Skip to content

Commit 3991eed

Browse files
teoincontattoteoincontatto
committed
feat: disable Envoy and enable SSL by default
1 parent 53182db commit 3991eed

47 files changed

Lines changed: 440 additions & 238 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.gitlab-ci/e2e-test.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -107,8 +107,8 @@
107107
( ( $CI_PIPELINE_SOURCE =~ /^(push|schedule|trigger)$/ || $CI_COMMIT_TAG
108108
|| ( $CI_PIPELINE_SOURCE == 'merge_request_event' && $CI_MERGE_REQUEST_TARGET_BRANCH_SHA == null ) )
109109
&& (
110-
( $DO_FULL_ARM && $SKIP_E2E != "true" && $SKIP_ARM != "true" && $CI_COMMIT_TAG )
111-
|| ( $DO_FULL_ARM && $DO_ARM ) )
110+
( $SKIP_E2E != "true" && $SKIP_ARM != "true" && $CI_COMMIT_TAG )
111+
|| ( $DO_ARM ) )
112112
artifacts:
113113
expire_in: 1 week
114114
when: always
@@ -139,8 +139,8 @@
139139
( ( $CI_PIPELINE_SOURCE =~ /^(push|schedule|trigger)$/ || $CI_COMMIT_TAG
140140
|| ( $CI_PIPELINE_SOURCE == 'merge_request_event' && $CI_MERGE_REQUEST_TARGET_BRANCH_SHA == null ) )
141141
&& (
142-
( $DO_FULL_ARM && $SKIP_E2E != "true" && $SKIP_NATIVE != "true" && $SKIP_ARM != "true" && $CI_COMMIT_TAG )
143-
|| ( $DO_FULL_ARM && $DO_NATIVE && $DO_ARM ) ) )
142+
( $SKIP_E2E != "true" && $SKIP_NATIVE != "true" && $SKIP_ARM != "true" && $CI_COMMIT_TAG )
143+
|| ( $DO_NATIVE && $DO_ARM ) ) )
144144
artifacts:
145145
expire_in: 1 week
146146
when: always

‎stackgres-k8s/e2e/spec/abstract/metrics‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ check_metrics() {
2121
fi
2222
done
2323

24-
if ! kubectl get sgcluster -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME" -o json | jq .spec.pods.disableEnvoy | grep -qxF true
24+
if ! kubectl get sgcluster -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME" --template '{{ .spec.pods.disableEnvoy }}' | grep -qxF true
2525
then
2626
if kubectl exec -i -n "$CLUSTER_NAMESPACE" curl \
2727
-- curl -s -f "http://$CLUSTER_POD_IP:8001/stats/prometheus" \

‎stackgres-k8s/e2e/spec/babelfish‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ e2e_test_install() {
2121
}
2222

2323
e2e_test() {
24-
run_test "Checking that all 6 ports (5432, 1433, 6432) in the patroni pods are opened and listening for queries" ports_check
24+
run_test "Checking that all 6 ports (5432, 1433, 6432, 7432, 7433, 7434) in the patroni pods are opened and listening for queries" ports_check
2525

2626
run_test "Checking that is possible to connect using services is working" service_check
2727

@@ -44,24 +44,34 @@ ports_check() {
4444
RESPONSE_5432="$(wait_until run_query -i 0 -p 5432)"
4545
RESPONSE_1433="$(wait_until run_query -t babelfish -i 0 -p 1433 | head -n 1)"
4646
RESPONSE_6432="$(run_query -i 0 -p 6432)"
47+
RESPONSE_7432="$(run_query -i 0 -p "$POSTGRES_PORT")"
48+
RESPONSE_7433="$(run_query -i 0 -p "$POSTGRES_REPLICATION_PORT")"
49+
RESPONSE_7434="$(run_query -t babelfish -i 0 -p "$BABELFISH_PORT")"
4750

4851
if [ "$RESPONSE_5432" = "1" ] && [ "$RESPONSE_1433" = "1" ] \
49-
&& [ "$RESPONSE_6432" = "1" ]
52+
&& [ "$RESPONSE_6432" = "1" ] \
53+
&& [ "$RESPONSE_7432" = "1" ] && [ "$RESPONSE_7433" = "1" ] && [ "$(printf %s "$RESPONSE_7434" | head -n 1)" = "1" ]
5054
then
5155
echo "Skipping replica check for babelfish"
5256
return
5357

