feat(pooler): support custom TLS and CA secrets in PgBouncer spec#8692
Conversation
|
❗ By default, the pull request is configured to backport to all release branches.
|
3df907d to
561324e
Compare
|
/test |
|
@leonardoce, here's the link to the E2E on CNPG workflow run: https://github.com/cloudnative-pg/cloudnative-pg/actions/runs/18135910829 |
c068074 to
07840fd
Compare
|
/test |
|
@leonardoce, here's the link to the E2E on CNPG workflow run: https://github.com/cloudnative-pg/cloudnative-pg/actions/runs/18157853970 |
07840fd to
d005059
Compare
d96850b to
3f96a76
Compare
1af0e17 to
e9d6103
Compare
|
/test limit=local |
|
@armru, here's the link to the E2E on CNPG workflow run: https://github.com/cloudnative-pg/cloudnative-pg/actions/runs/18227184678 |
|
/test ft=service-connectivity |
|
@NiccoloFei, here's the link to the E2E on CNPG workflow run: https://github.com/cloudnative-pg/cloudnative-pg/actions/runs/18351241312 |
2e79cf7 to
0ee9248
Compare
|
/test ft=service-connectivity |
|
@NiccoloFei, here's the link to the E2E on CNPG workflow run: https://github.com/cloudnative-pg/cloudnative-pg/actions/runs/18382206588 |
|
@leonardoce Will this change allow users to use cert-manager with the Pooler integration still working, assuming we only provide the client secret? I am trying to provide as much cert-manager resources while also allowing the Pooler integration to still work correctly without needing to do the manual steps. I have opened this issue, but it would be great if this handled what I am looking for. |
|
Or @NiccoloFei if you are now handling this PR |
|
Okay, I actually built a cluster using this branch and some of the settings from the tests and was able to successfully provide all my certs via cert-manager. So sounds like a success to me, I'll close my issue. |
864c71b to
907d27e
Compare
|
/test |
|
@gbartolini, here's the link to the E2E on CNPG workflow run: https://github.com/cloudnative-pg/cloudnative-pg/actions/runs/18876538809 |
This patch extends the Pooler CRD with the following new fields in `.spec.pgbouncer`: - `clientTLSSecret` maps to the `client_tls_key_file` and `client_tls_cert_file` parameters - `clientCASecret` maps to the `client_tls_ca_file` parameter - `serverTLSSecret` maps to the `server_tls_key_file` and `server_tls_cert_file` parameters - `serverCASecret` maps to the `server_ca_file` parameter When specified, these fields take precedence over the automatic TLS configuration that CloudNativePG already generates for PgBouncer. The existing `authQuery` and `authQuerySecret` behavior is preserved for backward compatibility, although `serverTLSSecret` may override it if set. See: cloudnative-pg#8675 Signed-off-by: Leonardo Cecchi <leonardo.cecchi@enterprisedb.com>
Signed-off-by: Leonardo Cecchi <leonardo.cecchi@enterprisedb.com>
Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
… are missing Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
Signed-off-by: Niccolò Fei <niccolo.fei@enterprisedb.com>
Signed-off-by: Niccolò Fei <niccolo.fei@enterprisedb.com>
Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
9a8d0cd to
5fb49f0
Compare
This patch extends the
PoolerCRD by introducing new fields under.spec.pgbouncerfor custom TLS configuration:clientTLSSecret: maps toclient_tls_key_fileandclient_tls_cert_fileclientCASecret: maps toclient_tls_ca_fileserverTLSSecret: maps toserver_tls_key_fileandserver_tls_cert_fileserverCASecret: maps toserver_ca_fileWhen defined, these fields take precedence over the automatically generated TLS configuration that CloudNativePG provides for PgBouncer.
The existing
authQueryandauthQuerySecretbehaviour remains unchanged for backward compatibility, thoughserverTLSSecretmay override them if set.Closes #8672
Closes #8675