Skip to content

Commit bf90fcb

Browse files
fernando-villalbafernando-villalba
authored
Merge pull request #232 from numtide/postgres-password-secret
feat(shard): add postgres password Secret
2 parents d00ef13 + 8ac1c97 commit bf90fcb

File tree

7 files changed

+340
-1
lines changed

7 files changed

+340
-1
lines changed

‎pkg/resource-handler/controller/shard/containers.go‎

Lines changed: 44 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,12 @@ const (
7878

7979
// PgHbaTemplatePath is the full path to the pg_hba template file
8080
PgHbaTemplatePath = PgHbaMountPath + "/pg_hba_template.conf"
81+
82+
// PostgresPasswordSecretName is the name of the Secret containing the PostgreSQL password
83+
PostgresPasswordSecretName = "postgres-password"
84+
85+
// PostgresPasswordSecretKey is the key within the Secret that holds the password
86+
PostgresPasswordSecretKey = "password"
8187
)
8288

8389
// buildSocketDirVolume creates the shared emptyDir volume for unix sockets.
@@ -145,6 +151,7 @@ func buildPostgresContainer(
145151
Name: "PGDATA",
146152
Value: PgDataPath,
147153
},
154+
pgPasswordEnvVar(),
148155
},
149156
SecurityContext: &corev1.SecurityContext{
150157
RunAsUser: ptr.To(int64(999)), // Must match postgres:17 image UID for file access
@@ -222,6 +229,7 @@ func buildPgctldContainer(
222229
Name: "PGDATA",
223230
Value: PgDataPath,
224231
},
232+
pgPasswordEnvVar(),
225233
},
226234
SecurityContext: &corev1.SecurityContext{
227235
RunAsUser: ptr.To(int64(999)),
@@ -270,7 +278,7 @@ func buildMultiPoolerSidecar(
270278

271279
// TODO: Add remaining command line arguments:
272280
// --grpc-socket-file, --log-level, --log-output, --hostname
273-
// --pgbackrest-stanza, --connpool-admin-password
281+
// --pgbackrest-stanza
274282

275283
args := []string{
276284
"multipooler", // Subcommand
@@ -288,6 +296,7 @@ func buildMultiPoolerSidecar(
288296
"--service-id=$(POD_NAME)", // Use pod name as unique service ID
289297
"--pgctld-addr=localhost:15470",
290298
"--pg-port=5432",
299+
"--connpool-admin-password=$(CONNPOOL_ADMIN_PASSWORD)", // Resolved from env var below
291300
}
292301

293302
c := corev1.Container{
@@ -339,6 +348,7 @@ func buildMultiPoolerSidecar(
339348
},
340349
},
341350
},
351+
connpoolAdminPasswordEnvVar(),
342352
},
343353
VolumeMounts: []corev1.VolumeMount{
344354
{
@@ -487,3 +497,36 @@ func buildBackupVolume(shard *multigresv1alpha1.Shard, poolName, cellName string
487497
},
488498
}
489499
}
500+
501+
// pgPasswordEnvVar returns a PGPASSWORD env var sourced from the postgres-password Secret.
502+
// pgctld reads this during initdb to set the superuser password.
503+
func pgPasswordEnvVar() corev1.EnvVar {
504+
return corev1.EnvVar{
505+
Name: "PGPASSWORD",
506+
ValueFrom: &corev1.EnvVarSource{
507+
SecretKeyRef: &corev1.SecretKeySelector{
508+
LocalObjectReference: corev1.LocalObjectReference{
509+
Name: PostgresPasswordSecretName,
510+
},
511+
Key: PostgresPasswordSecretKey,
512+
},
513+
},
514+
}
515+
}
516+
517+
// connpoolAdminPasswordEnvVar returns a CONNPOOL_ADMIN_PASSWORD env var sourced
518+
// from the postgres-password Secret. Multipooler uses this to authenticate
519+
// with PostgreSQL for connection pool administration.
520+
func connpoolAdminPasswordEnvVar() corev1.EnvVar {
521+
return corev1.EnvVar{
522+
Name: "CONNPOOL_ADMIN_PASSWORD",
523+
ValueFrom: &corev1.EnvVarSource{
524+
SecretKeyRef: &corev1.SecretKeySelector{
525+
LocalObjectReference: corev1.LocalObjectReference{
526+
Name: PostgresPasswordSecretName,
527+
},
528+
Key: PostgresPasswordSecretKey,
529+
},
530+
},
531+
}
532+
}

‎pkg/resource-handler/controller/shard/containers_test.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ func TestBuildPostgresContainer(t *testing.T) {
4747
Name: "PGDATA",
4848
Value: PgDataPath,
4949
},
50+
pgPasswordEnvVar(),
5051
},
5152
SecurityContext: &corev1.SecurityContext{
5253
RunAsUser: ptr.To(int64(999)),
@@ -110,6 +111,7 @@ func TestBuildPostgresContainer(t *testing.T) {
110111
Name: "PGDATA",
111112
Value: PgDataPath,
112113
},
114+
pgPasswordEnvVar(),
113115
},
114116
SecurityContext: &corev1.SecurityContext{
115117
RunAsUser: ptr.To(int64(999)),
@@ -191,6 +193,7 @@ func TestBuildPostgresContainer(t *testing.T) {
191193
Name: "PGDATA",
192194
Value: PgDataPath,
193195
},
196+
pgPasswordEnvVar(),
194197
},
195198
SecurityContext: &corev1.SecurityContext{
196199
RunAsUser: ptr.To(int64(999)),
@@ -279,6 +282,7 @@ func TestBuildMultiPoolerSidecar(t *testing.T) {
279282
"--service-id=$(POD_NAME)",
280283
"--pgctld-addr=localhost:15470",
281284
"--pg-port=5432",
285+
"--connpool-admin-password=$(CONNPOOL_ADMIN_PASSWORD)",
282286
},
283287
Ports: buildMultiPoolerContainerPorts(),
284288
Resources: corev1.ResourceRequirements{},
@@ -325,6 +329,7 @@ func TestBuildMultiPoolerSidecar(t *testing.T) {
325329
},
326330
},
327331
},
332+
connpoolAdminPasswordEnvVar(),
328333
},
329334
VolumeMounts: []corev1.VolumeMount{
330335
{
@@ -382,6 +387,7 @@ func TestBuildMultiPoolerSidecar(t *testing.T) {
382387
"--service-id=$(POD_NAME)",
383388
"--pgctld-addr=localhost:15470",
384389
"--pg-port=5432",
390+
"--connpool-admin-password=$(CONNPOOL_ADMIN_PASSWORD)",
385391
},
386392
Ports: buildMultiPoolerContainerPorts(),
387393
Resources: corev1.ResourceRequirements{},
@@ -428,6 +434,7 @@ func TestBuildMultiPoolerSidecar(t *testing.T) {
428434
},
429435
},
430436
},
437+
connpoolAdminPasswordEnvVar(),
431438
},
432439
VolumeMounts: []corev1.VolumeMount{
433440
{
@@ -494,6 +501,7 @@ func TestBuildMultiPoolerSidecar(t *testing.T) {
494501
"--service-id=$(POD_NAME)",
495502
"--pgctld-addr=localhost:15470",
496503
"--pg-port=5432",
504+
"--connpool-admin-password=$(CONNPOOL_ADMIN_PASSWORD)",
497505
},
498506
Ports: buildMultiPoolerContainerPorts(),
499507
Resources: corev1.ResourceRequirements{
@@ -549,6 +557,7 @@ func TestBuildMultiPoolerSidecar(t *testing.T) {
549557
},
550558
},
551559
},
560+
connpoolAdminPasswordEnvVar(),
552561
},
553562
VolumeMounts: []corev1.VolumeMount{
554563
{

‎pkg/resource-handler/controller/shard/integration_test.go‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -337,6 +337,7 @@ func TestShardReconciliation(t *testing.T) {
337337
"--service-id=$(POD_NAME)",
338338
"--pgctld-addr=localhost:15470",
339339
"--pg-port=5432",
340+
"--connpool-admin-password=$(CONNPOOL_ADMIN_PASSWORD)",
340341
},
341342
Ports: multipoolerPorts(t),
342343
RestartPolicy: ptr.To(corev1.ContainerRestartPolicyAlways),
@@ -383,6 +384,17 @@ func TestShardReconciliation(t *testing.T) {
383384
},
384385
},
385386
},
387+
{
388+
Name: "CONNPOOL_ADMIN_PASSWORD",
389+
ValueFrom: &corev1.EnvVarSource{
390+
SecretKeyRef: &corev1.SecretKeySelector{
391+
LocalObjectReference: corev1.LocalObjectReference{
392+
Name: shardcontroller.PostgresPasswordSecretName,
393+
},
394+
Key: shardcontroller.PostgresPasswordSecretKey,
395+
},
396+
},
397+
},
386398
},
387399
VolumeMounts: []corev1.VolumeMount{
388400
{Name: "pgdata", MountPath: "/var/lib/pooler"},
@@ -411,6 +423,17 @@ func TestShardReconciliation(t *testing.T) {
411423
},
412424
Env: []corev1.EnvVar{
413425
{Name: "PGDATA", Value: "/var/lib/pooler/pg_data"},
426+
{
427+
Name: "PGPASSWORD",
428+
ValueFrom: &corev1.EnvVarSource{
429+
SecretKeyRef: &corev1.SecretKeySelector{
430+
LocalObjectReference: corev1.LocalObjectReference{
431+
Name: shardcontroller.PostgresPasswordSecretName,
432+
},
433+
Key: shardcontroller.PostgresPasswordSecretKey,
434+
},
435+
},
436+
},
414437
},
415438
SecurityContext: &corev1.SecurityContext{
416439
RunAsUser: ptr.To(int64(999)),
@@ -681,6 +704,7 @@ func TestShardReconciliation(t *testing.T) {
681704
"--service-id=$(POD_NAME)",
682705
"--pgctld-addr=localhost:15470",
683706
"--pg-port=5432",
707+
"--connpool-admin-password=$(CONNPOOL_ADMIN_PASSWORD)",
684708
},
685709
Ports: multipoolerPorts(t),
686710
RestartPolicy: ptr.To(corev1.ContainerRestartPolicyAlways),
@@ -727,6 +751,17 @@ func TestShardReconciliation(t *testing.T) {
727751
},
728752
},
729753
},
754+
{
755+
Name: "CONNPOOL_ADMIN_PASSWORD",
756+
ValueFrom: &corev1.EnvVarSource{
757+
SecretKeyRef: &corev1.SecretKeySelector{
758+
LocalObjectReference: corev1.LocalObjectReference{
759+
Name: shardcontroller.PostgresPasswordSecretName,
760+
},
761+
Key: shardcontroller.PostgresPasswordSecretKey,
762+
},
763+
},
764+
},
730765
},
731766
VolumeMounts: []corev1.VolumeMount{
732767
{Name: "pgdata", MountPath: "/var/lib/pooler"},
@@ -755,6 +790,17 @@ func TestShardReconciliation(t *testing.T) {
755790
},
756791
Env: []corev1.EnvVar{
757792
{Name: "PGDATA", Value: "/var/lib/pooler/pg_data"},
793+
{
794+
Name: "PGPASSWORD",
795+
ValueFrom: &corev1.EnvVarSource{
796+
SecretKeyRef: &corev1.SecretKeySelector{
797+
LocalObjectReference: corev1.LocalObjectReference{
798+
Name: shardcontroller.PostgresPasswordSecretName,
799+
},
800+
Key: shardcontroller.PostgresPasswordSecretKey,
801+
},
802+
},
803+
},
758804
},
759805
SecurityContext: &corev1.SecurityContext{
760806
RunAsUser: ptr.To(int64(999)),
@@ -1133,6 +1179,7 @@ func TestShardReconciliation(t *testing.T) {
11331179
"--service-id=$(POD_NAME)",
11341180
"--pgctld-addr=localhost:15470",
11351181
"--pg-port=5432",
1182+
"--connpool-admin-password=$(CONNPOOL_ADMIN_PASSWORD)",
11361183
},
11371184
Ports: []corev1.ContainerPort{
11381185
tcpPort(t, "http", 15200),
@@ -1183,6 +1230,17 @@ func TestShardReconciliation(t *testing.T) {
11831230
},
11841231
},
11851232
},
1233+
{
1234+
Name: "CONNPOOL_ADMIN_PASSWORD",
1235+
ValueFrom: &corev1.EnvVarSource{
1236+
SecretKeyRef: &corev1.SecretKeySelector{
1237+
LocalObjectReference: corev1.LocalObjectReference{
1238+
Name: shardcontroller.PostgresPasswordSecretName,
1239+
},
1240+
Key: shardcontroller.PostgresPasswordSecretKey,
1241+
},
1242+
},
1243+
},
11861244
},
11871245
VolumeMounts: []corev1.VolumeMount{
11881246
{Name: "pgdata", MountPath: "/var/lib/pooler"},
@@ -1211,6 +1269,17 @@ func TestShardReconciliation(t *testing.T) {
12111269
},
12121270
Env: []corev1.EnvVar{
12131271
{Name: "PGDATA", Value: "/var/lib/pooler/pg_data"},
1272+
{
1273+
Name: "PGPASSWORD",
1274+
ValueFrom: &corev1.EnvVarSource{
1275+
SecretKeyRef: &corev1.SecretKeySelector{
1276+
LocalObjectReference: corev1.LocalObjectReference{
1277+
Name: shardcontroller.PostgresPasswordSecretName,
1278+
},
1279+
Key: shardcontroller.PostgresPasswordSecretKey,
1280+
},
1281+
},
1282+
},
12141283
},
12151284
SecurityContext: &corev1.SecurityContext{
12161285
RunAsUser: ptr.To(int64(999)),
@@ -1350,6 +1419,7 @@ func TestShardReconciliation(t *testing.T) {
13501419
"--service-id=$(POD_NAME)",
13511420
"--pgctld-addr=localhost:15470",
13521421
"--pg-port=5432",
1422+
"--connpool-admin-password=$(CONNPOOL_ADMIN_PASSWORD)",
13531423
},
13541424
Ports: []corev1.ContainerPort{
13551425
tcpPort(t, "http", 15200),
@@ -1400,6 +1470,17 @@ func TestShardReconciliation(t *testing.T) {
14001470
},
14011471
},
14021472
},
1473+
{
1474+
Name: "CONNPOOL_ADMIN_PASSWORD",
1475+
ValueFrom: &corev1.EnvVarSource{
1476+
SecretKeyRef: &corev1.SecretKeySelector{
1477+
LocalObjectReference: corev1.LocalObjectReference{
1478+
Name: shardcontroller.PostgresPasswordSecretName,
1479+
},
1480+
Key: shardcontroller.PostgresPasswordSecretKey,
1481+
},
1482+
},
1483+
},
14031484
},
14041485
VolumeMounts: []corev1.VolumeMount{
14051486
{Name: "pgdata", MountPath: "/var/lib/pooler"},
@@ -1428,6 +1509,17 @@ func TestShardReconciliation(t *testing.T) {
14281509
},
14291510
Env: []corev1.EnvVar{
14301511
{Name: "PGDATA", Value: "/var/lib/pooler/pg_data"},
1512+
{
1513+
Name: "PGPASSWORD",
1514+
ValueFrom: &corev1.EnvVarSource{
1515+
SecretKeyRef: &corev1.SecretKeySelector{
1516+
LocalObjectReference: corev1.LocalObjectReference{
1517+
Name: shardcontroller.PostgresPasswordSecretName,
1518+
},
1519+
Key: shardcontroller.PostgresPasswordSecretKey,
1520+
},
1521+
},
1522+
},
14311523
},
14321524
SecurityContext: &corev1.SecurityContext{
14331525
RunAsUser: ptr.To(int64(999)),