5458
RESPONSE_5432="$(wait_until run_query -i 1 -p 5432)"
5559
RESPONSE_1433="$(wait_until run_query -t babelfish -i 1 -p 1433 | head -n 1)"
5660
RESPONSE_6432="$(run_query -i 1 -p 6432)"
57-
58-
if ! ( [ "$RESPONSE_5432" = "1" ] && [ "$RESPONSE_1433" = "1" ] \
59-
&& [ "$RESPONSE_6432" = "1" ] )
61+
RESPONSE_7432="$(run_query -i 1 -p "$POSTGRES_PORT")"
62+
RESPONSE_7433="$(run_query -i 1 -p "$POSTGRES_REPLICATION_PORT")"
63+
RESPONSE_7434="$(run_query -t babelfish -i 1 -p "$BABELFISH_PORT")"
64+
65+
if ! {
66+
[ "$RESPONSE_5432" = "1" ] && [ "$RESPONSE_1433" = "1" ] \
67+
&& [ "$RESPONSE_6432" = "1" ] \
68+
&& [ "$RESPONSE_7432" = "1" ] && [ "$RESPONSE_7433" = "1" ] && [ "$(printf %s "$RESPONSE_7434" | head -n 1)" ]
69+
}
6070
then
61-
fail "Not all 6 ports of the replica node are working"
71+
fail "Not all ports of the replica node are working"
6272
fi
6373
else
64-
fail "Not all 6 ports of the primary node are working"
74+
fail "Not all ports of the primary node are working"
6575
fi
6676
}
6777

‎stackgres-k8s/e2e/spec/connectivity‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ e2e_test_install() {
2121
e2e_test() {
2222
run_test "Checking that it is not possible to connect to postgres without a password" check_password_required
2323

24-
run_test "Checking that all 4 ports (5432, 6432) in the patroni pods are openned and listening for queries" ports_check
24+
run_test "Checking that all 4 ports (5432, 6432, 7432, 7433) in the patroni pods are openned and listening for queries" ports_check
2525

2626
run_test "Checking that is possible to connect using services is working" service_check
2727

@@ -91,18 +91,26 @@ check_password_is_required() {
9191
ports_check() {
9292
RESPONSE_5432="$(run_query -i 0 -p 5432)"
9393
RESPONSE_6432="$(run_query -i 0 -p 6432)"
94+
RESPONSE_7432="$(run_query -i 0 -p "$POSTGRES_PORT")"
95+
RESPONSE_7433="$(run_query -i 0 -p "$POSTGRES_REPLICATION_PORT")"
9496

95-
if [ "$RESPONSE_5432" = "1" ] && [ "$RESPONSE_6432" = "1" ]
97+
if [ "$RESPONSE_5432" = "1" ] && [ "$RESPONSE_6432" = "1" ] \
98+
&& [ "$RESPONSE_7432" = "1" ] && [ "$RESPONSE_7433" = "1" ]
9699
then
97100
RESPONSE_5432="$(run_query -i 1 -p 5432)"
98101
RESPONSE_6432="$(run_query -i 1 -p 6432)"
102+
RESPONSE_7432="$(run_query -i 1 -p "$POSTGRES_PORT")"
103+
RESPONSE_7433="$(run_query -i 1 -p "$POSTGRES_REPLICATION_PORT")"
99104

100-
if ! ( [ "$RESPONSE_5432" = "1" ] && [ "$RESPONSE_6432" = "1" ] )
105+
if ! {
106+
[ "$RESPONSE_5432" = "1" ] && [ "$RESPONSE_6432" = "1" ] \
107+
&& [ "$RESPONSE_7432" = "1" ] && [ "$RESPONSE_7433" = "1" ]
108+
}
101109
then
102-
fail "Not all 4 ports of the replica node are working"
110+
fail "Not all ports of the replica node are working"
103111
fi
104112
else
105-
fail "Not all 4 ports of the primary node are working"
113+
fail "Not all ports of the primary node are working"
106114
fi
107115
}
108116

‎stackgres-k8s/e2e/spec/dbops-security-upgrade‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ e2e_test_install() {
2727
VERSION_AS_NUMBER_1_13_0="$(get_version_as_number 1.13.0-SNAPSHOT)"
2828
VERSION_AS_NUMBER_1_15_0="$(get_version_as_number 1.15.0-SNAPSHOT)"
2929
VERSION_AS_NUMBER_1_16_0="$(get_version_as_number 1.16.0-SNAPSHOT)"
30+
VERSION_AS_NUMBER_1_17_0="$(get_version_as_number 1.17.0-SNAPSHOT)"
3031

