Skip to content

K8SPG-952 | allow specifying trusted CAs for pgbouncer frontend #1676

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mayankshah1607 wants to merge 14 commits into
base: main
Choose a base branch
from
Open

K8SPG-952 | allow specifying trusted CAs for pgbouncer frontend #1676

Show file tree
Hide file tree
Changes from 13 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
b91f283
update apis: added additionalTrustedCAs field
mayankshah1607 Jul 9, 2026
ef7775e
implemented additionalTrustedCAs
mayankshah1607 Jul 9, 2026
0edac7e
support for manual TLS secret
mayankshah1607 Jul 9, 2026
8a254d3
copilot suggestion
mayankshah1607 Jul 10, 2026
fdcb4ee
added e2e test
mayankshah1607 Jul 10, 2026
1591cc1
update example cr.yaml
mayankshah1607 Jul 10, 2026
0fdd0a9
Merge branch 'main' into K8SPG-952
mayankshah1607 Jul 10, 2026
1b1dc81
linting
mayankshah1607 Jul 10, 2026
d8bfefc
fix timeout
mayankshah1607 Jul 13, 2026
4245862
Merge branch 'main' into K8SPG-952
mayankshah1607 Jul 14, 2026
76b8666
bump timeout
mayankshah1607 Jul 14, 2026
e09280a
add timeout at TestStep
mayankshah1607 Jul 14, 2026
60c2468
increase timeout
mayankshah1607 Jul 14, 2026
63027e5
Merge branch 'main' into K8SPG-952
mayankshah1607 Jul 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions build/crd/percona/generated/pgv2.percona.com_perconapgclusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22423,6 +22423,28 @@ spec:
pgBouncer:
description: Defines a PgBouncer proxy and connection pooler.
properties:
additionalTrustedCAs:
description: |-
K8SPG-952
Additional CA bundles that PgBouncer should trust when verifying client certificates.
Each item is a reference to a Secret that contains a PEM-encoded CA bundle in key `ca.crt`.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
affinity:
description: |-
Scheduling constraints of a PgBouncer pod. Changing this value causes
Expand Down
22 changes: 22 additions & 0 deletions config/crd/bases/pgv2.percona.com_perconapgclusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23121,6 +23121,28 @@ spec:
pgBouncer:
description: Defines a PgBouncer proxy and connection pooler.
properties:
additionalTrustedCAs:
description: |-
K8SPG-952
Additional CA bundles that PgBouncer should trust when verifying client certificates.
Each item is a reference to a Secret that contains a PEM-encoded CA bundle in key `ca.crt`.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
affinity:
description: |-
Scheduling constraints of a PgBouncer pod. Changing this value causes
Expand Down
22 changes: 22 additions & 0 deletions config/crd/bases/upstream.pgv2.percona.com_postgresclusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22480,6 +22480,28 @@ spec:
pgBouncer:
description: Defines a PgBouncer proxy and connection pooler.
properties:
additionalTrustedCAs:
description: |-
K8SPG-952
Additional CA bundles that PgBouncer should trust when verifying client certificates.
Each item is a reference to a Secret that contains a PEM-encoded CA bundle in key `ca.crt`.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
affinity:
description: |-
Scheduling constraints of a PgBouncer pod. Changing this value causes
Expand Down
44 changes: 44 additions & 0 deletions deploy/bundle.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23418,6 +23418,28 @@ spec:
pgBouncer:
description: Defines a PgBouncer proxy and connection pooler.
properties:
additionalTrustedCAs:
description: |-
K8SPG-952
Additional CA bundles that PgBouncer should trust when verifying client certificates.
Each item is a reference to a Secret that contains a PEM-encoded CA bundle in key `ca.crt`.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
affinity:
description: |-
Scheduling constraints of a PgBouncer pod. Changing this value causes
Expand Down Expand Up @@ -60553,6 +60575,28 @@ spec:
pgBouncer:
description: Defines a PgBouncer proxy and connection pooler.
properties:
additionalTrustedCAs:
description: |-
K8SPG-952
Additional CA bundles that PgBouncer should trust when verifying client certificates.
Each item is a reference to a Secret that contains a PEM-encoded CA bundle in key `ca.crt`.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
affinity:
description: |-
Scheduling constraints of a PgBouncer pod. Changing this value causes
Expand Down
3 changes: 2 additions & 1 deletion deploy/cr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -400,7 +400,8 @@ spec:
# loadBalancerClass: "eks.amazonaws.com/nlb"
# loadBalancerSourceRanges:
# - 10.0.0.0/8
#
# additionalTrustedCAs:
# - name: some-client-ca
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
Expand Down
44 changes: 44 additions & 0 deletions deploy/crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23418,6 +23418,28 @@ spec:
pgBouncer:
description: Defines a PgBouncer proxy and connection pooler.
properties:
additionalTrustedCAs:
description: |-
K8SPG-952
Additional CA bundles that PgBouncer should trust when verifying client certificates.
Each item is a reference to a Secret that contains a PEM-encoded CA bundle in key `ca.crt`.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
affinity:
description: |-
Scheduling constraints of a PgBouncer pod. Changing this value causes
Expand Down Expand Up @@ -60553,6 +60575,28 @@ spec:
pgBouncer:
description: Defines a PgBouncer proxy and connection pooler.
properties:
additionalTrustedCAs:
description: |-
K8SPG-952
Additional CA bundles that PgBouncer should trust when verifying client certificates.
Each item is a reference to a Secret that contains a PEM-encoded CA bundle in key `ca.crt`.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
affinity:
description: |-
Scheduling constraints of a PgBouncer pod. Changing this value causes
Expand Down
44 changes: 44 additions & 0 deletions deploy/cw-bundle.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23418,6 +23418,28 @@ spec:
pgBouncer:
description: Defines a PgBouncer proxy and connection pooler.
properties:
additionalTrustedCAs:
description: |-
K8SPG-952
Additional CA bundles that PgBouncer should trust when verifying client certificates.
Each item is a reference to a Secret that contains a PEM-encoded CA bundle in key `ca.crt`.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
affinity:
description: |-
Scheduling constraints of a PgBouncer pod. Changing this value causes
Expand Down Expand Up @@ -60553,6 +60575,28 @@ spec:
pgBouncer:
description: Defines a PgBouncer proxy and connection pooler.
properties:
additionalTrustedCAs:
description: |-
K8SPG-952
Additional CA bundles that PgBouncer should trust when verifying client certificates.
Each item is a reference to a Secret that contains a PEM-encoded CA bundle in key `ca.crt`.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
affinity:
description: |-
Scheduling constraints of a PgBouncer pod. Changing this value causes
Expand Down
1 change: 1 addition & 0 deletions e2e-tests/run-minikube.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ finalizers
init-deploy
one-pod
operator-self-healing
pgbouncer-mtls
scaling
scheduled-backup
self-healing
Expand Down
1 change: 1 addition & 0 deletions e2e-tests/run-pr.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ monitoring
monitoring-pmm3
one-pod
operator-self-healing
pgbouncer-mtls
pitr
scaling
scheduled-backup
Expand Down
1 change: 1 addition & 0 deletions e2e-tests/run-release.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ monitoring
monitoring-pmm3
one-pod
operator-self-healing
pgbouncer-mtls
pitr
scaling
scheduled-backup
Expand Down
24 changes: 24 additions & 0 deletions e2e-tests/tests/pgbouncer-mtls/00-assert.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
apiVersion: kuttl.dev/v1beta1
kind: TestAssert
timeout: 120
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: perconapgclusters.pgv2.percona.com
spec:
group: pgv2.percona.com
names:
kind: PerconaPGCluster
listKind: PerconaPGClusterList
plural: perconapgclusters
singular: perconapgcluster
scope: Namespaced
---
apiVersion: kuttl.dev/v1beta1
kind: TestAssert
metadata:
name: check-operator-deploy-status
timeout: 120
commands:
- script: kubectl assert exist-enhanced deployment percona-postgresql-operator -n ${OPERATOR_NS:-$NAMESPACE} --field-selector status.readyReplicas=1
13 changes: 13 additions & 0 deletions e2e-tests/tests/pgbouncer-mtls/00-deploy-operator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
apiVersion: kuttl.dev/v1beta1
kind: TestStep
commands:
- script: |-
set -o errexit
set -o xtrace

