRES_OLD_DATA_DIR="${POSTGRES_OLD_DATA_DIR:?must be exported by the entrypoint}"
 declare POSTGRES_PASSWORD_FILE="${POSTGRES_PASSWORD_FILE:?must be exported by the entrypoint}"
 declare POSTGRES_BIN_DIR="${POSTGRES_BIN_DIR:?must be exported by the entrypoint}"
 
@@ -49,7 +50,7 @@ create_pg_stat_statements() {
 # Runs once when /srv/postgres14 exists and /srv/postgres18 does not.
 # Requires both pg14 and pg18 binaries in the image (shipped through PMM 3.12.x).
 upgrade_pg14_to_pg18() {
-    local PG14_DATA="/srv/postgres14"
+    local PG14_DATA="$POSTGRES_OLD_DATA_DIR"
     local PG14_BIN="/usr/pgsql-14/bin"
     local BACKUP_DIR="/srv/backup"
     local STAGE_DIR="${POSTGRES_DATA_DIR}.new"

build/docker/server/entrypoint.sh

@@ -7,6 +7,7 @@ declare CURRENT_GID CURRENT_UID CURRENT_USER
 # Returns 0 (true) if the given variable is set to "1" or "true".
 is_enabled() { [ "$1" = "1" ] || [ "$1" = "true" ]; }
 declare POSTGRES_DATA_DIR="/srv/postgres18"
+declare POSTGRES_OLD_DATA_DIR="/srv/postgres14"
 declare POSTGRES_PASSWORD_FILE="/srv/.postgres_password"
 declare POSTGRES_BIN_DIR="/usr/pgsql-18/bin"
 
@@ -119,11 +120,21 @@ elif is_enabled "$PMM_DISABLE_BUILTIN_POSTGRES"; then
     echo "Skipping embedded PostgreSQL setup (builtin PostgreSQL is disabled)."
 else
     mkdir -p /run/postgresql
-    chmod 750 "$POSTGRES_DATA_DIR" || true
+    # Kubernetes applies fsGroup by recursively adding group permissions to the volume, which
+    # turns an initdb-created 0700 data directory into 2770 — a mode PostgreSQL refuses. Repair
+    # the current cluster and a PostgreSQL 14 directory awaiting migration, which
+    # postgres-migration has to start in order to dump it. chmod keeps the setgid bit on a
+    # directory, so the result is 2750, which PostgreSQL accepts.
+    for dir in "$POSTGRES_DATA_DIR" "$POSTGRES_OLD_DATA_DIR"; do
+        if [ -d "$dir" ]; then
+            chmod 750 "$dir" || true
+        fi
+    done
+    unset dir
     # Scoped to this subshell so the helper scripts inherit them without polluting
     # the environment that supervisord and its children are started with.
     (
-        export POSTGRES_DATA_DIR POSTGRES_PASSWORD_FILE POSTGRES_BIN_DIR
+        export POSTGRES_DATA_DIR POSTGRES_OLD_DATA_DIR POSTGRES_PASSWORD_FILE POSTGRES_BIN_DIR
         bash /opt/ansible/roles/postgres/files/postgres-migration
         bash /opt/ansible/roles/postgres/files/postgres-sep
     )

build/docs/MIGRATION.md

@@ -2,6 +2,4 @@
 
 This directory is home to a number of PMM build-related scripts, configs and specs.
 
-### How to create a [Release Candidate](./RELEASE_CANDIDATE.md)
-
-### Migration from [PMM v2 to v3](./MIGRATION.md)
+### How to create a [Release Candidate](./RELEASE_CANDIDATE.md)

build/docs/README.md

@@ -51,7 +51,7 @@ docker run -d -p 443:8443 --volumes-from pmm-data \
 !!! warning "Certificate requirements"
     Before mounting certificates, make sure to configure them correctly:
 
-    - All certificates must be owned by root: `chown 0:0 /etc/pmm-certs/*`
+    - All certificates must be owned by 1000:0: `chown 1000:0 /etc/pmm-certs/*`
     - Set proper permissions: `chmod 644 /etc/pmm-certs/*.crt /etc/pmm-certs/*.pem && chmod 600 /etc/pmm-certs/*.key`
     - The certificate directory must contain all four required files
     - Use port `443` for SSL encryption instead of port `80`
@@ -67,9 +67,9 @@ docker cp ca-certs.pem pmm-server:/srv/nginx/ca-certs.pem
 docker cp dhparam.pem pmm-server:/srv/nginx/dhparam.pem
 
