Skip to content

Commit d1d8edc

Browse files
tangledbytestangledbytes
committed
add support for TLS in CNPG
Signed-off-by: Utkarsh Srivastava <srivastavautkarsh8097@gmail.com>
1 parent 3548b6f commit d1d8edc

6 files changed

Lines changed: 103 additions & 26 deletions

File tree

‎deploy/internal/deployment-endpoint.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,7 @@ spec:
142142
- name: POSTGRES_CONNECTION_STRING
143143
- name: POSTGRES_SSL_REQUIRED
144144
- name: POSTGRES_SSL_UNAUTHORIZED
145+
- name: PGSSLROOTCERT
145146
- name: POSTGRES_HOST_PATH
146147
- name: POSTGRES_USER_PATH
147148
- name: POSTGRES_PASSWORD_PATH

‎deploy/internal/statefulset-core.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,7 @@ spec:
128128
- name: POSTGRES_CONNECTION_STRING
129129
- name: POSTGRES_SSL_REQUIRED
130130
- name: POSTGRES_SSL_UNAUTHORIZED
131+
- name: PGSSLROOTCERT
131132
- name: POSTGRES_HOST_PATH
132133
- name: POSTGRES_USER_PATH
133134
- name: POSTGRES_PASSWORD_PATH

‎pkg/bundle/deploy.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4343,7 +4343,7 @@ data:
43434343
shared_preload_libraries = 'pg_stat_statements'
43444344
`
43454345

4346-
const Sha256_deploy_internal_deployment_endpoint_yaml = "558ec22578b22c3ac3a6d6b72fa95a7122739014ded0a73adbac319aa4457aed"
4346+
const Sha256_deploy_internal_deployment_endpoint_yaml = "056b9894f53b6138d5bcc34f9a99fdb14604a47828f8110099106d99bff74488"
43474347

43484348
const File_deploy_internal_deployment_endpoint_yaml = `apiVersion: apps/v1
43494349
kind: Deployment
@@ -4489,6 +4489,7 @@ spec:
44894489
- name: POSTGRES_CONNECTION_STRING
44904490
- name: POSTGRES_SSL_REQUIRED
44914491
- name: POSTGRES_SSL_UNAUTHORIZED
4492+
- name: PGSSLROOTCERT
44924493
- name: POSTGRES_HOST_PATH
44934494
- name: POSTGRES_USER_PATH
44944495
- name: POSTGRES_PASSWORD_PATH
@@ -5581,7 +5582,7 @@ spec:
55815582
noobaa-s3-svc: "true"
55825583
`
55835584

5584-
const Sha256_deploy_internal_statefulset_core_yaml = "4ef493f94d8f81746f9d8904085de093b4ed37ee15d0767cc563f7aa89c86de8"
5585+
const Sha256_deploy_internal_statefulset_core_yaml = "0618df416c1406b53303a8365a64d6e59213e5c0316722ccefdd9d3ef8f22718"
55855586

55865587
const File_deploy_internal_statefulset_core_yaml = `apiVersion: apps/v1
55875588
kind: StatefulSet
@@ -5713,6 +5714,7 @@ spec:
57135714
- name: POSTGRES_CONNECTION_STRING
57145715
- name: POSTGRES_SSL_REQUIRED
57155716
- name: POSTGRES_SSL_UNAUTHORIZED
5717+
- name: PGSSLROOTCERT
57165718
- name: POSTGRES_HOST_PATH
57175719
- name: POSTGRES_USER_PATH
57185720
- name: POSTGRES_PASSWORD_PATH

‎pkg/system/db_reconciler.go‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ const (
3232
defaultCalcMemoryKB = int64(16 * 1024 * 1024) // 16GB in KB — used when DBResources not specified
3333
defaultCalcCPU = int64(4) // used when DBResources not specified
3434
defaultFailoverDelaySec = int32(30)
35+
36+
cnpgCAMountPath = "/etc/cnpg-ca"
3537
)
3638

3739
// ReconcileCNPGCluster reconciles the CNPG cluster
@@ -303,6 +305,15 @@ func (r *Reconciler) reconcileClusterSpec(dbSpec *nbv1.NooBaaDBSpec) error {
303305
Enabled: true,
304306
}
305307

308+
if r.CNPGCluster.Spec.Certificates == nil {
309+
r.CNPGCluster.Spec.Certificates = &cnpgv1.CertificatesConfiguration{}
310+
}
311+
r.CNPGCluster.Spec.Certificates.ServerAltDNSNames = []string{
312+
r.ServiceDbPg.Name,
313+
r.ServiceDbPg.Name + "." + r.Request.Namespace,
314+
r.ServiceDbPg.Name + "." + r.Request.Namespace + ".svc",
315+
}
316+
306317
r.CNPGCluster.Spec.FailoverDelay = defaultFailoverDelaySec
307318

308319
r.setPostgresConfig()
@@ -610,6 +621,17 @@ func (r *Reconciler) setPostgresConfig() {
610621
}
611622
r.cnpgLog("PGTune config: memory=%dKB, cpu=%d, endpoints=%d", totalMemoryKB, cpuNum, endpointMaxCount)
612623

624+
// propagate TLS security settings to the PostgreSQL server
625+
tlsSec := r.NooBaa.Spec.Security.APIServerSecurity
626+
if tlsSec != nil && !util.IsTLSConfigDisabled() {
627+
if tlsSec.TLSMinVersion != nil {
628+
overrideParameters["ssl_min_protocol_version"] = string(*tlsSec.TLSMinVersion)
629+
}
630+
if len(tlsSec.TLSCiphers) > 0 {
631+
overrideParameters["ssl_ciphers"] = util.MapCiphersToOpenSSL(tlsSec.TLSCiphers)
632+
}
633+
}
634+
613635
// apply any user-specified DBConf overrides on top of the calculated values
614636
if r.NooBaa.Spec.DBSpec.DBConf != nil {
615637
for k, v := range r.NooBaa.Spec.DBSpec.DBConf {
@@ -843,6 +865,10 @@ func (r *Reconciler) getClusterSecretName() string {
843865
return r.CNPGCluster.Name + "-app"
844866
}
845867

868+
func (r *Reconciler) getClusterCASecretName() string {
869+
return r.CNPGCluster.GetServerCASecretName()
870+
}
871+
846872
func (r *Reconciler) cnpgLog(format string, args ...interface{}) {
847873
r.Logger.Infof("cnpg:: "+format, args...)
848874
}
@@ -891,6 +917,7 @@ func (r *Reconciler) wasClusterSpecChanged(existingClusterSpec *cnpgv1.ClusterSp
891917
!reflect.DeepEqual(existingClusterSpec.Monitoring, r.CNPGCluster.Spec.Monitoring) ||
892918
!reflect.DeepEqual(existingClusterSpec.PostgresConfiguration.Parameters, r.CNPGCluster.Spec.PostgresConfiguration.Parameters) ||
893919
!reflect.DeepEqual(existingClusterSpec.Backup, r.CNPGCluster.Spec.Backup) ||
920+
!reflect.DeepEqual(existingClusterSpec.Certificates, r.CNPGCluster.Spec.Certificates) ||
894921
existingClusterSpec.PriorityClassName != r.CNPGCluster.Spec.PriorityClassName ||
895922
existingClusterSpec.FailoverDelay != r.CNPGCluster.Spec.FailoverDelay
896923
}

‎pkg/system/phase2_creating.go‎

Lines changed: 38 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -577,13 +577,17 @@ func (r *Reconciler) setDesiredCoreEnv(c *corev1.Container) {
577577
c.Env[j].Value = ""
578578
c.Env[j].ValueFrom = nil
579579
case "POSTGRES_SSL_REQUIRED":
580-
if r.NooBaa.Spec.ExternalPgSSLRequired {
580+
if r.NooBaa.Spec.ExternalPgSSLRequired || r.shouldReconcileCNPGCluster() {
581581
c.Env[j].Value = "true"
582582
}
583583
case "POSTGRES_SSL_UNAUTHORIZED":
584-
if r.NooBaa.Spec.ExternalPgSSLUnauthorized {
584+
if r.NooBaa.Spec.ExternalPgSSLUnauthorized || r.shouldReconcileCNPGCluster() {
585585
c.Env[j].Value = "true"
586586
}
587+
case "PGSSLROOTCERT":
588+
if r.shouldReconcileCNPGCluster() {
589+
c.Env[j].Value = cnpgCAMountPath + "/ca.crt"
590+
}
587591

588592
case "POSTGRES_DBNAME_PATH":
589593
c.Env[j].Value = postgresSecretMountPath + "/dbname"
@@ -702,11 +706,18 @@ func (r *Reconciler) SetDesiredCoreApp() error {
702706
}
703707

704708
if r.shouldReconcileCNPGCluster() {
705-
dbSecretVolumeMounts := []corev1.VolumeMount{{
706-
Name: r.CNPGCluster.Name,
707-
MountPath: postgresSecretMountPath,
708-
ReadOnly: true,
709-
}}
709+
dbSecretVolumeMounts := []corev1.VolumeMount{
710+
{
711+
Name: r.CNPGCluster.Name,
712+
MountPath: postgresSecretMountPath,
713+
ReadOnly: true,
714+
},
715+
{
716+
Name: r.CNPGCluster.Name + "-ca",
717+
MountPath: cnpgCAMountPath,
718+
ReadOnly: true,
719+
},
720+
}
710721
util.MergeVolumeMountList(&c.VolumeMounts, &dbSecretVolumeMounts)
711722
} else if r.NooBaa.Spec.ExternalPgSecret != nil {
712723
dbSecretVolumeMounts := []corev1.VolumeMount{{
@@ -889,14 +900,28 @@ func (r *Reconciler) SetDesiredCoreApp() error {
889900
}
890901

891902
if r.shouldReconcileCNPGCluster() {
892-
dbSecretVolumes := []corev1.Volume{{
893-
Name: r.CNPGCluster.Name,
894-
VolumeSource: corev1.VolumeSource{
895-
Secret: &corev1.SecretVolumeSource{
896-
SecretName: r.getClusterSecretName(),
903+
dbSecretVolumes := []corev1.Volume{
904+
{
905+
Name: r.CNPGCluster.Name,
906+
VolumeSource: corev1.VolumeSource{
907+
Secret: &corev1.SecretVolumeSource{
908+
SecretName: r.getClusterSecretName(),
909+
},
897910
},
898911
},
899-
}}
912+
{
913+
Name: r.CNPGCluster.Name + "-ca",
914+
VolumeSource: corev1.VolumeSource{
915+
Secret: &corev1.SecretVolumeSource{
916+
SecretName: r.getClusterCASecretName(),
917+
Items: []corev1.KeyToPath{{
918+
Key: "ca.crt",
919+
Path: "ca.crt",
920+
}},
921+
},
922+
},
923+
},
924+
}
900925
util.MergeVolumeList(&podSpec.Volumes, &dbSecretVolumes)
901926
} else if r.NooBaa.Spec.ExternalPgSecret != nil {
902927
externalPgVolumes := []corev1.Volume{{

‎pkg/system/phase4_configuring.go‎

Lines changed: 32 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -554,11 +554,18 @@ func (r *Reconciler) setDesiredEndpointMounts(podSpec *corev1.PodSpec, container
554554
container.VolumeMounts = r.DefaultDeploymentEndpoint.Containers[0].VolumeMounts
555555

556556
if r.shouldReconcileCNPGCluster() {
557-
dbSecretVolumeMounts := []corev1.VolumeMount{{
558-
Name: r.CNPGCluster.Name,
559-
MountPath: postgresSecretMountPath,
560-
ReadOnly: true,
561-
}}
557+
dbSecretVolumeMounts := []corev1.VolumeMount{
558+
{
559+
Name: r.CNPGCluster.Name,
560+
MountPath: postgresSecretMountPath,
561+
ReadOnly: true,
562+
},
563+
{
564+
Name: r.CNPGCluster.Name + "-ca",
565+
MountPath: cnpgCAMountPath,
566+
ReadOnly: true,
567+
},
568+
}
562569
util.MergeVolumeMountList(&container.VolumeMounts, &dbSecretVolumeMounts)
563570
} else if r.NooBaa.Spec.ExternalPgSecret != nil {
564571
dbSecretVolumeMounts := []corev1.VolumeMount{{
@@ -726,14 +733,28 @@ func (r *Reconciler) setDesiredEndpointMounts(podSpec *corev1.PodSpec, container
726733
}
727734

728735
if r.shouldReconcileCNPGCluster() {
729-
dbSecretVolumes := []corev1.Volume{{
730-
Name: r.CNPGCluster.Name,
731-
VolumeSource: corev1.VolumeSource{
732-
Secret: &corev1.SecretVolumeSource{
733-
SecretName: r.getClusterSecretName(),
736+
dbSecretVolumes := []corev1.Volume{
737+
{
738+
Name: r.CNPGCluster.Name,
739+
VolumeSource: corev1.VolumeSource{
740+
Secret: &corev1.SecretVolumeSource{
741+
SecretName: r.getClusterSecretName(),
742+
},
734743
},
735744
},
736-
}}
745+
{
746+
Name: r.CNPGCluster.Name + "-ca",
747+
VolumeSource: corev1.VolumeSource{
748+
Secret: &corev1.SecretVolumeSource{
749+
SecretName: r.getClusterCASecretName(),
750+
Items: []corev1.KeyToPath{{
751+
Key: "ca.crt",
752+
Path: "ca.crt",
753+
}},
754+
},
755+
},
756+
},
757+
}
737758
util.MergeVolumeList(&podSpec.Volumes, &dbSecretVolumes)
738759
} else if r.NooBaa.Spec.ExternalPgSecret != nil {
739760
externalPgVolumes := []corev1.Volume{{

0 commit comments

Comments
 (0)