Skip to content

Commit c9de9e4

Browse files
thesuperzapperthesuperzapper
authored
fix: only gen self-signed certs for pgbouncer client configs (#404)
Signed-off-by: Mathew Wicks <[email protected]>
1 parent bbd4a94 commit c9de9e4

File tree

4 files changed

+17
-49
lines changed

4 files changed

+17
-49
lines changed

‎charts/airflow/templates/pgbouncer/_helpers/pgbouncer.tpl‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,16 +27,24 @@ log_connections = {{ .Values.pgbouncer.logConnections }}
2727
## CLIENT TLS SETTINGS ##
2828
client_tls_sslmode = {{ .Values.pgbouncer.clientSSL.mode }}
2929
client_tls_ciphers = {{ .Values.pgbouncer.clientSSL.ciphers }}
30+
{{- if .Values.pgbouncer.clientSSL.caFile.existingSecret }}
3031
client_tls_ca_file = /home/pgbouncer/certs/client-ca.crt
32+
{{- end }}
3133
client_tls_key_file = /home/pgbouncer/certs/client.key
3234
client_tls_cert_file = /home/pgbouncer/certs/client.crt
3335

3436
## SERVER TLS SETTINGS ##
3537
server_tls_sslmode = {{ .Values.pgbouncer.serverSSL.mode }}
3638
server_tls_ciphers = {{ .Values.pgbouncer.serverSSL.ciphers }}
39+
{{- if .Values.pgbouncer.serverSSL.caFile.existingSecret }}
3740
server_tls_ca_file = /home/pgbouncer/certs/server-ca.crt
41+
{{- end }}
42+
{{- if .Values.pgbouncer.serverSSL.keyFile.existingSecret }}
3843
server_tls_key_file = /home/pgbouncer/certs/server.key
44+
{{- end }}
45+
{{- if .Values.pgbouncer.serverSSL.certFile.existingSecret }}
3946
server_tls_cert_file = /home/pgbouncer/certs/server.crt
47+
{{- end }}
4048

4149
{{- end }}
4250

‎charts/airflow/templates/pgbouncer/pgbouncer-deployment.yaml‎

Lines changed: 4 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -143,15 +143,11 @@ spec:
143143
- name: pgbouncer-certs
144144
projected:
145145
sources:
146-
{{- if or (not .Values.pgbouncer.clientSSL.caFile.existingSecret) (not .Values.pgbouncer.clientSSL.keyFile.existingSecret) (not .Values.pgbouncer.clientSSL.certFile.existingSecret) }}
147-
## CLIENT TLS FILES (AUTO GENERATED)
146+
{{- if or (not .Values.pgbouncer.clientSSL.keyFile.existingSecret) (not .Values.pgbouncer.clientSSL.certFile.existingSecret) }}
147+
## CLIENT TLS FILES (CHART GENERATED)
148148
- secret:
149149
name: {{ include "airflow.fullname" . }}-pgbouncer-certs
150150
items:
151-
{{- if not .Values.pgbouncer.clientSSL.caFile.existingSecret }}
152-
- key: client-ca.crt
153-
path: client-ca.crt
154-
{{- end }}
155151
{{- if not .Values.pgbouncer.clientSSL.keyFile.existingSecret }}
156152
- key: client.key
157153
path: client.key
@@ -162,27 +158,8 @@ spec:
162158
{{- end }}
163159
{{- end }}
164160

165-
{{- if or (not .Values.pgbouncer.serverSSL.caFile.existingSecret) (not .Values.pgbouncer.serverSSL.keyFile.existingSecret) (not .Values.pgbouncer.serverSSL.certFile.existingSecret) }}
166-
## SERVER TLS FILES (AUTO GENERATED)
167-
- secret:
168-
name: {{ include "airflow.fullname" . }}-pgbouncer-certs
169-
items:
170-
{{- if not .Values.pgbouncer.serverSSL.caFile.existingSecret }}
171-
- key: server-ca.crt
172-
path: server-ca.crt
173-
{{- end }}
174-
{{- if not .Values.pgbouncer.serverSSL.keyFile.existingSecret }}
175-
- key: server.key
176-
path: server.key
177-
{{- end }}
178-
{{- if not .Values.pgbouncer.serverSSL.certFile.existingSecret }}
179-
- key: server.crt
180-
path: server.crt
181-
{{- end }}
182-
{{- end }}
183-
184161
{{- if or (.Values.pgbouncer.clientSSL.caFile.existingSecret) (.Values.pgbouncer.clientSSL.keyFile.existingSecret) (.Values.pgbouncer.clientSSL.certFile.existingSecret) }}
185-
## CLIENT TLS FILES (USER CUSTOM)
162+
## CLIENT TLS FILES (USER PROVIDED)
186163
{{- if .Values.pgbouncer.clientSSL.caFile.existingSecret }}
187164
- secret:
188165
name: {{ .Values.pgbouncer.clientSSL.caFile.existingSecret }}
@@ -207,7 +184,7 @@ spec:
207184
{{- end }}
208185

