Skip to content

K8SPG-952 | allow specifying trusted CAs for pgbouncer frontend #1676

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mayankshah1607 wants to merge 13 commits into
base: main
Choose a base branch
from
Open

K8SPG-952 | allow specifying trusted CAs for pgbouncer frontend #1676

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
b91f283
update apis: added additionalTrustedCAs field
mayankshah1607 Jul 9, 2026
ef7775e
implemented additionalTrustedCAs
mayankshah1607 Jul 9, 2026
0edac7e
support for manual TLS secret
mayankshah1607 Jul 9, 2026
8a254d3
copilot suggestion
mayankshah1607 Jul 10, 2026
fdcb4ee
added e2e test
mayankshah1607 Jul 10, 2026
1591cc1
update example cr.yaml
mayankshah1607 Jul 10, 2026
0fdd0a9
Merge branch 'main' into K8SPG-952
mayankshah1607 Jul 10, 2026
1b1dc81
linting
mayankshah1607 Jul 10, 2026
d8bfefc
fix timeout
mayankshah1607 Jul 13, 2026
4245862
Merge branch 'main' into K8SPG-952
mayankshah1607 Jul 14, 2026
76b8666
bump timeout
mayankshah1607 Jul 14, 2026
e09280a
add timeout at TestStep
mayankshah1607 Jul 14, 2026
60c2468
increase timeout
mayankshah1607 Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions build/crd/percona/generated/pgv2.percona.com_perconapgclusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22423,6 +22423,28 @@ spec:
pgBouncer:
description: Defines a PgBouncer proxy and connection pooler.
properties:
additionalTrustedCAs:
description: |-
K8SPG-952
Additional CA bundles that PgBouncer should trust when verifying client certificates.
Each item is a reference to a Secret that contains a PEM-encoded CA bundle in key `ca.crt`.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
affinity:
description: |-
Scheduling constraints of a PgBouncer pod. Changing this value causes
Expand Down
22 changes: 22 additions & 0 deletions config/crd/bases/pgv2.percona.com_perconapgclusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23118,6 +23118,28 @@ spec:
pgBouncer:
description: Defines a PgBouncer proxy and connection pooler.
properties:
additionalTrustedCAs:
description: |-
K8SPG-952
Additional CA bundles that PgBouncer should trust when verifying client certificates.
Each item is a reference to a Secret that contains a PEM-encoded CA bundle in key `ca.crt`.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
affinity:
description: |-
Scheduling constraints of a PgBouncer pod. Changing this value causes
Expand Down
22 changes: 22 additions & 0 deletions config/crd/bases/upstream.pgv2.percona.com_postgresclusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22480,6 +22480,28 @@ spec:
pgBouncer:
description: Defines a PgBouncer proxy and connection pooler.
properties:
additionalTrustedCAs:
description: |-
K8SPG-952
Additional CA bundles that PgBouncer should trust when verifying client certificates.
Each item is a reference to a Secret that contains a PEM-encoded CA bundle in key `ca.crt`.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
affinity:
description: |-
Scheduling constraints of a PgBouncer pod. Changing this value causes
Expand Down
44 changes: 44 additions & 0 deletions deploy/bundle.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23415,6 +23415,28 @@ spec:
pgBouncer:
description: Defines a PgBouncer proxy and connection pooler.
properties:
additionalTrustedCAs:
description: |-
K8SPG-952
Additional CA bundles that PgBouncer should trust when verifying client certificates.
Each item is a reference to a Secret that contains a PEM-encoded CA bundle in key `ca.crt`.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
affinity:
description: |-
Scheduling constraints of a PgBouncer pod. Changing this value causes
Expand Down Expand Up @@ -60548,6 +60570,28 @@ spec:
pgBouncer:
description: Defines a PgBouncer proxy and connection pooler.
properties:
additionalTrustedCAs:
description: |-
K8SPG-952
Additional CA bundles that PgBouncer should trust when verifying client certificates.
Each item is a reference to a Secret that contains a PEM-encoded CA bundle in key `ca.crt`.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
affinity:
description: |-
Scheduling constraints of a PgBouncer pod. Changing this value causes
Expand Down
44 changes: 44 additions & 0 deletions deploy/crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23415,6 +23415,28 @@ spec:
pgBouncer:
description: Defines a PgBouncer proxy and connection pooler.
properties:
additionalTrustedCAs:
description: |-
K8SPG-952
Additional CA bundles that PgBouncer should trust when verifying client certificates.
Each item is a reference to a Secret that contains a PEM-encoded CA bundle in key `ca.crt`.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
affinity:
description: |-
Scheduling constraints of a PgBouncer pod. Changing this value causes
Expand Down Expand Up @@ -60548,6 +60570,28 @@ spec:
pgBouncer:
description: Defines a PgBouncer proxy and connection pooler.
properties:
additionalTrustedCAs:
description: |-
K8SPG-952
Additional CA bundles that PgBouncer should trust when verifying client certificates.
Each item is a reference to a Secret that contains a PEM-encoded CA bundle in key `ca.crt`.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
affinity:
description: |-
Scheduling constraints of a PgBouncer pod. Changing this value causes
Expand Down
44 changes: 44 additions & 0 deletions deploy/cw-bundle.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23415,6 +23415,28 @@ spec:
pgBouncer:
description: Defines a PgBouncer proxy and connection pooler.
properties:
additionalTrustedCAs:
description: |-
K8SPG-952
Additional CA bundles that PgBouncer should trust when verifying client certificates.
Each item is a reference to a Secret that contains a PEM-encoded CA bundle in key `ca.crt`.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
affinity:
description: |-
Scheduling constraints of a PgBouncer pod. Changing this value causes
Expand Down Expand Up @@ -60548,6 +60570,28 @@ spec:
pgBouncer:
description: Defines a PgBouncer proxy and connection pooler.
properties:
additionalTrustedCAs:
description: |-
K8SPG-952
Additional CA bundles that PgBouncer should trust when verifying client certificates.
Each item is a reference to a Secret that contains a PEM-encoded CA bundle in key `ca.crt`.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
affinity:
description: |-
Scheduling constraints of a PgBouncer pod. Changing this value causes
Expand Down
59 changes: 57 additions & 2 deletions internal/controller/postgrescluster/pgbouncer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,7 +247,6 @@ func (r *Reconciler) reconcilePGBouncerSecret(
ctx context.Context, cluster *v1beta1.PostgresCluster,
root *pki.RootCertificateAuthority, service *corev1.Service,
) (*corev1.Secret, error) {