3132
CLUSTER_CRD="sgclusters.stackgres.io"
3233

@@ -807,7 +808,9 @@ check_cluster_before_security_upgrade() {
807808
jq -Sc '.
808809
| if .synchronous_mode then . else del(.synchronous_node_count) end
809810
| .postgresql.parameters = (.postgresql.parameters
810-
| if .listen_addresses == "localhost" then .listen_addresses = "0.0.0.0" else . end
811+
| if .ssl == null then .ssl = "on" else . end
812+
| if .ssl_cert_file == null then .ssl_cert_file = "/etc/ssl/tls.crt" else . end
813+
| if .ssl_key_file == null then .ssl_key_file = "/etc/ssl/tls.key" else . end
811814
| if .port == null then .port = "5432" else . end
812815
| if .autovacuum_vacuum_cost_delay == "2" then .autovacuum_vacuum_cost_delay = "2ms" else . end
813816
| if .checkpoint_timeout == "30" then .checkpoint_timeout = "30s" else . end
@@ -829,15 +832,21 @@ check_cluster_before_security_upgrade() {
829832
if [ "$CLUSTER_NAME" = "$DISTRIBUTEDLOGS_NAME" ]
830833
then
831834
PREVIOUS_PATRONI_CONFIG="$(printf '%s' "$PREVIOUS_PATRONI_CONFIG" | jq -Sc '.
832-
| del(.postgresql.parameters.dynamic_library_path)
833835
| del(.postgresql.recovery_conf)
834836
')"
835837
fi
836838
if [ "$CLUSTER_NAME" = "$DISTRIBUTEDLOGS_NAME" ] \
837-
&& [ "$PREVIOUS_VERSION_AS_NUMBER" -lt "$VERSION_AS_NUMBER_1_15_0" ]
839+
&& [ "$PREVIOUS_VERSION_AS_NUMBER" -lt "$VERSION_AS_NUMBER_1_17_0" ]
838840
then
839841
PREVIOUS_PATRONI_CONFIG="$(printf '%s' "$PREVIOUS_PATRONI_CONFIG" | jq -Sc '.
840-
| del(.postgresql.parameters.listen_addresses)
842+
| del(.postgresql.parameters.ssl)
843+
| del(.postgresql.parameters.ssl_cert_file)
844+
| del(.postgresql.parameters.ssl_key_file)
845+
')"
846+
PATRONI_CONFIG="$(printf '%s' "$PATRONI_CONFIG" | jq -Sc '.
847+
| del(.postgresql.parameters.ssl)
848+
| del(.postgresql.parameters.ssl_cert_file)
849+
| del(.postgresql.parameters.ssl_key_file)
841850
')"
842851
fi
843852
@@ -861,6 +870,7 @@ check_cluster_before_security_upgrade() {
861870
PGBOUNCER_CONFIG="$(kubectl get configmap -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME-connection-pooling-config" --template '{{ index .data "pgbouncer.ini" }}')"
862871
PGBOUNCER_CONFIG="$(printf '%s' "$PGBOUNCER_CONFIG")"
863872
cat "$PREVIOUS_PGBOUNCER_CONFIG_PATH" \
873+
| sed '\#^auth_user = #a client_tls_cert_file = /etc/ssl/tls.crt\nclient_tls_key_file = /etc/ssl/tls.key\nclient_tls_sslmode = prefer' \
864874
| sed '/server_check_query = ;/d' \
865875
| sed 's/stats_users = /server_check_query = ;\nstats_users = /' > "$LOG_PATH/previous-pgbouncer-config-filtered.ini"
866876
PREVIOUS_PGBOUNCER_CONFIG="$(cat "$LOG_PATH/previous-pgbouncer-config-filtered.ini")"
@@ -901,19 +911,15 @@ check_sharded_cluster_security_upgrade() {
901911
local SHARDED_CLUSTER_NAME="$1"
902912
local DBOPS_NAME="$2"
903913
local METHOD="$3"
904-
local CLUSTERS="$4"
905914
local PRIMARY_INSTANCE
906915
local CLUSTER_NAME
907916
shift 3
908917
909918
assert_sharded_dbops_completion "$DBOPS_NAME" "$CLUSTER_NAMESPACE" "$((E2E_TIMEOUT * 2))"
910919
911920
for CLUSTER_NAME in "$SHARDED_CLUSTER_NAME-coord" \
912-
$(seq 0 "$((CLUSTERS - 1))" \
913-
| while read INDEX
914-
do
915-
printf %s "$SHARDED_CLUSTER_NAME-shard$INDEX"
916-
done)
921+
"$SHARDED_CLUSTER_NAME-shard0" \
922+
"$SHARDED_CLUSTER_NAME-shard1"
917923
do
918924
check_cluster_after_security_upgrade
919925
done

