-
Notifications
You must be signed in to change notification settings - Fork 23
[DPE-6902] Replace md5 with scram-sha-256 in patroni/pg_hba.conf #1004
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: 16/edge
Are you sure you want to change the base?
Conversation
c657c77
to
3e56682
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## 16/edge #1004 +/- ##
========================================
Coverage 64.87% 64.87%
========================================
Files 17 17
Lines 4270 4270
Branches 656 656
========================================
Hits 2770 2770
Misses 1333 1333
Partials 167 167 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
PG<>PGB<>APP test passed, but IMHO, the code can be simplified here.
65c5416
to
fe32154
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We should reconsider the instance_password_encryption config as a follow up. Setting it to md5
will not be practically usable, since users won't be able to login with md5 pass hashes.
Good point. Should I include it into this PR? @dragomirp |
Keep pgbouncer_auth_relation_% users in md5, enforce scram-sha-256 for all other users.
e1c2f86
to
fe73262
Compare
fe73262
to
e2b0f01
Compare
Requested review once again after adding instance_password_encryption config option. |
Issue
We have migrated from md5 to scram-sha-256 but still falling back to md5 in pg_hba.conf
Solution
Complete migration to scram-sha-256.
Support instance_password_encryption charm config option.
Checklist