existing := &corev1.Secret{ObjectMeta: naming.ClusterPGBouncer(cluster)}
err := errors.WithStack(
r.Client.Get(ctx, client.ObjectKeyFromObject(existing), existing))
Expand Down Expand Up @@ -314,8 +313,12 @@ func (r *Reconciler) reconcilePGBouncerSecret(
naming.LabelRole: naming.RolePGBouncer,
}, cluster.Name, "pgbouncer", cluster.Labels[naming.LabelVersion]))

var additionalTrustedCAs [][]byte
if err == nil {
additionalTrustedCAs, err = r.getAdditionalTrustedCAs(ctx, cluster)
}
if err == nil {
err = pgbouncer.Secret(ctx, cluster, root, existing, service, intent, frontendCertManagerSecret)
err = pgbouncer.Secret(ctx, cluster, root, existing, service, intent, frontendCertManagerSecret, additionalTrustedCAs)
}
if err == nil {
err = errors.WithStack(r.apply(ctx, intent))
Expand All @@ -324,6 +327,58 @@ func (r *Reconciler) reconcilePGBouncerSecret(
return intent, err
}

func (r *Reconciler) getAdditionalTrustedCAs(ctx context.Context, cluster *v1beta1.PostgresCluster) ([][]byte, error) {
pgBouncer := cluster.Spec.Proxy.PGBouncer
if len(pgBouncer.AdditionalTrustedCAs) == 0 {
return nil, nil
}

result := [][]byte{}

// K8SPG-952: in manual TLS mode the frontend CA file is built solely from
// this list, so it must begin with the authority of the custom TLS Secret.
if projection := pgBouncer.CustomTLSSecret; projection != nil {
secret := &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: projection.Name,
Namespace: cluster.GetNamespace(),
},
}

if err := r.Client.Get(ctx, client.ObjectKeyFromObject(secret), secret); err != nil {
return nil, errors.Wrapf(err, "failed to get custom TLS secret '%s'", projection.Name)
}

key := pgbouncer.CustomTLSAuthorityKey(projection)
ca, ok := secret.Data[key]
if !ok {
return nil, errors.Errorf("custom TLS secret '%s' does not contain key '%s'", projection.Name, key)
}
result = append(result, ca)
}

for _, ref := range pgBouncer.AdditionalTrustedCAs {
secret := &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: ref.Name,
Namespace: cluster.GetNamespace(),
},
}

if err := r.Client.Get(ctx, client.ObjectKeyFromObject(secret), secret); k8serrors.IsNotFound(err) {
logging.FromContext(ctx).Info("additional CA secret not found, skipping", "name", ref.Name)
continue
} else if err != nil {
return nil, errors.Wrapf(err, "failed to get additional CA secret '%s'", ref.Name)
}
if ca, ok := secret.Data["ca.crt"]; ok {
result = append(result, ca)
}
Comment thread
mayankshah1607 marked this conversation as resolved.
Outdated
}

return result, nil
}

// generatePGBouncerService returns a v1.Service that exposes PgBouncer pods.
// The ServiceType comes from the cluster proxy spec.
func (r *Reconciler) generatePGBouncerService(
Expand Down
Loading
Loading