‎stackgres-k8s/e2e/spec/default-mutator‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -649,7 +649,7 @@ EOF
649649
INSTALLED_CONTAINERS="$(wait_until kubectl get sts -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME" -o=jsonpath='{.spec.template.spec.containers[*].name}')"
650650

651651
assert_string_contains "prometheus-postgres-exporter" "$INSTALLED_CONTAINERS"
652-
if ! kubectl get sgcluster -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME" -o json | jq .spec.pods.disableEnvoy | grep -qxF true
652+
if ! kubectl get sgcluster -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME" --template '{{ .spec.pods.disableEnvoy }}' | grep -qxF true
653653
then
654654
assert_string_contains "envoy" "$INSTALLED_CONTAINERS"
655655
fi
@@ -702,7 +702,7 @@ EOF
702702
INSTALLED_CONTAINERS="$(wait_until kubectl get sts -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME" -o=jsonpath='{.spec.template.spec.containers[*].name}')"
703703

704704
assert_string_contains "prometheus-postgres-exporter" "$INSTALLED_CONTAINERS"
705-
if ! kubectl get sgcluster -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME" -o json | jq .spec.pods.disableEnvoy | grep -qxF true
705+
if ! kubectl get sgcluster -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME" --template '{{ .spec.pods.disableEnvoy }}' | grep -qxF true
706706
then
707707
assert_string_contains "envoy" "$INSTALLED_CONTAINERS"
708708
fi
@@ -948,7 +948,7 @@ EOF
948948
INSTALLED_CONTAINERS="$(wait_until kubectl get sts -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME"-coord -o=jsonpath='{.spec.template.spec.containers[*].name}')"
949949

950950
assert_string_contains "prometheus-postgres-exporter" "$INSTALLED_CONTAINERS"
951-
if ! kubectl get sgcluster -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME" -o json | jq .spec.pods.disableEnvoy | grep -qxF true
951+
if ! kubectl get sgshardedcluster -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME" --template '{{ .spec.coordinator.pods.disableEnvoy }}' | grep -qxF true
952952
then
953953
assert_string_contains "envoy" "$INSTALLED_CONTAINERS"
954954
fi
@@ -958,7 +958,7 @@ EOF
958958
INSTALLED_CONTAINERS="$(wait_until kubectl get sts -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME"-shard0 -o=jsonpath='{.spec.template.spec.containers[*].name}')"
959959

960960
assert_string_contains "prometheus-postgres-exporter" "$INSTALLED_CONTAINERS"
961-
if ! kubectl get sgcluster -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME" -o json | jq .spec.pods.disableEnvoy | grep -qxF true
961+
if ! kubectl get sgshardedcluster -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME" --template '{{ .spec.shards.pods.disableEnvoy }}' | grep -qxF true
962962
then
963963
assert_string_contains "envoy" "$INSTALLED_CONTAINERS"
964964
fi
@@ -1023,7 +1023,7 @@ EOF
10231023
INSTALLED_CONTAINERS="$(wait_until kubectl get sts -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME"-coord -o=jsonpath='{.spec.template.spec.containers[*].name}')"
10241024

10251025
assert_string_contains "prometheus-postgres-exporter" "$INSTALLED_CONTAINERS"
1026-
if ! kubectl get sgcluster -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME" -o json | jq .spec.pods.disableEnvoy | grep -qxF true
1026+
if ! kubectl get sgshardedcluster -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME" --template '{{ .spec.coordinator.pods.disableEnvoy }}' | grep -qxF true
10271027
then
10281028
assert_string_contains "envoy" "$INSTALLED_CONTAINERS"
10291029
fi
@@ -1033,7 +1033,7 @@ EOF
10331033
INSTALLED_CONTAINERS="$(wait_until kubectl get sts -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME"-shard0 -o=jsonpath='{.spec.template.spec.containers[*].name}')"
10341034