209186
{{- if or (.Values.pgbouncer.serverSSL.caFile.existingSecret) (.Values.pgbouncer.serverSSL.keyFile.existingSecret) (.Values.pgbouncer.serverSSL.certFile.existingSecret) }}
210-
## SERVER TLS FILES (USER CUSTOM)
187+
## SERVER TLS FILES (USER PROVIDED)
211188
{{- if .Values.pgbouncer.serverSSL.caFile.existingSecret }}
212189
- secret:
213190
name: {{ .Values.pgbouncer.serverSSL.caFile.existingSecret }}

‎charts/airflow/templates/pgbouncer/pgbouncer-secret-certs.yaml‎

Lines changed: 3 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,6 @@
1-
{{- $any_client_needed := or (not .Values.pgbouncer.clientSSL.caFile.existingSecret) (not .Values.pgbouncer.clientSSL.keyFile.existingSecret) (not .Values.pgbouncer.clientSSL.certFile.existingSecret) }}
2-
{{- $any_server_needed := or (not .Values.pgbouncer.serverSSL.caFile.existingSecret) (not .Values.pgbouncer.serverSSL.keyFile.existingSecret) (not .Values.pgbouncer.serverSSL.certFile.existingSecret) }}
3-
{{- if and (include "airflow.pgbouncer.should_use" .) (or $any_client_needed $any_server_needed) }}
4-
{{- $client_ca := genCA "client-ca" 365 }}
5-
{{- $client_cert := genSignedCert "localhost" nil nil 365 $client_ca }}
6-
{{- $server_ca := genCA "server-ca" 365 }}
7-
{{- $server_cert := genSignedCert "localhost" nil nil 365 $server_ca }}
1+
{{- $self_signed_needed := or (not .Values.pgbouncer.clientSSL.keyFile.existingSecret) (not .Values.pgbouncer.clientSSL.certFile.existingSecret) }}
2+
{{- if and (include "airflow.pgbouncer.should_use" .) ($self_signed_needed) }}
3+
{{- $client_cert := genSelfSignedCert "localhost" nil nil 365 }}
84
apiVersion: v1
95
kind: Secret
106
metadata:
@@ -16,23 +12,10 @@ metadata:
1612
release: {{ .Release.Name }}
1713
heritage: {{ .Release.Service }}
1814
data:
19-
{{- if not .Values.pgbouncer.clientSSL.caFile.existingSecret }}
20-
client-ca.crt: {{ $client_ca.Cert | b64enc | quote }}
21-
{{- end }}
2215
{{- if not .Values.pgbouncer.clientSSL.keyFile.existingSecret }}
2316
client.key: {{ $client_cert.Key | b64enc | quote }}
2417
{{- end }}
2518
{{- if not .Values.pgbouncer.clientSSL.certFile.existingSecret }}
2619
client.crt: {{ $client_cert.Cert | b64enc | quote }}
2720
{{- end }}
28-
29-
{{- if not .Values.pgbouncer.serverSSL.caFile.existingSecret }}
30-
server-ca.crt: {{ $server_ca.Cert | b64enc | quote }}
31-
{{- end }}
32-
{{- if not .Values.pgbouncer.serverSSL.keyFile.existingSecret }}
33-
server.key: {{ $server_cert.Key | b64enc | quote }}
34-
{{- end }}
35-
{{- if not .Values.pgbouncer.serverSSL.certFile.existingSecret }}
36-
server.crt: {{ $server_cert.Cert | b64enc | quote }}
37-
{{- end }}
3821
{{- end }}

‎charts/airflow/values.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1462,7 +1462,6 @@ pgbouncer:
14621462
logConnections: 0
14631463

14641464
## ssl configs for: clients -> pgbouncer
1465-
## - if `caFile`, `keyFile`, `certFile` are not provided, we auto generate self-signed certificates
14661465
##
14671466
clientSSL:
14681467
## sets pgbouncer config: `client_tls_sslmode`
@@ -1480,19 +1479,20 @@ pgbouncer:
14801479
existingSecretKey: root.crt
14811480

14821481
## sets pgbouncer config: `client_tls_key_file`
1482+
## - [WARNING] a self-signed cert & key are generated if left empty
14831483
##
14841484
keyFile:
14851485
existingSecret: ""
14861486
existingSecretKey: client.key
14871487

14881488
## sets pgbouncer config: `client_tls_cert_file`
1489+
## - [WARNING] a self-signed cert & key are generated if left empty
14891490
##
14901491
certFile:
14911492
existingSecret: ""
14921493
existingSecretKey: client.crt
14931494

14941495
## ssl configs for: pgbouncer -> postgres
1495-
## - if `caFile`, `keyFile`, `certFile` are not provided, we auto generate self-signed certificates
14961496
##
14971497
serverSSL:
14981498
## sets pgbouncer config: `server_tls_sslmode`

0 commit comments

Comments
 (0)