source ../../functions
init_temp_dir # do this only in the first TestStep

deploy_operator
deploy_client
timeout: 120
8 changes: 8 additions & 0 deletions e2e-tests/tests/pgbouncer-mtls/01-assert.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
apiVersion: kuttl.dev/v1beta1
kind: TestAssert
timeout: 30
---
apiVersion: v1
kind: Secret
metadata:
name: external-ca
33 changes: 33 additions & 0 deletions e2e-tests/tests/pgbouncer-mtls/01-create-external-ca.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
apiVersion: kuttl.dev/v1beta1
kind: TestStep
commands:
- script: |-
set -o errexit
set -o xtrace

source ../../functions

# An "external" CA the operator knows nothing about, and a client
# certificate signed by it. The CN matches the application user
# created by get_cr.
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-keyout "${TEMP_DIR}/external-ca.key" \
-out "${TEMP_DIR}/external-ca.crt" \
-subj "/CN=external-client-ca"

openssl req -nodes -newkey rsa:2048 \
-keyout "${TEMP_DIR}/client.key" \
-out "${TEMP_DIR}/client.csr" \
-subj "/CN=pgbouncer-mtls"

openssl x509 -req -days 365 \
-in "${TEMP_DIR}/client.csr" \
-CA "${TEMP_DIR}/external-ca.crt" \
-CAkey "${TEMP_DIR}/external-ca.key" \
-CAserial "${TEMP_DIR}/external-ca.srl" \
-CAcreateserial \
-out "${TEMP_DIR}/client.crt"

kubectl -n "${NAMESPACE}" create secret generic external-ca \
--from-file=ca.crt="${TEMP_DIR}/external-ca.crt"
timeout: 30
Loading
Loading