10351035
assert_string_contains "prometheus-postgres-exporter" "$INSTALLED_CONTAINERS"
1036-
if ! kubectl get sgcluster -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME" -o json | jq .spec.pods.disableEnvoy | grep -qxF true
1036+
if ! kubectl get sgshardedcluster -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME" --template '{{ .spec.shards.pods.disableEnvoy }}' | grep -qxF true
10371037
then
10381038
assert_string_contains "envoy" "$INSTALLED_CONTAINERS"
10391039
fi

‎stackgres-k8s/e2e/spec/failover‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ spec:
2929
ingress:
3030
- ports:
3131
- protocol: TCP
32-
port: 7433
32+
port: $POSTGRES_REPLICATION_PORT
3333
EOF
3434

3535
run_query -i 0 -p 5432 -q "INSERT INTO test SELECT i, 'try to generate a new timeline ' || i FROM generate_series(1, 10000) i"

‎stackgres-k8s/e2e/spec/no-pgbouncer‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ e2e_test_install() {
1717
}
1818

1919
e2e_test() {
20-
run_test "Checking that all 3 ports (5432) in the patroni pods are openned and listeing for queries" ports_check
20+
run_test "Checking that all 3 ports (5432, 7432, 7433) in the patroni pods are openned and listeing for queries" ports_check
2121

2222
run_test "Checking that is possible to connect using services is working" service_check
2323

@@ -32,19 +32,25 @@ e2e_test() {
3232

3333
ports_check() {
3434
RESPONSE_5432="$(run_query -i 0 -p 5432)"
35+
RESPONSE_7432="$(run_query -i 0 -p "$POSTGRES_PORT")"
36+
RESPONSE_7433="$(run_query -i 0 -p "$POSTGRES_REPLICATION_PORT")"
3537

36-
if [ "$RESPONSE_5432" = "1" ]
38+
if [ "$RESPONSE_5432" = "1" ] \
39+
&& [ "$RESPONSE_7432" = "1" ] && [ "$RESPONSE_7433" = "1" ]
3740
then
3841
RESPONSE_5432="$(run_query -i 1 -p 5432)"
42+
RESPONSE_7432="$(run_query -i 0 -p "$POSTGRES_PORT")"
43+
RESPONSE_7433="$(run_query -i 0 -p "$POSTGRES_REPLICATION_PORT")"
3944

40-
if [ "$RESPONSE_5432" = "1" ]
45+
if ! {
46+
[ "$RESPONSE_5432" = "1" ] \
47+
&& [ "$RESPONSE_7432" = "1" ] && [ "$RESPONSE_7433" = "1" ]
48+
}
4149
then
42-
success "All ports are ok"
43-
else
44-
fail "Not all 3 ports of the replica node are working"
50+
fail "Not all ports of the replica node are working"
4551
fi
4652
else
47-
fail "Not all 3 ports of the primary node are working"
53+
fail "Not all ports of the primary node are working"
4854
fi
4955
}
5056

‎stackgres-k8s/e2e/spec/operator-cluster-api‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -234,7 +234,7 @@ test_cluster_component_versions_are_annotated() {
234234
return 1
235235
fi
236236

237-
if ! kubectl get sgcluster -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME" -o json | jq .spec.pods.disableEnvoy | grep -qxF true
237+
if ! kubectl get sgcluster -n "$CLUSTER_NAMESPACE" "$CLUSTER_NAME" --template '{{ .spec.pods.disableEnvoy }}' | grep -qxF true
238238
then
239239
if [ "$(kubectl get pod -n "$CLUSTER_NAMESPACE" "$POD" -o jsonpath="{.metadata.annotations['stackgres\.io/envoy-version']}")" = "$ENVOY_VERSION" ]
240240
then

‎stackgres-k8s/e2e/spec/operator-pgpooling-api‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -278,12 +278,14 @@ user1 = max_user_connections=50 pool_mode=transaction
278278
user2 = max_user_connections=100 pool_mode=session
279279
280280
[pgbouncer]
281+
application_name_add_host = 1
281282
default_pool_size = 50
282283
ignore_startup_parameters = extra_float_digits
283284
max_client_conn = 2000
284285
max_db_connections = 0
285286
max_user_connections = 0
286-
pool_mode = session"
287+
pool_mode = session
288+
server_check_query = \";\""
287289

288290
assert_string_equal "$ACTUAL" "$EXPECTED"
289291
}

0 commit comments

Comments
 (0)