Secret populates the PgBouncer Secret.
(ctx context.Context, inCluster *v1beta1.PostgresCluster, inRoot *pki.RootCertificateAuthority, inSecret *corev1.Secret, inService *corev1.Service, outSecret *corev1.Secret, )
| 44 | |
| 45 | // Secret populates the PgBouncer Secret. |
| 46 | func Secret(ctx context.Context, |
| 47 | inCluster *v1beta1.PostgresCluster, |
| 48 | inRoot *pki.RootCertificateAuthority, |
| 49 | inSecret *corev1.Secret, |
| 50 | inService *corev1.Service, |
| 51 | outSecret *corev1.Secret, |
| 52 | ) error { |
| 53 | if inCluster.Spec.Proxy == nil || inCluster.Spec.Proxy.PGBouncer == nil { |
| 54 | // PgBouncer is disabled; there is nothing to do. |
| 55 | return nil |
| 56 | } |
| 57 | |
| 58 | var err error |
| 59 | initialize.Map(&outSecret.Data) |
| 60 | |
| 61 | // Use the existing password and verifier. Generate when one is missing. |
| 62 | // PgBouncer can login to PostgreSQL using either MD5 or SCRAM-SHA-256. |
| 63 | // When using MD5, the (hashed) verifier can be stored in PgBouncer's |
| 64 | // authentication file. When using SCRAM, the plaintext password must be |
| 65 | // stored. |
| 66 | // - https://www.pgbouncer.org/config.html#authentication-file-format |
| 67 | // - https://github.com/pgbouncer/pgbouncer/issues/508#issuecomment-713339834 |
| 68 | // NOTE(cbandy): We don't have a function to compare a plaintext password |
| 69 | // to a SCRAM verifier. |
| 70 | password := string(inSecret.Data[passwordSecretKey]) |
| 71 | verifier := string(inSecret.Data[verifierSecretKey]) |
| 72 | |
| 73 | if len(password) == 0 { |
| 74 | // If the password is empty, generate new password and verifier. |
| 75 | password, err = util.GenerateASCIIPassword(32) |
| 76 | err = errors.WithStack(err) |
| 77 | if err == nil { |
| 78 | verifier, err = passwd.NewSCRAMPassword(password).Build() |
| 79 | err = errors.WithStack(err) |
| 80 | } |
| 81 | } else if len(password) != 0 && len(verifier) == 0 { |
| 82 | // If the password is non-empty and the verifier is empty, generate a new verifier. |
| 83 | verifier, err = passwd.NewSCRAMPassword(password).Build() |
| 84 | err = errors.WithStack(err) |
| 85 | } |
| 86 | |
| 87 | if err == nil { |
| 88 | // Store the SCRAM verifier alongside the plaintext password so that |
| 89 | // later reconciles don't generate it repeatedly. |
| 90 | outSecret.Data[authFileSecretKey] = authFileContents(password) |
| 91 | outSecret.Data[passwordSecretKey] = []byte(password) |
| 92 | outSecret.Data[verifierSecretKey] = []byte(verifier) |
| 93 | } |
| 94 | |
| 95 | if inCluster.Spec.Proxy.PGBouncer.CustomTLSSecret == nil { |
| 96 | leaf := &pki.LeafCertificate{} |
| 97 | dnsNames := naming.ServiceDNSNames(ctx, inService) |
| 98 | dnsFQDN := dnsNames[0] |
| 99 | |
| 100 | if err == nil { |
| 101 | // Unmarshal and validate the stored leaf. These first errors can |
| 102 | // be ignored because they result in an invalid leaf which is then |
| 103 | // correctly regenerated. |