Secret populates the pgBackRest Secret.
(ctx context.Context, inCluster *v1beta1.PostgresCluster, inRepoHost *appsv1.StatefulSet, inRoot *pki.RootCertificateAuthority, inSecret *corev1.Secret, outSecret *corev1.Secret, )
| 527 | |
| 528 | // Secret populates the pgBackRest Secret. |
| 529 | func Secret(ctx context.Context, |
| 530 | inCluster *v1beta1.PostgresCluster, |
| 531 | inRepoHost *appsv1.StatefulSet, |
| 532 | inRoot *pki.RootCertificateAuthority, |
| 533 | inSecret *corev1.Secret, |
| 534 | outSecret *corev1.Secret, |
| 535 | ) error { |
| 536 | var err error |
| 537 | |
| 538 | // Save the CA and generate a TLS client certificate for the entire cluster. |
| 539 | initialize.Map(&outSecret.Data) |
| 540 | |
| 541 | // The server verifies its "tls-server-auth" option contains the common |
| 542 | // name (CN) of the certificate presented by a client. The entire |
| 543 | // cluster uses a single client certificate so the "tls-server-auth" |
| 544 | // option can stay the same when PostgreSQL instances and repository |
| 545 | // hosts are added or removed. |
| 546 | leaf := &pki.LeafCertificate{} |
| 547 | commonName := clientCommonName(inCluster) |
| 548 | dnsNames := []string{commonName} |
| 549 | |
| 550 | if err == nil { |
| 551 | // Unmarshal and validate the stored leaf. These first errors can |
| 552 | // be ignored because they result in an invalid leaf which is then |
| 553 | // correctly regenerated. |
| 554 | _ = leaf.Certificate.UnmarshalText(inSecret.Data[certClientSecretKey]) |
| 555 | _ = leaf.PrivateKey.UnmarshalText(inSecret.Data[certClientPrivateKeySecretKey]) |
| 556 | |
| 557 | leaf, err = inRoot.RegenerateLeafWhenNecessary(leaf, commonName, dnsNames) |
| 558 | err = errors.WithStack(err) |
| 559 | } |
| 560 | |
| 561 | if err == nil { |
| 562 | outSecret.Data[certAuthoritySecretKey], err = certFile(inRoot.Certificate) |
| 563 | } |
| 564 | if err == nil { |
| 565 | outSecret.Data[certClientPrivateKeySecretKey], err = certFile(leaf.PrivateKey) |
| 566 | } |
| 567 | if err == nil { |
| 568 | outSecret.Data[certClientSecretKey], err = certFile(leaf.Certificate) |
| 569 | } |
| 570 | |
| 571 | // Generate a TLS server certificate for each repository host. |
| 572 | if inRepoHost != nil { |
| 573 | // The client verifies the "pg-host" or "repo-host" option it used is |
| 574 | // present in the DNS names of the server certificate. |
| 575 | leaf := &pki.LeafCertificate{} |
| 576 | dnsNames := naming.RepoHostPodDNSNames(ctx, inRepoHost) |
| 577 | commonName := dnsNames[0] // FQDN |
| 578 | |
| 579 | if err == nil { |
| 580 | // Unmarshal and validate the stored leaf. These first errors can |
| 581 | // be ignored because they result in an invalid leaf which is then |
| 582 | // correctly regenerated. |
| 583 | _ = leaf.Certificate.UnmarshalText(inSecret.Data[certRepoSecretKey]) |
| 584 | _ = leaf.PrivateKey.UnmarshalText(inSecret.Data[certRepoPrivateKeySecretKey]) |
| 585 | |
| 586 | leaf, err = inRoot.RegenerateLeafWhenNecessary(leaf, commonName, dnsNames) |