serverConfig returns the options needed to run the TLS server for cluster.
(cluster *v1beta1.PostgresCluster)
| 714 | |
| 715 | // serverConfig returns the options needed to run the TLS server for cluster. |
| 716 | func serverConfig(cluster *v1beta1.PostgresCluster) iniSectionSet { |
| 717 | global := iniMultiSet{} |
| 718 | server := iniMultiSet{} |
| 719 | |
| 720 | // IPv6 support is a relatively recent addition to Kubernetes, so listen on |
| 721 | // the IPv4 wildcard address and trust that Pod DNS names will resolve to |
| 722 | // IPv4 addresses for now. |
| 723 | // |
| 724 | // NOTE(cbandy): The unspecified IPv6 address, which ends up being the IPv6 |
| 725 | // wildcard address, did not work in all environments. In some cases, the |
| 726 | // "server-ping" command would not connect. |
| 727 | // - https://tools.ietf.org/html/rfc3493#section-3.8 |
| 728 | // |
| 729 | // TODO(cbandy): When pgBackRest provides a way to bind to all addresses, |
| 730 | // use that here and configure "server-ping" to use "localhost" which |
| 731 | // Kubernetes guarantees resolves to a loopback address. |
| 732 | // - https://kubernetes.io/docs/concepts/cluster-administration/networking/ |
| 733 | // - https://releases.k8s.io/v1.18.0/pkg/kubelet/kubelet_pods.go#L327 |
| 734 | // - https://releases.k8s.io/v1.23.0/pkg/kubelet/kubelet_pods.go#L345 |
| 735 | global.Set("tls-server-address", "0.0.0.0") |
| 736 | |
| 737 | // NOTE (dsessler7): As pointed out by Chris above, there is an issue in |
| 738 | // pgBackRest (#1841), where using a wildcard address to bind all addresses |
| 739 | // does not work in certain IPv6 environments. Until this is fixed, we are |
| 740 | // going to workaround the issue by allowing the user to add an annotation to |
| 741 | // enable IPv6. We will check for that annotation here and override the |
| 742 | // "tls-server-address" setting accordingly. |
| 743 | if strings.EqualFold(cluster.Annotations[naming.PGBackRestIPVersion], "ipv6") { |
| 744 | global.Set("tls-server-address", "::") |
| 745 | } |
| 746 | |
| 747 | // The client certificate for this cluster is allowed to connect for any stanza. |
| 748 | // Without the wildcard "*", the "pgbackrest info" and "pgbackrest repo-ls" |
| 749 | // commands fail with "access denied" when invoked without a "--stanza" flag. |
| 750 | global.Add("tls-server-auth", clientCommonName(cluster)+"=*") |
| 751 | |
| 752 | global.Set("tls-server-ca-file", certAuthorityAbsolutePath) |
| 753 | global.Set("tls-server-cert-file", certServerAbsolutePath) |
| 754 | global.Set("tls-server-key-file", certServerPrivateKeyAbsolutePath) |
| 755 | |
| 756 | // Send all server logs to stderr and stdout without timestamps. |
| 757 | // - stderr has ERROR messages |
| 758 | // - stdout has WARN, INFO, and DETAIL messages |
| 759 | // |
| 760 | // The "trace" level shows when a connection is accepted, but nothing about |
| 761 | // the remote address or what commands it might send. |
| 762 | // - https://github.com/pgbackrest/pgbackrest/blob/release/2.38/src/command/server/server.c#L158-L159 |
| 763 | // - https://pgbackrest.org/configuration.html#section-log |
| 764 | server.Set("log-level-console", "detail") |
| 765 | server.Set("log-level-stderr", "error") |
| 766 | server.Set("log-level-file", "off") |
| 767 | server.Set("log-timestamp", "n") |
| 768 | |
| 769 | return iniSectionSet{ |
| 770 | "global": global, |
| 771 | "global:server": server, |
| 772 | } |
| 773 | } |