Skip to content

FIX #230 CRD passwordAuthentication for PostgreSQL Database Secret Engine Configs #235

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

FIX #230 CRD passwordAuthentication for PostgreSQL Database Secret Engine Configs #235

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions config/crd/bases/redhatcop.redhat.io_databasesecretengineconfigs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,17 @@ spec:
it takes precedence over {metatada.name}
pattern: '[a-z0-9]([-a-z0-9]*[a-z0-9])?'
type: string
passwordAuthentication:
description: When set to "scram-sha-256", passwords will be hashed
by Vault and stored as-is by PostgreSQL. Using "scram-sha-256" requires
a minimum version of PostgreSQL 10. Available options are "scram-sha-256"
and "password". The default is "password". When set to "password",
passwords will be sent to PostgreSQL in plaintext format and may
appear in PostgreSQL logs as-is.
enum:
- password
- scram-sha-256
type: string
passwordPolicy:
description: 'PasswordPolicy The name of the password policy to use
when generating passwords for this database. If not specified, this
Expand Down
3 changes: 3 additions & 0 deletions docs/secret-engines.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,7 @@ spec:
rootPasswordRotation:
enable: true
rotationPeriod: 2m
passwordAuthentication: scram-sha-256
```

The `pluginName` field specifies what type of database this connection is for.
Expand All @@ -88,6 +89,8 @@ The `rootPasswordRotation.enable` field activates the root password rotation. Th

The `rootPasswordRotation.rotationPeriod` field tells the operator to periodically rotate the root password. If only enable is specified the password will be rotated only once.

The `passwordAuthentication` field, set to `scram-sha-256`, tells Vault to hash the password before sending it to PostgreSQL. This field is optional; if not specified, the default value is "password". When set to "password", passwords are sent to PostgreSQL in clear text and may appear as such in PostgreSQL logs.

The password and possibly the username can be retrived a three different ways:

1. From a Kubernetes secret, specifying the `rootCredentialsFromSecret` field. The secret must be of [basic auth type](https://kubernetes.io/docs/concepts/configuration/secret/#basic-authentication-secret). If the secret is updated this connection will also be updated.
Expand Down
Loading