fix: Changing authenticator username breaks PgBouncer

Author: teoincontatto

stackgres-k8s/src/operator/src/main/java/io/stackgres/operator/conciliation/factory/cluster/patroni/PatroniSecret.java

@@ -37,6 +37,7 @@
 import org.jooq.impl.DSL;
 import org.jooq.lambda.tuple.Tuple;
 import org.jooq.lambda.tuple.Tuple2;
+import org.jooq.lambda.tuple.Tuple3;
 
 @Singleton
 @OperatorVersionBinder
@@ -199,40 +200,61 @@ private void setAuthenticatorCredentials(
       StackGresClusterContext context,
       Map<String, String> previousSecretData,
       Map<String, String> data) {
-    final String authenticatorUsername = context.getAuthenticatorUsername()
-            .orElse(previousSecretData
-                .getOrDefault(AUTHENTICATOR_USERNAME_KEY, previousSecretData
-                    .getOrDefault(AUTHENTICATOR_USERNAME_ENV, AUTHENTICATOR_USERNAME)));
-    data.put(AUTHENTICATOR_USERNAME_KEY, authenticatorUsername);
-    data.put(AUTHENTICATOR_USERNAME_ENV, authenticatorUsername);
-    final String authenticatorPasswordEnv = AUTHENTICATOR_PASSWORD_ENV
-        .replace(AUTHENTICATOR_USERNAME, authenticatorUsername);
-    final String authenticatorOptionsEnv = AUTHENTICATOR_OPTIONS_ENV
-        .replace(AUTHENTICATOR_USERNAME, authenticatorUsername);
-    final String authenticatorPassword = context.getAuthenticatorPassword()
-        .orElse(previousSecretData
-            .getOrDefault(AUTHENTICATOR_PASSWORD_KEY, previousSecretData
-                .getOrDefault(authenticatorPasswordEnv,
-                  context.getGeneratedAuthenticatorPassword())));
-    data.put(AUTHENTICATOR_PASSWORD_KEY, authenticatorPassword);
-    data.put(authenticatorPasswordEnv, context.getAuthenticatorPassword()
+    var authenticatorCredentials = getAuthenticatorCredentials(context, previousSecretData);
+    data.put(AUTHENTICATOR_USERNAME_KEY, authenticatorCredentials.v1);
+    data.put(AUTHENTICATOR_USERNAME_ENV, authenticatorCredentials.v1);
+    data.put(AUTHENTICATOR_PASSWORD_KEY, authenticatorCredentials.v2);
+    data.put(authenticatorCredentials.v3, context.getAuthenticatorPassword()
         .orElse(data.get(AUTHENTICATOR_PASSWORD_KEY)));
+    final String authenticatorOptionsEnv = AUTHENTICATOR_OPTIONS_ENV
+        .replace(AUTHENTICATOR_USERNAME, authenticatorCredentials.v1);
     data.put(authenticatorOptionsEnv, "SUPERUSER");
     data.put(
         ROLES_UPDATE_SQL_KEY,
         Optional.ofNullable(data.get(ROLES_UPDATE_SQL_KEY)).orElse("") + "\n"
         + "DO $$\n"
         + "BEGIN\n"
-        + "  IF NOT EXISTS (SELECT * FROM pg_roles WHERE rolname = " + DSL.inline(authenticatorUsername) + ") THEN\n"
-        + "    CREATE USER " + DSL.quotedName(authenticatorUsername)
-        + " WITH SUPERUSER PASSWORD " + DSL.inline(authenticatorPassword) + ";\n"
+        + "  IF NOT EXISTS (SELECT * FROM pg_roles WHERE rolname = "
+        + DSL.inline(authenticatorCredentials.v1) + ") THEN\n"
+        + "    CREATE USER " + DSL.quotedName(authenticatorCredentials.v1)
+        + " WITH SUPERUSER PASSWORD " + DSL.inline(authenticatorCredentials.v2) + ";\n"
         + "  ELSE\n"
-        + "    ALTER ROLE " + DSL.quotedName(authenticatorUsername)
-        + " WITH SUPERUSER PASSWORD " + DSL.inline(authenticatorPassword) + ";\n"
+        + "    ALTER ROLE " + DSL.quotedName(authenticatorCredentials.v1)
+        + " WITH SUPERUSER PASSWORD " + DSL.inline(authenticatorCredentials.v2) + ";\n"
         + "  END IF;\n"
         + "END$$;");
   }
 
+  public static Tuple3<String, String, String> getAuthenticatorCredentials(
+      StackGresClusterContext context) {
+    final Map<String, String> previousSecretData = context.getDatabaseSecret()
+        .map(Secret::getData)
+        .map(ResourceUtil::decodeSecret)
+        .orElse(Map.of());
+
+    return getAuthenticatorCredentials(context, previousSecretData);
+  }
+
+  private static Tuple3<String, String, String> getAuthenticatorCredentials(
+      StackGresClusterContext context,
+      Map<String, String> previousSecretData) {
+    final String authenticatorUsername = context.getAuthenticatorUsername()
+        .orElse(previousSecretData
+            .getOrDefault(AUTHENTICATOR_USERNAME_KEY, previousSecretData
+                .getOrDefault(AUTHENTICATOR_USERNAME_ENV, AUTHENTICATOR_USERNAME)));
+    final String authenticatorPasswordEnv = AUTHENTICATOR_PASSWORD_ENV
+        .replace(AUTHENTICATOR_USERNAME, authenticatorUsername);
+    final String authenticatorPassword = context.getAuthenticatorPassword()
+        .orElse(previousSecretData
+            .getOrDefault(AUTHENTICATOR_PASSWORD_KEY, previousSecretData
+                .getOrDefault(authenticatorPasswordEnv,
+                  context.getGeneratedAuthenticatorPassword())));
+    return Tuple.tuple(
+        authenticatorUsername,
+        authenticatorPassword,
+        authenticatorPasswordEnv);
+  }
+
   private void setBabelfishCredentials(
       StackGresClusterContext context,
       final Map<String, String> previousSecretData,

stackgres-k8s/src/operator/src/main/java/io/stackgres/operator/conciliation/factory/cluster/sidecars/pooling/PgBouncerPooling.java

@@ -290,6 +290,8 @@ private String getPgBouncerSection(
     parameters.put("listen_addr", isEnvoyDisabled ? "0.0.0.0,::" : "127.0.0.1,::1");
     parameters.put("listen_port", String.valueOf(EnvoyUtil.PG_POOL_PORT));
     parameters.put("unix_socket_dir", ClusterPath.PG_RUN_PATH.path());
+    var credentials = PatroniSecret.getAuthenticatorCredentials(context);
+    parameters.put("auth_user", credentials.v1);
     parameters.put("auth_file", ClusterPath.PGBOUNCER_AUTH_FILE_PATH.path());
     if (Optional.of(context.getSource())
         .map(StackGresCluster::getSpec)

stackgres-k8s/src/operator/src/main/resources/pgbouncer-default-values.properties

@@ -5,7 +5,6 @@ max_db_connections=0
 max_user_connections=0
 
 auth_type=md5
-auth_user=authenticator
 auth_query=SELECT usename, passwd FROM pg_shadow WHERE usename=$1
 
 admin_users=pgbouncer_admin