mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-13 08:05:19 +09:00
Yasar Rahman
f6f879cf38
CloudNativePG offers TLS but its built-in last pg_hba rule, host all all all, also accepts plaintext, so a client outside the cluster that connects with sslmode=disable gets an unencrypted session. tls.enabled only decides whether the external hostname goes into the certificate and cannot prevent this. When external is true the chart now renders spec.postgresql.pg_hba with hostssl all all all scram-sha-256 followed by host all all all reject. CloudNativePG places user rules after its fixed rules and before its default rule, and the first match wins, so only TLS sessions are accepted. The pod network cannot be told apart from an external client, so in-cluster clients are held to the same rule; libpq's default sslmode=prefer already negotiates TLS. The new tri-state tls.required follows external when omitted. Setting it to false keeps accepting plaintext on an external instance and true requires TLS on an in-cluster one. The hostssl rule uses the same password method as CloudNativePG's own default rule (md5 before PostgreSQL 14, scram-sha-256 from 14), so existing md5 verifiers keep working on PostgreSQL 13. Rendering fails when postgresql.parameters.ssl is off while TLS is required, since hostssl would never match and every remote session would be refused. BREAKING CHANGE: external clients that connect without TLS are refused after the upgrade. Set tls.required to false to keep accepting them. Assisted-by: LLM Signed-off-by: Yasar Rahman <yasar.rehman@gmail.com>
31 lines
1.0 KiB
Smarty
31 lines
1.0 KiB
Smarty
{{/*
|
|
postgres.tls.enabled resolves the tri-state tls.enabled field to a plain
|
|
string "true" or "false" so callers can use it with `eq`:
|
|
|
|
{{- $tlsEnabled := (include "postgres.tls.enabled" .) | eq "true" -}}
|
|
|
|
Tri-state semantics:
|
|
- tls.enabled explicitly set → use that value
|
|
- tls.enabled unset (null) → auto-on when external is true
|
|
*/}}
|
|
{{- define "postgres.tls.enabled" -}}
|
|
{{- if kindIs "invalid" .Values.tls.enabled -}}
|
|
{{- .Values.external | default false | toString -}}
|
|
{{- else -}}
|
|
{{- .Values.tls.enabled | toString -}}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/*
|
|
postgres.tls.required resolves the tri-state tls.required field to "true" or
|
|
"false". Unset follows external, so an externally published instance refuses
|
|
plaintext sessions by default. Set explicitly, it wins in either direction.
|
|
*/}}
|
|
{{- define "postgres.tls.required" -}}
|
|
{{- if kindIs "invalid" .Values.tls.required -}}
|
|
{{- .Values.external | default false | toString -}}
|
|
{{- else -}}
|
|
{{- .Values.tls.required | toString -}}
|
|
{{- end -}}
|
|
{{- end -}}
|