mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-08 21:14:56 +09:00
CloudNativePG offers TLS but its built-in last pg_hba rule, host all all all, also accepts plaintext, so a client outside the cluster that connects with sslmode=disable gets an unencrypted session. tls.enabled only decides whether the external hostname goes into the certificate and cannot prevent this. When external is true the chart now renders spec.postgresql.pg_hba with hostssl all all all scram-sha-256 followed by host all all all reject. CloudNativePG places user rules after its fixed rules and before its default rule, and the first match wins, so only TLS sessions are accepted. The pod network cannot be told apart from an external client, so in-cluster clients are held to the same rule; libpq's default sslmode=prefer already negotiates TLS. The new tri-state tls.required follows external when omitted. Setting it to false keeps accepting plaintext on an external instance and true requires TLS on an in-cluster one. The hostssl rule uses the same password method as CloudNativePG's own default rule (md5 before PostgreSQL 14, scram-sha-256 from 14), so existing md5 verifiers keep working on PostgreSQL 13. Rendering fails when postgresql.parameters.ssl is off while TLS is required, since hostssl would never match and every remote session would be refused. BREAKING CHANGE: external clients that connect without TLS are refused after the upgrade. Set tls.required to false to keep accepting them. Assisted-by: LLM Signed-off-by: Yasar Rahman <yasar.rehman@gmail.com>
312 lines
8.4 KiB
Go
Generated
312 lines
8.4 KiB
Go
Generated
//go:build !ignore_autogenerated
|
|
|
|
/*
|
|
Copyright 2025 The Cozystack Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
// Code generated by controller-gen. DO NOT EDIT.
|
|
|
|
package postgresql
|
|
|
|
import (
|
|
runtime "k8s.io/apimachinery/pkg/runtime"
|
|
"k8s.io/apimachinery/pkg/util/intstr"
|
|
)
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *Autoscaling) DeepCopyInto(out *Autoscaling) {
|
|
*out = *in
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Autoscaling.
|
|
func (in *Autoscaling) DeepCopy() *Autoscaling {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(Autoscaling)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *Backup) DeepCopyInto(out *Backup) {
|
|
*out = *in
|
|
out.EndpointCA = in.EndpointCA
|
|
out.S3CredentialsSecret = in.S3CredentialsSecret
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backup.
|
|
func (in *Backup) DeepCopy() *Backup {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(Backup)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *Bootstrap) DeepCopyInto(out *Bootstrap) {
|
|
*out = *in
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Bootstrap.
|
|
func (in *Bootstrap) DeepCopy() *Bootstrap {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(Bootstrap)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *Config) DeepCopyInto(out *Config) {
|
|
*out = *in
|
|
out.TypeMeta = in.TypeMeta
|
|
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
|
in.Spec.DeepCopyInto(&out.Spec)
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
|
|
func (in *Config) DeepCopy() *Config {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(Config)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
|
func (in *Config) DeepCopyObject() runtime.Object {
|
|
if c := in.DeepCopy(); c != nil {
|
|
return c
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
|
|
*out = *in
|
|
in.Resources.DeepCopyInto(&out.Resources)
|
|
out.Size = in.Size.DeepCopy()
|
|
in.Tls.DeepCopyInto(&out.Tls)
|
|
in.Postgresql.DeepCopyInto(&out.Postgresql)
|
|
out.Quorum = in.Quorum
|
|
out.Autoscaling = in.Autoscaling
|
|
if in.Users != nil {
|
|
in, out := &in.Users, &out.Users
|
|
*out = make(map[string]User, len(*in))
|
|
for key, val := range *in {
|
|
(*out)[key] = val
|
|
}
|
|
}
|
|
if in.Databases != nil {
|
|
in, out := &in.Databases, &out.Databases
|
|
*out = make(map[string]Database, len(*in))
|
|
for key, val := range *in {
|
|
(*out)[key] = *val.DeepCopy()
|
|
}
|
|
}
|
|
out.Backup = in.Backup
|
|
out.Bootstrap = in.Bootstrap
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
|
|
func (in *ConfigSpec) DeepCopy() *ConfigSpec {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(ConfigSpec)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *Database) DeepCopyInto(out *Database) {
|
|
*out = *in
|
|
if in.Extensions != nil {
|
|
in, out := &in.Extensions, &out.Extensions
|
|
*out = make([]string, len(*in))
|
|
copy(*out, *in)
|
|
}
|
|
in.Roles.DeepCopyInto(&out.Roles)
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Database.
|
|
func (in *Database) DeepCopy() *Database {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(Database)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *DatabaseRoles) DeepCopyInto(out *DatabaseRoles) {
|
|
*out = *in
|
|
if in.Admin != nil {
|
|
in, out := &in.Admin, &out.Admin
|
|
*out = make([]string, len(*in))
|
|
copy(*out, *in)
|
|
}
|
|
if in.Readonly != nil {
|
|
in, out := &in.Readonly, &out.Readonly
|
|
*out = make([]string, len(*in))
|
|
copy(*out, *in)
|
|
}
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DatabaseRoles.
|
|
func (in *DatabaseRoles) DeepCopy() *DatabaseRoles {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(DatabaseRoles)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *EndpointCA) DeepCopyInto(out *EndpointCA) {
|
|
*out = *in
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointCA.
|
|
func (in *EndpointCA) DeepCopy() *EndpointCA {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(EndpointCA)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *PostgreSQL) DeepCopyInto(out *PostgreSQL) {
|
|
*out = *in
|
|
if in.Parameters != nil {
|
|
in, out := &in.Parameters, &out.Parameters
|
|
*out = make(map[string]intstr.IntOrString, len(*in))
|
|
for key, val := range *in {
|
|
(*out)[key] = val
|
|
}
|
|
}
|
|
if in.SharedPreloadLibraries != nil {
|
|
in, out := &in.SharedPreloadLibraries, &out.SharedPreloadLibraries
|
|
*out = make([]PreloadLibrary, len(*in))
|
|
copy(*out, *in)
|
|
}
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PostgreSQL.
|
|
func (in *PostgreSQL) DeepCopy() *PostgreSQL {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(PostgreSQL)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *Quorum) DeepCopyInto(out *Quorum) {
|
|
*out = *in
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Quorum.
|
|
func (in *Quorum) DeepCopy() *Quorum {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(Quorum)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *Resources) DeepCopyInto(out *Resources) {
|
|
*out = *in
|
|
out.Cpu = in.Cpu.DeepCopy()
|
|
out.Memory = in.Memory.DeepCopy()
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
|
|
func (in *Resources) DeepCopy() *Resources {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(Resources)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *S3CredentialsSecret) DeepCopyInto(out *S3CredentialsSecret) {
|
|
*out = *in
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new S3CredentialsSecret.
|
|
func (in *S3CredentialsSecret) DeepCopy() *S3CredentialsSecret {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(S3CredentialsSecret)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *TLS) DeepCopyInto(out *TLS) {
|
|
*out = *in
|
|
if in.Enabled != nil {
|
|
in, out := &in.Enabled, &out.Enabled
|
|
*out = new(bool)
|
|
**out = **in
|
|
}
|
|
if in.Required != nil {
|
|
in, out := &in.Required, &out.Required
|
|
*out = new(bool)
|
|
**out = **in
|
|
}
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLS.
|
|
func (in *TLS) DeepCopy() *TLS {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(TLS)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *User) DeepCopyInto(out *User) {
|
|
*out = *in
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
|
|
func (in *User) DeepCopy() *User {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(User)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|