Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[bitnami/postgresql-repmgr] Delay custom pg_hba.conf injection #73570

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

yukha-dw
Copy link
Contributor

@yukha-dw yukha-dw commented Oct 24, 2024

Description of the change

This container applies custom pg_hba.conf right before initialization process. This will cause an issue when we set security on pg_hba.conf. What this PR does is delaying custom pg_hba.conf injection until postgresql_initialize has been executed just like REPMGR_PGHBA_TRUST_ALL=no did to replace trust with md5 here:

if ! repmgr_is_file_external "pg_hba.conf"; then
is_boolean_yes "$REPMGR_PGHBA_TRUST_ALL" || postgresql_restrict_pghba
fi

Benefits

Let user to customize pg_hba.conf without breaking initialization process, example:

hostnossl    all            all         all             reject
hostssl      repmgr         repmgr      all             scram-sha-256
hostssl      replication    repmgr      all             scram-sha-256
hostssl      all            repmgr      all             scram-sha-256
hostssl      all            all         all             scram-sha-256

Possible drawbacks

Other logic still able to break initialization process

Applicable issues

Additional information

If we want to adapt this PR to bitnami/postgresql, I think we should refactor these lines:

if postgresql_is_file_external "pg_hba.conf"; then
info "Custom configuration $POSTGRESQL_PGHBA_FILE detected"
create_pghba_file=no
fi

# Remove any pg_hba.conf lines that match the given filters
if ! postgresql_is_file_external "pg_hba.conf" && [[ -n "$POSTGRESQL_PGHBA_REMOVE_FILTERS" ]]; then
info "Removing lines that match these filters: ${POSTGRESQL_PGHBA_REMOVE_FILTERS}"
postgresql_remove_pghba_lines
fi

@bitnami-bot bitnami-bot added verify Execute verification workflow for these changes in-progress labels Oct 24, 2024
@github-actions github-actions bot removed the triage Triage is needed label Oct 28, 2024
@github-actions github-actions bot removed the request for review from carrodher October 28, 2024 16:48
@yukha-dw yukha-dw force-pushed the fix/postgresql-repmgr/delay-custom-pg-hba-conf-injection branch from 3cc1fc8 to fc7abeb Compare November 1, 2024 03:53
Copy link
Member

@migruiz4 migruiz4 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm sorry for the late response @yukha-dw, could you please take a look at my comments?

…to `POSTGRESQL_MOUNTED_CONF_DIR`

Co-authored-by: Miguel Ruiz <[email protected]>
Signed-off-by: Yukha Dharmeswara <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in-progress postgresql-repmgr verify Execute verification workflow for these changes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[bitnami/postgresql-repmgr] Cannot specify a custom pg_hba.conf
4 participants