 # Set proper ownership and permissions
-docker exec -it pmm-server chown pmm:root /srv/nginx/*
-docker exec -it pmm-server chmod 644 /srv/nginx/*.crt /srv/nginx/*.pem
-docker exec -it pmm-server chmod 600 /srv/nginx/*.key
+docker exec --user root pmm-server sh -c 'chown 1000:0 /srv/nginx/*'
+docker exec --user root pmm-server sh -c 'chmod 644 /srv/nginx/*.crt /srv/nginx/*.pem'
+docker exec --user root pmm-server sh -c 'chmod 600 /srv/nginx/*.key'
 ```
 
 ### Apply certificate changes
@@ -226,4 +226,4 @@ curl -v https://<server-hostname>/ping
 
 # Test pmm-admin connection
 pmm-admin status
-```
+```

documentation/docs/admin/security/ssl_encryption.md

@@ -200,10 +200,17 @@ docker cp certificate.crt pmm-server:/srv/nginx/certificate.crt
 docker cp certificate.key pmm-server:/srv/nginx/certificate.key
 docker cp ca-certs.pem pmm-server:/srv/nginx/ca-certs.pem
 
+# Set proper ownership and permissions
+docker exec --user root pmm-server sh -c 'chown 1000:0 /srv/nginx/*'
+docker exec --user root pmm-server sh -c 'chmod 644 /srv/nginx/*.crt /srv/nginx/*.pem'
+docker exec --user root pmm-server sh -c 'chmod 600 /srv/nginx/*.key'
+
 # Restart nginx
 docker exec pmm-server supervisorctl restart nginx
 ```
 
+For the full list of required certificate files and configuration details, see [SSL encryption](../admin/security/ssl_encryption.md).
+
 ## Operations
 
 ### Connect monitoring clients

documentation/docs/install-pmm/HA-docker.md

@@ -35,10 +35,10 @@ Replace the self-signed certificate with a proper SSL certificate for production
     systemctl --user stop pmm-server
 
     # Configure PMM to use the certificate
-    sudo cp /etc/letsencrypt/live/pmm.yourdomain.com/fullchain.pem /home/admin/volume/pmm-certs/certificate.crt
-    sudo cp /etc/letsencrypt/live/pmm.yourdomain.com/privkey.pem /home/admin/volume/pmm-certs/certificate.key
-    sudo chown pmm:pmm /home/admin/volume/pmm-certs/certificate.*
-    sudo chmod 600 /home/admin/volume/pmm-certs/certificate.*
+    sudo cp /etc/letsencrypt/live/pmm.yourdomain.com/fullchain.pem /home/admin/volume/srv/nginx/certificate.crt
+    sudo cp /etc/letsencrypt/live/pmm.yourdomain.com/privkey.pem /home/admin/volume/srv/nginx/certificate.key
+    sudo chown admin:admin /home/admin/volume/srv/nginx/certificate.*
+    sudo chmod 600 /home/admin/volume/srv/nginx/certificate.*
 
     # Restart PMM Server
     systemctl --user start pmm-server
@@ -56,10 +56,10 @@ Replace the self-signed certificate with a proper SSL certificate for production
 
     2. Install certificates:
        ```bash
-       sudo mv /tmp/certificate.crt /home/admin/volume/pmm-certs/
-       sudo mv /tmp/private.key /home/admin/volume/pmm-certs/certificate.key
-       sudo chown pmm:pmm /home/admin/volume/pmm-certs/certificate.*
-       sudo chmod 600 /home/admin/volume/pmm-certs/certificate.*
+       sudo mv /tmp/certificate.crt /home/admin/volume/srv/nginx/
+       sudo mv /tmp/private.key /home/admin/volume/srv/nginx/certificate.key
+       sudo chown admin:admin /home/admin/volume/srv/nginx/certificate.*
+       sudo chmod 600 /home/admin/volume/srv/nginx/certificate.*
        systemctl --user restart pmm-server
        ```
 

documentation/docs/install-pmm/install-pmm-server/deployment-options/aws/configure_aws.md

@@ -79,7 +79,7 @@ Choose the restoration method that matches how your backup was created:
 
     4. Fix ownership of restored files:
         ```sh
-        docker run --rm -v pmm-data:/srv -t percona/pmm-server:3 chown -R pmm:pmm /srv
+        docker run --rm --user root -v pmm-data:/srv -t percona/pmm-server:3 chown -R 1000:0 /srv
         ```
 
     5. Start the restored PMM Server:
@@ -162,7 +162,7 @@ Choose the restoration method that matches how your backup was created:
 
     6. Fix ownership of the restored files:
         ```sh
-        docker run --rm -v pmm-data:/srv -t percona/pmm-server:3 chown -R pmm:pmm /srv
+        docker run --rm --user root -v pmm-data:/srv -t percona/pmm-server:3 chown -R 1000:0 /srv
         ```
 
     7. Start the restored PMM Server container: