feat(pgbouncer): simplify authentication using auth_dbname#8671
Merged
armru merged 5 commits intocloudnative-pg:mainfrom Sep 29, 2025
Merged
feat(pgbouncer): simplify authentication using auth_dbname#8671armru merged 5 commits intocloudnative-pg:mainfrom
auth_dbname#8671armru merged 5 commits intocloudnative-pg:mainfrom
Conversation
Previously, CloudNativePG configured authentication by creating a `user_search` function in every accessible database and granting CONNECT privileges to the PgBouncer auth_user. This patch simplifies the process by using the `auth_dbname` configuration option, so that PgBouncer runs its authentication queries only against the `postgres` database. This results in a simpler reconciliation loop with no extra connections required for other databases. Closes: cloudnative-pg#4939 Signed-off-by: Leonardo Cecchi <leonardo.cecchi@enterprisedb.com>
Contributor
|
❗ By default, the pull request is configured to backport to all release branches.
|
Contributor
Author
|
/test |
Contributor
|
@leonardoce, here's the link to the E2E on CNPG workflow run: https://github.com/cloudnative-pg/cloudnative-pg/actions/runs/18042447414 |
auth_dbname option in PgBouncerauth_dbname
Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
4ab749d to
c7f42c5
Compare
gbartolini
approved these changes
Sep 27, 2025
Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
armru
approved these changes
Sep 29, 2025
rossigee
pushed a commit
to rossigee/cloudnative-pg
that referenced
this pull request
Oct 2, 2025
…tive-pg#8671) Previously, authentication was handled by creating a `user_search` function in every accessible database and granting `CONNECT` privileges to the PgBouncer `auth_user`. This change leverages the `auth_dbname` option, so PgBouncer runs its authentication queries only against the `postgres` database. PgBouncer 1.19+ is required (`auth_dbame` option needed). Benefits: - simpler reconciliation loop - no extra connections required for other databases Closes: cloudnative-pg#1383 --------- Signed-off-by: Leonardo Cecchi <leonardo.cecchi@enterprisedb.com> Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com> Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com> Co-authored-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com> Co-authored-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
THE-BRAHMA
pushed a commit
to THE-BRAHMA/cloudnative-pg
that referenced
this pull request
Oct 30, 2025
…tive-pg#8671) Previously, authentication was handled by creating a `user_search` function in every accessible database and granting `CONNECT` privileges to the PgBouncer `auth_user`. This change leverages the `auth_dbname` option, so PgBouncer runs its authentication queries only against the `postgres` database. PgBouncer 1.19+ is required (`auth_dbame` option needed). Benefits: - simpler reconciliation loop - no extra connections required for other databases Closes: cloudnative-pg#1383 --------- Signed-off-by: Leonardo Cecchi <leonardo.cecchi@enterprisedb.com> Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com> Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com> Co-authored-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com> Co-authored-by: Armando Ruocco <armando.ruocco@enterprisedb.com> Signed-off-by: theBrahma <office.utpal.brahma@gmail.com>
|
This should perhaps be documented in release notes as being a Change instead of Enhancement, or something? Maybe I'm just some edge case, but I'm using externalClusters to behave as a read-only replica from a non-CNPG postgres, and then having CNPG Pooler against this CNPG-owned replica. As such, it couldn't automatically add this function to the It was unclear what the problem was at first, because here is no mention in this new documentation about migration, and the previous documentation said just Thanks! |
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Previously, authentication was handled by creating a
user_searchfunction in every accessible database and grantingCONNECTprivileges to the PgBouncerauth_user.This change leverages the
auth_dbnameoption, so PgBouncer runs its authentication queries only against thepostgresdatabase.PgBouncer 1.19+ is required (
auth_dbameoption needed).Benefits:
Closes: #1383