‎pkg/resource-handler/controller/shard/pool_statefulset_test.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,7 @@ func TestBuildPoolStatefulSet(t *testing.T) {
157157
Name: "PGDATA",
158158
Value: "/var/lib/pooler/pg_data",
159159
},
160+
pgPasswordEnvVar(),
160161
},
161162
SecurityContext: &corev1.SecurityContext{
162163
RunAsUser: ptr.To(int64(999)),
@@ -369,6 +370,7 @@ func TestBuildPoolStatefulSet(t *testing.T) {
369370
Name: "PGDATA",
370371
Value: "/var/lib/pooler/pg_data",
371372
},
373+
pgPasswordEnvVar(),
372374
},
373375
SecurityContext: &corev1.SecurityContext{
374376
RunAsUser: ptr.To(int64(999)),
@@ -574,6 +576,7 @@ func TestBuildPoolStatefulSet(t *testing.T) {
574576
Name: "PGDATA",
575577
Value: "/var/lib/pooler/pg_data",
576578
},
579+
pgPasswordEnvVar(),
577580
},
578581
SecurityContext: &corev1.SecurityContext{
579582
RunAsUser: ptr.To(int64(999)),
@@ -814,6 +817,7 @@ func TestBuildPoolStatefulSet(t *testing.T) {
814817
Name: "PGDATA",
815818
Value: "/var/lib/pooler/pg_data",
816819
},
820+
pgPasswordEnvVar(),
817821
},
818822
SecurityContext: &corev1.SecurityContext{
819823
RunAsUser: ptr.To(int64(999)),

0 commit comments

Comments
 (0)